Commit Graph

900 Commits

Author SHA1 Message Date
Dmitriy Rabotyagov 7e2cf5283f Restart cinder-purge-deleted service only on abnormal exit
Default value of Restart for any service which type is not `oneshot` is
`on-failure`. While this suits most usecases, this leads to unexpected
consequences for cinder-purge-deleted.service.

In case there're some historical inconsistencies in the database which
make impossible to flush deleted volumes from the database
(ie due to prior manual intervention), cinder-manage exists with code 1
which triggers systemd to restart the service and attempt cleanup again.

The troublesome part is the transactional behaviour of the script. With
each run it locks records in it's transaction that is failing and being
reverted in a loops with 2 sec delay, that not only causes unnecessary
load for database itself, but also causes deadlocks during operations
with volumes that are not being re-tryed and fail with 500 return code
in cinder-api.

Changing Restart to `on-abnormal` will leave service in a failed state
and systemd won't attempt to restart it.

Change-Id: Ib091cc11a16fcd31ef351d9ec21d070d25829791
2023-11-08 09:01:19 +00:00
Dmitriy Rabotyagov b9b06052cb Fix example playbook linters
Change-Id: If0873fd38d40cb2317e644e20f5be5334753d79a
2023-11-08 10:00:57 +01:00
Dmitriy Rabotyagov 79ccde30b4 Split lines to not exceed 160 characters limit
Change-Id: I1e35c59edff17f19916258eee2a8b0a8bc77958f
2023-09-18 16:17:05 +02:00
Zuul 24648387cc Merge "Add quorum queues support for service" 2023-09-04 12:43:30 +00:00
Zuul ae713f9c8c Merge "Use proper galera port in configuration" 2023-08-14 11:02:01 +00:00
Zuul 5f6e86a7da Merge "Fix linters and metadata" 2023-08-14 10:48:17 +00:00
Dmitriy Rabotyagov 5683c693c1 Use proper galera port in configuration
While <servuce>_galera_port is defined and used for db_setup
role, it's not in fact used in a connection string for oslo.db.

Change-Id: I6b910817ddc6eab68f815f776faeee432e55012e
2023-07-31 14:27:51 +02:00
Dmitriy Rabotyagov 8413941eaa Fix linters and metadata
With update of ansible-lint to version >=6.0.0 a lot of new
linters were added, that enabled by default. In order to comply
with linter rules we're applying changes to the role.

With that we also update metdata to reflect current state.

Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/888223
Change-Id: I671cc35a055b35fb249ad3054c45ec65f2b54ab4
2023-07-14 12:58:19 +00:00
Simon Hensel 3c014fb2b6 Reduce memory consumption in Cinder services
This patch reduces memory usage for Cinder Volume and Backup services by
tuning glibc.

The specific tuning consist on disabling the per thread arenas and
disabling dynamic thresholds.

This is the equivalent of the devstack proposed patch from Change-Id
Ic9030d01468b3189350f83b04a8d1d346c489d3c

Related-bug: #1908805
Change-Id: I066ee76fe0cef9443f9e9f1ed3c8062d6c6f8566
2023-07-10 11:35:06 +02:00
Dmitriy Rabotyagov af229369fb Add quorum queues support for service
This change implements and enables by default quorum support
for rabbitmq as well as providing default variables to globally tune
it's behaviour.

In order to ensure upgrade path and ability to switch back to HA queues
we change vhost names with removing leading `/`, as enabling quorum
requires to remove exchange which is tricky thing to do with running
services.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/875399
Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/873618
Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-os_glance/+/873632
Change-Id: I9e1f87fd2c396eb4b48459c3055b43678fae296a
2023-07-06 12:56:08 +00:00
Jonathan Rosser 2820fcc1d6 Use v3 service type in keystone_authtoken config
The service type in this config section must match the service
type in the service catalog, otherwise limited scope application
credentials will not work with the cinder API [1].

[1] https://docs.openstack.org/keystone/2023.1/user/application_credentials.html#access-rules

Change-Id: I711241af8f7520b97f2b1cafd1406ff705fb78a6
2023-06-20 15:11:20 +01:00
Dmitriy Rabotyagov 1af3003e16 Define service_user for cinder services
In order to cover OSSA-2023-003, a requirement to define service_user
section for all cinder services has been added by cinder.

Change-Id: I19c2b03c61f714fedb593da8489e50d3fa08d933
2023-05-22 15:57:41 +02:00
Dmitriy Rabotyagov f16036e1f1 Add way to periodically trim Cinder DB
We're adding a service that is responsible for executing db purge.
Service will be deployed by default, but left
stopped/disabled. This way we allow deployers to enable/disable
feature by changing value of cinder_purge_deleted.

Otherwise, when variables set to true once, setting them back to false
won't lead to stopping of DB trimming , so timer would need to be
stopped manually.

Change-Id: Ic5ae8c778bff2858fcb31c85d4b910805e452c3f
2023-05-18 08:10:21 +00:00
Zuul 1732bff64b Merge "Add TLS support to cinder backends" 2023-05-03 11:55:46 +00:00
Damian Dabrowski 2de5a8a1a0 Add TLS support to cinder backends
By overriding the variable `cinder_backend_ssl: True` HTTPS will
be enabled, disabling HTTP support on the cinder backend api.

The ansible-role-pki is used to generate the required TLS
certificates if this functionality is enabled.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/879085
Change-Id: Ib682499e900071db38cc2fd7c30822d0c33dba38
2023-04-29 18:36:09 +02:00
Dmitriy Rabotyagov 7e076b39a4 Move online data migrations to post-restart step
It's supposed that online migrations are executed once services are
upgraded and restarted after upgrade. Eventually, you can run
online migrations before the next upgrade according to the doc [1]

So we move that to a separate file that is executed after all services
are upgraded and handlers are flushed. Tasks are delegated to API hosts
and we clean up facts for them as well.

[1] https://docs.openstack.org/cinder/latest/admin/upgrades.html#database-upgrades

Change-Id: Ic3ecdddd7dcc2dd617c8606278590c8e59230fdf
2023-04-12 19:09:30 +02:00
Dmitriy Rabotyagov 92aba932b1 Ensure service is restarted on unit file changes
At the moment we don't restart services if systemd unit file is changed.

We knowingly prevent systemd_service role handlers to execute
by providing `state: started` as otherwise service will be restarted twice.
With that now  we ensure that role handlers will also listen for systemd
unit changes.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/879671
Change-Id: I8140add1a4e4fdacee89bd29bd2e3c87eff0953a
2023-04-07 09:53:38 +00:00
Dmitriy Rabotyagov 369f01589c Remove rsync requirement for cinder
We used rsync to synchronize filters from rootwrap.d. However, with
smart-source that is not needed anymore, since /etc/cinder is simply
a symlink to the source directory of rsync. We still need os-brick
rootwrap linkage though.

Change-Id: Ib1571c5be67155b584c412da8336de49bc80d948
2023-01-10 15:09:56 +01:00
OpenStack Release Bot 492e519b98 Update master for stable/zed
Add file to the reno documentation build to show release notes for
stable/zed.

Use pbr instruction to increment the minor version number
automatically so that master versions are higher than the versions on
stable/zed.

Sem-Ver: feature
Change-Id: Id4cda2eb6ffdb55a80e555b33b1cae9ee4c5f67c
2022-12-13 13:12:58 +00:00
Zuul 3bc15b4369 Merge "Add coordination support" 2022-12-08 16:17:52 +00:00
Dmitriy Rabotyagov bfb256d49b Define local facts separately only for distro
We do define local facts locally using python_venv_build role so no need
to do the same as a separate task for source installs. Though these
facts are still needed for distro path.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/862924
Change-Id: I5e4717a780a20914bba345bc0e0e275d6ee7b81f
Needed-By: https://review.opendev.org/c/openstack/openstack-ansible/+/866126
2022-12-06 12:07:51 +00:00
Dmitriy Rabotyagov 789d14de9d Add coordination support
This patch adds configuration for coordination service when cinder
active/active setup is used and coordination hosts exist

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/864750
Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/865805
Change-Id: I2dda4c74aa69aea3ecea92954922dbfe1bd56687
2022-11-28 09:05:04 +00:00
Zuul dd9051ed36 Merge "Replace git-core with git for debian" 2022-10-07 10:12:41 +00:00
Dmitriy Rabotyagov 0ebed2408b Replace git-core with git for debian
With ansible-core 2.13 it tries to substitude package resolution in apt
module.
However git-core is used in Debian as transitional name, but ansible
tries to select it and provide version, which is not correct behaviour.
But since git-core is not really valid anyway, we just replace it
to workaround ansible's imperfectness.

Change-Id: Ib0a75886baffec27c8a7d38d729623c7b41216eb
2022-10-05 10:51:20 +02:00
Dmitriy Rabotyagov 0d4b994049 Add nfs and ceph jobs to templates
With changing cinder code we potentially can break some backends.
In order to detect this in time we are adding ceph and nfs scenarios.

We also fix lvm backend for use on RedHat.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/859339
Change-Id: Ifceb2b816199339ec7725bd95cc890595eed95d9
2022-10-04 12:56:58 +02:00
Erik Berg 13bf575d23 Remove redundant vars line
This line was introduced by I21f84809c44ac4be0165fadfb8da67bbcbc9b05c
for centos-7 support, and should already be covered by the
distribution_major_version line above.

Change-Id: I5d5f84b84de35763024709212e0673607127e264
2022-09-14 13:03:52 +02:00
Jimmy McCrory 75d7ae9093 Remove oslo_policy section from cinder.conf
policy.json was deprecated.
Remove the oslo_policy configuration which was still using it.

Change-Id: I0215bb17219745ab2c838a1999caf0a7baa4242d
2022-08-08 23:21:06 -07:00
Zuul 5fadeff98b Merge "Support service tokens" 2022-06-16 12:28:01 +00:00
Zuul c07280e339 Merge "Forcefully remove Cinder v2 endpoints" 2022-06-16 09:08:19 +00:00
Dmitriy Rabotyagov f3b2abb887 Remove mention of haproxy-endpoints role
Role was never migrated to usage of haproxy-endpoints role
and included task was used instead the whole time.
With that to reduce complexity and to have unified approach, all mention
of the role and handler are removed from the code.

Change-Id: I0c055393ccb1c8d61affc2c1bb6d01f0c329afe9
2022-06-14 18:02:35 +00:00
Dmitriy Rabotyagov f755eadadf Support service tokens
Implement support for service_tokens. For that we convert
role_name to be a list along with renaming corresponding variable.

Additionally service_type is defined now for keystone_authtoken which
enables to validate tokens with restricted access rules

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/845690
Change-Id: I1d0156a2ad829aa730419e1d9dfa1cd49026a6be
Related-Bug: #1948456
2022-06-14 11:30:31 +02:00
Dmitriy Rabotyagov 9a8ea212c0 Forcefully remove Cinder v2 endpoints
Nowadays Cinder does not support v2 api so it makes sense to ensure
that these endpoints or service is not present in catalog.

Change-Id: I62a4ba182cc752a5bc4f6e8c4d2430f7e7aafe54
2022-06-14 11:16:07 +02:00
Dmitriy Rabotyagov 091b2dfa72 Switch sphinx language to en
With sphinx release of 5.0.0, they changed default for language variable
to 'en' from None. With that current None valuable is not valid and should
not be used.


Change-Id: I46594578f4e686d02522477255e99ea157cadec4
2022-05-30 16:01:23 +02:00
Zuul 9c170cf1f5 Merge "Setup db/mq/service during scheduler run" 2022-04-26 13:09:42 +00:00
Zuul 252010bb8a Merge "Allow to run cinder role in check mode" 2022-04-23 14:52:37 +00:00
Dmitriy Rabotyagov 4aad247b20 Allow to run cinder role in check mode
Always fetch config files as it's treated as safe operation.
On top of that handle case when there's no local config specified.

Change-Id: I5f5f36da96672679d6801c2a52c58d86657ca612
2022-04-14 18:05:55 +02:00
siavash sardari 66eb424de5 Add the ability to disable send_actions option in cinder-volume-usage-audit service.
Change-Id: I351279dab0d90e60573df7db4c80b63320dff787
Closes-Bug: #1968734
2022-04-13 16:06:34 +04:30
OpenStack Proposal Bot 89f48407c0 Updated from OpenStack Ansible Tests
Change-Id: I2e7fa34ccfa0ed197b461e3408b87cc55ae95e66
2022-04-04 09:37:40 +00:00
Jonathan Rosser e3708903c2 Cleanup setup.py config
Change-Id: Ifef39d280e86cef9a45defe23e2a48bd5c6ce0a3
2022-04-04 10:37:10 +01:00
Andrew Bonney 6efa45e2bd Add configuration option for heartbeat_in_pthread
This configuration option has been observed to result in file
descriptor leaks in certain circumstances. A variable is added
here so that it can be easily overridden.

Related-Bug: #1961603
Change-Id: I8155264b181d6f21728804ef8260979931597427
2022-03-15 10:52:22 +00:00
Jonathan Rosser a9eec797b7 Remove legacy policy.json cleanup handler
Change-Id: Icc44bcf02229ad7d18853a47924b4aa3d3d1b7cd
2022-02-02 04:08:44 -05:00
Zuul 9f2bf29db8 Merge "Use common service setup tasks from a collection rather than in-role" 2022-01-13 13:01:23 +00:00
Dmitriy Rabotyagov 1d8627b360 Setup db/mq/service during scheduler run
According to our playbook, role runs against api last, after scheduler,
volume and backup services are already setup.

It makes difference only when cinder-scheduler and cinder-api are
deployed to different targets.

Change-Id: I18f68b5cb9dd60d9cf72850e840d0459e1245b76
2022-01-13 14:05:35 +02:00
Jonathan Rosser ef8fa2b358 Use common service setup tasks from a collection rather than in-role
Change-Id: I4ffa85e918e515dde2fcae86ff5cf872e65a82c4
2022-01-12 18:30:02 +00:00
Zuul e9531f6241 Merge "Refactor use of include_vars" 2022-01-12 14:59:00 +00:00
Jonathan Rosser 5c7fa97a00 Refactor use of include_vars
Use a first_found lookup instead of a with_first_found loop so that
the 'paths' parameter can be used.

This ensures that only vars from the role are included, and not vars
from a parent calling role. This can happen when a parent role has
a higher priority vars file available for inclusion than the role
it calls.

Change-Id: I5c50529b5e73bac6094c203d49a32497c7a388c3
2022-01-12 08:38:29 +00:00
Damian Dabrowski b0f7154ffe Enable recursion in combine() filter
Ansible's combine() filter needs recursive=True parameter in order to recursively merge nested hashes.

https: //docs.ansible.com/ansible/latest/user_guide/playbooks_filters.html#combining-hashes-dictionaries
Change-Id: I6d5362afe2c52ae08f60ac877ee3d58da3388da6
2022-01-11 19:23:36 +01:00
OpenStack Proposal Bot 3ed476ab07 Updated from OpenStack Ansible Tests
Change-Id: Ie084bb1a212d6834a172b888421dec284ce18ee2
2021-12-17 16:45:39 +00:00
OpenStack Proposal Bot 8732c718fd Updated from OpenStack Ansible Tests
Change-Id: Ib6e646678a102b4b86f0ff06304d7d767aea1921
2021-12-04 17:39:44 +00:00
Damian Dabrowski 210cfc5f8f Database connection pooling improvements
- Implemented new variable ``connection_recycle_time`` responsible for SQLAlchemy's connection recycling
- Set new default values for db pooling variables which are inherited from the global ones.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/819424
Change-Id: Ib445e0ddd01d52314e50ca6edd2fa20e5f6ef3eb
2021-12-03 11:40:36 +01:00