Commit Graph

2936 Commits

Author SHA1 Message Date
Zuul
28574d01cd Merge "Horizon: Expose additional security config params" 2019-07-19 15:55:14 +00:00
Zuul
4864da8207 Merge "Change cinder bootstrap script" 2019-07-19 14:12:08 +00:00
Gupta, Sangeet (sg774j)
4f5a78351d Horizon: Expose additional security config params
Expose additional Horizon security params in accordance with the
OpenStack Security Guide [0]

- ALLOWED_HOSTS
- HORIZON_IMAGES_UPLOAD_MODE

[0] https://docs.openstack.org/security-guide/dashboard/domains-dashboard-upgrades-basic-web-server-configuration.html

Depends-On: https://review.opendev.org/#/c/635545

Change-Id: I071c8fbfc5ea9b41d3c35840e342d83349ae1613
2019-07-18 10:15:56 -05:00
Zuul
dadf9946e0 Merge "Adding dependency in cinder for keystone-api" 2019-07-17 15:48:33 +00:00
Teresa Ho
7de7cf2f14 Change cinder bootstrap script
This commit changes the cinder template bootstrap script
to use the openstack client instead of the cinder client
to list volume types.

Change-Id: I5a4b22ab4475d503b3e8fa46cd3c56a0b40863e0
Signed-off-by: Teresa Ho <teresa.ho@windriver.com>
2019-07-16 09:02:36 -04:00
Zuul
5b8d18c021 Merge "Fix iptables locking in L3 neutron container" 2019-07-16 12:03:36 +00:00
Oleh Hryhorov
e0b6f6b9c9 Adding dependency in cinder for keystone-api
The patch adds dependency in cinder for create_internal_tenant job which
uses openstack client to create internal_project_name and internal_user_name
but if identity server is not ready yet the job crashes therefore cinder-volume
doesn't work as well.

Change-Id: I4386f127b834a9777093ac1d3c269937947c7bcf
2019-07-15 16:48:28 +03:00
Oleh Hryhorov
69ac8dfde8 Fixing typo in job-create-internal-tenant template
Change-Id: I61a8fd59a1d1d3056414611cb50ddd3e718539f5
2019-07-15 16:46:32 +03:00
Manuel Buil
94cd5a9935 Fix iptables locking in L3 neutron container
The L3 neutron agent uses the -W flag when adding new iptable rules.
That flag verifies if the lock is free to avoid race conditions. The
lock is normally /run/xtables.lock.

In iptables <1.6.2, if the file does not exist, iptables ignores the
lock and silently continues. Starting with 1.6.2, that behaviour changed
and if the file does not exist, iptables fails:

https://git.netfilter.org/iptables/commit/?id=80d8bfaac9e2430d710084a10ec78e68bd61e6ec

Leap 15.0 is using iptables 1.6.2 whereas Ubuntu Bionic uses 1.6.1.
That is why Ubuntu compute-kit gates where working whereas openSUSE
compute-kit gate was not

This patch fixes the gate problem by mounting /run/xtables.lock

Change-Id: Ia9c648cdf95c9824b34f40a6d9ed538a2cad5154
Signed-off-by: Manuel Buil <mbuil@suse.com>
2019-07-15 14:03:12 +02:00
Zuul
b81eda1410 Merge "Fix an error while getting Pod's nodeName when setting up VMs with vbmc" 2019-07-14 04:46:41 +00:00
Zuul
1aec9940cb Merge "[neutron] Bring in bgpvpn/bagpipe support" 2019-07-12 13:20:17 +00:00
jlego229-kim
62b12e3af5 Fix an error while getting Pod's nodeName when setting up VMs with vbmc
Currently, in the script which sets up VMs with vmbc instead of BM for ironic
practice,

There is an IF command checking if OVS_VSWITCHD pod is located in master
node or not.

To get the info about Pod's nodeName, command below has been used.

$ kubectl --namespace openstack get pod "${OVS_VSWITCHD_POD}" -o wide --no-headers | awk '{ print $NF }'

But this command sometimes cannot parse Pod's nodeName correctly becuase
new headers such as "NOMINATED NODE" and "READINESS GATE" are printed in the end "-o wide" option.
(in some version of k8s)

To avoid this problem and give more readability,
I suggest changing commands to use "-o json" option.

Change-Id: Ib81ae505ac8d04dae9af6326880e1fa17664ac0b
2019-07-12 14:13:15 +09:00
Zuul
48dcc644f7 Merge "Remove service specific periodic jobs that add no value" 2019-07-11 18:54:56 +00:00
Zuul
565060c01a Merge "Aodh and Panko: Add TLS support for public endpoints" 2019-07-11 14:11:57 +00:00
Steve Wilkerson
f9b1643409 Remove service specific periodic jobs that add no value
This removes the service specific job definitions that currently
run periodically, as they add no value (as they're currently part
of the compute kit jobs).  This helps ensure we have a workable
history of our multinode periodic jobs, as the current number of
periodic jobs limits us to ~2 days of history with no added value

Change-Id: Id525ca4895de2673bed2b638b816834bcf34e131
Signed-off-by: Steve Wilkerson <sw5822@att.com>
2019-07-11 08:04:28 -05:00
Zuul
938f4a4a3a Merge "Ironic: Add pxe boot support for centos image" 2019-07-11 06:11:25 +00:00
Angie Wang
9c2f6fadb4 Aodh and Panko: Add TLS support for public endpoints
This commit adds the capability for Aodh, Panko charts to
support TLS on overriden fqdn for public endpoints.

Change-Id: Ia1350f65872b0eddda8ecc83ffea1dd215b3b6db
Signed-off-by: Angie Wang <angie.wang@windriver.com>
2019-07-10 12:25:49 -04:00
Zuul
4e8f25b115 Merge "Make Helm test timeouts configurable in multinode" 2019-07-10 14:09:31 +00:00
Michael Polenchuk
0e01e058a1 [neutron] Bring in bgpvpn/bagpipe support
BGP-MPLS VPN extension allows attachment of Neutron networks and/or
routers to VPNs built in carrier provided WANs using these standard
protocols.

Change-Id: Ib0ec8cb22e9c113d4be1c992d895b565db5e30b0
2019-07-10 16:23:01 +04:00
Abel Navarro
fb1c491d50 Make Helm test timeouts configurable in multinode
On some deployments the tests run on Neutron for multinode deployments
exceed the current 15 minutes timeout. The timeout is now configurable
through the OSH_TEST_TIMEOUT variable which can be passed from the yaml
file. The default timeout remains 15 minutes.

Change-Id: Ic5a1e9fd812e51ed51aef4de162b1c08d1c9a593
Signed-off-by: Abel Navarro <abel.navarro@gmail.com>
2019-07-10 11:37:53 +02:00
Zuul
ac3952a720 Merge "Add docker-default (enforce) AppArmor profile to barbican" 2019-07-10 09:34:18 +00:00
Zuul
a96189ee2e Merge "Using HTK for cinder security policies" 2019-07-10 09:34:16 +00:00
Mingyuan Qi
5f37a88a14 Ironic: Add pxe boot support for centos image
Current pxe init script does not support pxe for centos distro as
base image. Different folders were checked for centos to copy
pxe/ipxe files to tftpboot folder.

Change-Id: I4911825193d75aaaed24e8b71ba43efa2fc78fe8
Signed-off-by: Mingyuan Qi <mingyuan.qi@intel.com>
2019-07-10 15:23:28 +08:00
Pete Birley
4d9c91cc3e Neutron: fix security context typo
This PS fixes a typo in the security context settings for neutrons
sriov agent.

Change-Id: I8cd255969b0f47d541cd5df68dbddde0b1fcf898
Signed-off-by: Pete Birley <pete@port.direct>
2019-07-09 13:32:50 +00:00
Gage Hugo
a57cd78439 Fix credential cleanup hook
The keystone-credential-cleanup hook was previously changed to
post-delete, this can cause issues where the serviceName is deleted
prior to running and will cause this to fail. This change reverts
the hook back to pre-delete to avoid this issue.

Change-Id: I45f3e73f8a957576ef82a733c1a7b7feaba7b679
2019-07-09 06:12:11 +00:00
pd2839
77dfdc99c9 Using HTK for cinder security policies
Overriding the values in values.yaml

Change-Id: Ib7cd343b4b95cae088a4fe564524448af79de785
2019-07-08 18:00:59 +00:00
Zuul
69d5c4c1e1 Merge "Nova: add service token" 2019-07-07 18:48:05 +00:00
Sphicas, Phil (ps3910)
07bc6cf5c8 Neutron: remove readiness probe from init container
Remove the readiness probe from the neutron-sriov-agent-init init
container of the neutron-sriov-agent DaemonSet, and use the probe
template for the neutron-sriov-agent container.

Change-Id: Iaa1fbca0b2d5ba1b0c15b82b6e8927c2b7be9f52
2019-07-06 21:30:34 -07:00
Zuul
07c5c79cd4 Merge "Cinder: Require cinder volume to be running before attempting bootstrap" 2019-07-05 18:55:23 +00:00
Zuul
72e9d00efd Merge "Neutron: Fix security context values keys" 2019-07-05 18:40:13 +00:00
Pete Birley
a750802331 Cinder: Require cinder volume to be running before attempting bootstrap
This PS udpates the deps on the cinder boostrap job to ensure that the
cinder volume service has started prior to attempting bootstrap.

This crtainly could be enhanced further, but is the 1st step in preventing
the liklyhood of a race.

Change-Id: Id0f958077b296750242450179b41c0a1b703b4a5
Signed-off-by: Pete Birley <pete@port.direct>
2019-07-05 11:52:53 -05:00
Zuul
96f76b4e93 Merge "[neutron] Swap arguments for default function" 2019-07-05 16:35:46 +00:00
Steve Wilkerson
363b50b336 Neutron: Fix security context values keys
This updates the values used for generating the pod and container
security contexts for the components of the neutron chart. This
moves to using a unique application key for each neutron service
instead of a single 'neutron' key that maps to every pod

This also removes the .pod.user.neutron.uid key in favor of using
the user key in the security_context values tree

Change-Id: I1c87a5b4b74e2a2d17b8913dd34f40dc1c38fbe0
Signed-off-by: Steve Wilkerson <sw5822@att.com>
2019-07-05 16:15:06 +00:00
Zuul
c559c45b2a Merge "Ceph-RGW - Update chart install scripts" 2019-07-05 15:38:32 +00:00
Michael Polenchuk
c7acc26e88 [neutron] Swap arguments for default function
For reference:
http://masterminds.github.io/sprig/defaults.html

Change-Id: Ie56ef548b84c3726f36fcd6352e0f8725179bbb6
Signed-off-by: Pete Birley <pete@port.direct>
2019-07-05 10:02:13 -05:00
Renis Makadia
092d7103ab Ceph-RGW - Update chart install scripts
- As part of PS 634782, Ceph-rgw chart was updated. We need to update
Ceph chart install script as per new changes.

Change-Id: Ieede912272903ed251693879f17a821cb2a4e7bb
2019-07-04 14:15:10 +00:00
Manuel Buil
0a965cf4c7 Allow keystone pods to connect to kube-dns
When deploying keystone, two pods fail with error:

Temporary failure in name resolution

These pods are executing fernet_manage.py and fetch secrets using:
https://github.com/openstack/openstack-helm/blob/master/keystone/templates/bin/_fernet-manage.py.tpl#L60

However, the current network policy blocks the connection to kube-dns.
This patch fixes it

Change-Id: I4ae6722a5bcb350e64995fbd2e1010153b0c29e6
Signed-off-by: Manuel Buil <mbuil@suse.com>
2019-07-04 14:14:42 +00:00
Gerry Kopec
34cc0104c8 Nova: add service token
Add capability for nova to send service token.  Default to disabled.
Config setup is similar to keystone_authtoken.

Change-Id: I666f8f52fed50c61f67397b3da58133a2f9b49d3
Signed-off-by: Gerry Kopec <Gerry.Kopec@windriver.com>
2019-07-04 14:10:26 +00:00
Zuul
dc247b3856 Merge "Using htk for glance security policies" 2019-07-03 20:59:11 +00:00
Zuul
38e3237da4 Merge "[neutron] Bring in L2 gateway support" 2019-07-03 16:47:37 +00:00
Chinasubbareddy Mallavarapu
f11a51fc61 [ceph] Cleanup install scripts for duplicate variables
This is just to  remove duplicate variables from scripts.

Change-Id: I26ea5b859ab3d494bd6432039d67683ee5632759
2019-07-03 13:43:30 +00:00
Pete Birley
74e4474ec6 OpenStack: Check Stein release on Ubuntu Bionic
This PS adds checks for the Stein Release of OpenStack in Ubuntu Bionic
containers.

Depends-On: https://review.opendev.org/667726

Change-Id: Icfad3434ca496a841993b95adaf5d853728d920f
Signed-off-by: Pete Birley <pete@port.direct>
2019-07-03 00:26:30 +00:00
Pete Birley
03efee0abb Neutron: allow control of probes
This PS allows the probes in containers/pods to be tuned via values
overrides.

Depends-On: https://review.opendev.org/#/c/631597/

Change-Id: I439dce38a1b7df8c798f10f7fad406f9b0dfe3e6
Signed-off-by: Pete Birley <pete@port.direct>
2019-07-02 18:39:37 +00:00
pd2839
9d72b805d0 Using htk for glance security policies
Overriding the values in values.yaml

Change-Id: I52dd8b5513062242ad4f2c89bb4cc998dc5ef9c5
2019-07-02 13:10:52 -05:00
Hemachandra Reddy
287602fe20 Support for RabbitMQ HA
There can be more than one RabbitMQ node in
transport_url in conf file when RabbitMQ is
configured in HA mode.

Change-Id: I9721e2e33212918d402bce295c02b1869dce67f7
2019-07-02 16:10:44 +00:00
Michael Polenchuk
8c93743041 [neutron] Bring in L2 gateway support
L2 Gateway (L2GW) is an API framework that offers bridging 2+
networks together to make them look as a single broadcast domain.
A typical use case is bridging the virtual with the physical networks.

Change-Id: I95ff59ce024747f7af40c6bef0661bb3743b0af1
2019-07-01 15:25:45 +04:00
Pete Birley
fd37d61b12 Nova: Provide method for removing sections from nova compute conf
This PS provides a method to redact sectionf from the nova compute
configuration file. By default this is configured to redact the
db connection strings, and sections.

Change-Id: Ifb50b932155c166634bb8a88363f6c02fbde8389
Signed-off-by: Pete Birley <pete@port.direct>
2019-06-28 16:55:29 -05:00
Zuul
5d993140d7 Merge "[neutron] Mend rootwrap privsep indentation" 2019-06-27 16:52:56 +00:00
Zuul
fcca95f3a4 Merge "Set threads=1 for wsgi applications" 2019-06-27 12:56:31 +00:00
Michael Polenchuk
67ede00551 [neutron] Mend rootwrap privsep indentation
Change-Id: I09c8ae14947898b7e63dab9516a4899106e91cf2
2019-06-27 13:53:40 +04:00