The cloud-compute relation uses the private-address setting to
reflect the hostname/address to be used for vm migrations. This
can be the default management network or an alternate one. When
this charm populates ssh known_hosts entries for compute hosts
it needs to ensure hostname, address and fqdn for the mgmt network
is included so that Nova resize operations can work if they use
the hostname from the db (which will always be from the mgmt
network).
Change-Id: Ic9e4657453d8f53d1ecbee23475c7b11549ebc14
Closes-Bug: #1969971
When taking the nova-cloud-controller from single unit to full HA by
increasing the number of units from 1 to 3 and relating it to hacluster,
the data set on the cloud-compute relation is not updated, because the
update_nova_relation() function is only called on
cloud-compute-relation-joined and config-changed, none of these hooks
are executed when scaling out the application.
This patch introduces a call to update_nova_relation() on
ha-relation-changed.
Test case on an environment deployed with a single unit of
nova-cloud-controller:
export NOVA_CC_VIP=10.0.0.11
juju config nova-cloud-controller vip=$NOVA_CC_VIP
juju deploy --series jammy --channel 2.4/stable hacluster \
nova-cloud-controller-hacluster
juju add-unit -n 2 nova-cloud-controller
juju deploy --series jammy memcached
juju add-relation memcached nova-cloud-controller
juju add-relation nova-cloud-controller nova-cloud-controller-hacluster
Change-Id: Ib08bf9b6e1ce2b69be4d99ffe0726b59d81f4bc9
Closes-Bug: #2002154
The charm looks for endpoint changes and restarts the nova-scheduler
when the endpoint changes. However, the nova-conductor also needs to be
restarted in order to pick up new endpoints.
Closes-Bug: 1968708
Change-Id: I18dee4eb46bd836805e60427c0afc508e2489111
nova-consoleauth was removed for OpenStack >= Train, this change will
remove the nrpe check associated with it when is_consoleauth_enabled()
returns False.
Change-Id: I891634fc8001597089312801b29a80336543f5f0
Closes-Bug: #1904650
The mock third party library was needed for mock support in py2
runtimes. Since we now only support py36 and later, we can use the
standard lib unittest.mock module instead.
Note that https://github.com/openstack/charms.openstack is used during tests
and he need `mock`, unfortunatelly it doesn't declare `mock` in its
requirements so it retrieve mock from other charm project (cross dependency).
So we depend on charms.openstack first and when
Ib1ed5b598a52375e29e247db9ab4786df5b6d142 will be merged then CI
will pass without errors.
Depends-On: Ib1ed5b598a52375e29e247db9ab4786df5b6d142
Change-Id: Id925078c5c04c2f89a570bdf7171c666839f9e40
stestr runs tests in parallel and this can cause issues with locking
when SQLite is not mocked out properly and gets used in a test. This
patch just switches Storage to use :memory: so that locking does not
occur.
Closes-Bug: #1908282
Change-Id: Iaa1c7b78dee498e0cc6dc6fccf12e74f22225ecd
SSH keys from nova-compute are now shared across all
nova-compute charm apps.
Closes-Bug: #1468871
Change-Id: Ia142eceff56bb763fcca8ddf5b74b83f84bf3539
Communicate to compute services the cross_az_attach config setting.
Since the cross_az_attach setting needs to be applied at the compute
node, update the relation settings to specify the cross_az_attach
policy configured.
Change-Id: I71e97453453d5d091449caf547e68c6455d091cf
Closes-Bug: #1899084
Note that part of this fix belongs in c-h, but let's add it here
as a tactical measure given we are practically frozen.
Enable TLS in the functional test for focal-ussuri and onwards.
Also switch to focal-ussuri as target for smoke.
Drop Trusty/Mitaka as it currently does not pass with symptoms
like https://bugs.launchpad.net/charm-nova-compute/+bug/1861094
Closes-Bug: #1911902
Change-Id: I7b12479ce3afb94a0fb21c26b1ac78736b81aba2
If an ep change trigger is recieved then also look for the
catalog_ttl key on the relation. If it is present then wait for
that long before restarting services, this allows stale ep
entries to expire from the catalogue before restarting.
Change-Id: Ief2fa8286d9fa8058b7a012ec719776c4dd302f5
If the database is in maintenace mode do not attempt to access
it.
Depends-On: I5d8ed7d3935db5568c50f8d585e37a4d0cc6914f
Change-Id: I7d5b7a20573b38d12b1ead708ee446472f21e9f8
If nova-compute is contected to the message broker before
the nova-conducter then it times out after a minute and shutsdown.
The nova-cloud-controller needs to inform the nova-compute charm
to restart nova-compute when it is connected to the message broker.
The restart is limited to the leader to stop multiple restart
requests.
Change-Id: Icdf47ea80267d421ca14f131f2d1f7cbdeb73641
Closes-Bug: #1861094
Essentially, the functions returning the related units and expected
units (for goal state) might not be sorted, something the author of
the code (me) hadn't taken into account. This fixes that by comparing
sorted lists.
Change-Id: I5c7bfe39b80f103e95fd5105d2185a89975ec23c
Closes-bug: #1859050
This new config called spice-agent-enabled is added to inform the spice agent
is not installed in the guest instance, which in conjunction with an image
property hw_pointer_model=usbtablet allows accurate position of the mouse in
Windows guests.
This option is not rendered in the nova.conf local to nova-cloud-controller
units, instead it's passed to related nova-compute units.
Change-Id: Id64699b6d04aa05935b31d55532df45c6d973fa7
Depends-On: https://review.opendev.org/699461
Closes-Bug: #1856602
As of OpenStack Train, the placement charm manages the placement API, and it
is no longer managed by nova-cloud-controller. This requires the placement
charm to be deployed and related to nova-cloud-controller prior to upgrading
nova-cloud-controller to Train.
This patch ensures that if an attempt is made to upgrade nova-cloud-controller
from Stein to Train, and placement is not yet related, it will block and
prevent the upgrade.
Change-Id: I217adfb59aed2e509a56b6559a528ae4c0adaa48
Closes-Bug: 1848529
The placement project has split from nova into its own project
in Train. This patch disables the nova placement API as of Stein
when the placement charm relatation joins, and discontinues
nova placement installation as of Train for new installs.
Change-Id: If7c37ef8936e418b5afd21d83c9322563348cbcf
Needed-By: https://review.opendev.org/#/c/687915/
Partial-Bug: 1811681
This patchset implements policy overrides for nova-cloud-controler.
This change includes a charm-helpers sync to bring in the policyd helper
code.
Note there are no functional tests for this feature as the charm still
uses the old style non-zaza amulet framework. The Related-Bug below is
tracking this issue.
Change-Id: Ia5f3f8189d4a7b7b46a827707d964ebe40740aeb
Closes-Bug: #1741723
Related-Bug: #1845639
If console_access_protocol was switched to none then
console_access_protocol was not set at all by the relation set
acting on the relation with the compute nodes. This meant the
operator had no mechanism to unset console_access_protocol. This
change explicitly unsets it so the change is passed to the
compute units.
Change-Id: Ifdca0ec6626732ee0ea30a6847130ea97478df6f
Closes-Bug: #1844356
In test environments where multiple CPUs are available and tests can
be run concurrently, the two test cases patched here can both generate
INSERT statements. The first completed test case will commit
successfully. The subsequent test case will also attempt to
INSERT (with the same primary key), resulting in an SQL integrity
error.
For a full break-down of the race condition please see:
https://bugs.launchpad.net/charm-nova-cloud-controller/+bug/1841806/comments/5
Change-Id: I0b8d4d7544e76c1c11c928fd7325259186d9ff53
Currently the unit testing suite has a minimal set of IPs
hard-coded (in the subnet 10.0.0.0/8). The failing unit tests call
functions that will perform DNS reverse lookups on the hard-coded
IPs. In the event that a DNS server is unavailable, or misconfigured,
the DNS lookups will result in a Python Exception being thrown,
causing the unit tests to fail.
This solution patches DNS lookups to return None result.
Also add OS_* to tox passenv to resolve the http proxy issue in
retrieving the cirros image.
Change-Id: I7a519fbe7fba5f3aefd22c57b8d44e3b39c99582
Closes-Bug: #1841806
This change adds caching for the host look ups associated with a
private-address of a unit. This cache is maintained across hook
invocations, and is designed to reduce the time spent in
cloud-compute-relation-changed hooks (which occur as nova-compute units
join and update on the cloud-compute relation).
The feature has been added under an EXPERIMENTAL config flag (with the
default being "don't use the cached values") in case there are any
corner cases around DNS resolution in the deploying cloud during
deployment.
An action is included to allow clearing of the cache at unit,
application and whole relation level. This clears the cache and
re-triggers the host resolution, and relation updates. This is in case
of either 1) DNS changed during the deployment, 2) DNS has been altered
during the running of the cloud.
Change-Id: I5a68bf4c30bf1591184d660d50559c969822ddcf
The main driver here is to separate the concerns of resolving host names
and adding them to service/user related files. This is to enable the
(eventual) resolution of the feature to allow migrations across
relation ids (i.e. between nova-compute applications) and to enable
caching of hostname look ups.
Change-Id: I406d1daacbcc74eb6f3e090f9a46e01dd3e19cc8
If goal state is available, this patch uses it to defer distributing the
known_hosts and authorized_keys to the related nova-compute units until
the last nova-compute unit expected has joined and triggered a
cloud-compute-relation-changed hook. This means that all of the hosts
have been scanned and thus the whole group (per relation id) can be set.
Note that this patch does not unify the known_hosts/authorized_keys
files across relations. That's for a separate patch.
Change-Id: I6c26ebbad2236e66c174ef4606828db834803865
Related-Bug: #1833420
The (already) refactored region notification code checked for the
'region' value in the remote unit, despite the nova-compute charm not
setting the value. This has been removed. Now that the function only
needs to be set for the relation, it is no longer included in 'unit'
loops.
The utility function is also renamed to
set_region_on_relation_from_config to better reflect it's actual
function.
Change-Id: I81d9924bebe4009119505b1d5dccf2e498925c7e
Related-Bug: #1833420
Refactor ssh_known_hosts_lines() and ssh_authorized_keys_lines to be
easier to maintain and only call rstrip() once (per function).
Change-Id: Id2774bb1551e4826a2fd71d1a371d65ab2439a7d
This patchset refactors the update_ssh_keys_and_notify_compute_units()
into two separate halves: one is "update keys and hosts from a specified
unit on a relation (or the current relation/unit for the hook)" and the
other is update the relation_set data for the relation with the found
keys/hosts.
This is a precusor patch to reducing the number of dns queries and
setting of relation data, and to eliminate repeated operations on the
same data/result (which currently happens).
Change-Id: I45bc9a889968796572a61c199ac25d543c064670
Related-Bug: 1833420
The compute_changed() function (which handled the cloud-compute relation
changed hook event) was also used in the config-changed and update-charm
hooks. This meant that it did a lot of work that wasn't necessary for
those hooks.
This patch splits the function up into separate functions that deal with
one thing, and then introduces a new function to call those. This means
that the other usages compute_changed() now use the actual features that
they need.
Change-Id: I59e52076480729beec9e125f66714a208303908d
Related-Bug: 1833420
The nova-api (commit 962790239b)
introduced a 'nova-api' ready relation, but it was never added to the
metadata.yaml and it has never been used. This commit removes it, as
there is no need for it after 3 years, and it therefore has a
maintenance burden, even if not being used.
Change-Id: I6b13e2639b808fd640a6f8d892d1e3dd58215361
As with nova-compute the neutron-gateway needs to know if the CA
changes otherwise certificate validation will fail when it makes
calls out to other endpoints.
Change-Id: I45beef2521e8168d98482709a4d0196b6859db5c
If the certificates change then services needs to be restarted. This
change adds the SSL directory to the restart map to ensure any
certificate changes trigger a restart.
Also, if the certificates change we need to pass those on to
nova-compute.
Change-Id: I4cb2f760c26f0804d3cb7466c8aa741d5e0ec314
Closes-Bug: 1828530
Remove support for single-nova-consoleauth operation; this option
managed a single instance of the nova-consoleauth process across
a cluster nova-cloud-controller application using the hacluster
charm. This proves somewhat racey on deployment as the ocf resource
deep checks the operation of nova-consoleauth including connectivity
to AMQP etc.. If the clustering of the service occurs before
other principle relations have been completed, the resource will
fail to start and the hook execution will spin, never returning.
HA deployments should always use memcached to share tokens between
instances of the nova-consolauth daemon; If the 'ha' relation is
detected, then ensure that a memcache relation is then required
for charm operation.
To support evaluation of the memcache relation completeness
the memcache specific code in InstanceConsoleContext was split out
into a new memcache specific class RemoteMemcacheContext.
Existing pacemaker resources will be deleted on upgrade; units will
move into a blocked state until a relation is added to memcached.
The nova-consoleauth service is resumed on upgrade to ensure that
instances run on all nova-cloud-controller units.
Change-Id: I2ac91b2bd92269b761befeb7563ad01cc5431151
Closes-Bug: 1781620
Due to an issue in python3 oslo_cache+eventlet when using
memcached. As workaroud for Rocky it has been decided to run service
nova-api-os-compute from systemd to apache2.
Closes-Bug: #1812672
Depends-On: https://review.openstack.org/#/c/633218
Depends-On: https://review.openstack.org/#/c/633482
Change-Id: I3bf279638c5decf1020345f3d2e876e379144997
Signed-off-by: Sahid Orentino Ferdjaoui <sahid.ferdjaoui@canonical.com>
Use the generate_ha_relation_data helper from charmhelpers to
generate the data to send down the relation to the hacluster
charm.
This results in a few changes in behaviour:
1) The charm will no longer specify a nic name to bind the vip. This
is because Pacemaker VIP resources are able to automatically
detect and configure correct iface and netmask parameters based
on local configuration of the unit.
2) The original iface named VIP resource will be stopped and deleted
prior to the creation of the new short hash named VIP resource.
Change-Id: I7018e94e75c7c873c6c610b06d3e7cc9fedcc507
Disabling the single-nova-consoleauth while the unit is paused
will restart the nova-consoleauth service on the local unit.
This patch only resumes the service locally if the local unit
is not currently paused.
Change-Id: Id66375ab758e1b33b96a819d2ce788a4434b1686
Related-Bug: #1765215
Related-Bug: #1705514
Some major changes:
* the charm has been rebased (from a Python perspective) to be rooted in
the charm directory. This is a single root.
* Imports have been changed so that the don't add lots of imports to the
namespace of the module doing the import.
* The code that used to run at module import time has been made lazy
such that it only has to run if the relevant functions are called.
This includes restart_on_change parameters, the harden function and
the parameters to the guard_map. Appropriate changes will be
submitted to charm-helpers.
* Several tests had to be re-written as (incorrect) mocking meant that
text fixtures didn't actually match what the code was doing. Thus,
the tests were meaningless.
* This has had a net positive impact on the unit tests wrt to importing
modules and mocking.
Change-Id: Id07d9d1caaa9b29453a63c2e49ba831071e9457f
This change adds relations necessary for registering a compute cell
with the superconductor. For a cell to be registered this charm
must have relations with the compute cells conductor, database and
message queue. Only when all these relations are complete can the
registration happen. Below are major changes included in this PR.
* Add nova-cell-api relation for communicating with the
nova-cell-conductor
* Add shared-db-cell relation for communicating with the
a compute cells database.
* Add amqp-cell relation for communicating with the
a compute cells message queue.
* Add methods for registering cells with the
superconductors database.
* Charm helper sync
Change-Id: Ic6ddc29426319b98b147c29031f60485fccc513f
Add a service for handling nova metadata api services. This was
previously handled by the neutron-gateway and still is for
deployemnts up to and including Pike, For the neutron metadata
service and the nova service to communicate they need a shared
secret. To achieve this, the change includes:
* A charmhelper sync to get support for multiple wsgi vhosts
* Rendering new wsgi vhost and corresponding haproxy config.
* Setting a shared-secret down the relation with the neutron
gateway.
* Remove fragile keystone authtoken checks as they are failing
after a ch sync and any issues will be caught by the instance
launch functional test.
Change-Id: I5ad15ba782cb87b6fdb3c0941a6482d201670bff
Replace charm custom init control functions with `service_pause`
and `service_resume` functions from charm-helpers.
Change-Id: I235af30a19294316f65fba0e13fe10ae50164a42
Closes-Bug: #1765215
Ensure that only the elected leader can add compute hosts to the
cell in cloud-compute-relation-changed as database commands should
only be run by the elected leader.
Change-Id: I4806580f58e2a2feba82c74d9d5ff29dfb220c9e
Closes-Bug: #1752402
Drop support for deployment from Git repositories, as deprecated
in the 17.02 charm release. This feature is unmaintained and has
no known users.
Change-Id: I2fe15b648d485e5b03965a00dee6324669ebe9fa
Remove postgresql DB support; This feature is untested as part
of the charms, is not in use and was deprecated as part of
the 1708 charms release.
Change-Id: I866559f519ace3476e0cc85661d99e5f5491227d
Support for the ZeroMQ messaging driver has bit-rotted over
the last few years across the OpenStack charms; drop support
for ZMQ inline with deprecation notices issued in 17.02 charm
release.
Change-Id: I39e464b289c9df842ca73e64c7576ba0531963ae
Running the current unit tests you keep getting prompted
for root password because of a load of missing mocks.
This patch mocks out functions that there left unmocked
in unit tests that were not actually testing them.
Change-Id: I6d7dac4f900f133a4d1ac64e431ffcb6b2cfd58e
Update all nova-manage commands to use subprocess.check_output()
and log subprocess.CalledProcessError.output on failure. This
will help capture nova-manage error details on first failure.
Specify cell1 uuid on discover_hosts call. This doesn't change
behavior, it is just more explicit and useful if we move to
multiple cells in the future.
Introduce an is_cellv2_init_ready() function that uses contexts to
check if cells_v2 is ready to initialize. This cleans up the
corresponding TODOs.
Move checks for cell v2 init readiness to update_cell_db_if_ready(),
also cleaning up corresponding TODOs.
Change-Id: I313edce84d3d249031e020a4fbb4baf216c01ddb
Related-Bug: 1720846
Edward Hope-Morley