From b877cb060e442e39c9fc39b78b075e672bec93ab Mon Sep 17 00:00:00 2001 From: "axel.jacquet" Date: Fri, 12 Dec 2025 11:57:47 +0100 Subject: ansible-lint: fix yaml[line-length] in group_vars Change-Id: I1d399edcd2910b5e13583ffd2f9b83aaed0086ba Signed-off-by: Axel Jacquet --- ansible/group_vars/all/common.yml | 17 +++++++++++--- ansible/group_vars/all/haproxy.yml | 41 +++++++++++++++++++++++++++------- ansible/group_vars/all/letsencrypt.yml | 9 +++++++- ansible/group_vars/all/mariadb.yml | 11 ++++++++- ansible/group_vars/all/neutron.yml | 8 +++++-- ansible/group_vars/all/opensearch.yml | 12 ++++++++-- ansible/group_vars/all/ovn.yml | 15 ++++++++++--- ansible/group_vars/all/prometheus.yml | 7 +++++- 8 files changed, 99 insertions(+), 21 deletions(-) diff --git a/ansible/group_vars/all/common.yml b/ansible/group_vars/all/common.yml index 43cff1e27..1bd048aec 100644 --- a/ansible/group_vars/all/common.yml +++ b/ansible/group_vars/all/common.yml @@ -167,7 +167,12 @@ kolla_base_distro: "rocky" kolla_internal_vip_address: "{{ kolla_internal_address | default('') }}" kolla_internal_fqdn: "{{ kolla_internal_vip_address }}" kolla_external_vip_address: "{{ kolla_internal_vip_address }}" -kolla_same_external_internal_vip: "{{ kolla_external_vip_address | ansible.utils.ipaddr('address') == kolla_internal_vip_address | ansible.utils.ipaddr('address') }}" +kolla_same_external_internal_vip: >- + {{ + kolla_external_vip_address | ansible.utils.ipaddr('address') == + kolla_internal_vip_address | ansible.utils.ipaddr('address') + }} + kolla_external_fqdn: "{{ kolla_internal_fqdn if kolla_same_external_internal_vip | bool else kolla_external_vip_address }}" kolla_dev_repos_directory: "/opt/stack/" @@ -252,7 +257,10 @@ om_rpc_port: "{{ rabbitmq_port }}" om_rpc_group: "rabbitmq" om_rpc_vhost: "/" -rpc_transport_url: "{{ om_rpc_transport }}://{% for host in groups[om_rpc_group] %}{{ om_rpc_user }}:{{ om_rpc_password }}@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ om_rpc_port }}{% if not loop.last %},{% endif %}{% endfor %}/{{ om_rpc_vhost }}" +rpc_transport_url: "{{ om_rpc_transport }}://\ + {% for host in groups[om_rpc_group] %}\ + {{ om_rpc_user }}:{{ om_rpc_password }}@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ om_rpc_port }}\ + {%if not loop.last %},{% endif %}{% endfor %}/{{ om_rpc_vhost }}" # oslo.messaging notify transport valid options are [ rabbit ] om_notify_transport: "rabbit" @@ -262,7 +270,10 @@ om_notify_port: "{{ rabbitmq_port }}" om_notify_group: "rabbitmq" om_notify_vhost: "/" -notify_transport_url: "{{ om_notify_transport }}://{% for host in groups[om_notify_group] %}{{ om_notify_user }}:{{ om_notify_password }}@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ om_notify_port }}{% if not loop.last %},{% endif %}{% endfor %}/{{ om_notify_vhost }}" +notify_transport_url: "{{ om_notify_transport }}://\ + {% for host in groups[om_notify_group] %}\ + {{ om_notify_user }}:{{ om_notify_password }}@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ om_notify_port }}\ + {%if not loop.last %},{% endif %}{% endfor %}/{{ om_notify_vhost }}" # Whether to enable TLS for oslo.messaging communication with RabbitMQ. om_enable_rabbitmq_tls: "{{ rabbitmq_enable_tls | bool }}" diff --git a/ansible/group_vars/all/haproxy.yml b/ansible/group_vars/all/haproxy.yml index 9566d7768..c96e6e408 100644 --- a/ansible/group_vars/all/haproxy.yml +++ b/ansible/group_vars/all/haproxy.yml @@ -23,25 +23,50 @@ haproxy_single_external_frontend_public_port: "{{ '443' if kolla_enable_tls_exte # configure SSL/TLS settings for haproxy config, one of [modern, intermediate, legacy]: kolla_haproxy_ssl_settings: "modern" -haproxy_ssl_settings: "{{ ssl_legacy_settings if kolla_haproxy_ssl_settings == 'legacy' else ssl_intermediate_settings if kolla_haproxy_ssl_settings == 'intermediate' - else ssl_modern_settings | default(ssl_modern_settings) }}" +haproxy_ssl_settings: >- + {{ + ssl_legacy_settings if kolla_haproxy_ssl_settings == 'legacy' + else ssl_intermediate_settings if kolla_haproxy_ssl_settings == 'intermediate' + else ssl_modern_settings | default(ssl_modern_settings) + }} ssl_legacy_settings: | ssl-default-bind-ciphers DEFAULT:!MEDIUM:!3DES ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 +_ssl_intermediate_ciphers: + - ECDHE-ECDSA-AES128-GCM-SHA256 + - ECDHE-RSA-AES128-GCM-SHA256 + - ECDHE-ECDSA-AES256-GCM-SHA384 + - ECDHE-RSA-AES256-GCM-SHA384 + - ECDHE-ECDSA-CHACHA20-POLY1305 + - ECDHE-RSA-CHACHA20-POLY1305 + - DHE-RSA-AES128-GCM-SHA256 + - DHE-RSA-AES256-GCM-SHA384 + - DHE-RSA-CHACHA20-POLY1305 + +_ssl_intermediate_ciphersuites: + - TLS_AES_128_GCM_SHA256 + - TLS_AES_256_GCM_SHA384 + - TLS_CHACHA20_POLY1305_SHA256 + +_ssl_modern_ciphersuites: + - TLS_AES_128_GCM_SHA256 + - TLS_AES_256_GCM_SHA384 + - TLS_CHACHA20_POLY1305_SHA256 + ssl_intermediate_settings: | - ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 - ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 + ssl-default-bind-ciphers {{ _ssl_intermediate_ciphers | join(':') }} + ssl-default-bind-ciphersuites {{ _ssl_intermediate_ciphersuites | join(':') }} ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets - ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 - ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 + ssl-default-server-ciphers {{ _ssl_intermediate_ciphers | join(':') }} + ssl-default-server-ciphersuites {{ _ssl_intermediate_ciphersuites | join(':') }} ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets ssl_modern_settings: | - ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 + ssl-default-bind-ciphersuites {{ _ssl_modern_ciphersuites | join(':') }} ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets - ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 + ssl-default-server-ciphersuites {{ _ssl_modern_ciphersuites | join(':') }} ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets haproxy_stats_port: "1984" diff --git a/ansible/group_vars/all/letsencrypt.yml b/ansible/group_vars/all/letsencrypt.yml index 64b5ad9ef..b2c36ccc0 100644 --- a/ansible/group_vars/all/letsencrypt.yml +++ b/ansible/group_vars/all/letsencrypt.yml @@ -8,6 +8,13 @@ acme_client_lego: "server lego {{ api_interface_address }}:{{ letsencrypt_webser acme_client_servers: "{% set arr = [] %}{% if enable_letsencrypt | bool %}{{ arr.append(acme_client_lego) }}{% endif %}{{ arr }}" letsencrypt_webserver_port: "8081" -letsencrypt_managed_certs: "{{ '' if not enable_letsencrypt | bool else ('internal' if letsencrypt_internal_cert_server != '' and kolla_same_external_internal_vip | bool else ('internal,external' if letsencrypt_internal_cert_server != '' and letsencrypt_external_cert_server != '' else ('internal' if letsencrypt_internal_cert_server != '' else ('external' if letsencrypt_external_cert_server != '' and not kolla_same_external_internal_vip | bool else '')))) }}" +letsencrypt_managed_certs: >- + {{ + '' if not enable_letsencrypt | bool + else ('internal' if letsencrypt_internal_cert_server != '' and kolla_same_external_internal_vip | bool + else ('internal,external' if letsencrypt_internal_cert_server != '' and letsencrypt_external_cert_server != '' + else ('internal' if letsencrypt_internal_cert_server != '' + else ('external' if letsencrypt_external_cert_server != '' and not kolla_same_external_internal_vip | bool)))) + }} letsencrypt_external_cert_server: "https://acme-v02.api.letsencrypt.org/directory" letsencrypt_internal_cert_server: "" diff --git a/ansible/group_vars/all/mariadb.yml b/ansible/group_vars/all/mariadb.yml index f53f48a87..289fde77e 100644 --- a/ansible/group_vars/all/mariadb.yml +++ b/ansible/group_vars/all/mariadb.yml @@ -25,7 +25,16 @@ mariadb_monitor_user: "monitor" mariadb_datadir_volume: "mariadb" mariadb_default_database_shard_id: 0 -mariadb_default_database_shard_hosts: "{% set default_shard = [] %}{% for host in groups['mariadb'] %}{% if hostvars[host]['mariadb_shard_id'] is not defined or hostvars[host]['mariadb_shard_id'] == mariadb_default_database_shard_id %}{{ default_shard.append(host) }}{% endif %}{% endfor %}{{ default_shard }}" +# NOTE(blanson) this little trick is made to work in ansible 2.19 and up +# in multiline scalar that need to return a non-string object +mariadb_default_database_shard_hosts: >- + {%- set ns = namespace(default_shard=[]) -%} + {%- for host in groups['mariadb'] -%} + {%- if hostvars[host]['mariadb_shard_id'] is not defined or hostvars[host]['mariadb_shard_id'] == mariadb_default_database_shard_id -%} + {%- set ns.default_shard = ns.default_shard + [host] -%} + {%- endif -%} + {%- endfor -%} + {{ ns.default_shard }} mariadb_shard_id: "{{ mariadb_default_database_shard_id }}" mariadb_shard_name: "shard_{{ mariadb_shard_id }}" mariadb_shard_group: "mariadb_{{ mariadb_shard_name }}" diff --git a/ansible/group_vars/all/neutron.yml b/ansible/group_vars/all/neutron.yml index 8dad06f89..a46615445 100644 --- a/ansible/group_vars/all/neutron.yml +++ b/ansible/group_vars/all/neutron.yml @@ -44,8 +44,12 @@ neutron_tenant_network_types: "{% if neutron_plugin_agent == 'ovn' %}geneve{% el # valid values: ["dvr", "dvr_no_external"] neutron_compute_dvr_mode: "dvr" -computes_need_external_bridge: "{{ (enable_neutron_dvr | bool and neutron_compute_dvr_mode == 'dvr') or enable_neutron_provider_networks | bool or neutron_ovn_distributed_fip | bool }}" - +computes_need_external_bridge: >- + {{ + (enable_neutron_dvr | bool and neutron_compute_dvr_mode == 'dvr') or + enable_neutron_provider_networks | bool or + neutron_ovn_distributed_fip | bool + }} # Default DNS resolvers for virtual networks neutron_dnsmasq_dns_servers: "1.1.1.1,8.8.8.8,8.8.4.4" diff --git a/ansible/group_vars/all/opensearch.yml b/ansible/group_vars/all/opensearch.yml index 21c208c67..c05f04507 100644 --- a/ansible/group_vars/all/opensearch.yml +++ b/ansible/group_vars/all/opensearch.yml @@ -7,7 +7,11 @@ # services with ElasticSearch endpoints should be configured to log # to the external cluster by default. This is for backwards compatibility. opensearch_address: "{{ elasticsearch_address if elasticsearch_address is defined else kolla_internal_fqdn }}" -enable_opensearch: "{{ enable_central_logging | bool or enable_osprofiler | bool or (enable_cloudkitty | bool and cloudkitty_storage_backend == 'opensearch') }}" +enable_opensearch: >- + {{ enable_central_logging | bool or + enable_osprofiler | bool or + (enable_cloudkitty | bool and cloudkitty_storage_backend == 'opensearch') + }} enable_opensearch_dashboards: "{{ enable_opensearch | bool }}" enable_opensearch_dashboards_external: "{{ enable_opensearch_dashboards | bool }}" @@ -29,5 +33,9 @@ opensearch_log_index_prefix: "{{ kibana_log_prefix if kibana_log_prefix is defin # endpoints. This is for backwards compatibility. opensearch_port: "{{ elasticsearch_port | default('9200') }}" opensearch_dashboards_port: "5601" -opensearch_dashboards_port_external: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else opensearch_dashboards_port }}" +opensearch_dashboards_port_external: >- + {{ + haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool + else opensearch_dashboards_port + }} opensearch_dashboards_listen_port: "{{ opensearch_dashboards_port }}" diff --git a/ansible/group_vars/all/ovn.yml b/ansible/group_vars/all/ovn.yml index dc9b4b6e8..a11b53860 100644 --- a/ansible/group_vars/all/ovn.yml +++ b/ansible/group_vars/all/ovn.yml @@ -10,7 +10,16 @@ ovn_sb_db_relay_compute_per_relay: "50" ovn_sb_db_relay_port_prefix: "1664" ovn_sb_db_relay_port: "{{ ovn_sb_db_relay_port_prefix ~ ovn_sb_db_relay_client_group_id }}" ovn_sb_db_relay_client_group_id: "{{ range(1, ovn_sb_db_relay_count | int + 1) | random(seed=inventory_hostname) }}" -ovn_nb_connection: "{% for host in groups['ovn-nb-db'] %}tcp:{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ ovn_nb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}" +ovn_nb_connection: + "{% for host in groups['ovn-nb-db'] %}\ + tcp:{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ ovn_nb_db_port }}\ + {% if not loop.last %},{% endif %}{% endfor %}" ovn_sb_connection: "{{ ovn_sb_connection_relay if enable_ovn_sb_db_relay | bool else ovn_sb_connection_no_relay }}" -ovn_sb_connection_no_relay: "{% for host in groups['ovn-sb-db'] %}tcp:{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ ovn_sb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}" -ovn_sb_connection_relay: "{% for host in groups['ovn-sb-db-relay'] %}tcp:{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ ovn_sb_db_relay_port }}{% if not loop.last %},{% endif %}{% endfor %}" +ovn_sb_connection_no_relay: + "{% for host in groups['ovn-sb-db'] %}\ + tcp:{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ ovn_sb_db_port }}\ + {% if not loop.last %},{% endif %}{% endfor %}" +ovn_sb_connection_relay: + "{% for host in groups['ovn-sb-db-relay'] %}\ + tcp:{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ ovn_sb_db_relay_port }}\ + {% if not loop.last %},{% endif %}{% endfor %}" diff --git a/ansible/group_vars/all/prometheus.yml b/ansible/group_vars/all/prometheus.yml index f240e0d1c..388825907 100644 --- a/ansible/group_vars/all/prometheus.yml +++ b/ansible/group_vars/all/prometheus.yml @@ -64,7 +64,12 @@ prometheus_alertmanager_internal_endpoint: "{{ prometheus_alertmanager_internal_ prometheus_alertmanager_public_endpoint: "{{ prometheus_alertmanager_external_fqdn | kolla_url(public_protocol, prometheus_alertmanager_public_port) }}" prometheus_alertmanager_port: "9093" prometheus_alertmanager_cluster_port: "9094" -prometheus_alertmanager_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else prometheus_alertmanager_port }}" +prometheus_alertmanager_public_port: >- + {{ + haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool + else prometheus_alertmanager_port + }} + prometheus_alertmanager_listen_port: "{{ prometheus_alertmanager_port }}" # Prometheus openstack-exporter ports -- cgit v1.2.3