From e55f8a610808f266f0eac995afee41973150b439 Mon Sep 17 00:00:00 2001 From: Michal Nasiadka Date: Fri, 27 Mar 2026 14:13:54 +0100 Subject: Drop support for running WSGI under Apache The migration to uWSGI has been successfully completed. All API services now run exclusively under uWSGI. The *_wsgi_provider variables have been removed from all affected roles along with leftover Apache wsgi config templates and fluentd Apache log handling. Rework Apache fluentd input configuration so it doesn't glob out whole /var/log/kolla/*/* and just include required services when enabled. Change-Id: I1475e629d033163a50a5c681c8fe2557a7b10bae Signed-off-by: Michal Nasiadka Signed-off-by: Bartosz Bezak --- ...drop-apache-wsgi-provider-5049b660249d0f20.yaml | 8 ++ ansible/roles/aodh/defaults/main.yml | 5 - ansible/roles/aodh/tasks/config.yml | 13 --- ansible/roles/aodh/templates/aodh-api.json.j2 | 15 +-- ansible/roles/aodh/templates/wsgi-aodh.conf.j2 | 38 ------- ansible/roles/barbican/defaults/main.yml | 5 - ansible/roles/barbican/tasks/config.yml | 1 - ansible/roles/cinder/defaults/main.yml | 5 - ansible/roles/cinder/tasks/config.yml | 17 --- ansible/roles/cinder/templates/cinder-api.json.j2 | 15 +-- ansible/roles/cinder/templates/cinder-wsgi.conf.j2 | 35 ------ ansible/roles/cloudkitty/defaults/main.yml | 5 - ansible/roles/cloudkitty/tasks/config.yml | 13 --- .../cloudkitty/templates/cloudkitty-api.json.j2 | 15 +-- .../cloudkitty/templates/wsgi-cloudkitty.conf.j2 | 36 ------ ansible/roles/fluentd/tasks/config.yml | 8 +- .../templates/conf/filter/01-rewrite.conf.j2 | 10 -- .../templates/conf/format/apache_access.conf.j2 | 12 -- .../templates/conf/format/wsgi_access.conf.j2 | 12 -- .../fluentd/templates/conf/input/04-apache.conf.j2 | 34 ++++++ .../templates/conf/input/04-openstack-wsgi.conf.j2 | 12 -- ansible/roles/gnocchi/defaults/main.yml | 5 - ansible/roles/gnocchi/tasks/config.yml | 15 --- .../roles/gnocchi/templates/gnocchi-api.json.j2 | 15 +-- .../roles/gnocchi/templates/wsgi-gnocchi.conf.j2 | 34 ------ ansible/roles/heat/defaults/main.yml | 5 - ansible/roles/heat/tasks/config.yml | 26 ----- ansible/roles/heat/templates/heat-api-cfn.json.j2 | 15 +-- ansible/roles/heat/templates/heat-api.json.j2 | 15 +-- .../roles/heat/templates/wsgi-heat-api-cfn.conf.j2 | 46 -------- ansible/roles/heat/templates/wsgi-heat-api.conf.j2 | 46 -------- ansible/roles/horizon/defaults/main.yml | 5 - ansible/roles/horizon/tasks/config.yml | 17 --- ansible/roles/horizon/templates/horizon.conf.j2 | 91 ---------------- ansible/roles/horizon/templates/horizon.json.j2 | 14 +-- ansible/roles/ironic/defaults/main.yml | 5 - ansible/roles/ironic/tasks/config.yml | 29 ----- .../roles/ironic/templates/ironic-api-wsgi.conf.j2 | 49 --------- ansible/roles/ironic/templates/ironic-api.json.j2 | 15 +-- .../ironic-prometheus-exporter-wsgi.conf.j2 | 37 ------- .../templates/ironic-prometheus-exporter.json.j2 | 15 +-- ansible/roles/keystone/defaults/main.yml | 8 +- ansible/roles/keystone/tasks/config.yml | 18 --- .../keystone/templates/keystone-startup.sh.j2 | 6 +- ansible/roles/keystone/templates/keystone.json.j2 | 53 ++------- .../roles/keystone/templates/wsgi-keystone.conf.j2 | 121 --------------------- ansible/roles/masakari/defaults/main.yml | 5 - ansible/roles/masakari/tasks/config.yml | 13 --- .../roles/masakari/templates/masakari-api.json.j2 | 15 +-- .../roles/masakari/templates/wsgi-masakari.conf.j2 | 37 ------- ansible/roles/nova/defaults/main.yml | 5 - ansible/roles/nova/tasks/config.yml | 25 ----- ansible/roles/nova/templates/nova-api-wsgi.conf.j2 | 49 --------- ansible/roles/nova/templates/nova-api.json.j2 | 15 +-- .../nova/templates/nova-metadata-wsgi.conf.j2 | 49 --------- ansible/roles/nova/templates/nova-metadata.json.j2 | 15 +-- ansible/roles/octavia/defaults/main.yml | 5 - ansible/roles/octavia/tasks/config.yml | 17 --- .../roles/octavia/templates/octavia-api.json.j2 | 15 +-- .../roles/octavia/templates/octavia-wsgi.conf.j2 | 41 ------- ansible/roles/placement/defaults/main.yml | 5 - ansible/roles/placement/tasks/config.yml | 19 ---- .../placement/templates/placement-api-wsgi.conf.j2 | 42 ------- .../placement/templates/placement-api.json.j2 | 23 ++-- ansible/roles/trove/defaults/main.yml | 5 - ansible/roles/trove/tasks/config.yml | 17 --- ansible/roles/trove/templates/trove-api.json.j2 | 15 +-- ansible/roles/trove/templates/trove-wsgi.conf.j2 | 41 ------- ansible/roles/zun/defaults/main.yml | 5 - ansible/roles/zun/tasks/config.yml | 13 --- ansible/roles/zun/templates/wsgi-zun.conf.j2 | 41 ------- ansible/roles/zun/templates/zun-api.json.j2 | 15 +-- 72 files changed, 105 insertions(+), 1461 deletions(-) create mode 100644 ansible/releasenotes/notes/drop-apache-wsgi-provider-5049b660249d0f20.yaml delete mode 100644 ansible/roles/aodh/templates/wsgi-aodh.conf.j2 delete mode 100644 ansible/roles/cinder/templates/cinder-wsgi.conf.j2 delete mode 100644 ansible/roles/cloudkitty/templates/wsgi-cloudkitty.conf.j2 delete mode 100644 ansible/roles/fluentd/templates/conf/format/apache_access.conf.j2 delete mode 100644 ansible/roles/fluentd/templates/conf/format/wsgi_access.conf.j2 create mode 100644 ansible/roles/fluentd/templates/conf/input/04-apache.conf.j2 delete mode 100644 ansible/roles/fluentd/templates/conf/input/04-openstack-wsgi.conf.j2 delete mode 100644 ansible/roles/gnocchi/templates/wsgi-gnocchi.conf.j2 delete mode 100644 ansible/roles/heat/templates/wsgi-heat-api-cfn.conf.j2 delete mode 100644 ansible/roles/heat/templates/wsgi-heat-api.conf.j2 delete mode 100644 ansible/roles/horizon/templates/horizon.conf.j2 delete mode 100644 ansible/roles/ironic/templates/ironic-api-wsgi.conf.j2 delete mode 100644 ansible/roles/ironic/templates/ironic-prometheus-exporter-wsgi.conf.j2 delete mode 100644 ansible/roles/keystone/templates/wsgi-keystone.conf.j2 delete mode 100644 ansible/roles/masakari/templates/wsgi-masakari.conf.j2 delete mode 100644 ansible/roles/nova/templates/nova-api-wsgi.conf.j2 delete mode 100644 ansible/roles/nova/templates/nova-metadata-wsgi.conf.j2 delete mode 100644 ansible/roles/octavia/templates/octavia-wsgi.conf.j2 delete mode 100644 ansible/roles/placement/templates/placement-api-wsgi.conf.j2 delete mode 100644 ansible/roles/trove/templates/trove-wsgi.conf.j2 delete mode 100644 ansible/roles/zun/templates/wsgi-zun.conf.j2 (limited to 'ansible') diff --git a/ansible/releasenotes/notes/drop-apache-wsgi-provider-5049b660249d0f20.yaml b/ansible/releasenotes/notes/drop-apache-wsgi-provider-5049b660249d0f20.yaml new file mode 100644 index 000000000..e5eda3f92 --- /dev/null +++ b/ansible/releasenotes/notes/drop-apache-wsgi-provider-5049b660249d0f20.yaml @@ -0,0 +1,8 @@ +--- +upgrade: + - | + Support for running WSGI services under Apache+mod_wsgi has been dropped. + All API services now run exclusively under uWSGI. The ``*_wsgi_provider`` + variables (``keystone_wsgi_provider``, ``nova_wsgi_provider``, + ``cinder_wsgi_provider``, etc.) have been removed. If you had any of these + set to ``apache`` in your configuration, remove them before upgrading. diff --git a/ansible/roles/aodh/defaults/main.yml b/ansible/roles/aodh/defaults/main.yml index 0c6df039c..21315cbd8 100644 --- a/ansible/roles/aodh/defaults/main.yml +++ b/ansible/roles/aodh/defaults/main.yml @@ -260,8 +260,3 @@ aodh_database_enable_tls_internal: "{{ database_enable_tls_internal | bool }}" # Copy certificates ################### aodh_copy_certs: "{{ kolla_copy_ca_into_containers | bool or aodh_database_enable_tls_internal | bool }}" - -#################### -# WSGI -#################### -aodh_wsgi_provider: "uwsgi" diff --git a/ansible/roles/aodh/tasks/config.yml b/ansible/roles/aodh/tasks/config.yml index a45074681..b90d7892d 100644 --- a/ansible/roles/aodh/tasks/config.yml +++ b/ansible/roles/aodh/tasks/config.yml @@ -78,17 +78,4 @@ service_uwsgi_config_uid: "aodh" service_uwsgi_config_workers: "{{ aodh_api_workers }}" when: - - aodh_wsgi_provider == "uwsgi" - - service | service_enabled_and_mapped_to_host - -- name: Copying over wsgi-aodh files for services - vars: - service: "{{ aodh_services['aodh-api'] }}" - ansible.builtin.template: - src: "wsgi-aodh.conf.j2" - dest: "{{ node_config_directory }}/aodh-api/wsgi-aodh.conf" - mode: "0660" - become: true - when: - - aodh_wsgi_provider == "apache" - service | service_enabled_and_mapped_to_host diff --git a/ansible/roles/aodh/templates/aodh-api.json.j2 b/ansible/roles/aodh/templates/aodh-api.json.j2 index 844fe8db9..77fd4604b 100644 --- a/ansible/roles/aodh/templates/aodh-api.json.j2 +++ b/ansible/roles/aodh/templates/aodh-api.json.j2 @@ -1,27 +1,18 @@ -{% set apache_binary = 'apache2' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd' %} -{% set aodh_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %} -{% set command = ('/usr/sbin/' + apache_binary + ' -DFOREGROUND') if aodh_wsgi_provider == 'apache' else 'uwsgi /etc/aodh/aodh-api-uwsgi.ini' %} { - "command": "{{ command }}", + "command": "uwsgi /etc/aodh/aodh-api-uwsgi.ini", "config_files": [ { "source": "{{ container_config_directory }}/aodh.conf", "dest": "/etc/aodh/aodh.conf", "owner": "aodh", "perm": "0600" - }{% if aodh_wsgi_provider == "apache" %}, - { - "source": "{{ container_config_directory }}/wsgi-aodh.conf", - "dest": "/etc/{{ aodh_dir }}/wsgi-aodh.conf", - "owner": "root", - "perm": "0600" - }{% elif aodh_wsgi_provider == 'uwsgi' %}, + }, { "source": "{{ container_config_directory }}/aodh-api-uwsgi.ini", "dest": "/etc/aodh/aodh-api-uwsgi.ini", "owner": "aodh", "perm": "0600" - }{% endif %}{% if aodh_policy_file is defined %}, + }{% if aodh_policy_file is defined %}, { "source": "{{ container_config_directory }}/{{ aodh_policy_file }}", "dest": "/etc/aodh/{{ aodh_policy_file }}", diff --git a/ansible/roles/aodh/templates/wsgi-aodh.conf.j2 b/ansible/roles/aodh/templates/wsgi-aodh.conf.j2 deleted file mode 100644 index a1f61a0d0..000000000 --- a/ansible/roles/aodh/templates/wsgi-aodh.conf.j2 +++ /dev/null @@ -1,38 +0,0 @@ -{% set aodh_log_dir = '/var/log/kolla/aodh' %} -{% set binary_path = '/var/lib/kolla/venv/bin' %} -Listen {{ api_interface_address | put_address_in_context('url') }}:{{ aodh_api_listen_port }} - -ServerSignature Off -ServerTokens Prod -TraceEnable off -TimeOut {{ kolla_httpd_timeout }} -KeepAliveTimeout {{ kolla_httpd_keep_alive }} - -ErrorLog "{{ aodh_log_dir }}/apache-error.log" - - CustomLog "{{ aodh_log_dir }}/apache-access.log" common - - -{% if aodh_logging_debug | bool %} -LogLevel info -{% endif %} - - - - Options Indexes FollowSymLinks MultiViews - AllowOverride None - Require all granted - - - - - ## Logging - ErrorLog "{{ aodh_log_dir }}/aodh_wsgi_error.log" - ServerSignature Off - LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat - CustomLog "{{ aodh_log_dir }}/aodh_wsgi_access.log" logformat - WSGIApplicationGroup %{GLOBAL} - WSGIDaemonProcess aodh group=aodh processes={{ aodh_api_workers }} threads=1 user=aodh - WSGIProcessGroup aodh - WSGIScriptAlias / "{{ binary_path }}/aodh-api" - diff --git a/ansible/roles/barbican/defaults/main.yml b/ansible/roles/barbican/defaults/main.yml index 211080579..5e1ad0287 100644 --- a/ansible/roles/barbican/defaults/main.yml +++ b/ansible/roles/barbican/defaults/main.yml @@ -236,8 +236,3 @@ barbican_database_enable_tls_internal: "{{ database_enable_tls_internal | bool } # Copy certificates ################### barbican_copy_certs: "{{ kolla_copy_ca_into_containers | bool or barbican_enable_tls_backend | bool or barbican_database_enable_tls_internal | bool }}" - -################### -# WSGI -################### -barbican_wsgi_provider: "uwsgi" diff --git a/ansible/roles/barbican/tasks/config.yml b/ansible/roles/barbican/tasks/config.yml index da7126fc1..52ebbff16 100644 --- a/ansible/roles/barbican/tasks/config.yml +++ b/ansible/roles/barbican/tasks/config.yml @@ -50,7 +50,6 @@ service_uwsgi_config_workers: "{{ barbican_api_workers }}" when: - service | service_enabled_and_mapped_to_host - - barbican_wsgi_provider == "uwsgi" - name: Copying over config.json files for services ansible.builtin.template: diff --git a/ansible/roles/cinder/defaults/main.yml b/ansible/roles/cinder/defaults/main.yml index 50d764c62..37f7f7aab 100644 --- a/ansible/roles/cinder/defaults/main.yml +++ b/ansible/roles/cinder/defaults/main.yml @@ -388,11 +388,6 @@ cinder_enable_tls_backend: "{{ kolla_enable_tls_backend }}" cinder_cluster_name: "" cinder_cluster_skip_precheck: false -############ -# WSGI -############ -cinder_wsgi_provider: "uwsgi" - # Database cinder_database_enable_tls_internal: "{{ database_enable_tls_internal | bool }}" diff --git a/ansible/roles/cinder/tasks/config.yml b/ansible/roles/cinder/tasks/config.yml index d97cd080f..e2022fdc0 100644 --- a/ansible/roles/cinder/tasks/config.yml +++ b/ansible/roles/cinder/tasks/config.yml @@ -54,22 +54,6 @@ become: true with_dict: "{{ cinder_services | select_services_enabled_and_mapped_to_host }}" -- name: Copying over cinder-wsgi.conf - vars: - service: "{{ cinder_services['cinder-api'] }}" - become: true - ansible.builtin.template: - src: "{{ item }}" - dest: "{{ node_config_directory }}/cinder-api/cinder-wsgi.conf" - mode: "0660" - with_first_found: - - "{{ node_custom_config }}/cinder/{{ inventory_hostname }}/cinder-wsgi.conf" - - "{{ node_custom_config }}/cinder/cinder-wsgi.conf" - - "cinder-wsgi.conf.j2" - when: - - service | service_enabled_and_mapped_to_host - - cinder_wsgi_provider == "apache" - - name: "Configure uWSGI for Cinder" ansible.builtin.include_role: name: service-uwsgi-config @@ -87,7 +71,6 @@ service_uwsgi_config_workers: "{{ cinder_api_workers }}" when: - service | service_enabled_and_mapped_to_host - - cinder_wsgi_provider == "uwsgi" - name: Copying over cinder.conf vars: diff --git a/ansible/roles/cinder/templates/cinder-api.json.j2 b/ansible/roles/cinder/templates/cinder-api.json.j2 index 1a332f173..161597c6d 100644 --- a/ansible/roles/cinder/templates/cinder-api.json.j2 +++ b/ansible/roles/cinder/templates/cinder-api.json.j2 @@ -1,27 +1,18 @@ -{% set cinder_cmd = 'apache2' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd' %} -{% set cinder_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %} -{% set command = '/usr/sbin/' + apache_binary + ' -DFOREGROUND' if cinder_wsgi_provider == 'apache' else 'uwsgi /etc/cinder/cinder-api-uwsgi.ini' %} { - "command": "{{ command }}", + "command": "uwsgi /etc/cinder/cinder-api-uwsgi.ini", "config_files": [ { "source": "{{ container_config_directory }}/cinder.conf", "dest": "/etc/cinder/cinder.conf", "owner": "cinder", "perm": "0600" - }{% if cinder_wsgi_provider == 'apache' %}, - { - "source": "{{ container_config_directory }}/cinder-wsgi.conf", - "dest": "/etc/{{ cinder_dir }}/cinder-wsgi.conf", - "owner": "cinder", - "perm": "0600" - }{% elif cinder_wsgi_provider == 'uwsgi' %}, + }, { "source": "{{ container_config_directory }}/cinder-api-uwsgi.ini", "dest": "/etc/cinder/cinder-api-uwsgi.ini", "owner": "cinder", "perm": "0600" - }{% endif %}{% if cinder_policy_file is defined %}, + }{% if cinder_policy_file is defined %}, { "source": "{{ container_config_directory }}/{{ cinder_policy_file }}", "dest": "/etc/cinder/{{ cinder_policy_file }}", diff --git a/ansible/roles/cinder/templates/cinder-wsgi.conf.j2 b/ansible/roles/cinder/templates/cinder-wsgi.conf.j2 deleted file mode 100644 index d0f090bb0..000000000 --- a/ansible/roles/cinder/templates/cinder-wsgi.conf.j2 +++ /dev/null @@ -1,35 +0,0 @@ -{% if cinder_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} -LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} -LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} -{% endif %} -Listen {{ api_interface_address | put_address_in_context('url') }}:{{ cinder_api_listen_port }} - -ServerSignature Off -ServerTokens Prod -TraceEnable off -TimeOut {{ kolla_httpd_timeout }} -KeepAliveTimeout {{ kolla_httpd_keep_alive }} - -{% if cinder_logging_debug | bool %} -LogLevel info -{% endif %} - - - WSGIDaemonProcess cinder-api processes={{ cinder_api_workers }} threads=1 user=cinder group=cinder display-name=cinder-api - WSGIProcessGroup cinder-api - WSGIScriptAlias / /var/www/cgi-bin/cinder/cinder-wsgi - WSGIApplicationGroup %{GLOBAL} - WSGIPassAuthorization On - ErrorLogFormat "%{cu}t %M" - ErrorLog /var/log/kolla/cinder/cinder-api-error.log - LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat - CustomLog /var/log/kolla/cinder/cinder-api-access.log logformat -{% if cinder_enable_tls_backend | bool %} - SSLEngine On - SSLCertificateFile /etc/cinder/certs/cinder-cert.pem - SSLCertificateKeyFile /etc/cinder/certs/cinder-key.pem -{% endif %} - diff --git a/ansible/roles/cloudkitty/defaults/main.yml b/ansible/roles/cloudkitty/defaults/main.yml index b1840642e..0b74f8e27 100644 --- a/ansible/roles/cloudkitty/defaults/main.yml +++ b/ansible/roles/cloudkitty/defaults/main.yml @@ -235,8 +235,3 @@ cloudkitty_database_enable_tls_internal: "{{ database_enable_tls_internal | bool # Copy certificates ################### cloudkitty_copy_certs: "{{ kolla_copy_ca_into_containers | bool or cloudkitty_database_enable_tls_internal | bool }}" - -####### -# WSGI -####### -cloudkitty_wsgi_provider: "uwsgi" diff --git a/ansible/roles/cloudkitty/tasks/config.yml b/ansible/roles/cloudkitty/tasks/config.yml index e5f95f301..15e994add 100644 --- a/ansible/roles/cloudkitty/tasks/config.yml +++ b/ansible/roles/cloudkitty/tasks/config.yml @@ -90,19 +90,6 @@ service_uwsgi_config_workers: "{{ cloudkitty_api_workers }}" when: - service | service_enabled_and_mapped_to_host - - cloudkitty_wsgi_provider == "uwsgi" - -- name: Copying over wsgi-cloudkitty.conf - vars: - service: "{{ cloudkitty_services['cloudkitty-api'] }}" - ansible.builtin.template: - src: "wsgi-cloudkitty.conf.j2" - dest: "{{ node_config_directory }}/cloudkitty-api/wsgi-cloudkitty.conf" - mode: "0660" - become: true - when: - - cloudkitty_wsgi_provider == "apache" - - service | service_enabled_and_mapped_to_host - name: Copying over existing policy file ansible.builtin.template: diff --git a/ansible/roles/cloudkitty/templates/cloudkitty-api.json.j2 b/ansible/roles/cloudkitty/templates/cloudkitty-api.json.j2 index c6fcca90e..2bf756d20 100644 --- a/ansible/roles/cloudkitty/templates/cloudkitty-api.json.j2 +++ b/ansible/roles/cloudkitty/templates/cloudkitty-api.json.j2 @@ -1,27 +1,18 @@ -{% set apache_binary = 'apache2' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd' %} -{% set apache_conf_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %} -{% set command = ('/usr/sbin/' + apache_binary + ' -DFOREGROUND') if cloudkitty_wsgi_provider == 'apache' else 'uwsgi /etc/cloudkitty/cloudkitty-api-uwsgi.ini' %} { - "command": "{{ command }}", + "command": "uwsgi /etc/cloudkitty/cloudkitty-api-uwsgi.ini", "config_files": [ { "source": "{{ container_config_directory }}/cloudkitty.conf", "dest": "/etc/cloudkitty/cloudkitty.conf", "owner": "cloudkitty", "perm": "0600" - }{% if cloudkitty_wsgi_provider == "apache" %}, - { - "source": "{{ container_config_directory }}/wsgi-cloudkitty.conf", - "dest": "/etc/{{ apache_conf_dir }}/wsgi-cloudkitty.conf", - "owner": "cloudkitty", - "perm": "0600" - }{% elif cloudkitty_wsgi_provider == "uwsgi" %}, + }, { "source": "{{ container_config_directory }}/cloudkitty-api-uwsgi.ini", "dest": "/etc/cloudkitty/cloudkitty-api-uwsgi.ini", "owner": "cloudkitty", "perm": "0600" - }{% endif %}{% if cloudkitty_policy_file is defined %}, + }{% if cloudkitty_policy_file is defined %}, { "source": "{{ container_config_directory }}/{{ cloudkitty_policy_file }}", "dest": "/etc/cloudkitty/{{ cloudkitty_policy_file }}", diff --git a/ansible/roles/cloudkitty/templates/wsgi-cloudkitty.conf.j2 b/ansible/roles/cloudkitty/templates/wsgi-cloudkitty.conf.j2 deleted file mode 100644 index 38a315005..000000000 --- a/ansible/roles/cloudkitty/templates/wsgi-cloudkitty.conf.j2 +++ /dev/null @@ -1,36 +0,0 @@ -{% set cloudkitty_log_dir = '/var/log/kolla/cloudkitty' %} -{% set binary_path = '/var/lib/kolla/venv/bin' %} -Listen {{ api_interface_address | put_address_in_context('url') }}:{{ cloudkitty_api_port }} - -ServerSignature Off -ServerTokens Prod -TraceEnable off -TimeOut {{ kolla_httpd_timeout }} -KeepAliveTimeout {{ kolla_httpd_keep_alive }} - -ErrorLog "{{ cloudkitty_log_dir }}/apache-error.log" - - CustomLog "{{ cloudkitty_log_dir }}/apache-access.log" common - - -{% if cloudkitty_logging_debug | bool %} -LogLevel info -{% endif %} - - - - ErrorLog "{{ cloudkitty_log_dir }}/cloudkitty-api-error.log" - LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat - CustomLog "{{ cloudkitty_log_dir }}/cloudkitty-api-access.log" logformat - WSGIApplicationGroup %{GLOBAL} - WSGIDaemonProcess cloudkitty group=cloudkitty processes={{ cloudkitty_api_workers }} threads=1 user=cloudkitty - WSGIProcessGroup cloudkitty - WSGIScriptAlias / "{{ binary_path }}/cloudkitty-api" - - - - Require all granted - - - - diff --git a/ansible/roles/fluentd/tasks/config.yml b/ansible/roles/fluentd/tasks/config.yml index 50e54a7ec..830ce9148 100644 --- a/ansible/roles/fluentd/tasks/config.yml +++ b/ansible/roles/fluentd/tasks/config.yml @@ -85,8 +85,8 @@ enabled: true - name: "conf/input/03-rabbitmq.conf.j2" enabled: true - - name: "conf/input/04-openstack-wsgi.conf.j2" - enabled: true + - name: "conf/input/04-apache.conf.j2" + enabled: "{{ enable_keystone_federation | bool or enable_ironic | bool or enable_letsencrypt | bool or enable_skyline | bool }}" - name: "conf/input/05-libvirt.conf.j2" enabled: "{{ enable_nova | bool and enable_nova_libvirt_container | bool }}" - name: "conf/input/08-prometheus.conf.j2" @@ -111,9 +111,7 @@ customised_filter_files: "{{ find_custom_fluentd_filters.files | map(attribute='path') | list }}" # Formats fluentd_format_files: "{{ default_format_files | customise_fluentd(customised_format_files) }}" - default_format_files: - - "conf/format/apache_access.conf.j2" - - "conf/format/wsgi_access.conf.j2" + default_format_files: [] customised_format_files: "{{ find_custom_fluentd_formats.files | map(attribute='path') | list }}" # Outputs fluentd_output_files: "{{ default_output_files_enabled | customise_fluentd(customised_output_files) }}" diff --git a/ansible/roles/fluentd/templates/conf/filter/01-rewrite.conf.j2 b/ansible/roles/fluentd/templates/conf/filter/01-rewrite.conf.j2 index 66a1897a2..d6bb68490 100644 --- a/ansible/roles/fluentd/templates/conf/filter/01-rewrite.conf.j2 +++ b/ansible/roles/fluentd/templates/conf/filter/01-rewrite.conf.j2 @@ -1,16 +1,6 @@ @type rewrite_tag_filter capitalize_regex_backreference yes - - key programname - pattern ^(cinder-api-access|cloudkitty-api-access|gnocchi-api-access|horizon-access|keystone-apache-admin-access|keystone-apache-public-access|octavia-api-access|placement-api-access|trove-api-access)$ - tag apache_access - - - key programname - pattern ^(aodh_wsgi_access|barbican_api_uwsgi_access|zun_api_wsgi_access)$ - tag wsgi_access - key programname pattern ^(nova-api|nova-compute|nova-compute-ironic|nova-conductor|nova-manage|nova-novncproxy|nova-scheduler|nova-placement-api|placement-api|privsep-helper)$ diff --git a/ansible/roles/fluentd/templates/conf/format/apache_access.conf.j2 b/ansible/roles/fluentd/templates/conf/format/apache_access.conf.j2 deleted file mode 100644 index ba12c6695..000000000 --- a/ansible/roles/fluentd/templates/conf/format/apache_access.conf.j2 +++ /dev/null @@ -1,12 +0,0 @@ - - @type parser - reserve_data true - key_name Payload - - @type grok - grok_pattern \[%{HTTPDATE:Timestamp}\] "(?:%{WORD:http_method} %{NOTSPACE:http_url}(?: HTTP/%{NUMBER:http_version})?|%{DATA:rawrequest})" %{NUMBER:http_status} (?:%{NUMBER:http_bytes}|-) (?:%{NUMBER:http_response_time_us}|-) "%{DATA:referrer}" "%{DATA:agent}" - time_key Timestamp - time_format %d/%b/%Y:%H:%M:%S %z - keep_time_key true - - diff --git a/ansible/roles/fluentd/templates/conf/format/wsgi_access.conf.j2 b/ansible/roles/fluentd/templates/conf/format/wsgi_access.conf.j2 deleted file mode 100644 index fae0e5212..000000000 --- a/ansible/roles/fluentd/templates/conf/format/wsgi_access.conf.j2 +++ /dev/null @@ -1,12 +0,0 @@ - - @type parser - reserve_data true - key_name Payload - - @type grok - grok_pattern %{IPORHOST:clientip} %{HTTPDUSER:ident} %{USER:auth} \[%{HTTPDATE:Timestamp}\] "(?:%{WORD:http_method} %{NOTSPACE:http_url}(?: HTTP/%{NUMBER:http_version})?|%{DATA:rawrequest})" %{NUMBER:http_status} (?:%{NUMBER:http_bytes}|-) (?:%{NUMBER:http_response_time_us}|-) %{QS:referrer} %{QS:agent} - time_key Timestamp - time_format %d/%b/%Y:%H:%M:%S %z - keep_time_key true - - diff --git a/ansible/roles/fluentd/templates/conf/input/04-apache.conf.j2 b/ansible/roles/fluentd/templates/conf/input/04-apache.conf.j2 new file mode 100644 index 000000000..975e85f93 --- /dev/null +++ b/ansible/roles/fluentd/templates/conf/input/04-apache.conf.j2 @@ -0,0 +1,34 @@ +{% set apache_paths = [] %} +{% if enable_keystone_federation | bool %} +{% set _ = apache_paths.append('/var/log/kolla/keystone/apache-access.log') %} +{% set _ = apache_paths.append('/var/log/kolla/keystone/apache-error.log') %} +{% set _ = apache_paths.append('/var/log/kolla/keystone/keystone-apache-public-access.log') %} +{% set _ = apache_paths.append('/var/log/kolla/keystone/keystone-apache-public-error.log') %} +{% endif %} +{% if enable_ironic | bool %} +{% set _ = apache_paths.append('/var/log/kolla/ironic/ironic-http-access.log') %} +{% set _ = apache_paths.append('/var/log/kolla/ironic/ironic-http-error.log') %} +{% endif %} +{% if enable_letsencrypt | bool %} +{% set _ = apache_paths.append('/var/log/kolla/letsencrypt/letsencrypt-webserver-access.log') %} +{% set _ = apache_paths.append('/var/log/kolla/letsencrypt/letsencrypt-webserver-error.log') %} +{% endif %} +{% if enable_skyline | bool %} +{% set _ = apache_paths.append('/var/log/kolla/skyline/skyline-access.log') %} +{% set _ = apache_paths.append('/var/log/kolla/skyline/skyline-error.log') %} +{% set _ = apache_paths.append('/var/log/kolla/skyline/skyline-nginx-access.log') %} +{% set _ = apache_paths.append('/var/log/kolla/skyline/skyline-nginx-error.log') %} +{% endif %} +{% if apache_paths | length > 0 %} + + @type tail + path {{ apache_paths | join(',') }} + pos_file /var/run/fluentd/kolla-apache.pos + tag kolla.* + enable_watch_timer {{ fluentd_enable_watch_timer }} + + @type regexp + expression /^(?.*)$/ + + +{% endif %} diff --git a/ansible/roles/fluentd/templates/conf/input/04-openstack-wsgi.conf.j2 b/ansible/roles/fluentd/templates/conf/input/04-openstack-wsgi.conf.j2 deleted file mode 100644 index 20d408f12..000000000 --- a/ansible/roles/fluentd/templates/conf/input/04-openstack-wsgi.conf.j2 +++ /dev/null @@ -1,12 +0,0 @@ -# Note (blallau): to manage Apache and WSGI log files - - @type tail - path /var/log/kolla/*/*-access.log,/var/log/kolla/*/*-error.log,/var/log/kolla/*/*_access.log,/var/log/kolla/*/*_error.log - pos_file /var/run/fluentd/kolla-openstack-wsgi.pos - tag kolla.* - enable_watch_timer {{ fluentd_enable_watch_timer }} - - @type regexp - expression /^(?.*)$/ - - diff --git a/ansible/roles/gnocchi/defaults/main.yml b/ansible/roles/gnocchi/defaults/main.yml index 401f14326..83a29d597 100644 --- a/ansible/roles/gnocchi/defaults/main.yml +++ b/ansible/roles/gnocchi/defaults/main.yml @@ -203,8 +203,3 @@ gnocchi_database_enable_tls_internal: "{{ database_enable_tls_internal | bool }} # Copy certificates ################### gnocchi_copy_certs: "{{ kolla_copy_ca_into_containers | bool or gnocchi_database_enable_tls_internal | bool }}" - -#################### -# WSGI -#################### -gnocchi_wsgi_provider: "uwsgi" diff --git a/ansible/roles/gnocchi/tasks/config.yml b/ansible/roles/gnocchi/tasks/config.yml index b895d0a0f..00ee883dd 100644 --- a/ansible/roles/gnocchi/tasks/config.yml +++ b/ansible/roles/gnocchi/tasks/config.yml @@ -61,20 +61,6 @@ become: true with_dict: "{{ gnocchi_services | select_services_enabled_and_mapped_to_host }}" -- name: Copying over wsgi-gnocchi.conf - vars: - service: "{{ gnocchi_services['gnocchi-api'] }}" - ansible.builtin.template: - src: "wsgi-gnocchi.conf.j2" - dest: "{{ node_config_directory }}/{{ item }}/wsgi-gnocchi.conf" - mode: "0660" - become: true - when: - - gnocchi_wsgi_provider == "apache" - - service | service_enabled_and_mapped_to_host - with_items: - - "gnocchi-api" - - name: "Configure uWSGI for Gnocchi" ansible.builtin.include_role: name: service-uwsgi-config @@ -87,7 +73,6 @@ service_uwsgi_config_uid: "gnocchi" service_uwsgi_config_workers: "{{ gnocchi_api_workers }}" when: - - gnocchi_wsgi_provider == "uwsgi" - service | service_enabled_and_mapped_to_host - name: Copying over existing policy file diff --git a/ansible/roles/gnocchi/templates/gnocchi-api.json.j2 b/ansible/roles/gnocchi/templates/gnocchi-api.json.j2 index 2fc22c646..0880285ef 100644 --- a/ansible/roles/gnocchi/templates/gnocchi-api.json.j2 +++ b/ansible/roles/gnocchi/templates/gnocchi-api.json.j2 @@ -1,27 +1,18 @@ -{% set apache_binary = 'apache2' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd' %} -{% set gnocchi_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %} -{% set command = ('/usr/sbin/' + apache_binary + ' -DFOREGROUND') if gnocchi_wsgi_provider == 'apache' else 'uwsgi /etc/gnocchi/gnocchi-api-uwsgi.ini' %} { - "command": "{{ command }}", + "command": "uwsgi /etc/gnocchi/gnocchi-api-uwsgi.ini", "config_files": [ { "source": "{{ container_config_directory }}/gnocchi.conf", "dest": "/etc/gnocchi/gnocchi.conf", "owner": "gnocchi", "perm": "0600" - }{% if gnocchi_wsgi_provider == 'apache' %}, - { - "source": "{{ container_config_directory }}/wsgi-gnocchi.conf", - "dest": "/etc/{{ gnocchi_dir }}/wsgi-gnocchi.conf", - "owner": "gnocchi", - "perm": "0600" - }{% elif gnocchi_wsgi_provider == 'uwsgi' %}, + }, { "source": "{{ container_config_directory }}/gnocchi-api-uwsgi.ini", "dest": "/etc/gnocchi/gnocchi-api-uwsgi.ini", "owner": "gnocchi", "perm": "0600" - }{% endif %}{% if gnocchi_policy_file is defined %}, + }{% if gnocchi_policy_file is defined %}, { "source": "{{ container_config_directory }}/{{ gnocchi_policy_file }}", "dest": "/etc/gnocchi/{{ gnocchi_policy_file }}", diff --git a/ansible/roles/gnocchi/templates/wsgi-gnocchi.conf.j2 b/ansible/roles/gnocchi/templates/wsgi-gnocchi.conf.j2 deleted file mode 100644 index f3309bfef..000000000 --- a/ansible/roles/gnocchi/templates/wsgi-gnocchi.conf.j2 +++ /dev/null @@ -1,34 +0,0 @@ -{% set gnocchi_log_dir = '/var/log/kolla/gnocchi' %} -{% set wsgi_path = '/var/lib/kolla/venv/bin' %} -Listen {{ api_interface_address | put_address_in_context('url') }}:{{ gnocchi_api_listen_port }} - -ServerSignature Off -ServerTokens Prod -TraceEnable off -TimeOut {{ kolla_httpd_timeout }} -KeepAliveTimeout {{ kolla_httpd_keep_alive }} - -ErrorLog "{{ gnocchi_log_dir }}/apache-error.log" - - CustomLog "{{ gnocchi_log_dir }}/apache-access.log" common - - -{% if gnocchi_logging_debug | bool %} -LogLevel info -{% endif %} - - - - ErrorLog "{{ gnocchi_log_dir }}/gnocchi-api-error.log" - LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat - CustomLog "{{ gnocchi_log_dir }}/gnocchi-api-access.log" logformat - WSGIApplicationGroup %{GLOBAL} - WSGIDaemonProcess gnocchi group=gnocchi processes={{ gnocchi_api_workers }} threads=1 user=gnocchi - WSGIProcessGroup gnocchi - WSGIScriptAlias / "{{ wsgi_path }}/gnocchi-api" - - - Require all granted - - - diff --git a/ansible/roles/heat/defaults/main.yml b/ansible/roles/heat/defaults/main.yml index bc22c1a35..ca2992c56 100644 --- a/ansible/roles/heat/defaults/main.yml +++ b/ansible/roles/heat/defaults/main.yml @@ -276,8 +276,3 @@ heat_database_enable_tls_internal: "{{ database_enable_tls_internal | bool }}" # Copy certificates ################### heat_copy_certs: "{{ kolla_copy_ca_into_containers | bool or heat_enable_tls_backend | bool or heat_database_enable_tls_internal | bool }}" - -###### -# WSGI -###### -heat_wsgi_provider: "uwsgi" diff --git a/ansible/roles/heat/tasks/config.yml b/ansible/roles/heat/tasks/config.yml index 3e2c488cb..d1641dfaa 100644 --- a/ansible/roles/heat/tasks/config.yml +++ b/ansible/roles/heat/tasks/config.yml @@ -66,18 +66,6 @@ - heat_policy_file is defined with_dict: "{{ heat_services | select_services_enabled_and_mapped_to_host }}" -- name: Copying over heat-api wsgi config - vars: - service: "{{ heat_services['heat-api'] }}" - ansible.builtin.template: - src: "{{ role_path }}/templates/wsgi-heat-api.conf.j2" - dest: "{{ node_config_directory }}/heat-api/wsgi-heat-api.conf" - mode: "0660" - become: true - when: - - service | service_enabled_and_mapped_to_host - - heat_wsgi_provider == "apache" - - name: Configure uWSGI for heat-api ansible.builtin.include_role: name: service-uwsgi-config @@ -95,19 +83,6 @@ service_uwsgi_config_workers: "{{ heat_api_workers }}" when: - service | service_enabled_and_mapped_to_host - - heat_wsgi_provider == "uwsgi" - -- name: Copying over heat-api-cfn wsgi config - vars: - service: "{{ heat_services['heat-api-cfn'] }}" - ansible.builtin.template: - src: "{{ role_path }}/templates/wsgi-heat-api-cfn.conf.j2" - dest: "{{ node_config_directory }}/heat-api-cfn/wsgi-heat-api-cfn.conf" - mode: "0660" - become: true - when: - - service | service_enabled_and_mapped_to_host - - heat_wsgi_provider == "apache" - name: Configure uWSGI for heat-api-cfn ansible.builtin.include_role: @@ -126,4 +101,3 @@ service_uwsgi_config_workers: "{{ heat_api_cfn_workers }}" when: - service | service_enabled_and_mapped_to_host - - heat_wsgi_provider == "uwsgi" diff --git a/ansible/roles/heat/templates/heat-api-cfn.json.j2 b/ansible/roles/heat/templates/heat-api-cfn.json.j2 index 7868e4a1a..1a308dfd8 100644 --- a/ansible/roles/heat/templates/heat-api-cfn.json.j2 +++ b/ansible/roles/heat/templates/heat-api-cfn.json.j2 @@ -1,27 +1,18 @@ -{% set apache_binary = 'apache2' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd' %} -{% set apache_conf_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %} -{% set command = ('/usr/sbin/' + apache_binary + ' -DFOREGROUND') if heat_wsgi_provider == 'apache' else 'uwsgi /etc/heat/heat-api-cfn-uwsgi.ini' %} { - "command": "{{ command }}", + "command": "uwsgi /etc/heat/heat-api-cfn-uwsgi.ini", "config_files": [ { "source": "{{ container_config_directory }}/heat.conf", "dest": "/etc/heat/heat.conf", "owner": "heat", "perm": "0600" - }{% if heat_wsgi_provider == 'apache' %}, - { - "source": "{{ container_config_directory }}/wsgi-heat-api-cfn.conf", - "dest": "/etc/{{ apache_conf_dir }}/wsgi-heat-api-cfn.conf", - "owner": "heat", - "perm": "0600" - }{% elif heat_wsgi_provider == 'uwsgi' %}, + }, { "source": "{{ container_config_directory }}/heat-api-cfn-uwsgi.ini", "dest": "/etc/heat/heat-api-cfn-uwsgi.ini", "owner": "heat", "perm": "0600" - }{% endif %}{% if heat_policy_file is defined %}, + }{% if heat_policy_file is defined %}, { "source": "{{ container_config_directory }}/{{ heat_policy_file }}", "dest": "/etc/heat/{{ heat_policy_file }}", diff --git a/ansible/roles/heat/templates/heat-api.json.j2 b/ansible/roles/heat/templates/heat-api.json.j2 index b3afb8182..079267847 100644 --- a/ansible/roles/heat/templates/heat-api.json.j2 +++ b/ansible/roles/heat/templates/heat-api.json.j2 @@ -1,27 +1,18 @@ -{% set apache_binary = 'apache2' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd' %} -{% set apache_conf_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %} -{% set command = ('/usr/sbin/' + apache_binary + ' -DFOREGROUND') if heat_wsgi_provider == 'apache' else 'uwsgi /etc/heat/heat-api-uwsgi.ini' %} { - "command": "{{ command }}", + "command": "uwsgi /etc/heat/heat-api-uwsgi.ini", "config_files": [ { "source": "{{ container_config_directory }}/heat.conf", "dest": "/etc/heat/heat.conf", "owner": "heat", "perm": "0600" - }{% if heat_wsgi_provider == 'apache' %}, - { - "source": "{{ container_config_directory }}/wsgi-heat-api.conf", - "dest": "/etc/{{ apache_conf_dir }}/wsgi-heat-api.conf", - "owner": "heat", - "perm": "0600" - }{% elif heat_wsgi_provider == 'uwsgi' %}, + }, { "source": "{{ container_config_directory }}/heat-api-uwsgi.ini", "dest": "/etc/heat/heat-api-uwsgi.ini", "owner": "heat", "perm": "0600" - }{% endif %}{% if heat_policy_file is defined %}, + }{% if heat_policy_file is defined %}, { "source": "{{ container_config_directory }}/{{ heat_policy_file }}", "dest": "/etc/heat/{{ heat_policy_file }}", diff --git a/ansible/roles/heat/templates/wsgi-heat-api-cfn.conf.j2 b/ansible/roles/heat/templates/wsgi-heat-api-cfn.conf.j2 deleted file mode 100644 index 1b339959f..000000000 --- a/ansible/roles/heat/templates/wsgi-heat-api-cfn.conf.j2 +++ /dev/null @@ -1,46 +0,0 @@ -{% set heat_log_dir = '/var/log/kolla/heat' %} -{% set binary_path = '/var/lib/kolla/venv/bin' %} -{% if heat_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} -LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} -LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} -{% endif %} -Listen {{ api_interface_address | put_address_in_context('url') }}:{{ heat_api_cfn_listen_port }} - -ServerSignature Off -ServerTokens Prod -TraceEnable off -TimeOut {{ kolla_httpd_timeout }} -KeepAliveTimeout {{ kolla_httpd_keep_alive }} - - - - AllowOverride None - Options None - Require all granted - - - -ErrorLog "{{ heat_log_dir }}/apache-cfn-error.log" - -CustomLog "{{ heat_log_dir }}/apache-cfn-access.log" common - - - - WSGIDaemonProcess heat-api-cfn processes={{ heat_api_cfn_workers }} threads=1 user=heat group=heat display-name=heat-api-cfn - WSGIProcessGroup heat-api-cfn - WSGIScriptAlias / {{ binary_path }}/heat-wsgi-api-cfn - WSGIApplicationGroup %{GLOBAL} - WSGIPassAuthorization On - ErrorLogFormat "%{cu}t %M" - ErrorLog "{{ heat_log_dir }}/heat-api-cfn-error.log" - LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat - CustomLog "{{ heat_log_dir }}/heat-api-cfn-access.log" logformat -{% if heat_enable_tls_backend | bool %} - SSLEngine On - SSLCertificateFile /etc/heat/certs/heat-cert.pem - SSLCertificateKeyFile /etc/heat/certs/heat-key.pem -{% endif %} - diff --git a/ansible/roles/heat/templates/wsgi-heat-api.conf.j2 b/ansible/roles/heat/templates/wsgi-heat-api.conf.j2 deleted file mode 100644 index 175336f52..000000000 --- a/ansible/roles/heat/templates/wsgi-heat-api.conf.j2 +++ /dev/null @@ -1,46 +0,0 @@ -{% set heat_log_dir = '/var/log/kolla/heat' %} -{% set binary_path = '/var/lib/kolla/venv/bin' %} -{% if heat_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} -LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} -LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} -{% endif %} -Listen {{ api_interface_address | put_address_in_context('url') }}:{{ heat_api_listen_port }} - -ServerSignature Off -ServerTokens Prod -TraceEnable off -TimeOut {{ kolla_httpd_timeout }} -KeepAliveTimeout {{ kolla_httpd_keep_alive }} - - - - AllowOverride None - Options None - Require all granted - - - -ErrorLog "{{ heat_log_dir }}/apache-error.log" - -CustomLog "{{ heat_log_dir }}/apache-access.log" common - - - - WSGIDaemonProcess heat-api processes={{ heat_api_workers }} threads=1 user=heat group=heat display-name=heat-api - WSGIProcessGroup heat-api - WSGIScriptAlias / {{ binary_path }}/heat-wsgi-api - WSGIApplicationGroup %{GLOBAL} - WSGIPassAuthorization On - ErrorLogFormat "%{cu}t %M" - ErrorLog "{{ heat_log_dir }}/heat-api-error.log" - LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat - CustomLog "{{ heat_log_dir }}/heat-api-access.log" logformat -{% if heat_enable_tls_backend | bool %} - SSLEngine On - SSLCertificateFile /etc/heat/certs/heat-cert.pem - SSLCertificateKeyFile /etc/heat/certs/heat-key.pem -{% endif %} - diff --git a/ansible/roles/horizon/defaults/main.yml b/ansible/roles/horizon/defaults/main.yml index 2f69d04a5..de4f6129a 100644 --- a/ansible/roles/horizon/defaults/main.yml +++ b/ansible/roles/horizon/defaults/main.yml @@ -171,8 +171,3 @@ horizon_use_keystone_public_url: false # Copy certificates ################### horizon_copy_certs: "{{ kolla_copy_ca_into_containers | bool or horizon_enable_tls_backend | bool }}" - -############ -# WSGI -############ -horizon_wsgi_provider: "uwsgi" diff --git a/ansible/roles/horizon/tasks/config.yml b/ansible/roles/horizon/tasks/config.yml index 8065779cf..08a46f0ec 100644 --- a/ansible/roles/horizon/tasks/config.yml +++ b/ansible/roles/horizon/tasks/config.yml @@ -48,22 +48,6 @@ mode: "0660" when: service | service_enabled_and_mapped_to_host -- name: Copying over horizon.conf - become: true - vars: - service: "{{ horizon_services['horizon'] }}" - ansible.builtin.template: - src: "{{ item }}" - dest: "{{ node_config_directory }}/horizon/horizon.conf" - mode: "0660" - with_first_found: - - "{{ node_custom_config }}/horizon/{{ inventory_hostname }}/horizon.conf" - - "{{ node_custom_config }}/horizon/horizon.conf" - - "horizon.conf.j2" - when: - - service | service_enabled_and_mapped_to_host - - horizon_wsgi_provider == "apache" - - name: "Configure uWSGI for Horizon" ansible.builtin.include_role: name: service-uwsgi-config @@ -80,7 +64,6 @@ service_uwsgi_config_workers: "{{ horizon_wsgi_processes }}" when: - service | service_enabled_and_mapped_to_host - - horizon_wsgi_provider == "uwsgi" - name: Copying over kolla-settings.py become: true diff --git a/ansible/roles/horizon/templates/horizon.conf.j2 b/ansible/roles/horizon/templates/horizon.conf.j2 deleted file mode 100644 index 8d78f67a4..000000000 --- a/ansible/roles/horizon/templates/horizon.conf.j2 +++ /dev/null @@ -1,91 +0,0 @@ -{% if horizon_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} -LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} -LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} -{% endif %} -Listen {{ api_interface_address | put_address_in_context('url') }}:{{ horizon_listen_port }} - -ServerSignature Off -ServerTokens Prod -TraceEnable off - - - LogLevel warn - ErrorLogFormat "%{cu}t %M" - ErrorLog /var/log/kolla/horizon/horizon-error.log - LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat - CustomLog /var/log/kolla/horizon/horizon-access.log logformat - - WSGIScriptReloading On - WSGIDaemonProcess horizon-http processes={{ horizon_wsgi_processes }} threads={{ horizon_wsgi_threads }} user=horizon group=horizon display-name=horizon - WSGIProcessGroup horizon-http - WSGIScriptAlias / /var/lib/kolla/venv/lib/python3/site-packages/openstack_dashboard/wsgi.py - WSGIPassAuthorization On - WSGIApplicationGroup %{GLOBAL} - - - Require all granted - - - - Require local - - - Alias /static /var/lib/kolla/venv/lib/python3/site-packages/static - - SetHandler None - - -{% if horizon_enable_tls_backend | bool %} - SSLEngine On - SSLCertificateFile /etc/horizon/certs/horizon-cert.pem - SSLCertificateKeyFile /etc/horizon/certs/horizon-key.pem -{% endif %} -{% if horizon_httpd_limitrequestbody is defined %} - LimitRequestBody {{ horizon_httpd_limitrequestbody }} -{% endif %} - - - - # Compress HTML, CSS, JavaScript, Json, Text, XML and fonts - AddOutputFilterByType DEFLATE application/javascript - AddOutputFilterByType DEFLATE application/json - AddOutputFilterByType DEFLATE application/rss+xml - AddOutputFilterByType DEFLATE application/vnd.ms-fontobject - AddOutputFilterByType DEFLATE application/x-font - AddOutputFilterByType DEFLATE application/x-font-opentype - AddOutputFilterByType DEFLATE application/x-font-otf - AddOutputFilterByType DEFLATE application/x-font-truetype - AddOutputFilterByType DEFLATE application/x-font-ttf - AddOutputFilterByType DEFLATE application/x-javascript - AddOutputFilterByType DEFLATE application/xhtml+xml - AddOutputFilterByType DEFLATE application/xml - AddOutputFilterByType DEFLATE font/opentype - AddOutputFilterByType DEFLATE font/otf - AddOutputFilterByType DEFLATE font/ttf - AddOutputFilterByType DEFLATE image/svg+xml - AddOutputFilterByType DEFLATE image/x-icon - AddOutputFilterByType DEFLATE text/css - AddOutputFilterByType DEFLATE text/html - AddOutputFilterByType DEFLATE text/javascript - AddOutputFilterByType DEFLATE text/plain - AddOutputFilterByType DEFLATE text/xml - - - - - ExpiresActive on - ExpiresDefault "access plus 1 month" - ExpiresByType application/javascript "access plus 1 year" - ExpiresByType text/css "access plus 1 year" - ExpiresByType image/x-ico "access plus 1 year" - ExpiresByType image/jpg "access plus 1 year" - ExpiresByType image/jpeg "access plus 1 year" - ExpiresByType image/gif "access plus 1 year" - ExpiresByType image/png "access plus 1 year" - Header merge Cache-Control public - Header unset ETag - - diff --git a/ansible/roles/horizon/templates/horizon.json.j2 b/ansible/roles/horizon/templates/horizon.json.j2 index 9b86503dc..f7859194a 100644 --- a/ansible/roles/horizon/templates/horizon.json.j2 +++ b/ansible/roles/horizon/templates/horizon.json.j2 @@ -1,23 +1,11 @@ -{% set apache_cmd = 'apache2' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd' %} -{% set apache_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %} -{% set apache_file = '000-default.conf' if kolla_base_distro in ['ubuntu', 'debian'] else 'horizon.conf' %} -{% set uwsgi_cmd = 'uwsgi /etc/horizon/horizon-uwsgi.ini' %} -{% set command = uwsgi_cmd if horizon_wsgi_provider == 'uwsgi' else ('/usr/sbin/' + apache_cmd + ' -DFOREGROUND') %} { - "command": "{{ command }}", + "command": "uwsgi /etc/horizon/horizon-uwsgi.ini", "config_files": [ { -{% if horizon_wsgi_provider == 'apache' %} - "source": "{{ container_config_directory }}/horizon.conf", - "dest": "/etc/{{ apache_dir }}/{{ apache_file }}", - "owner": "horizon", - "perm": "0600" -{% elif horizon_wsgi_provider == 'uwsgi' %} "source": "{{ container_config_directory }}/horizon-uwsgi.ini", "dest": "/etc/horizon/horizon-uwsgi.ini", "owner": "horizon", "perm": "0600" -{% endif %} }, {% for path in custom_policy %} { diff --git a/ansible/roles/ironic/defaults/main.yml b/ansible/roles/ironic/defaults/main.yml index 10b5a6d4f..12ee3a185 100644 --- a/ansible/roles/ironic/defaults/main.yml +++ b/ansible/roles/ironic/defaults/main.yml @@ -359,11 +359,6 @@ ironic_database_enable_tls_internal: "{{ database_enable_tls_internal | bool }}" ################### ironic_copy_certs: "{{ kolla_copy_ca_into_containers | bool or ironic_enable_tls_backend | bool or ironic_database_enable_tls_internal | bool }}" -############ -# WSGI -############ -ironic_wsgi_provider: "uwsgi" - ############ # NTP ############ diff --git a/ansible/roles/ironic/tasks/config.yml b/ansible/roles/ironic/tasks/config.yml index cc1073081..bfe7c600e 100644 --- a/ansible/roles/ironic/tasks/config.yml +++ b/ansible/roles/ironic/tasks/config.yml @@ -153,22 +153,6 @@ - "ironic-http-httpd.conf.j2" when: service | service_enabled_and_mapped_to_host -- name: Copying over ironic-prometheus-exporter-wsgi.conf - vars: - service: "{{ ironic_services['ironic-prometheus-exporter'] }}" - ansible.builtin.template: - src: "{{ item }}" - dest: "{{ node_config_directory }}/ironic-prometheus-exporter/ironic-prometheus-exporter-wsgi.conf" - mode: "0660" - become: true - with_first_found: - - "{{ node_config_directory }}/ironic/{{ inventory_hostname }}/ironic-prometheus-exporter-wsgi.conf" - - "{{ node_config_directory }}/ironic/ironic-prometheus-exporter-wsgi.conf" - - "ironic-prometheus-exporter-wsgi.conf.j2" - when: - - service | service_enabled_and_mapped_to_host - - ironic_wsgi_provider == "apache" - - name: Copying over existing Ironic policy file vars: services_require_policy_json: @@ -184,18 +168,6 @@ - item.key in services_require_policy_json with_dict: "{{ ironic_services | select_services_enabled_and_mapped_to_host }}" -- name: Copying over ironic-api-wsgi.conf - vars: - service: "{{ ironic_services['ironic-api'] }}" - ansible.builtin.template: - src: "ironic-api-wsgi.conf.j2" - dest: "{{ node_config_directory }}/ironic-api/ironic-api-wsgi.conf" - mode: "0660" - become: true - when: - - service | service_enabled_and_mapped_to_host - - ironic_wsgi_provider == "apache" - - name: "Configure uWSGI for ironic-api" ansible.builtin.include_role: name: service-uwsgi-config @@ -213,7 +185,6 @@ service_uwsgi_config_workers: "{{ item.workers }}" when: - service | service_enabled_and_mapped_to_host - - ironic_wsgi_provider == "uwsgi" loop: - { name: "ironic-api", port: "{{ ironic_api_listen_port }}", workers: "{{ ironic_api_workers }}" } - { name: "ironic-prometheus-exporter", port: "{{ ironic_prometheus_exporter_port }}", workers: "{{ ironic_prometheus_exporter_workers }}" } diff --git a/ansible/roles/ironic/templates/ironic-api-wsgi.conf.j2 b/ansible/roles/ironic/templates/ironic-api-wsgi.conf.j2 deleted file mode 100644 index 03fce1104..000000000 --- a/ansible/roles/ironic/templates/ironic-api-wsgi.conf.j2 +++ /dev/null @@ -1,49 +0,0 @@ -{% set ironic_log_dir = '/var/log/kolla/ironic' %} -{% set wsgi_directory = '/var/lib/kolla/venv/bin' %} -{% if ironic_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} -LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} -LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} -{% endif %} -Listen {{ api_interface_address | put_address_in_context('url') }}:{{ ironic_api_listen_port }} - -ServerSignature Off -ServerTokens Prod -TraceEnable off -TimeOut {{ kolla_httpd_timeout }} -KeepAliveTimeout {{ kolla_httpd_keep_alive }} - - - - Options None - Require all granted - - - -ErrorLog "{{ ironic_log_dir }}/apache-error.log" - -CustomLog "{{ ironic_log_dir }}/apache-access.log" common - - -{% if ironic_logging_debug | bool %} -LogLevel info -{% endif %} - - - WSGIDaemonProcess ironic-api processes={{ ironic_api_workers }} threads=1 user=ironic group=ironic display-name=ironic-api - WSGIProcessGroup ironic-api - WSGIScriptAlias / {{ wsgi_directory }}/ironic-api-wsgi - WSGIApplicationGroup %{GLOBAL} - WSGIPassAuthorization On - ErrorLogFormat "%{cu}t %M" - ErrorLog "{{ ironic_log_dir }}/ironic-api-error.log" - LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat - CustomLog "{{ ironic_log_dir }}/ironic-api-access.log" logformat -{% if ironic_enable_tls_backend | bool %} - SSLEngine on - SSLCertificateFile /etc/ironic/certs/ironic-cert.pem - SSLCertificateKeyFile /etc/ironic/certs/ironic-key.pem -{% endif %} - diff --git a/ansible/roles/ironic/templates/ironic-api.json.j2 b/ansible/roles/ironic/templates/ironic-api.json.j2 index 7765e421f..d9c5d5f8b 100644 --- a/ansible/roles/ironic/templates/ironic-api.json.j2 +++ b/ansible/roles/ironic/templates/ironic-api.json.j2 @@ -1,27 +1,18 @@ -{% set apache_binary = 'apache2' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd' %} -{% set apache_conf_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %} -{% set command = ('/usr/sbin/' + apache_binary + ' -DFOREGROUND') if ironic_wsgi_provider == 'apache' else 'uwsgi /etc/ironic/ironic-api-uwsgi.ini' %} { - "command": "{{ command }}", + "command": "uwsgi /etc/ironic/ironic-api-uwsgi.ini", "config_files": [ { "source": "{{ container_config_directory }}/ironic.conf", "dest": "/etc/ironic/ironic.conf", "owner": "ironic", "perm": "0600" - }{% if ironic_wsgi_provider == "apache" %}, - { - "source": "{{ container_config_directory }}/ironic-api-wsgi.conf", - "dest": "/etc/{{ apache_conf_dir }}/ironic-api-wsgi.conf", - "owner": "ironic", - "perm": "0600" - }{% elif ironic_wsgi_provider == "uwsgi" %}, + }, { "source": "{{ container_config_directory }}/ironic-api-uwsgi.ini", "dest": "/etc/ironic/ironic-api-uwsgi.ini", "owner": "ironic", "perm": "0600" - }{% endif %}{% if ironic_policy_file is defined %}, + }{% if ironic_policy_file is defined %}, { "source": "{{ container_config_directory }}/{{ ironic_policy_file }}", "dest": "/etc/ironic/{{ ironic_policy_file }}", diff --git a/ansible/roles/ironic/templates/ironic-prometheus-exporter-wsgi.conf.j2 b/ansible/roles/ironic/templates/ironic-prometheus-exporter-wsgi.conf.j2 deleted file mode 100644 index 319bf2f88..000000000 --- a/ansible/roles/ironic/templates/ironic-prometheus-exporter-wsgi.conf.j2 +++ /dev/null @@ -1,37 +0,0 @@ -{% set ironic_log_dir = '/var/log/kolla/ironic' %} -Listen {{ api_interface_address | put_address_in_context('url') }}:{{ ironic_prometheus_exporter_port }} - -ServerSignature Off -ServerTokens Prod -TraceEnable off - - - - AllowOverride None - Options None - Require all granted - - - -ErrorLog "{{ ironic_log_dir }}/apache-error.log" - - CustomLog "{{ ironic_log_dir }}/apache-access.log" common - - -{% if ironic_logging_debug | bool %} -LogLevel info -{% endif %} - - - ErrorLog "{{ ironic_log_dir }}/ironic-prometheus-exporter-wsgi-error.log" - LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat - CustomLog "{{ ironic_log_dir }}/ironic-prometheus-exporter-wsgi-access.log" logformat - - WSGIDaemonProcess ironic-prometheus-exporter processes={{ openstack_service_workers }} threads=1 user=ironic display-name=%{GROUP} python-path=/var/lib/kolla/venv/lib/python3/site-packages - WSGIProcessGroup ironic-prometheus-exporter - WSGIScriptAlias / /var/lib/kolla/venv/lib/python3/site-packages/ironic_prometheus_exporter/app/wsgi.py - WSGIApplicationGroup %{GLOBAL} - - Require all granted - - diff --git a/ansible/roles/ironic/templates/ironic-prometheus-exporter.json.j2 b/ansible/roles/ironic/templates/ironic-prometheus-exporter.json.j2 index 1075b312d..a4d931eff 100644 --- a/ansible/roles/ironic/templates/ironic-prometheus-exporter.json.j2 +++ b/ansible/roles/ironic/templates/ironic-prometheus-exporter.json.j2 @@ -1,27 +1,18 @@ -{% set ironic_prometheus_exporter_cmd = 'apache2' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd' %} -{% set ironic_prometheus_exporter_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %} -{% set command = ('/usr/sbin/' + apache_binary + ' -DFOREGROUND') if ironic_wsgi_provider == 'apache' else 'uwsgi /etc/ironic/ironic-prometheus-exporter-uwsgi.ini' %} { - "command": "{{ command }}", + "command": "uwsgi /etc/ironic/ironic-prometheus-exporter-uwsgi.ini", "config_files": [ { "source": "{{ container_config_directory }}/ironic.conf", "dest": "/etc/ironic/ironic.conf", "owner": "ironic", "perm": "0600" - }{% if ironic_wsgi_provider == 'apache' %}, - { - "source": "{{ container_config_directory }}/ironic-prometheus-exporter-wsgi.conf", - "dest": "/etc/{{ ironic_prometheus_exporter_dir }}/ironic-prometheus-exporter-wsgi.conf", - "owner": "ironic", - "perm": "0600" - }{% elif ironic_wsgi_provider == 'uwsgi' %}, + }, { "source": "{{ container_config_directory }}/ironic-prometheus-exporter-uwsgi.ini", "dest": "/etc/ironic/ironic-prometheus-exporter-uwsgi.ini", "owner": "ironic", "perm": "0600" - }{% endif %}{% if kolla_copy_ca_into_containers | bool %}, + }{% if kolla_copy_ca_into_containers | bool %}, { "source": "{{ container_config_directory }}/ca-certificates", "dest": "/var/lib/kolla/share/ca-certificates", diff --git a/ansible/roles/keystone/defaults/main.yml b/ansible/roles/keystone/defaults/main.yml index bb3b35286..bb4efcd9d 100644 --- a/ansible/roles/keystone/defaults/main.yml +++ b/ansible/roles/keystone/defaults/main.yml @@ -48,7 +48,7 @@ keystone_services: keystone-httpd: container_name: "keystone_httpd" group: "keystone" - enabled: "{{ enable_keystone_federation | bool and keystone_wsgi_provider == 'uwsgi' }}" + enabled: "{{ enable_keystone_federation | bool }}" image: "{{ keystone_httpd_image_full }}" volumes: "{{ keystone_httpd_default_volumes + keystone_httpd_extra_volumes }}" dimensions: "{{ keystone_httpd_dimensions }}" @@ -265,10 +265,7 @@ keystone_remote_id_attribute_oidc: "HTTP_OIDC_ISS" keystone_container_federation_oidc_metadata_folder: "{{ '/etc/apache2/metadata' if kolla_base_distro in ['debian', 'ubuntu'] else '/etc/httpd/metadata' }}" keystone_container_federation_oidc_idp_certificate_folder: "{{ '/etc/apache2/cert' if kolla_base_distro in ['debian', 'ubuntu'] else '/etc/httpd/cert' }}" keystone_container_federation_oidc_attribute_mappings_folder: "{{ container_config_directory }}/federation/oidc/attribute_maps" -keystone_host_federation_base_folder: >- - {{ node_config_directory }}/{{ - 'keystone-httpd' if keystone_wsgi_provider == 'uwsgi' else 'keystone' - }}/federation +keystone_host_federation_base_folder: "{{ node_config_directory }}/keystone-httpd/federation" keystone_host_federation_oidc_metadata_folder: "{{ keystone_host_federation_base_folder }}/oidc/metadata" keystone_host_federation_oidc_idp_certificate_folder: "{{ keystone_host_federation_base_folder }}/oidc/cert" keystone_host_federation_oidc_attribute_mappings_folder: "{{ keystone_host_federation_base_folder }}/oidc/attribute_maps" @@ -322,5 +319,4 @@ keystone_copy_certs: "{{ kolla_copy_ca_into_containers | bool or keystone_enable ############ # WSGI ############ -keystone_wsgi_provider: "uwsgi" keystone_wsgi_socket_port: "5001" diff --git a/ansible/roles/keystone/tasks/config.yml b/ansible/roles/keystone/tasks/config.yml index 2170135dd..92c306d97 100644 --- a/ansible/roles/keystone/tasks/config.yml +++ b/ansible/roles/keystone/tasks/config.yml @@ -126,22 +126,6 @@ when: - keystone_enable_federation_openid | bool -- name: Copying over wsgi-keystone.conf - vars: - service: "{{ keystone_services['keystone'] }}" - ansible.builtin.template: - src: "{{ item }}" - dest: "{{ node_config_directory }}/keystone/wsgi-keystone.conf" - mode: "0660" - become: true - when: - - service | service_enabled_and_mapped_to_host - - keystone_wsgi_provider == "apache" - with_first_found: - - "{{ node_custom_config }}/keystone/{{ inventory_hostname }}/wsgi-keystone.conf" - - "{{ node_custom_config }}/keystone/wsgi-keystone.conf" - - "wsgi-keystone.conf.j2" - - name: "Configure uWSGI for Keystone" ansible.builtin.include_role: name: service-uwsgi-config @@ -163,7 +147,6 @@ service_uwsgi_config_workers: "{{ keystone_api_workers }}" when: - service | service_enabled_and_mapped_to_host - - keystone_wsgi_provider == "uwsgi" - name: Copying over httpd-keystone.conf vars: @@ -175,7 +158,6 @@ become: true when: - service | service_enabled_and_mapped_to_host - - keystone_wsgi_provider == "uwsgi" with_first_found: - "{{ node_custom_config }}/keystone/{{ inventory_hostname }}/httpd-keystone.conf" - "{{ node_custom_config }}/keystone/httpd-keystone.conf" diff --git a/ansible/roles/keystone/templates/keystone-startup.sh.j2 b/ansible/roles/keystone/templates/keystone-startup.sh.j2 index 224e86f5d..6ea097ba2 100644 --- a/ansible/roles/keystone/templates/keystone-startup.sh.j2 +++ b/ansible/roles/keystone/templates/keystone-startup.sh.j2 @@ -1,8 +1,4 @@ #!/bin/bash -x -{% set apache_cmd = '/usr/sbin/apache2' if kolla_base_distro in ['ubuntu', 'debian'] else '/usr/sbin/httpd' %} -{% set uwsgi_cmd = 'uwsgi /etc/keystone/keystone-api-uwsgi.ini' %} -{% set keystone_cmd = uwsgi_cmd if keystone_wsgi_provider == 'uwsgi' else (apache_cmd + ' -DFOREGROUND') %} - set -o errexit set -o pipefail @@ -23,4 +19,4 @@ while [ ! -f "${FERNET_KEY_DIR}/0" ]; do fi done -exec {{ keystone_cmd }} $@ +exec uwsgi /etc/keystone/keystone-api-uwsgi.ini diff --git a/ansible/roles/keystone/templates/keystone.json.j2 b/ansible/roles/keystone/templates/keystone.json.j2 index a4cf8b7fa..4ebfdce8e 100644 --- a/ansible/roles/keystone/templates/keystone.json.j2 +++ b/ansible/roles/keystone/templates/keystone.json.j2 @@ -1,5 +1,3 @@ -{% set keystone_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %} -{% set apache_user = 'www-data' if kolla_base_distro in ['ubuntu', 'debian'] else 'apache' %} { "command": "/usr/bin/keystone-startup.sh", "config_files": [ @@ -28,22 +26,16 @@ "owner": "keystone", "perm": "0600", "optional": true - }{% if keystone_policy_file is defined %}, - { - "source": "{{ container_config_directory }}/{{ keystone_policy_file }}", - "dest": "/etc/keystone/{{ keystone_policy_file }}", - "owner": "keystone", - "perm": "0600" - }{% endif %}{% if keystone_wsgi_provider == 'apache' %}, + }, { - "source": "{{ container_config_directory }}/wsgi-keystone.conf", - "dest": "/etc/{{ keystone_dir }}/wsgi-keystone.conf", + "source": "{{ container_config_directory }}/keystone-uwsgi.ini", + "dest": "/etc/keystone/keystone-api-uwsgi.ini", "owner": "keystone", "perm": "0600" - }{% elif keystone_wsgi_provider == 'uwsgi' %}, + }{% if keystone_policy_file is defined %}, { - "source": "{{ container_config_directory }}/keystone-uwsgi.ini", - "dest": "/etc/keystone/keystone-api-uwsgi.ini", + "source": "{{ container_config_directory }}/{{ keystone_policy_file }}", + "dest": "/etc/keystone/{{ keystone_policy_file }}", "owner": "keystone", "perm": "0600" }{% endif %}{% if keystone_enable_tls_backend | bool %}, @@ -58,28 +50,7 @@ "dest": "/etc/keystone/certs/keystone-key.pem", "owner": "keystone", "perm": "0600" - }{% endif %}{% if keystone_enable_federation_openid | bool and keystone_wsgi_provider == 'apache' %}, - { - "source": "{{ container_config_directory }}/federation/oidc/metadata", - "dest": "{{ keystone_container_federation_oidc_metadata_folder }}", - "owner": "{{ apache_user }}:{{ apache_user }}", - "perm": "0600", - "merge": true - }, - { - "source": "{{ container_config_directory }}/federation/oidc/cert", - "dest": "{{ keystone_container_federation_oidc_idp_certificate_folder }}", - "owner": "{{ apache_user }}:{{ apache_user }}", - "perm": "0600", - "merge": true - }, - { - "source": "{{ container_config_directory }}/federation/modoidc-error-page.html", - "dest": "/var/www/html/modoidc-error-page.html", - "owner": "{{ apache_user }}:{{ apache_user }}", - "perm": "0600" - } - {% endif %}{% if kolla_copy_ca_into_containers | bool %}, + }{% endif %}{% if kolla_copy_ca_into_containers | bool %}, { "source": "{{ container_config_directory }}/ca-certificates", "dest": "/var/lib/kolla/share/ca-certificates", @@ -95,17 +66,7 @@ { "path": "/var/log/kolla/keystone/keystone.log", "owner": "keystone:keystone" - },{% if keystone_enable_federation_openid | bool and keystone_wsgi_provider == 'apache' %} - { - "path": "{{ keystone_container_federation_oidc_metadata_folder }}", - "owner": "{{ apache_user }}:{{ apache_user }}", - "perm": "0700" }, - { - "path": "{{ keystone_container_federation_oidc_idp_certificate_folder }}", - "owner": "{{ apache_user }}:{{ apache_user }}", - "perm": "0700" - },{% endif %} { "path": "/etc/keystone/fernet-keys", "owner": "keystone:keystone", diff --git a/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 b/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 deleted file mode 100644 index 13f9f56c5..000000000 --- a/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 +++ /dev/null @@ -1,121 +0,0 @@ -{% set keystone_log_dir = '/var/log/kolla/keystone' %} -{% set binary_path = '/var/lib/kolla/venv/bin' %} -{% if keystone_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} -LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} -LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} -{% endif %} -Listen {{ api_interface_address | put_address_in_context('url') }}:{{ keystone_public_listen_port }} - -ServerSignature Off -ServerTokens Prod -TraceEnable off -TimeOut {{ kolla_httpd_timeout }} -KeepAliveTimeout {{ kolla_httpd_keep_alive }} - -ErrorLog "{{ keystone_log_dir }}/apache-error.log" - - CustomLog "{{ keystone_log_dir }}/apache-access.log" common - - -{% if keystone_logging_debug | bool %} -LogLevel info -{% endif %} - - - - AllowOverride None - Options None - Require all granted - - - - - -{# NOTE(darmach): with external tls enabled OIDC redirection fails, as TLS terminated on haproxy keystone is not aware that redirection should use https. -#} -{# With missing ServerName Keystone Apache uses fqdn, with http. Adding ServerName pointing to keystone_public_url corrects this. -#} -{% if kolla_enable_tls_external | bool %} - ServerName {{ keystone_public_url }} -{% endif %} - WSGIDaemonProcess keystone-public processes={{ keystone_api_workers }} threads=1 user=keystone group=keystone display-name=keystone-public - WSGIProcessGroup keystone-public - WSGIScriptAlias / {{ binary_path }}/keystone-wsgi-public - WSGIApplicationGroup %{GLOBAL} - WSGIPassAuthorization On - ErrorLogFormat "%{cu}t %M" - ErrorLog "{{ keystone_log_dir }}/keystone-apache-public-error.log" - LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat - CustomLog "{{ keystone_log_dir }}/keystone-apache-public-access.log" logformat - -{% if keystone_enable_tls_backend | bool %} - SSLEngine on - SSLCertificateFile /etc/keystone/certs/keystone-cert.pem - SSLCertificateKeyFile /etc/keystone/certs/keystone-key.pem -{% endif %} - -{% if keystone_enable_federation_openid | bool %} -{% if keystone_federation_oidc_forwarded_headers | length > 0 %} - OIDCXForwardedHeaders "{{ keystone_federation_oidc_forwarded_headers }}" -{% endif %} - OIDCClaimPrefix "OIDC-" - OIDCClaimDelimiter "{{ keystone_federation_oidc_claim_delimiter }}" - OIDCResponseType "{{ keystone_federation_oidc_response_type }}" - OIDCScope "{{ keystone_federation_oidc_scopes }}" - OIDCMetadataDir {{ keystone_container_federation_oidc_metadata_folder }} -{% if keystone_federation_oidc_jwks_uri | length > 0 %} - OIDCOAuthVerifyJwksUri {{ keystone_federation_oidc_jwks_uri }} -{% endif %} -{# TODO(mnasiadka): Drop this when introducing Ubuntu 26.04 or when Noble bumps package version #} -{% if kolla_base_distro == "ubuntu" %} - OIDCHTMLErrorTemplate /var/www/html/modoidc-error-page.html -{% endif %} -{% if keystone_federation_openid_certificate_key_ids | length > 0 %} - OIDCOAuthVerifyCertFiles {{ keystone_federation_openid_certificate_key_ids | join(" ") }} -{% endif %} - OIDCCryptoPassphrase {{ keystone_federation_openid_crypto_password }} - OIDCRedirectURI {{ keystone_public_url }}/redirect_uri -{% if enable_memcached | bool and keystone_oidc_enable_memcached | bool %} - OIDCCacheType memcache - OIDCMemCacheServers "{% for host in groups['memcached'] %}{{ 'api' | kolla_address(host) | put_address_in_context('memcache') }}:{{ memcached_port }}{% if not loop.last %} {% endif %}{% endfor %}" -{% endif %} -{% for key, value in keystone_federation_oidc_additional_options.items() %} - {{ key }} {{ value }} -{% endfor %} - - - Require valid-user - AuthType openid-connect - - - {# WebSSO authentication endpoint -#} - - Require valid-user - AuthType openid-connect - - -{% for idp in keystone_identity_providers %} -{% if idp.protocol == 'openid' %} - - OIDCDiscoverURL {{ keystone_public_url }}/redirect_uri?iss={{ idp.identifier | urlencode }} - Require valid-user - AuthType openid-connect - -{% endif %} -{% endfor %} - - {# CLI / API authentication endpoint -#} -{% for idp in keystone_identity_providers %} -{% if idp.protocol == 'openid' %} - - Require valid-user - {# Note(jasonanderson): `auth-openidc` is a special auth type that can -#} - {# additionally handle verifying bearer tokens -#} - AuthType auth-openidc - -{% endif %} -{% endfor %} -{% endif %} - - diff --git a/ansible/roles/masakari/defaults/main.yml b/ansible/roles/masakari/defaults/main.yml index 12910a5b9..7c39e60d9 100644 --- a/ansible/roles/masakari/defaults/main.yml +++ b/ansible/roles/masakari/defaults/main.yml @@ -217,8 +217,3 @@ masakari_database_enable_tls_internal: "{{ database_enable_tls_internal | bool } # Copy certificates ################### masakari_copy_certs: "{{ kolla_copy_ca_into_containers | bool or masakari_database_enable_tls_internal | bool }}" - -############ -# WSGI -############ -masakari_wsgi_provider: "uwsgi" diff --git a/ansible/roles/masakari/tasks/config.yml b/ansible/roles/masakari/tasks/config.yml index 350648efb..26eb3573b 100644 --- a/ansible/roles/masakari/tasks/config.yml +++ b/ansible/roles/masakari/tasks/config.yml @@ -89,18 +89,6 @@ - masakari-instancemonitor - masakari-hostmonitor -- name: Copying over wsgi-masakari file for services - vars: - service: "{{ masakari_services['masakari-api'] }}" - ansible.builtin.template: - src: "wsgi-masakari.conf.j2" - dest: "{{ node_config_directory }}/masakari-api/wsgi-masakari.conf" - mode: "0660" - become: true - when: - - service | service_enabled_and_mapped_to_host - - masakari_wsgi_provider == "apache" - - name: "Configure uWSGI for Masakari" ansible.builtin.include_role: name: service-uwsgi-config @@ -115,7 +103,6 @@ service_uwsgi_config_workers: "{{ masakari_api_workers }}" when: - service | service_enabled_and_mapped_to_host - - masakari_wsgi_provider == "uwsgi" - name: Copying over masakari-api-paste.ini vars: diff --git a/ansible/roles/masakari/templates/masakari-api.json.j2 b/ansible/roles/masakari/templates/masakari-api.json.j2 index b0b2ca370..55d1c103d 100644 --- a/ansible/roles/masakari/templates/masakari-api.json.j2 +++ b/ansible/roles/masakari/templates/masakari-api.json.j2 @@ -1,8 +1,5 @@ -{% set apache_binary = 'apache2' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd' %} -{% set apache_conf_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %} -{% set command = ('/usr/sbin/' + apache_binary + ' -DFOREGROUND') if masakari_wsgi_provider == 'apache' else 'uwsgi /etc/masakari/masakari-api-uwsgi.ini' %} { - "command": "{{ command }}", + "command": "uwsgi /etc/masakari/masakari-api-uwsgi.ini", "config_files": [ { "source": "{{ container_config_directory }}/masakari.conf", @@ -15,19 +12,13 @@ "dest": "/etc/masakari/api-paste.ini", "owner": "masakari", "perm": "0600" - }{% if masakari_wsgi_provider == 'apache' %}, - { - "source": "{{ container_config_directory }}/wsgi-masakari.conf", - "dest": "/etc/{{ apache_conf_dir }}/wsgi-masakari.conf", - "owner": "root", - "perm": "0600" - }{% elif masakari_wsgi_provider == 'uwsgi' %}, + }, { "source": "{{ container_config_directory }}/masakari-api-uwsgi.ini", "dest": "/etc/masakari/masakari-api-uwsgi.ini", "owner": "masakari", "perm": "0600" - }{% endif %}{% if masakari_policy_file is defined %}, + }{% if masakari_policy_file is defined %}, { "source": "{{ container_config_directory }}/{{ masakari_policy_file }}", "dest": "/etc/masakari/{{ masakari_policy_file }}", diff --git a/ansible/roles/masakari/templates/wsgi-masakari.conf.j2 b/ansible/roles/masakari/templates/wsgi-masakari.conf.j2 deleted file mode 100644 index 1891dcde8..000000000 --- a/ansible/roles/masakari/templates/wsgi-masakari.conf.j2 +++ /dev/null @@ -1,37 +0,0 @@ -{% set masakari_log_dir = '/var/log/kolla/masakari' %} -{% set binary_path = '/var/lib/kolla/venv/bin' %} - -Listen {{ api_interface_address | put_address_in_context('url') }}:{{ masakari_api_port }} - -ServerSignature Off -ServerTokens Prod -TraceEnable off -TimeOut {{ kolla_httpd_timeout }} -KeepAliveTimeout {{ kolla_httpd_keep_alive }} - -ErrorLog "{{ masakari_log_dir }}/apache-error.log" - - CustomLog "{{ masakari_log_dir }}/apache-access.log" common - - -{% if masakari_logging_debug | bool %} -LogLevel info -{% endif %} - - - - Options Indexes FollowSymLinks MultiViews - Require all granted - - - - - ## Logging - ErrorLog "{{ masakari_log_dir }}/masakari_wsgi_error.log" - LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat - CustomLog "{{ masakari_log_dir }}/masakari_wsgi_access.log" logformat - WSGIApplicationGroup %{GLOBAL} - WSGIDaemonProcess masakari group=masakari processes={{ masakari_api_workers }} threads=1 user=masakari - WSGIProcessGroup masakari - WSGIScriptAlias / "{{ binary_path }}/masakari-wsgi" - diff --git a/ansible/roles/nova/defaults/main.yml b/ansible/roles/nova/defaults/main.yml index faf44558a..215826cdd 100644 --- a/ansible/roles/nova/defaults/main.yml +++ b/ansible/roles/nova/defaults/main.yml @@ -312,8 +312,3 @@ nova_source_version: "{{ kolla_source_version }}" nova_enable_tls_backend: "{{ kolla_enable_tls_backend }}" nova_copy_certs: "{{ kolla_copy_ca_into_containers | bool or nova_enable_tls_backend | bool or nova_database_enable_tls_internal | bool }}" nova_database_enable_tls_internal: "{{ database_enable_tls_internal | bool }}" - -#################### -# WSGI -#################### -nova_wsgi_provider: "uwsgi" diff --git a/ansible/roles/nova/tasks/config.yml b/ansible/roles/nova/tasks/config.yml index 320563a6b..b2ce4591f 100644 --- a/ansible/roles/nova/tasks/config.yml +++ b/ansible/roles/nova/tasks/config.yml @@ -80,30 +80,6 @@ - item.key in nova_services_require_policy_json with_dict: "{{ nova_services | select_services_enabled_and_mapped_to_host }}" -- name: Copying over nova-api-wsgi.conf - vars: - service: "{{ nova_services['nova-api'] }}" - ansible.builtin.template: - src: "nova-api-wsgi.conf.j2" - dest: "{{ node_config_directory }}/nova-api/nova-api-wsgi.conf" - mode: "0660" - become: true - when: - - service | service_enabled_and_mapped_to_host - - nova_wsgi_provider == "apache" - -- name: Copying over nova-metadata-wsgi.conf - vars: - service: "{{ nova_services['nova-metadata'] }}" - ansible.builtin.template: - src: "nova-metadata-wsgi.conf.j2" - dest: "{{ node_config_directory }}/nova-metadata/nova-metadata-wsgi.conf" - mode: "0660" - become: true - when: - - service | service_enabled_and_mapped_to_host - - nova_wsgi_provider == "apache" - - name: Copying over vendordata file for nova services vars: service: "{{ nova_services[item] }}" @@ -136,7 +112,6 @@ service_uwsgi_config_workers: "{{ item.workers }}" when: - service | service_enabled_and_mapped_to_host - - nova_wsgi_provider == "uwsgi" loop: - { name: "nova-api", port: "{{ nova_api_listen_port }}", workers: "{{ nova_api_workers }}" } - { name: "nova-metadata", port: "{{ nova_metadata_listen_port }}", workers: "{{ nova_metadata_api_workers }}" } diff --git a/ansible/roles/nova/templates/nova-api-wsgi.conf.j2 b/ansible/roles/nova/templates/nova-api-wsgi.conf.j2 deleted file mode 100644 index 79f6956fd..000000000 --- a/ansible/roles/nova/templates/nova-api-wsgi.conf.j2 +++ /dev/null @@ -1,49 +0,0 @@ -{% set nova_log_dir = '/var/log/kolla/nova' %} -{% set wsgi_directory = '/var/lib/kolla/venv/bin' %} -{% if nova_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} -LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} -LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} -{% endif %} -Listen {{ api_interface_address | put_address_in_context('url') }}:{{ nova_api_listen_port }} - -ServerSignature Off -ServerTokens Prod -TraceEnable off -TimeOut {{ kolla_httpd_timeout }} -KeepAliveTimeout {{ kolla_httpd_keep_alive }} - - - - Options None - Require all granted - - - -ErrorLog "{{ nova_log_dir }}/apache-error.log" - -CustomLog "{{ nova_log_dir }}/apache-access.log" common - - -{% if nova_logging_debug | bool %} -LogLevel info -{% endif %} - - - WSGIDaemonProcess nova-api processes={{ nova_api_workers }} threads=1 user=nova group=nova display-name=nova-api - WSGIProcessGroup nova-api - WSGIScriptAlias / {{ wsgi_directory }}/nova-api-wsgi - WSGIApplicationGroup %{GLOBAL} - WSGIPassAuthorization On - ErrorLogFormat "%{cu}t %M" - ErrorLog "{{ nova_log_dir }}/nova-api-error.log" - LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat - CustomLog "{{ nova_log_dir }}/nova-api-access.log" logformat -{% if nova_enable_tls_backend | bool %} - SSLEngine on - SSLCertificateFile /etc/nova/certs/nova-cert.pem - SSLCertificateKeyFile /etc/nova/certs/nova-key.pem -{% endif %} - diff --git a/ansible/roles/nova/templates/nova-api.json.j2 b/ansible/roles/nova/templates/nova-api.json.j2 index af6bc96b9..71947010e 100644 --- a/ansible/roles/nova/templates/nova-api.json.j2 +++ b/ansible/roles/nova/templates/nova-api.json.j2 @@ -1,27 +1,18 @@ -{% set apache_binary = 'apache2' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd' %} -{% set apache_conf_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %} -{% set command = '/usr/sbin/' + apache_binary + ' -DFOREGROUND' if nova_wsgi_provider == 'apache' else 'uwsgi /etc/nova/nova-api-uwsgi.ini' %} { - "command": "{{ command }}", + "command": "uwsgi /etc/nova/nova-api-uwsgi.ini", "config_files": [ { "source": "{{ container_config_directory }}/nova.conf", "dest": "/etc/nova/nova.conf", "owner": "nova", "perm": "0600" - }{% if nova_wsgi_provider == 'apache' %}, - { - "source": "{{ container_config_directory }}/nova-api-wsgi.conf", - "dest": "/etc/{{ apache_conf_dir }}/nova-api-wsgi.conf", - "owner": "nova", - "perm": "0600" - }{% elif nova_wsgi_provider == 'uwsgi' %}, + }, { "source": "{{ container_config_directory }}/nova-api-uwsgi.ini", "dest": "/etc/nova/nova-api-uwsgi.ini", "owner": "nova", "perm": "0600" - }{% endif %}{% if nova_policy_file is defined %}, + }{% if nova_policy_file is defined %}, { "source": "{{ container_config_directory }}/{{ nova_policy_file }}", "dest": "/etc/nova/{{ nova_policy_file }}", diff --git a/ansible/roles/nova/templates/nova-metadata-wsgi.conf.j2 b/ansible/roles/nova/templates/nova-metadata-wsgi.conf.j2 deleted file mode 100644 index 471baac84..000000000 --- a/ansible/roles/nova/templates/nova-metadata-wsgi.conf.j2 +++ /dev/null @@ -1,49 +0,0 @@ -{% set nova_log_dir = '/var/log/kolla/nova' %} -{% set wsgi_directory = '/var/lib/kolla/venv/bin' %} -{% if nova_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} -LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} -LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} -{% endif %} -Listen {{ api_interface_address | put_address_in_context('url') }}:{{ nova_metadata_listen_port }} - -ServerSignature Off -ServerTokens Prod -TraceEnable off -TimeOut {{ kolla_httpd_timeout }} -KeepAliveTimeout {{ kolla_httpd_keep_alive }} - - - - Options None - Require all granted - - - -ErrorLog "{{ nova_log_dir }}/apache-error.log" - -CustomLog "{{ nova_log_dir }}/apache-access.log" common - - -{% if nova_logging_debug | bool %} -LogLevel info -{% endif %} - - - WSGIDaemonProcess nova-metadata processes={{ nova_metadata_api_workers }} threads=1 user=nova group=nova display-name=nova-metadata-api - WSGIProcessGroup nova-metadata - WSGIScriptAlias / {{ wsgi_directory }}/nova-metadata-wsgi - WSGIApplicationGroup %{GLOBAL} - WSGIPassAuthorization On - ErrorLogFormat "%{cu}t %M" - ErrorLog "{{ nova_log_dir }}/nova-metadata-error.log" - LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat - CustomLog "{{ nova_log_dir }}/nova-metadata-access.log" logformat -{% if nova_enable_tls_backend | bool %} - SSLEngine on - SSLCertificateFile /etc/nova/certs/nova-cert.pem - SSLCertificateKeyFile /etc/nova/certs/nova-key.pem -{% endif %} - diff --git a/ansible/roles/nova/templates/nova-metadata.json.j2 b/ansible/roles/nova/templates/nova-metadata.json.j2 index f33a6f96f..0bbfa920e 100644 --- a/ansible/roles/nova/templates/nova-metadata.json.j2 +++ b/ansible/roles/nova/templates/nova-metadata.json.j2 @@ -1,27 +1,18 @@ -{% set apache_binary = 'apache2' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd' %} -{% set apache_conf_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %} -{% set command = '/usr/sbin/' + apache_binary + ' -DFOREGROUND' if nova_wsgi_provider == 'apache' else 'uwsgi /etc/nova/nova-metadata-uwsgi.ini' %} { - "command": "{{ command }}", + "command": "uwsgi /etc/nova/nova-metadata-uwsgi.ini", "config_files": [ { "source": "{{ container_config_directory }}/nova.conf", "dest": "/etc/nova/nova.conf", "owner": "nova", "perm": "0600" - }{% if nova_wsgi_provider == 'apache' %}, - { - "source": "{{ container_config_directory }}/nova-metadata-wsgi.conf", - "dest": "/etc/{{ apache_conf_dir }}/nova-api-wsgi.conf", - "owner": "nova", - "perm": "0600" - }{% elif nova_wsgi_provider == 'uwsgi' %}, + }, { "source": "{{ container_config_directory }}/nova-metadata-uwsgi.ini", "dest": "/etc/nova/nova-metadata-uwsgi.ini", "owner": "nova", "perm": "0600" - }{% endif %}{% if nova_policy_file is defined %}, + }{% if nova_policy_file is defined %}, { "source": "{{ container_config_directory }}/{{ nova_policy_file }}", "dest": "/etc/nova/{{ nova_policy_file }}", diff --git a/ansible/roles/octavia/defaults/main.yml b/ansible/roles/octavia/defaults/main.yml index 4e53dac61..1909af8cf 100644 --- a/ansible/roles/octavia/defaults/main.yml +++ b/ansible/roles/octavia/defaults/main.yml @@ -405,8 +405,3 @@ octavia_database_enable_tls_internal: "{{ database_enable_tls_internal | bool }} # Copy certificates ################### octavia_copy_certs: "{{ kolla_copy_ca_into_containers | bool or octavia_enable_tls_backend | bool or octavia_database_enable_tls_internal | bool }}" - -############ -# WSGI -############ -octavia_wsgi_provider: "uwsgi" diff --git a/ansible/roles/octavia/tasks/config.yml b/ansible/roles/octavia/tasks/config.yml index aed1f7c4c..709b4c02e 100644 --- a/ansible/roles/octavia/tasks/config.yml +++ b/ansible/roles/octavia/tasks/config.yml @@ -55,22 +55,6 @@ become: true with_dict: "{{ octavia_services | select_services_enabled_and_mapped_to_host }}" -- name: Copying over octavia-wsgi.conf - vars: - service: "{{ octavia_services['octavia-api'] }}" - become: true - ansible.builtin.template: - src: "{{ item }}" - dest: "{{ node_config_directory }}/octavia-api/octavia-wsgi.conf" - mode: "0660" - with_first_found: - - "{{ node_custom_config }}/octavia/{{ inventory_hostname }}/octavia-wsgi.conf" - - "{{ node_custom_config }}/octavia/octavia-wsgi.conf" - - "octavia-wsgi.conf.j2" - when: - - service | service_enabled_and_mapped_to_host - - octavia_wsgi_provider == "apache" - - name: "Configure uWSGI for Octavia" ansible.builtin.include_role: name: service-uwsgi-config @@ -88,7 +72,6 @@ service_uwsgi_config_workers: "{{ octavia_api_workers }}" when: - service | service_enabled_and_mapped_to_host - - octavia_wsgi_provider == "uwsgi" - name: Copying over octavia.conf vars: diff --git a/ansible/roles/octavia/templates/octavia-api.json.j2 b/ansible/roles/octavia/templates/octavia-api.json.j2 index f9b3ebfc5..7304e9150 100644 --- a/ansible/roles/octavia/templates/octavia-api.json.j2 +++ b/ansible/roles/octavia/templates/octavia-api.json.j2 @@ -1,27 +1,18 @@ -{% set apache_binary = 'apache2' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd' %} -{% set apache_conf_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %} -{% set command = ( '/usr/sbin/' + apache_binary + ' -DFOREGROUND' ) if octavia_wsgi_provider == 'apache' else 'uwsgi /etc/octavia/octavia-api-uwsgi.ini' %} { - "command": "{{ command }}", + "command": "uwsgi /etc/octavia/octavia-api-uwsgi.ini", "config_files": [ { "source": "{{ container_config_directory }}/octavia.conf", "dest": "/etc/octavia/octavia.conf", "owner": "octavia", "perm": "0600" - }{% if octavia_wsgi_provider == "apache" %}, - { - "source": "{{ container_config_directory }}/octavia-wsgi.conf", - "dest": "/etc/{{ apache_conf_dir }}/octavia-wsgi.conf", - "owner": "octavia", - "perm": "0600" - }{% elif octavia_wsgi_provider == "uwsgi" %}, + }, { "source": "{{ container_config_directory }}/octavia-api-uwsgi.ini", "dest": "/etc/octavia/octavia-api-uwsgi.ini", "owner": "octavia", "perm": "0600" - }{% endif %}{% if octavia_policy_file is defined %}, + }{% if octavia_policy_file is defined %}, { "source": "{{ container_config_directory }}/{{ octavia_policy_file }}", "dest": "/etc/octavia/{{ octavia_policy_file }}", diff --git a/ansible/roles/octavia/templates/octavia-wsgi.conf.j2 b/ansible/roles/octavia/templates/octavia-wsgi.conf.j2 deleted file mode 100644 index d7fa10ac3..000000000 --- a/ansible/roles/octavia/templates/octavia-wsgi.conf.j2 +++ /dev/null @@ -1,41 +0,0 @@ -{% set wsgi_directory = '/var/lib/kolla/venv/bin' %} -{% if octavia_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} -LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} -LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} -{% endif %} -Listen {{ api_interface_address | put_address_in_context('url') }}:{{ octavia_api_listen_port }} - -ServerSignature Off -ServerTokens Prod -TraceEnable off -TimeOut {{ kolla_httpd_timeout }} -KeepAliveTimeout {{ kolla_httpd_keep_alive }} - -{% if octavia_logging_debug | bool %} -LogLevel info -{% endif %} - - - WSGIDaemonProcess octavia-api processes={{ octavia_api_workers }} threads=1 user=octavia group=octavia display-name=octavia-api - WSGIProcessGroup octavia-api - WSGIScriptAlias / {{ wsgi_directory }}/octavia-wsgi - WSGIApplicationGroup %{GLOBAL} - WSGIPassAuthorization On - ErrorLogFormat "%{cu}t %M" - ErrorLog /var/log/kolla/octavia/octavia-api-error.log - LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat - CustomLog /var/log/kolla/octavia/octavia-api-access.log logformat - - - Require all granted - - -{% if octavia_enable_tls_backend | bool %} - SSLEngine On - SSLCertificateFile /etc/octavia/certs/octavia-cert.pem - SSLCertificateKeyFile /etc/octavia/certs/octavia-key.pem -{% endif %} - diff --git a/ansible/roles/placement/defaults/main.yml b/ansible/roles/placement/defaults/main.yml index f70c496b9..e40aa86a4 100644 --- a/ansible/roles/placement/defaults/main.yml +++ b/ansible/roles/placement/defaults/main.yml @@ -162,8 +162,3 @@ placement_database_enable_tls_internal: "{{ database_enable_tls_internal | bool # Copy certificates ################### placement_copy_certs: "{{ kolla_copy_ca_into_containers | bool or placement_enable_tls_backend | bool or placement_database_enable_tls_internal | bool }}" - -#################### -# WSGI -#################### -placement_wsgi_provider: "uwsgi" diff --git a/ansible/roles/placement/tasks/config.yml b/ansible/roles/placement/tasks/config.yml index 4e7252ab8..da9ae4136 100644 --- a/ansible/roles/placement/tasks/config.yml +++ b/ansible/roles/placement/tasks/config.yml @@ -56,24 +56,6 @@ mode: "0660" with_dict: "{{ placement_services | select_services_enabled_and_mapped_to_host }}" -- name: Copying over placement-api wsgi configuration - become: true - vars: - service: "{{ placement_services['placement-api'] }}" - ansible.builtin.template: - src: "{{ item }}" - dest: "{{ node_config_directory }}/placement-api/placement-api-wsgi.conf" - mode: "0660" - when: - - service | service_enabled_and_mapped_to_host - - placement_wsgi_provider == "apache" - with_first_found: - - "{{ node_custom_config }}/placement/{{ inventory_hostname }}/placement-api-wsgi.conf" - - "{{ node_custom_config }}/placement/placement-api-wsgi.conf" - - "placement-api-wsgi.conf.j2" - notify: - - "Restart placement-api container" - - name: "Configure uWSGI for Placement" ansible.builtin.include_role: name: service-uwsgi-config @@ -90,7 +72,6 @@ service_uwsgi_config_workers: "{{ placement_api_workers }}" when: - service | service_enabled_and_mapped_to_host - - placement_wsgi_provider == "uwsgi" - name: Copying over migrate-db.rc.j2 configuration become: true diff --git a/ansible/roles/placement/templates/placement-api-wsgi.conf.j2 b/ansible/roles/placement/templates/placement-api-wsgi.conf.j2 deleted file mode 100644 index 19925bae5..000000000 --- a/ansible/roles/placement/templates/placement-api-wsgi.conf.j2 +++ /dev/null @@ -1,42 +0,0 @@ -{% set log_dir = '/var/log/kolla/placement' %} -{% set wsgi_directory = '/var/lib/kolla/venv/bin' %} -{% if placement_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} -LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} -LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} -{% endif %} -Listen {{ api_interface_address | put_address_in_context('url') }}:{{ placement_api_listen_port }} - -ServerSignature Off -ServerTokens Prod -TraceEnable off -TimeOut {{ kolla_httpd_timeout }} -KeepAliveTimeout {{ kolla_httpd_keep_alive }} - -{% if placement_logging_debug | bool %} -LogLevel info -{% endif %} - - - WSGIDaemonProcess placement-api processes={{ placement_api_workers }} threads=1 user=placement group=placement display-name=placement-api - WSGIProcessGroup placement-api - WSGIScriptAlias / {{ wsgi_directory }}/placement-api - WSGIApplicationGroup %{GLOBAL} - WSGIPassAuthorization On - ErrorLogFormat "%{cu}t %M" - ErrorLog "{{ log_dir }}/placement-api-error.log" - LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat - CustomLog "{{ log_dir }}/placement-api-access.log" logformat - - - Require all granted - - -{% if placement_enable_tls_backend | bool %} - SSLEngine on - SSLCertificateFile /etc/placement/certs/placement-cert.pem - SSLCertificateKeyFile /etc/placement/certs/placement-key.pem -{% endif %} - diff --git a/ansible/roles/placement/templates/placement-api.json.j2 b/ansible/roles/placement/templates/placement-api.json.j2 index 29409eac3..9333e1459 100644 --- a/ansible/roles/placement/templates/placement-api.json.j2 +++ b/ansible/roles/placement/templates/placement-api.json.j2 @@ -1,30 +1,21 @@ -{% set apache_binary = 'apache2' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd' %} -{% set apache_conf_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %} -{% set command = '/usr/sbin/' + apache_binary + ' -DFOREGROUND' if placement_wsgi_provider == 'apache' else 'uwsgi /etc/placement/placement-api-uwsgi.ini' %} { - "command": "{{ command }}", + "command": "uwsgi /etc/placement/placement-api-uwsgi.ini", "config_files": [ { "source": "{{ container_config_directory }}/placement.conf", "dest": "/etc/placement/placement.conf", "owner": "placement", "perm": "0600" - }{% if placement_policy_file is defined %}, - { - "source": "{{ container_config_directory }}/{{ placement_policy_file }}", - "dest": "/etc/placement/{{ placement_policy_file }}", - "owner": "placement", - "perm": "0600" - }{% endif %}{% if placement_wsgi_provider == 'apache' %}, + }, { - "source": "{{ container_config_directory }}/placement-api-wsgi.conf", - "dest": "/etc/{{ apache_conf_dir }}/00-placement-api.conf", + "source": "{{ container_config_directory }}/placement-api-uwsgi.ini", + "dest": "/etc/placement/placement-api-uwsgi.ini", "owner": "placement", "perm": "0600" - }{% elif placement_wsgi_provider == 'uwsgi' %}, + }{% if placement_policy_file is defined %}, { - "source": "{{ container_config_directory }}/placement-api-uwsgi.ini", - "dest": "/etc/placement/placement-api-uwsgi.ini", + "source": "{{ container_config_directory }}/{{ placement_policy_file }}", + "dest": "/etc/placement/{{ placement_policy_file }}", "owner": "placement", "perm": "0600" }{% endif %}, diff --git a/ansible/roles/trove/defaults/main.yml b/ansible/roles/trove/defaults/main.yml index 8dd251d4e..5b481fad6 100644 --- a/ansible/roles/trove/defaults/main.yml +++ b/ansible/roles/trove/defaults/main.yml @@ -230,8 +230,3 @@ trove_database_enable_tls_internal: "{{ database_enable_tls_internal | bool }}" # Copy certificates ################### trove_copy_certs: "{{ kolla_copy_ca_into_containers | bool or trove_enable_tls_backend | bool or trove_database_enable_tls_internal | bool }}" - -####### -# WSGI -####### -trove_wsgi_provider: "uwsgi" diff --git a/ansible/roles/trove/tasks/config.yml b/ansible/roles/trove/tasks/config.yml index bd964c108..0952c6c94 100644 --- a/ansible/roles/trove/tasks/config.yml +++ b/ansible/roles/trove/tasks/config.yml @@ -55,23 +55,6 @@ service_uwsgi_config_workers: "{{ trove_api_workers }}" when: - service | service_enabled_and_mapped_to_host - - trove_wsgi_provider == "uwsgi" - -- name: Copying over trove-wsgi.conf - vars: - service: "{{ trove_services['trove-api'] }}" - become: true - ansible.builtin.template: - src: "{{ item }}" - dest: "{{ node_config_directory }}/trove-api/trove-wsgi.conf" - mode: "0660" - with_first_found: - - "{{ node_custom_config }}/trove/{{ inventory_hostname }}/trove-wsgi.conf" - - "{{ node_custom_config }}/trove/trove-wsgi.conf" - - "trove-wsgi.conf.j2" - when: - - trove_wsgi_provider == "apache" - - service | service_enabled_and_mapped_to_host - name: Copying over trove-guestagent.conf vars: diff --git a/ansible/roles/trove/templates/trove-api.json.j2 b/ansible/roles/trove/templates/trove-api.json.j2 index f487e3127..a44c927de 100644 --- a/ansible/roles/trove/templates/trove-api.json.j2 +++ b/ansible/roles/trove/templates/trove-api.json.j2 @@ -1,27 +1,18 @@ -{% set apache_binary = 'apache2' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd' %} -{% set apache_conf_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %} -{% set command = ('/usr/sbin/' + apache_binary + ' -DFOREGROUND') if trove_wsgi_provider == 'apache' else 'uwsgi /etc/trove/trove-api-uwsgi.ini' %} { - "command": "{{ command }}", + "command": "uwsgi /etc/trove/trove-api-uwsgi.ini", "config_files": [ { "source": "{{ container_config_directory }}/trove.conf", "dest": "/etc/trove/trove.conf", "owner": "trove", "perm": "0600" - }{% if trove_wsgi_provider == "apache" %}, - { - "source": "{{ container_config_directory }}/trove-wsgi.conf", - "dest": "/etc/{{ apache_conf_dir }}/trove-wsgi.conf", - "owner": "trove", - "perm": "0600" - }{% elif trove_wsgi_provider == "uwsgi" %}, + }, { "source": "{{ container_config_directory }}/trove-api-uwsgi.ini", "dest": "/etc/trove/trove-api-uwsgi.ini", "owner": "trove", "perm": "0600" - }{% endif %}{% if trove_policy_file is defined %}, + }{% if trove_policy_file is defined %}, { "source": "{{ container_config_directory }}/{{ trove_policy_file }}", "dest": "/etc/trove/{{ trove_policy_file }}", diff --git a/ansible/roles/trove/templates/trove-wsgi.conf.j2 b/ansible/roles/trove/templates/trove-wsgi.conf.j2 deleted file mode 100644 index f623704bb..000000000 --- a/ansible/roles/trove/templates/trove-wsgi.conf.j2 +++ /dev/null @@ -1,41 +0,0 @@ -{% set wsgi_directory = '/var/lib/kolla/venv/bin' %} -{% if trove_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos'] %} -LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} -LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} -{% endif %} -Listen {{ api_interface_address | put_address_in_context('url') }}:{{ trove_api_listen_port }} - -ServerSignature Off -ServerTokens Prod -TraceEnable off -TimeOut {{ kolla_httpd_timeout }} -KeepAliveTimeout {{ kolla_httpd_keep_alive }} - -{% if trove_logging_debug | bool %} -LogLevel info -{% endif %} - - - WSGIDaemonProcess trove-api processes={{ trove_api_workers }} threads=1 user=trove group=trove display-name=trove-api - WSGIProcessGroup trove-api - WSGIScriptAlias / {{ wsgi_directory }}/trove-wsgi - WSGIApplicationGroup %{GLOBAL} - WSGIPassAuthorization On - ErrorLogFormat "%{cu}t %M" - ErrorLog /var/log/kolla/trove/trove-api-error.log - LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat - CustomLog /var/log/kolla/trove/trove-api-access.log logformat - - - Require all granted - - -{% if trove_enable_tls_backend | bool %} - SSLEngine On - SSLCertificateFile /etc/trove/certs/trove-cert.pem - SSLCertificateKeyFile /etc/trove/certs/trove-key.pem -{% endif %} - diff --git a/ansible/roles/zun/defaults/main.yml b/ansible/roles/zun/defaults/main.yml index 01a577f20..69fce72c2 100644 --- a/ansible/roles/zun/defaults/main.yml +++ b/ansible/roles/zun/defaults/main.yml @@ -263,8 +263,3 @@ zun_database_enable_tls_internal: "{{ database_enable_tls_internal | bool }}" # Copy certificates ################### zun_copy_certs: "{{ kolla_copy_ca_into_containers | bool or zun_database_enable_tls_internal | bool }}" - -####### -# WSGI -####### -zun_wsgi_provider: "uwsgi" diff --git a/ansible/roles/zun/tasks/config.yml b/ansible/roles/zun/tasks/config.yml index 60df39a4b..1f5014812 100644 --- a/ansible/roles/zun/tasks/config.yml +++ b/ansible/roles/zun/tasks/config.yml @@ -76,19 +76,6 @@ service_uwsgi_config_workers: "{{ zun_api_workers }}" when: - service | service_enabled_and_mapped_to_host - - zun_wsgi_provider == "uwsgi" - -- name: Copying over wsgi-zun files for services - vars: - service: "{{ zun_services['zun-api'] }}" - ansible.builtin.template: - src: "wsgi-zun.conf.j2" - dest: "{{ node_config_directory }}/zun-api/wsgi-zun.conf" - mode: "0660" - become: true - when: - - zun_wsgi_provider == "apache" - - service | service_enabled_and_mapped_to_host - name: Copying over existing policy file ansible.builtin.template: diff --git a/ansible/roles/zun/templates/wsgi-zun.conf.j2 b/ansible/roles/zun/templates/wsgi-zun.conf.j2 deleted file mode 100644 index 725b95597..000000000 --- a/ansible/roles/zun/templates/wsgi-zun.conf.j2 +++ /dev/null @@ -1,41 +0,0 @@ -{% set zun_log_dir = '/var/log/kolla/zun' %} -Listen {{ api_interface_address | put_address_in_context('url') }}:{{ zun_api_port }} - -ServerSignature Off -ServerTokens Prod -TraceEnable off -TimeOut {{ kolla_httpd_timeout }} -KeepAliveTimeout {{ kolla_httpd_keep_alive }} - -ErrorLog "{{ zun_log_dir }}/apache-error.log" - - CustomLog "{{ zun_log_dir }}/apache-access.log" common - - -{% if zun_logging_debug | bool %} -LogLevel info -{% endif %} - - - - ## Vhost docroot - DocumentRoot "/var/www/cgi-bin/zun" - - ## Directories, there should at least be a declaration for /var/www/cgi-bin/zun - - - Options Indexes FollowSymLinks MultiViews - AllowOverride None - Require all granted - - - ## Logging - ErrorLog "{{ zun_log_dir }}/zun_api_wsgi_error.log" - ServerSignature Off - LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat - CustomLog "{{ zun_log_dir }}/zun_api_wsgi_access.log" logformat - WSGIApplicationGroup %{GLOBAL} - WSGIDaemonProcess zun group=zun processes={{ zun_api_workers }} threads=1 user=zun - WSGIProcessGroup zun - WSGIScriptAlias / "/var/www/cgi-bin/zun/app.wsgi" - diff --git a/ansible/roles/zun/templates/zun-api.json.j2 b/ansible/roles/zun/templates/zun-api.json.j2 index a1ea4c973..27198a32b 100644 --- a/ansible/roles/zun/templates/zun-api.json.j2 +++ b/ansible/roles/zun/templates/zun-api.json.j2 @@ -1,27 +1,18 @@ -{% set zun_cmd = 'apache2' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd' %} -{% set zun_dir = 'apache2/conf-enabled' if kolla_base_distro in ['ubuntu', 'debian'] else 'httpd/conf.d' %} -{% set command = ('/usr/sbin/' + apache_binary + ' -DFOREGROUND') if zun_wsgi_provider == 'apache' else 'uwsgi /etc/zun/zun-api-uwsgi.ini' %} { - "command": "{{ command }}", + "command": "uwsgi /etc/zun/zun-api-uwsgi.ini", "config_files": [ { "source": "{{ container_config_directory }}/zun.conf", "dest": "/etc/zun/zun.conf", "owner": "zun", "perm": "0600" - }{% if zun_wsgi_provider == "apache" %}, - { - "source": "{{ container_config_directory }}/wsgi-zun.conf", - "dest": "/etc/{{ zun_dir }}/wsgi-zun.conf", - "owner": "zun", - "perm": "0600" - }{% elif zun_wsgi_provider == "uwsgi" %}, + }, { "source": "{{ container_config_directory }}/zun-api-uwsgi.ini", "dest": "/etc/zun/zun-api-uwsgi.ini", "owner": "zun", "perm": "0600" - }{% endif %}{% if zun_policy_file is defined %}, + }{% if zun_policy_file is defined %}, { "source": "{{ container_config_directory }}/{{ zun_policy_file }}", "dest": "/etc/zun/{{ zun_policy_file }}", -- cgit v1.2.3