Commit Graph

2946 Commits

Author SHA1 Message Date
Zuul
777e5994e8 Merge "Cinder support multiple Ceph volume backends" 2019-07-29 15:16:14 +00:00
Zuul
4bb6976d2c Merge "Imported Translations from Zanata" 2019-07-25 14:36:35 +00:00
Pete Birley
09616b4f3f Nova: Update Cell management to allow db updates and improve rabbit
This PS allows the db connection string for the singular cell that OSH
currently supports to be updated, and also uses the full connection
string for the transport url.

Change-Id: I700133263273e04dad5b3e69d5e1f8255323e560
Signed-off-by: Pete Birley <pete@port.direct>
2019-07-25 12:30:06 +00:00
OpenStack Proposal Bot
c5f7192b34 Imported Translations from Zanata
For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: Ia187ceea37f815a16048a1565d4d4cdb317c755e
2019-07-25 08:52:32 +00:00
Zuul
2c166a726c Merge "Nova: Update DB sync job to update transport url" 2019-07-24 22:29:55 +00:00
Pete Birley
467b81a3e4 Nova: Update DB sync job to update transport url
If the transport url changes, cell needs to be updated to use new
transport.

Change-Id: I1a931b5ce272a731be710c43f3fea08abc79af71
Signed-off-by: Pete Birley <pete@port.direct>
2019-07-24 20:49:12 +00:00
sg774j
5925b7c3cb Gate: Deploy default number of rabbit replicas
This ps updates the component check scripts to deploy
the default number of rabbit replicas in the gate

Change-Id: I996af138373476ae4a65dc2bef7e360155390a5d
2019-07-24 19:21:20 +00:00
Zuul
ffd19105f0 Merge "Fix typo" 2019-07-24 16:16:19 +00:00
Daniel Badea
11d7e1d49a Cinder support multiple Ceph volume backends
Wrap code making the assumption there is only one Ceph backend
(using is_ceph_volume_configured) in a "range" and use
ceph_backend_list helper to iterate all available Ceph backends.

Move Ceph pool application name in values.yaml from
conf.software.rbd.rbd_pool_app_name* to conf.ceph.pools.*.app_name

Change-Id: If1126e51fe9ebb85185e375dc282e83db63d934c
Depends-On: Iaa67061b05a9d355228ad7d3f5ee0f4f04dbdc66
Signed-off-by: Daniel Badea <daniel.badea@windriver.com>
2019-07-23 16:57:08 +03:00
Zuul
28574d01cd Merge "Horizon: Expose additional security config params" 2019-07-19 15:55:14 +00:00
Zuul
4864da8207 Merge "Change cinder bootstrap script" 2019-07-19 14:12:08 +00:00
Gupta, Sangeet (sg774j)
4f5a78351d Horizon: Expose additional security config params
Expose additional Horizon security params in accordance with the
OpenStack Security Guide [0]

- ALLOWED_HOSTS
- HORIZON_IMAGES_UPLOAD_MODE

[0] https://docs.openstack.org/security-guide/dashboard/domains-dashboard-upgrades-basic-web-server-configuration.html

Depends-On: https://review.opendev.org/#/c/635545

Change-Id: I071c8fbfc5ea9b41d3c35840e342d83349ae1613
2019-07-18 10:15:56 -05:00
Manuel Buil
d911d44ec9 Fix typo
The name of the variable ends with LIBVIRT although it should end with
OPENVSWITCH, as used in line 29

Change-Id: I0ec490de44969aea2cccf51d753f1ffcfa9e2511
Signed-off-by: Manuel Buil <mbuil@suse.com>
2019-07-18 11:56:16 +00:00
Zuul
dadf9946e0 Merge "Adding dependency in cinder for keystone-api" 2019-07-17 15:48:33 +00:00
Teresa Ho
7de7cf2f14 Change cinder bootstrap script
This commit changes the cinder template bootstrap script
to use the openstack client instead of the cinder client
to list volume types.

Change-Id: I5a4b22ab4475d503b3e8fa46cd3c56a0b40863e0
Signed-off-by: Teresa Ho <teresa.ho@windriver.com>
2019-07-16 09:02:36 -04:00
Zuul
5b8d18c021 Merge "Fix iptables locking in L3 neutron container" 2019-07-16 12:03:36 +00:00
Oleh Hryhorov
e0b6f6b9c9 Adding dependency in cinder for keystone-api
The patch adds dependency in cinder for create_internal_tenant job which
uses openstack client to create internal_project_name and internal_user_name
but if identity server is not ready yet the job crashes therefore cinder-volume
doesn't work as well.

Change-Id: I4386f127b834a9777093ac1d3c269937947c7bcf
2019-07-15 16:48:28 +03:00
Oleh Hryhorov
69ac8dfde8 Fixing typo in job-create-internal-tenant template
Change-Id: I61a8fd59a1d1d3056414611cb50ddd3e718539f5
2019-07-15 16:46:32 +03:00
Manuel Buil
94cd5a9935 Fix iptables locking in L3 neutron container
The L3 neutron agent uses the -W flag when adding new iptable rules.
That flag verifies if the lock is free to avoid race conditions. The
lock is normally /run/xtables.lock.

In iptables <1.6.2, if the file does not exist, iptables ignores the
lock and silently continues. Starting with 1.6.2, that behaviour changed
and if the file does not exist, iptables fails:

https://git.netfilter.org/iptables/commit/?id=80d8bfaac9e2430d710084a10ec78e68bd61e6ec

Leap 15.0 is using iptables 1.6.2 whereas Ubuntu Bionic uses 1.6.1.
That is why Ubuntu compute-kit gates where working whereas openSUSE
compute-kit gate was not

This patch fixes the gate problem by mounting /run/xtables.lock

Change-Id: Ia9c648cdf95c9824b34f40a6d9ed538a2cad5154
Signed-off-by: Manuel Buil <mbuil@suse.com>
2019-07-15 14:03:12 +02:00
Zuul
b81eda1410 Merge "Fix an error while getting Pod's nodeName when setting up VMs with vbmc" 2019-07-14 04:46:41 +00:00
Zuul
1aec9940cb Merge "[neutron] Bring in bgpvpn/bagpipe support" 2019-07-12 13:20:17 +00:00
jlego229-kim
62b12e3af5 Fix an error while getting Pod's nodeName when setting up VMs with vbmc
Currently, in the script which sets up VMs with vmbc instead of BM for ironic
practice,

There is an IF command checking if OVS_VSWITCHD pod is located in master
node or not.

To get the info about Pod's nodeName, command below has been used.

$ kubectl --namespace openstack get pod "${OVS_VSWITCHD_POD}" -o wide --no-headers | awk '{ print $NF }'

But this command sometimes cannot parse Pod's nodeName correctly becuase
new headers such as "NOMINATED NODE" and "READINESS GATE" are printed in the end "-o wide" option.
(in some version of k8s)

To avoid this problem and give more readability,
I suggest changing commands to use "-o json" option.

Change-Id: Ib81ae505ac8d04dae9af6326880e1fa17664ac0b
2019-07-12 14:13:15 +09:00
Zuul
48dcc644f7 Merge "Remove service specific periodic jobs that add no value" 2019-07-11 18:54:56 +00:00
Zuul
565060c01a Merge "Aodh and Panko: Add TLS support for public endpoints" 2019-07-11 14:11:57 +00:00
Steve Wilkerson
f9b1643409 Remove service specific periodic jobs that add no value
This removes the service specific job definitions that currently
run periodically, as they add no value (as they're currently part
of the compute kit jobs).  This helps ensure we have a workable
history of our multinode periodic jobs, as the current number of
periodic jobs limits us to ~2 days of history with no added value

Change-Id: Id525ca4895de2673bed2b638b816834bcf34e131
Signed-off-by: Steve Wilkerson <sw5822@att.com>
2019-07-11 08:04:28 -05:00
Zuul
938f4a4a3a Merge "Ironic: Add pxe boot support for centos image" 2019-07-11 06:11:25 +00:00
Angie Wang
9c2f6fadb4 Aodh and Panko: Add TLS support for public endpoints
This commit adds the capability for Aodh, Panko charts to
support TLS on overriden fqdn for public endpoints.

Change-Id: Ia1350f65872b0eddda8ecc83ffea1dd215b3b6db
Signed-off-by: Angie Wang <angie.wang@windriver.com>
2019-07-10 12:25:49 -04:00
Zuul
4e8f25b115 Merge "Make Helm test timeouts configurable in multinode" 2019-07-10 14:09:31 +00:00
Michael Polenchuk
0e01e058a1 [neutron] Bring in bgpvpn/bagpipe support
BGP-MPLS VPN extension allows attachment of Neutron networks and/or
routers to VPNs built in carrier provided WANs using these standard
protocols.

Change-Id: Ib0ec8cb22e9c113d4be1c992d895b565db5e30b0
2019-07-10 16:23:01 +04:00
Abel Navarro
fb1c491d50 Make Helm test timeouts configurable in multinode
On some deployments the tests run on Neutron for multinode deployments
exceed the current 15 minutes timeout. The timeout is now configurable
through the OSH_TEST_TIMEOUT variable which can be passed from the yaml
file. The default timeout remains 15 minutes.

Change-Id: Ic5a1e9fd812e51ed51aef4de162b1c08d1c9a593
Signed-off-by: Abel Navarro <abel.navarro@gmail.com>
2019-07-10 11:37:53 +02:00
Zuul
ac3952a720 Merge "Add docker-default (enforce) AppArmor profile to barbican" 2019-07-10 09:34:18 +00:00
Zuul
a96189ee2e Merge "Using HTK for cinder security policies" 2019-07-10 09:34:16 +00:00
Mingyuan Qi
5f37a88a14 Ironic: Add pxe boot support for centos image
Current pxe init script does not support pxe for centos distro as
base image. Different folders were checked for centos to copy
pxe/ipxe files to tftpboot folder.

Change-Id: I4911825193d75aaaed24e8b71ba43efa2fc78fe8
Signed-off-by: Mingyuan Qi <mingyuan.qi@intel.com>
2019-07-10 15:23:28 +08:00
Pete Birley
4d9c91cc3e Neutron: fix security context typo
This PS fixes a typo in the security context settings for neutrons
sriov agent.

Change-Id: I8cd255969b0f47d541cd5df68dbddde0b1fcf898
Signed-off-by: Pete Birley <pete@port.direct>
2019-07-09 13:32:50 +00:00
Gage Hugo
a57cd78439 Fix credential cleanup hook
The keystone-credential-cleanup hook was previously changed to
post-delete, this can cause issues where the serviceName is deleted
prior to running and will cause this to fail. This change reverts
the hook back to pre-delete to avoid this issue.

Change-Id: I45f3e73f8a957576ef82a733c1a7b7feaba7b679
2019-07-09 06:12:11 +00:00
pd2839
77dfdc99c9 Using HTK for cinder security policies
Overriding the values in values.yaml

Change-Id: Ib7cd343b4b95cae088a4fe564524448af79de785
2019-07-08 18:00:59 +00:00
Zuul
69d5c4c1e1 Merge "Nova: add service token" 2019-07-07 18:48:05 +00:00
Sphicas, Phil (ps3910)
07bc6cf5c8 Neutron: remove readiness probe from init container
Remove the readiness probe from the neutron-sriov-agent-init init
container of the neutron-sriov-agent DaemonSet, and use the probe
template for the neutron-sriov-agent container.

Change-Id: Iaa1fbca0b2d5ba1b0c15b82b6e8927c2b7be9f52
2019-07-06 21:30:34 -07:00
Zuul
07c5c79cd4 Merge "Cinder: Require cinder volume to be running before attempting bootstrap" 2019-07-05 18:55:23 +00:00
Zuul
72e9d00efd Merge "Neutron: Fix security context values keys" 2019-07-05 18:40:13 +00:00
Pete Birley
a750802331 Cinder: Require cinder volume to be running before attempting bootstrap
This PS udpates the deps on the cinder boostrap job to ensure that the
cinder volume service has started prior to attempting bootstrap.

This crtainly could be enhanced further, but is the 1st step in preventing
the liklyhood of a race.

Change-Id: Id0f958077b296750242450179b41c0a1b703b4a5
Signed-off-by: Pete Birley <pete@port.direct>
2019-07-05 11:52:53 -05:00
Zuul
96f76b4e93 Merge "[neutron] Swap arguments for default function" 2019-07-05 16:35:46 +00:00
Steve Wilkerson
363b50b336 Neutron: Fix security context values keys
This updates the values used for generating the pod and container
security contexts for the components of the neutron chart. This
moves to using a unique application key for each neutron service
instead of a single 'neutron' key that maps to every pod

This also removes the .pod.user.neutron.uid key in favor of using
the user key in the security_context values tree

Change-Id: I1c87a5b4b74e2a2d17b8913dd34f40dc1c38fbe0
Signed-off-by: Steve Wilkerson <sw5822@att.com>
2019-07-05 16:15:06 +00:00
Zuul
c559c45b2a Merge "Ceph-RGW - Update chart install scripts" 2019-07-05 15:38:32 +00:00
Michael Polenchuk
c7acc26e88 [neutron] Swap arguments for default function
For reference:
http://masterminds.github.io/sprig/defaults.html

Change-Id: Ie56ef548b84c3726f36fcd6352e0f8725179bbb6
Signed-off-by: Pete Birley <pete@port.direct>
2019-07-05 10:02:13 -05:00
Renis Makadia
092d7103ab Ceph-RGW - Update chart install scripts
- As part of PS 634782, Ceph-rgw chart was updated. We need to update
Ceph chart install script as per new changes.

Change-Id: Ieede912272903ed251693879f17a821cb2a4e7bb
2019-07-04 14:15:10 +00:00
Manuel Buil
0a965cf4c7 Allow keystone pods to connect to kube-dns
When deploying keystone, two pods fail with error:

Temporary failure in name resolution

These pods are executing fernet_manage.py and fetch secrets using:
https://github.com/openstack/openstack-helm/blob/master/keystone/templates/bin/_fernet-manage.py.tpl#L60

However, the current network policy blocks the connection to kube-dns.
This patch fixes it

Change-Id: I4ae6722a5bcb350e64995fbd2e1010153b0c29e6
Signed-off-by: Manuel Buil <mbuil@suse.com>
2019-07-04 14:14:42 +00:00
Gerry Kopec
34cc0104c8 Nova: add service token
Add capability for nova to send service token.  Default to disabled.
Config setup is similar to keystone_authtoken.

Change-Id: I666f8f52fed50c61f67397b3da58133a2f9b49d3
Signed-off-by: Gerry Kopec <Gerry.Kopec@windriver.com>
2019-07-04 14:10:26 +00:00
Zuul
dc247b3856 Merge "Using htk for glance security policies" 2019-07-03 20:59:11 +00:00
Zuul
38e3237da4 Merge "[neutron] Bring in L2 gateway support" 2019-07-03 16:47:37 +00:00