Merge remote-tracking branch 'origin/stackhpc/2023.1' into caracal-aios

Alex-Welsh · Alex-Welsh · commit 36cd87f86e71 · 2024-08-19T14:50:06.000+01:00
diff --git a/doc/source/_static/images/release-train.svg b/doc/source/_static/images/release-train.svg
diff --git a/doc/source/configuration/cephadm.rst b/doc/source/configuration/cephadm.rst
@@ -347,6 +347,10 @@ should be used in the Kolla Manila configuration e.g.:
 RADOS Gateways
 --------------
 
+RADOS Gateway integration is described in the :kolla-ansible-doc:`Kolla Ansible
+documentation
+<https://docs.openstack.org/kolla-ansible/latest/reference/storage/external-ceph-guide.html#radosgw>`.
+
 RADOS Gateways (RGWs) are defined with the following:
 
 .. code:: yaml
@@ -377,7 +381,7 @@ The set of commands below configure all of these.
   - "config set client.rgw rgw_enable_apis 's3, swift, swift_auth, admin'"
   - "config set client.rgw rgw_enforce_swift_acls true"
   - "config set client.rgw rgw_keystone_accepted_admin_roles 'admin'"
-  - "config set client.rgw rgw_keystone_accepted_roles 'member, Member, _member_, admin'"
+  - "config set client.rgw rgw_keystone_accepted_roles 'member, admin'"
   - "config set client.rgw rgw_keystone_admin_domain Default"
   - "config set client.rgw rgw_keystone_admin_password {{ secrets_ceph_rgw_keystone_password }}"
   - "config set client.rgw rgw_keystone_admin_project service"
@@ -393,6 +397,12 @@ The set of commands below configure all of these.
   - "config set client.rgw rgw_swift_account_in_url true"
   - "config set client.rgw rgw_swift_versioning_enabled true"
 
+Enable the Kolla Ansible RADOS Gateway integration in ``kolla.yml``:
+
+.. code:: yaml
+
+   kolla_enable_ceph_rgw: true
+
 As we have configured Ceph to respond to Swift APIs, you will need to tell
 Kolla to account for this when registering Swift endpoints with Keystone. Also,
 when ``rgw_swift_account_in_url`` is set, the equivalent Kolla variable should
@@ -414,6 +424,11 @@ before deploying the RADOS gateways. If you are using the Kolla load balancer
 
   kayobe overcloud service deploy -kt ceph-rgw,keystone,haproxy,loadbalancer
 
+There are two options for load balancing RADOS Gateway:
+
+1. HA with Ceph Ingress services
+2. RGWs with hyper-converged Ceph (using the Kolla Ansible deployed HAProxy
+   load balancer)
 
 .. _RGWs-with-hyper-converged-Ceph:
 
diff --git a/doc/source/configuration/magnum-capi.rst b/doc/source/configuration/magnum-capi.rst
@@ -60,12 +60,12 @@ To deploy the CAPI management cluster using this site-specific environment, run
 
 .. code-block:: bash
 
-    # Activate the environment
-    ./bin/activate <site-specific-name>
-
     # Install or update the local Ansible Python venv
     ./bin/ensure-venv
 
+    # Activate the environment
+    source bin/activate <site-specific-name>
+
     # Install or update Ansible dependencies
     ansible-galaxy install -f -r ./requirements.yml
 
@@ -103,12 +103,7 @@ To configure the Magnum service with the Cluster API driver enabled, first ensur
 
 Next, copy the CAPI management cluster's kubeconfig file into your stackhpc-kayobe-config environment (e.g. ``<your-skc-environment>/kolla/config/magnum/kubeconfig``). This file must be Ansible vault encrypted.
 
-The following config should also be set in your stackhpc-kayobe-config environment:
-
-.. code-block:: yaml
-    :caption: kolla/globals.yml
-
-    magnum_capi_helm_driver_enabled: true
+The presence of a kubeconfig file in the Magnum config directory is used by Kolla to determine whether the CAPI Helm driver should be enabled.
 
 To apply the configuration, run ``kayobe overcloud service reconfigure -kt magnum``.
 
diff --git a/doc/source/configuration/wazuh.rst b/doc/source/configuration/wazuh.rst
@@ -12,7 +12,6 @@ The short version
    particular the defaults assume that the ``provision_oc_net`` network will be
    used.
 #. Generate secrets: ``kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/wazuh-secrets.yml``
-#. Encrypt the secrets: ``ansible-vault encrypt --vault-password-file ~/vault.password  $KAYOBE_CONFIG_PATH/environments/ci-multinode/wazuh-secrets.yml``
 #. Deploy the Wazuh manager: ``kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/wazuh-manager.yml``
 #. Deploy the Wazuh agents: ``kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/wazuh-agent.yml``
 
@@ -250,7 +249,6 @@ It will be used by wazuh secrets playbook to generate wazuh secrets vault file.
 .. code-block:: console
 
   kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/wazuh-secrets.yml
-  ansible-vault encrypt --vault-password-file ~/vault.pass $KAYOBE_CONFIG_PATH/wazuh-secrets.yml
 
 Configure Wazuh Dashboard's Server Host
 ---------------------------------------
diff --git a/etc/kayobe/ansible/cis.yml b/etc/kayobe/ansible/cis.yml
@@ -35,9 +35,7 @@
     - include_role:
         name: ansible-lockdown.rhel9_cis
       when: ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_major_version == '9'
-      tags: always
 
     - include_role:
         name: ansible-lockdown.ubuntu22_cis
       when: ansible_facts.distribution == 'Ubuntu' and ansible_facts.distribution_major_version == '22'
-      tags: always
diff --git a/etc/kayobe/ansible/prometheus-network-names.yml b/etc/kayobe/ansible/prometheus-network-names.yml
@@ -1,3 +1,4 @@
+---
 - name: Prometheus friendly network names
   hosts: overcloud
   gather_facts: no
diff --git a/etc/kayobe/ansible/reboot.yml b/etc/kayobe/ansible/reboot.yml
@@ -2,15 +2,26 @@
 - name: Reboot the host
   hosts: seed-hypervisor:seed:overcloud:infra-vms
   serial: "{{ lookup('env', 'ANSIBLE_SERIAL') | default(1, true) }}"
+  gather_facts: false
   vars:
-    gather_facts: false
+    reboot_timeout_s: "{{ 20 * 60 }}"
     reboot_with_bootstrap_user: false
-    ansible_user: "{{ bootstrap_user if reboot_with_bootstrap_user else kayobe_ansible_user }}"
-    ansible_python_interpreter: "{{ '/usr/bin/python3' if reboot_with_bootstrap_user else virtualenv_path + '/kayobe/bin/python' }}"
-    ansible_ssh_common_args: "{{ '-o StrictHostKeyChecking=no' if reboot_with_bootstrap_user else '' }}"
+    ansible_user: "{{ bootstrap_user if reboot_with_bootstrap_user | bool else kayobe_ansible_user }}"
+    ansible_ssh_common_args: "{{ '-o StrictHostKeyChecking=no' if reboot_with_bootstrap_user | bool else '' }}"
+    ansible_python_interpreter: "/usr/bin/python3"
   tags:
     - reboot
   tasks:
     - name: Reboot and wait
       become: true
       reboot:
+        reboot_timeout: "{{ reboot_timeout_s }}"
+        search_paths:
+          # Systems running molly-guard hang waiting for confirmation before rebooting without this.
+          - "/lib/molly-guard"
+          # Default list:
+          - "/sbin"
+          - "/bin"
+          - "/usr/sbin"
+          - "/usr/bin"
+          - "/usr/local/sbin"
diff --git a/etc/kayobe/ansible/requirements.yml b/etc/kayobe/ansible/requirements.yml
@@ -9,7 +9,7 @@ collections:
   - name: stackhpc.pulp
     version: 0.5.5
   - name: stackhpc.hashicorp
-    version: 2.5.0
+    version: 2.5.1
   - name: stackhpc.kayobe_workflows
     version: 1.0.3
 roles:
diff --git a/etc/kayobe/ansible/scripts/aio-init.sh b/etc/kayobe/ansible/scripts/aio-init.sh
@@ -142,4 +142,4 @@ if ! $KOLLA_OPENSTACK_COMMAND flavor list | grep -q m1.tiny; then
     $KOLLA_OPENSTACK_COMMAND flavor create --id 5 --ram 16384 --disk 160 --vcpus 8 m1.xlarge
 fi
 
-touch /tmp/.init-runonce
+touch /tmp/.init-runonce
diff --git a/etc/kayobe/ansible/stackhpc-openstack-tests.yml b/etc/kayobe/ansible/stackhpc-openstack-tests.yml
@@ -31,7 +31,7 @@
             depth: 1
             single_branch: true
 
-        - name: Ensure the latest versions of pip and setuptools are installed # noqa package-latest
+        - name: Ensure the latest versions of pip and setuptools are installed  # noqa package-latest
           ansible.builtin.pip:
             name: "{{ item.name }}"
             state: latest
diff --git a/etc/kayobe/ansible/templates/wazuh-secrets.yml.j2 b/etc/kayobe/ansible/templates/wazuh-secrets.yml.j2
@@ -7,7 +7,7 @@ secrets_wazuh:
   # Strengthen default wazuh api user pass
   wazuh_api_users:
     - username: "wazuh"
-      password: "{{ secrets_wazuh.wazuh_api_users[0].password | default(lookup('community.general.random_string', min_lower=1, min_upper=1, min_special=1, min_numeric=1, length=30)) }}"
+      password: "{{ secrets_wazuh.wazuh_api_users[0].password | default(lookup('community.general.random_string', min_lower=1, min_upper=1, min_special=1, min_numeric=1, length=30, override_special=override_special_characters)) }}"
   # OpenSearch 'admin' user pass
   opendistro_admin_password: "{{ secrets_wazuh.opendistro_admin_password | default(lookup('password', '/dev/null'), true) }}"
   # OpenSearch 'kibanaserver' user pass
diff --git a/etc/kayobe/ansible/ubuntu-upgrade.yml b/etc/kayobe/ansible/ubuntu-upgrade.yml
@@ -40,6 +40,15 @@
       reboot:
         reboot_timeout: "{{ reboot_timeout_s }}"
         connect_timeout: 600
+        search_paths:
+          # Systems running molly-guard hang waiting for confirmation before rebooting without this.
+          - "/lib/molly-guard"
+          # Default list:
+          - "/sbin"
+          - "/bin"
+          - "/usr/sbin"
+          - "/usr/bin"
+          - "/usr/local/sbin"
       become: true
       when: file_status.stat.exists
 
@@ -101,6 +110,15 @@
       reboot:
         reboot_timeout: "{{ reboot_timeout_s }}"
         connect_timeout: 600
+        search_paths:
+          # Systems running molly-guard hang waiting for confirmation before rebooting without this.
+          - "/lib/molly-guard"
+          # Default list:
+          - "/sbin"
+          - "/bin"
+          - "/usr/sbin"
+          - "/usr/bin"
+          - "/usr/local/sbin"
       become: true
 
     - name: Update distribution facts
diff --git a/etc/kayobe/ansible/wazuh-secrets.yml b/etc/kayobe/ansible/wazuh-secrets.yml
@@ -3,6 +3,7 @@
   gather_facts: false
   vars:
     wazuh_secrets_path: "{{ kayobe_env_config_path }}/wazuh-secrets.yml"
+    override_special_characters: '"#$%&()*+,-./:;<=>?@[\]^_{|}~'
   tasks:
     - name: install passlib[bcrypt]
       pip:
diff --git a/etc/kayobe/apt.yml b/etc/kayobe/apt.yml
@@ -74,15 +74,15 @@ stackhpc_apt_repositories:
 # Do not replace apt configuration for non-overcloud hosts. This can result in
 # errors if apt reconfiguration is performed before local repository mirrors
 # are deployed.
-apt_repositories: "{{ stackhpc_apt_repositories | selectattr('required') | list if 'overcloud' in group_names else [] }}"
+apt_repositories: "{{ stackhpc_apt_repositories | selectattr('required') | list if stackhpc_repos_enabled | bool else [] }}"
 
 # Whether to disable repositories in /etc/apt/sources.list. This may be used
 # when replacing the distribution repositories via apt_repositories.
 # Default is false.
 # Do not disable the default apt configuration for non-overcloud hosts. This
 # can result in errors if apt reconfiguration is performed before local
 # repository mirrors are deployed.
-apt_disable_sources_list: "{{ 'overcloud' in group_names }}"
+apt_disable_sources_list: "{{ stackhpc_repos_enabled | bool }}"
 
 # Apt auth configuration for accessing the package repository mirror.
 stackhpc_apt_auth:
@@ -98,7 +98,7 @@ stackhpc_apt_auth:
 # * filename: Name of a file in which to store the auth configuration. The
 #   extension should be '.conf'.
 # Default is an empty list.
-apt_auth: "{{ stackhpc_apt_auth if 'overcloud' in group_names and stackhpc_repo_mirror_username is truthy else [] }}"
+apt_auth: "{{ stackhpc_apt_auth if stackhpc_repos_enabled | bool and stackhpc_repo_mirror_username is truthy else [] }}"
 
 ###############################################################################
 # Dummy variable to allow Ansible to accept this file.
diff --git a/etc/kayobe/dnf.yml b/etc/kayobe/dnf.yml
@@ -41,10 +41,10 @@
 #     file: myrepo
 #     gpgkey: http://gpgkey
 #     gpgcheck: yes
-#dnf_custom_repos:
+dnf_custom_repos: "{{ stackhpc_dnf_repos if stackhpc_repos_enabled | bool else [] }}"
 
 # A dict of custom repositories that point to the local Pulp server.
-# To use these repos, set dnf_custom_repos to the value of stackhpc_dnf_repos.
+# To use these repos, set stackhpc_repos_enabled to true.
 # This is done by default for hosts in the overcloud group via a group_vars
 # file.
 stackhpc_dnf_repos: "{{ dnf_custom_repos_el9 | combine(dnf_custom_repos_rocky_9) | combine(dnf_custom_repos_elrepo_9 if dnf_install_elrepo_9 | bool else {}) }}"
diff --git a/etc/kayobe/environments/aufn-ceph/configure-openstack.sh b/etc/kayobe/environments/aufn-ceph/configure-openstack.sh
@@ -25,4 +25,4 @@ ansible-galaxy collection install -p ansible/collections -r requirements.yml
 source $BASE_PATH/src/kayobe-config/etc/kolla/public-openrc.sh
 
 # Run script to configure openstack cloud
-tools/openstack-config 
+tools/openstack-config
diff --git a/etc/kayobe/environments/aufn-ceph/inventory/groups b/etc/kayobe/environments/aufn-ceph/inventory/groups
@@ -26,4 +26,4 @@ storage-ceph
 # Monitoring groups
 
 [monitoring:children]
-controllers
+controllers
diff --git a/etc/kayobe/environments/ci-multinode/networks.yml b/etc/kayobe/environments/ci-multinode/networks.yml
@@ -107,10 +107,11 @@ storage_allocation_pool_end: 192.168.41.254
 storage_vlan: 105
 
 # Storage management network
-storage_mgmt_cidr: 192.168.42.0/24
+# NOTE: Skipping the .42 subnet to avoid a collision with a popular number.
+storage_mgmt_cidr: 192.168.43.0/24
 storage_mgmt_mtu: "{{ ansible_facts.default_ipv4.mtu - 50 }}"
-storage_mgmt_allocation_pool_start: 192.168.42.3
-storage_mgmt_allocation_pool_end: 192.168.42.254
+storage_mgmt_allocation_pool_start: 192.168.43.3
+storage_mgmt_allocation_pool_end: 192.168.43.254
 storage_mgmt_vlan: 106
 
 # Provision overcloud network
diff --git a/etc/kayobe/inventory/group_vars/all/stackhpc b/etc/kayobe/inventory/group_vars/all/stackhpc
@@ -3,4 +3,4 @@
 # Feature flags
 
 # Whether or not to run CIS benchmark hardening playbooks. Default is false.
-stackhpc_enable_cis_benchmark_hardening_hook: false
+stackhpc_enable_cis_benchmark_hardening_hook: false
diff --git a/etc/kayobe/inventory/group_vars/all/stackhpc-repos b/etc/kayobe/inventory/group_vars/all/stackhpc-repos
@@ -0,0 +1,6 @@
+---
+# Use upstream package repos by default to avoid situations where the
+# seed-hypervisor tries to use a local pulp repo on the seed VM before the seed
+# vm has been provisioned
+# This behaviour is overriden for Overcloud hosts.
+stackhpc_repos_enabled: false
diff --git a/etc/kayobe/inventory/group_vars/overcloud/stackhpc-repos b/etc/kayobe/inventory/group_vars/overcloud/stackhpc-repos
@@ -1,7 +1,7 @@
+---
 # Only use local pulp mirrors for overcloud hosts
 # to avoid situations where the seed-hypervisor 
 # tries to use a local pulp repo on the seed VM
 # before the seed vm has been provisioned
-dnf_custom_repos: "{{ stackhpc_dnf_repos }}"
-
+stackhpc_repos_enabled: true
 enable_docker_repo: false
diff --git a/etc/kayobe/kolla.yml b/etc/kayobe/kolla.yml
@@ -147,6 +147,14 @@ kolla_sources:
     type: git
     location: https://github.com/stackhpc/networking-generic-switch.git
     reference: stackhpc/{{ openstack_release }}
+  octavia-api-plugin-ovn-octavia-provider:
+    type: git
+    location: https://github.com/stackhpc/ovn-octavia-provider.git
+    reference: stackhpc/{{ openstack_release }}
+  octavia-driver-agent-plugin-ovn-octavia-provider:
+    type: git
+    location: https://github.com/stackhpc/ovn-octavia-provider.git
+    reference: stackhpc/{{ openstack_release }}
 
 ###############################################################################
 # Kolla image build configuration.
@@ -433,16 +441,44 @@ kolla_build_customizations_common:
     - /additions/*
 
 kolla_build_customizations_rocky:
+  kolla_toolbox_packages_remove:
+    - openvswitch
+  kolla_toolbox_packages_append:
+    - openvswitch3.3
+  manila_base_packages_remove:
+    - openvswitch
+  manila_base_packages_append:
+    - openvswitch3.3
+  neutron_base_packages_remove:
+    - openvswitch
+    - python3-openvswitch
+  neutron_base_packages_append:
+    - openvswitch3.3
+    - python3-openvswitch3.3
+  nova_base_packages_remove:
+    - openvswitch
+    - python3-openvswitch
+  nova_base_packages_append:
+    - openvswitch3.3
+    - python3-openvswitch3.3
+  octavia_base_packages_remove:
+    - python3-openvswitch
+  openvswitch_base_packages_remove:
+    - openvswitch
+    - python3-openvswitch
+  openvswitch_base_packages_append:
+    - openvswitch3.3
+    - python3-openvswitch3.3
   ovn_base_packages_override:
-    - ovn23.03
+    - ovn24.03
   ovn_controller_packages_override:
-    - ovn23.03-host
+    - ovn24.03-host
   ovn_nb_db_server_packages_override:
-    - ovn23.03-central
+    - ovn24.03-central
   ovn_northd_packages_override:
-    - ovn23.03-central
+    - ovn24.03-central
   ovn_sb_db_server_packages_override:
-    - ovn23.03-central
+    - ovn24.03-central
 
 kolla_build_customizations_ubuntu: {}
 
diff --git a/etc/kayobe/kolla/config/grafana/dashboards/openstack/grafana_cloud_dashboard.json b/etc/kayobe/kolla/config/grafana/dashboards/openstack/grafana_cloud_dashboard.json
@@ -902,4 +902,4 @@
   "version": 1,
   "weekStart": ""
 }
-{% endraw %}
+{% endraw %}
diff --git a/etc/kayobe/kolla/config/grafana/dashboards/openstack/grafana_project_dashboard.json b/etc/kayobe/kolla/config/grafana/dashboards/openstack/grafana_project_dashboard.json
@@ -1138,4 +1138,4 @@
   "version": 1,
   "weekStart": ""
 }
-{% endraw %}
+{% endraw %}
diff --git a/etc/kayobe/kolla/config/grafana/dashboards/openstack/openstack.json b/etc/kayobe/kolla/config/grafana/dashboards/openstack/openstack.json
@@ -2531,4 +2531,4 @@
   "version": 2,
   "weekStart": ""
 }
-{% endraw %}
+{% endraw %}
diff --git a/etc/kayobe/kolla/config/grafana/dashboards/openstack/prometheus_benchmark.json b/etc/kayobe/kolla/config/grafana/dashboards/openstack/prometheus_benchmark.json
@@ -5353,4 +5353,4 @@
   "version": 8,
   "weekStart": ""
 }
-{% endraw %}
+{% endraw %}
diff --git a/etc/kayobe/kolla/config/prometheus/prometheus-alertmanager.yml.example b/etc/kayobe/kolla/config/prometheus/prometheus-alertmanager.yml.example
diff --git a/etc/kayobe/kolla/globals.yml b/etc/kayobe/kolla/globals.yml
diff --git a/etc/kayobe/kolla/inventory/group_vars/prometheus-blackbox-exporter b/etc/kayobe/kolla/inventory/group_vars/prometheus-blackbox-exporter
diff --git a/releasenotes/notes/fix-cve-2024-40767-24b9b3c35f61a0c8.yaml b/releasenotes/notes/fix-cve-2024-40767-24b9b3c35f61a0c8.yaml
diff --git a/releasenotes/notes/ovn-24-03-47c1eb9846f261b0.yaml b/releasenotes/notes/ovn-24-03-47c1eb9846f261b0.yaml
diff --git a/releasenotes/notes/ovn-octavia-provider-bug-2072754-5cbd7dc9c366668d.yaml b/releasenotes/notes/ovn-octavia-provider-bug-2072754-5cbd7dc9c366668d.yaml
diff --git a/releasenotes/notes/stackhpc-repos-enabled-10c8a698991e53c2.yaml b/releasenotes/notes/stackhpc-repos-enabled-10c8a698991e53c2.yaml
diff --git a/releasenotes/notes/update-hcp-collection-39acaafe76c95b3f.yaml b/releasenotes/notes/update-hcp-collection-39acaafe76c95b3f.yaml
diff --git a/terraform/aio/vm.tf b/terraform/aio/vm.tf

Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
	`1`	`+---`
`1`	`2`	`- name: Prometheus friendly network names`
`2`	`3`	`hosts: overcloud`
`3`	`4`	`gather_facts: no`