aboutsummaryrefslogtreecommitdiff
path: root/kolla_ansible
AgeCommit message (Collapse)AuthorFilesLines
2026-05-26Always set kolla-actionWill Szumski1-7/+29
This makes things more consistent. I'm hoping to rely on this in kayobe to make the --kolla-playbook work when we make multiple calls to kolla-ansible in the same command invocation. Change-Id: Ieac1f4c7cf1cba19d08ac872bba60794af029110 Signed-off-by: Will Szumski <will@stackhpc.com> (cherry picked from commit f699a60283e5b1b4ac247b0759c862d59e1c3150)
2026-05-06Merge "prechecks: Add a precheck if using test images (quay.io/openstack.kolla)"Zuul1-0/+12
2026-05-05prechecks: Add a precheck if using test images (quay.io/openstack.kolla)Michal Nasiadka1-0/+12
Change-Id: I2babda3d1388f1ee825fa79a1d85d3113b5ecbd4 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-25Merge "Support multiple Nova Compute Ironic instances"Zuul2-0/+137
2026-04-24Support multiple Nova Compute Ironic instancesDoug Szumski2-0/+137
Adds support for deploying multiple instances of the Nova Compute Ironic service on the same host. This is useful in large baremetal deployments, where the sharding and/or conductor group feature is used to scale out the service. A further patch to support deploying multiple Ironic conductor instances will follow. Co-Authored-By: Bartosz Bezak <bartosz@stackhpc.com> Co-Authored-By: Bertrand Lanson <bertrand.lanson@protonmail.com> Change-Id: Ibbddfd87e831a3775c3ed66c80b18e5070cedc90 Signed-off-by: Doug Szumski <doug@stackhpc.com>
2026-04-24Merge "Fix shebangs"Zuul2-2/+2
2026-03-03Switch from passlib to internal bcrypt filterMichal Nasiadka2-0/+61
Change-Id: I1c0312aa7bdfb78fedef6c98463f25e6460f4587 Co-Authored-By: Pierre Riteau <pierre@stackhpc.com> Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-01-30Merge "Try not to return loopback addresses with kolla_address in ipv4"Zuul2-0/+105
2026-01-16kolla-ansible: migrate redis password to valkey in mergepwdPiotr Milewski1-0/+10
When migrating from Redis to Valkey, 'valkey_master_password' is introduced as a new requirement. During an upgrade, 'kolla-mergepwd' previously left the newly generated random password for Valkey, ignoring the existing Redis password. This caused critical authentication failures. Specifically, for users utilizing custom Keystone caching solutions, starting Valkey with a new password would seriously damage the entire cluster. Furthermore, in standard upgrades, Octavia stops working due to the password change, leaving the service unstable until the upgrade is complete. This patch updates 'mergepwd.py' to detect when 'valkey_master_password' is a new entry and automatically assigns it the value of the existing 'redis_master_password'. This ensures a seamless transition and maintains cloud stability during the Redis-to-Valkey migration. Closes-Bug: #2138461 Change-Id: Id0eb88e739c44016a0bd118793f81ff66a624655 Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-01-06Standardize naming for MariaDB recovery and backup filesPiotr Milewski1-2/+2
This commit addresses and corrects the inconsistency in naming across multiple files within the project. Specifically, the terms mariadb_recovery and mariadb_backup have been replaced with mariadb-recovery and mariadb-backup respectively to adhere to the project's naming conventions and improve clarity. Change-Id: I47b80eaa0dc0487f506b47ca065951b5140e0d62 Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2025-12-12glance: Switch to use uWSGIMichal Nasiadka1-100/+0
Glance is removing their warning around running in WSGI [1], so let's switch. [1]: https://review.opendev.org/c/openstack/glance/+/963294 Change-Id: Iae2c5ef5251d6695daf3262ed208c4bd914d7fb3 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-23Try not to return loopback addresses with kolla_address in ipv4Bertrand Lanson2-0/+105
kolla_address does not check if the returned ip address is a loopback for ipv4 addresses, this change checks, and always try to return the first non loopback address, defaulting to the primary in case only loopbacks are available. Closes-Bug: #2085699 Change-Id: Ie8a8b6156e6db025aba94e80a4b3aa2bf72d73ef Signed-off-by: Bertrand Lanson <bertrand.lanson@protonmail.com>
2025-06-03Fix shebangsDinçer Çelik2-2/+2
Change-Id: I305bb756eb2fd8f582bbef5b2674f8b09b141ab8
2025-05-20Standardize Python interpreter handlingMichal Arbet1-1/+14
This patch ensures that the system Python interpreter is always used during the `bootstrap-servers` phase by setting `ansible_python_interpreter=auto_silent` via `extra_vars`, while the `octavia-certificates` command now explicitly uses the same Python interpreter that was used to invoke the `kolla-ansible` CLI, ensuring compatibility with the local environment. Summary: - The `ansible_python_interpreter` is now dynamically defined in `group_vars/all.yml`, falling back to the system interpreter if no virtualenv is configured. - CLI commands now detect and respect user-specified `ansible_python_interpreter` values via `-e`, and avoid overriding them. - The `bootstrap-servers` command always uses the system Python interpreter by setting `ansible_python_interpreter=auto_silent`, ensuring a clean environment for virtualenv creation. - The `octavia-certificates` command uses the Python interpreter that invoked the `kolla-ansible` CLI, ensuring compatibility with locally installed packages (e.g. cryptography). This improves interpreter handling across commands, especially in environments with custom Python setups or virtual environments. Depends-On: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/949767 Change-Id: I7dc6cf8eda3b1fd48d2000f18b4670a4ef4ce1b4
2025-05-08Merge "Add container engine migration scenario"Zuul1-0/+13
2025-04-09Correctly append --ask-vault-password as a single argumentklippo1-1/+1
Closes-Bug: #2106540 Change-Id: I143e3267622b106fa65bc952d62412ffcaeeae7c Signed-off-by: Michael Klippberg <klippo@deny.se>
2025-03-24Allow ignoring missing containers in service-stopMatt Crees1-0/+8
The kolla docker/podman workers already have support for ignoring when containers are missing. This patch just exposes that to the CLI with the flag ``--ignore-missing``. Change-Id: Ie74ea3ea66380063cf67f2e0edb2a0e160d89cd7
2025-03-19Add container engine migration scenarioKonstantin Yarovoy1-0/+13
Add "migrate-container-engine" action to kolla-ansible which changes the container engine on which the Openstack is deployed on. For example Docker to Podman and vice versa. Depends-on: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/925083 Signed-off-by: Konstantin Yarovoy <konstantin.yarovoy@tietoevry.com> Signed-off-by: Martin Hiner <m.hiner@partner.samsung.com> Signed-off-by: Roman Krček <roman.krcek@tietoevry.com> Change-Id: Icd709cb042d44e063c5da64ab0695b0b6ba6d48b
2025-02-21prometheus: Support overriding address of scrape targetsMark Goddard2-1/+89
In many cases we use the kolla_address filter to look up the IP address of the current host or another host on a particular network interface. This filter uses the host's facts to determine the IP, meaning that we must have gathered facts for the host, even if it is outside of a requested --limit. This is a limitation, since it requires that all hosts must be reachable, even if we are not directly configuring them. Most instances of this cross-host fact referencing involve a controller, since they host clustered services. The only instance found to affect compute nodes is in the prometheus role, where Prometheus server needs to know the IP address of all targets in its scrape configs. If we are able to specify the address of the scrape targets as a static variable such as a host variable, then facts would not be required for compute nodes outside of the --limit. Removing the requirement to have facts for all compute nodes has benefits for performance (gathering facts for all hosts can take a long time) and fault tolerance (we can operate when some compute hosts are unreachable). This change modifies the kolla_address filter to accept an optional override_var argument which can be used to specify the name of a host variable that may override the returned IP address. This is used in the Prometheus server configuration to allow specifying the IP address used by Prometheus server when collecting metrics from exporter using a 'prometheus_target_address' host variable. If specified, this takes precedence over the API interface address currently used. This makes it possible to statically override prometheus_target_address and avoid the cross-host fact reference. This is not a complete solution because it is not yet possible to skip the cross-host fact gathering step. Partial-Bug: #2041860 Change-Id: I207ca56362de00d8ec578333eab9e1a72e7bcd19
2025-01-27Reintroduce kolla-ansible checkMark Goddard1-0/+14
This allows operators quickly diagnose all containers across all hosts by running kolla-ansible check. It returns a list of containers that are missing, not running or in unhealthy state for each OpenStack service. Change-Id: I36119ccdeb264aa3de928ec2254d6ff4cc955bfb Implements: blueprint check-containers Co-Authored-By: Roman Krček <roman.krcek@tietoevry.com>
2024-12-19Retry Ansible Galaxy callsMichal Nasiadka1-6/+19
Change-Id: Ic0e33c4f2939c36ed80caa3ec1015cf53a4d93e2
2024-11-20cli: Add check=True to catch Ansible failuresMichal Nasiadka1-2/+2
From [1]: If check is true, and the process exits with a non-zero exit code, a CalledProcessError exception will be raised. Attributes of that exception hold the arguments, the exit code, and stdout and stderr if they were captured. [1]: https://docs.python.org/3/library/subprocess.html Closes-Bug: #2089173 Change-Id: I8cf38c2f7db1493e7303e94c212251fbeafaced3
2024-11-03Fix Octavia cert generationMichal Nasiadka1-1/+2
I have no clue how it worked previously in CI, but now it's using default path to the inventory - which does not exist. In addition to that, type=int in cliff will default to None, so the check had to be rewritten - because we always did cert expiry check instead of generating them. Change-Id: I84d71558c2666ba2cfa47054f782d25ff0c1f691
2024-10-29Fix detection of editable installationPierre Riteau1-6/+11
When installing kolla-ansible with `pip install ./kolla-ansible`, pip always creates a direct_url.json file, even when not using an editable installation. We see this behaviour with Python 3.12, while direct_url.json is only created for editable installations on Python 3.9, which was used when this code was initially developed for Kayobe. When using a regular (non-editable) installation, this would make kolla-ansible invoke site.yml from the source directory instead of the virtualenv installation, causing a failure to load Ansible collections: Invalid plugin FQCN (ansible.utils.ipaddr): unable to locate collection ansible.utils Fix by returning the source URL only if dir_info.editable is True. Change-Id: Icdc2cedaa6a6e3a6b4351b1f4369e2e8b3a2dc97
2024-10-28Fix typo in kolla-ansible metavarPierre Riteau1-1/+1
Change-Id: Ic15b8cb334c207a6923aa8d1908f98ecf8710c1e
2024-10-28Rewrite kolla-ansible CLI to pythonRoman Krček5-0/+1011
Moving the CLI to python allows for easier maintenance and larger feature-set. This patch introduces a few breaking changes! The changes stem the nature of the cliff package. - the order of parameters must be kolla-ansible <action> <arguments> - mariadb_backup and mariadb_recovery now are mariadb-backup and mariadb-recovery Closes-bug: #1589020 Signed-off-by: Roman Krček <roman.krcek@tietoevry.com> Change-Id: I9749b320d4f5eeec601a055b597dfa7d8fb97ce2
2024-08-05fix flake8 error in database_shards.pySven Kieske1-2/+2
wrong use of a f-string when no variable is templated Signed-off-by: Sven Kieske <kieske@osism.tech> Change-Id: I4ef5147eacef32ed93c21d44bf23b664adf1eb91
2024-05-07kolla_url: port is a stringMichal Nasiadka1-0/+1
Ansible passes port as a string - therefore matching does not work and we get https://nova_url:443/v2.1 Closes-Bug: #2063434 Change-Id: I76cce7f491c77b6b788d29c8644e87055f5cfff0
2024-04-08Update cell0 database connectionRoman Krček1-2/+1
When kolla VIP address is changed the cell0 database connection is now updated to the new address. Closes-bug: #1915302 Change-Id: I35be54efb5aaa230702d0cebaae04f1e64c3bca3 Signed-off-by: Roman Krček <roman.krcek@tietoevry.com>
2023-11-16Fix proxysql get mariadb_backup_database_passwordPetr Slavchenkov2-3/+12
Implements: Kolla Ansible Closes-Bug: #2043554 Change-Id: I5648a79b4aa1960f1984a5179e3dfc3f0982c709
2023-11-07Support exposing prometheus_server externallyWill Szumski1-2/+11
This avoids the need to use a proxy, or some other means, to connect to Prometheus. This is disabled by default and can be enabled by setting enable_prometheus_server_external to true. Change-Id: Ia0af044ff436c2a204b357750a16ff49fcdfec45
2023-11-07Add support for LetsEncrypt-managed certsJames Kirsch1-2/+3
Add support for automatic provisioning and renewal of HTTPS certificates via LetsEncrypt. Spec is available at: https://etherpad.opendev.org/p/kolla-ansible-letsencrypt-https Depends-On: https://review.opendev.org/c/openstack/kolla/+/887347 Co-Authored-By: Michal Arbet <michal.arbet@ultimum.io> Implements: blueprint letsencrypt-https Change-Id: I35317ea0343f0db74ddc0e587862e95408e9e106
2023-10-03kolla_address: check correct error return valueCélestin Matte1-1/+1
Unlike other methods such as resolve(), get() does not return an Undefined object, but None. This removes 4 ansible-lint warnings in various files calling kolla_address. Closes-Bug: #2038281 Change-Id: I591a50512a954210f951c40a350ed4b9e1fc48ae
2023-06-29haproxy: support single external frontendMichal Nasiadka2-0/+104
Use case: exposing single external https frontend and load balancing services using FQDNs. Support different ports for internal and external endpoints. Introduced kolla_url filter to normalize urls like: - https://magnum.external:443/v1 - http://magnum.external:80/v1 Change-Id: I9fb03fe1cebce5c7198d523e015280c69f139cd0 Co-Authored-By: Jakub Darmach <jakub@stackhpc.com>
2023-05-31Fix passwords.yml permissionsMaksim Malchuk4-3/+69
The kolla-genpwd, kolla-mergepwd, kolla-readpwd and kolla-writepwd commands now creates or updates passwords.yml with correct permissions. Also they display warning message about incorrect permissions. Closes-Bug: #2018338 Change-Id: I4b50053ced9150499d1d09fd4a0ec2e243cf938b Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
2022-09-02Fix Hashi login method for approlesScott Solkhon1-1/+2
Moves Hashi Vault client login to use `auth.approle.login` as current method is being deprecated in the next release. ``` DeprecationWarning: Call to deprecated function 'auth_approle'. This method will be removed in version '0.12.0' Please use the 'login' method on the 'hvac.api.auth_methods.approle' class moving forward. client.auth_approle(vault_role_id, vault_secret_id) ``` Change-Id: Ie5c1ebe99c8508336cc10944fdaa742ad7d1d85e
2022-08-09Add loadbalancer-config role and wrap haproxy-config role insideMichal Arbet1-1/+1
This patch adds loadbalancer-config role which is "wrapper" around haproxy-config and proxysql-config role which will be added in follow-up patches. Change-Id: I64d41507317081e1860a94b9481a85c8d400797d
2022-07-29Add proxysql support for databaseMichal Arbet2-0/+381
Kolla environment currently uses haproxy to fullfill HA in mariadb. This patch is switching haproxy to proxysql if enabled. This patch is also replacing mariadb's user 'haproxy' with user 'monitor'. This replacement has two reasons: - Use better name to "monitor" galera claster as there are two services using this user (HAProxy, ProxySQL) - Set password for monitor user as it's always better to use password then not use. Previous haproxy user didn't use password as it was historically not possible with haproxy and mariadb-clustercheck wasn't implemented. Depends-On: https://review.opendev.org/c/openstack/kolla/+/769385 Depends-On: https://review.opendev.org/c/openstack/kolla/+/765781 Depends-On: https://review.opendev.org/c/openstack/kolla/+/850656 Change-Id: I0edae33d982c2e3f3b5f34b3d5ad07a431162844
2022-07-27adds firewalld configuration based on enabled servicesk-s-dean2-0/+428
This change introduces automated configuration of firewalld and adds a new filter for extracting services from the project_services dict. the filter selects any enabled services and their haproxy element and returns them so they can be iterated over. This commit also enables automated configuration of firewalld from enabled openstack services and adds them to the defined zone and reloads the system firewall. Change-Id: Iea3680142711873984efff2b701347b6a56dd355
2022-05-24genpwd: handle lack of password file nicerMarcin Juszkiewicz1-2/+6
From: (kolla) 13:11 (s) marcin@puchatek:kolla-ansible$ kolla-genpwd Traceback (most recent call last): File "/home/marcin/.virtualenvs/kolla/bin/kolla-genpwd", line 8, in <module> sys.exit(main()) File "/home/marcin/.virtualenvs/kolla/lib/python3.10/site-packages/kolla_ansible/cmd/genpwd.py", line 135, in main genpwd(passwords_file, length, uuid_keys, ssh_keys, blank_keys, File "/home/marcin/.virtualenvs/kolla/lib/python3.10/site-packages/kolla_ansible/cmd/genpwd.py", line 59, in genpwd with open(passwords_file, 'r') as f: FileNotFoundError: [Errno 2] No such file or directory: '/etc/kolla/passwords.yml' To: (kolla) 13:17 (s) marcin@puchatek:kolla-ansible$ kolla-genpwd ERROR: Passwords file "/etc/kolla/passwords.yml" is missing Change-Id: I18a9559daeb3d124a03dcb735ebb01a2cf24f617
2022-03-30Merge "neutron: add ssh key"Zuul1-1/+2
2022-03-30neutron: add ssh keyMichal Nasiadka1-1/+2
This key can be used by users in networking-generic-switch scenario instead of adding cleartext password in ml2_conf.ini. Change-Id: I10003e6526a55a97f22678ab81c411e4645c5157
2022-03-25Merge "re-add rabbitmq config for clustering interface"Zuul2-3/+27
2022-03-24re-add rabbitmq config for clustering interfaceSven Kieske2-3/+27
this adds back the ability to configure the rabbitmq/erlang kernel network interface which was removed in https://review.opendev.org/#/c/584427/ seemingly by accident. Closes-Bug: 1900160 Change-Id: I6f00396495853e117429c17fadfafe809e322a31
2022-03-24Use jinja2.pass_context instead of contextfilterMark Goddard2-6/+6
The contextfilter decorator was deprecated in jinja2 3.0.0, and has been dropped in 3.1.0. This results in the following warning, and failed attempts to use filters: [WARNING]: Skipping plugin (filters.py) as it seems to be invalid: module 'jinja2' has no attribute 'contextfilter' This change switches to use the pass_context decorator. The minimum version of Jinja2 is raised to 3 to ensure pass_context is present. Change-Id: I649dd6211d3ae72b9539bc44652ef8cf5d579777
2021-11-09Replace deprecated assertRaisesRegexpwu.shiming1-2/+2
The assertRaisesRegexp method has been deprecated since it was renamed to assertRaisesRegex in Python 3.2. https://docs.python.org/3/library/unittest.html#deprecated-aliases Change-Id: I38ed4bebee3617267463d13d8f12bc083ab74ac2
2021-07-02Merge "Support storing passwords in Hashicorp Vault"Zuul3-0/+302
2021-06-30Support storing passwords in Hashicorp VaultScott Solkhon3-0/+302
This commit adds two new cli commands to allow an operator to read and write passwords into a configured Hashicorp Vault KV. Change-Id: Icf0eaf7544fcbdf7b83f697cc711446f47118a4d
2021-06-23Use ansible_facts to reference factsMark Goddard2-86/+104
By default, Ansible injects a variable for every fact, prefixed with ansible_. This can result in a large number of variables for each host, which at scale can incur a performance penalty. Ansible provides a configuration option [0] that can be set to False to prevent this injection of facts. In this case, facts should be referenced via ansible_facts.<fact>. This change updates all references to Ansible facts within Kolla Ansible from using individual fact variables to using the items in the ansible_facts dictionary. This allows users to disable fact variable injection in their Ansible configuration, which may provide some performance improvement. This change disables fact variable injection in the ansible configuration used in CI, to catch any attempts to use the injected variables. [0] https://docs.ansible.com/ansible/latest/reference_appendices/config.html#inject-facts-as-vars Change-Id: I7e9d5c9b8b9164d4aee3abb4e37c8f28d98ff5d1 Partially-Implements: blueprint performance-improvements
2020-12-22Remove Retired Karbor SupportKendall Nelson1-2/+1
As announced on the openstack-discuss ML[1], Karbor is retiring this cycle (Wallaby). Needed-By: https://review.opendev.org/c/openstack/karbor/+/767032 [1] http://lists.openstack.org/pipermail/openstack-discuss/2020-November/018643.html Change-Id: I222cf302e507f6a9de0347c79ec536aa7be22bb6
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 16:05:44 +0000