Commit Graph

335 Commits

Author SHA1 Message Date
Zuul bfa8e12fcc Merge "Fix nova device_spec to support multiple values" 2024-02-13 14:37:15 +00:00
Dmitriy Rabotyagov b78e8a68ea Evaluate my_ip address once
Instead of evaluating same condition of my_ip in multiple places across
the role this patch suggests doing this once in vars and using the
resulting variable afterwards.

This not only reduce amount of evaluations made throughout the role runtime,
but also solves possible corner cases where some syntax may go off.

Closes-Bug: #2052884
Change-Id: I454b53713ecacf844ac14f77b6d1e1adc1322c0e
2024-02-11 17:36:15 +01:00
Andrew Bonney c7a976c584 Fix nova device_spec to support multiple values
It appears there was a change to remove the list option when
moving from pci_passthrough_whitelist. Instead device_spec
can be specified multiple times in the file.

This patch aims to resolve this whilst maintaining backwards
compatibility.

Change-Id: I12b38e45d7b41fbf4786d3320e511eb9127fe216
2024-02-06 09:17:58 +00:00
Dmitriy Rabotyagov 5a533aae23 Improve Blazar integration with Nova
As of today we do not have any means of Blazar integration with Nova,
while we do provide roles for Blazar installation for a while now. This
patch aims to bring in more native integration and remove necessity
of overrides for such deployment.

Related-Bug: #2048048
Co-Authored-By: Alexey Rusetsky <fenuks@fenuks.ru>
Change-Id: Ica50a5504de1b1604f72123751cbb3f45c85ab46
2024-01-05 05:27:42 +00:00
Zuul f372c88a09 Merge "Add nova_libvirt_live_migration_inbound_addr to compute SAN" 2023-10-26 09:58:24 +00:00
Dmitriy Rabotyagov 4aa65eb606 Fix logic of discovering hosts by service
For quite some time, we relate usage of --by-service flag for
nova-manage cell_v2 discover_hosts command to the used nova_virt_type.
However, we run db_post_setup tasks only once and delegating to the
conductor host. With latest changes to the logic, when this task in
included from the playbook level it makes even less sense, since
definition of nova_virt_type for conductor is weird and wrong.

Instead, we attempt to detect if ironic is in use by checking hostvars
of all compute nodes for that. It will include host_vars, group_vars,
all sort of extra variables, etc.

Thus, ironic hosts should be better discovered now with nova-manage
command.

Related-Bug: #2034583
Change-Id: I3deea859a4017ff96919290ba50cb375c0f960ea
2023-10-19 08:47:36 +00:00
Dmitriy Rabotyagov 155323fe68 Add nova_libvirt_live_migration_inbound_addr to compute SAN
Some deployments might want to perform live migrations over dedicated
networks, like fast storage network, while keep management over default
mgmt network.

Current default behaviour will prevent such usecase, since
nova_libvirt_live_migration_inbound_addr is not added to the generated
for libvirtd certificate, and thus live migration will fail.

Also to enable users override default behviour more nicely and reduce
code duplication, new variable ``nova_pki_compute_san`` was introduced,
that handles SAN definition for compute nodes.

Change-Id: I22cc1a20190f0573b0350369a6cea5310ab0f0a7
2023-10-18 21:03:11 +02:00
Marc Gariepy 9d2924fa80 Config has changed for pci passthrough.
updating the config for pci devices since the old config is deprecated.
https://docs.openstack.org/nova/latest/configuration/config.html#pci.device_spec

Change-Id: Id2da29464359b4845c7d05e3bec53759341f4bad
2023-09-05 14:28:40 -04:00
Zuul 6873b7d8a1 Merge "Add quorum queues support for the service" 2023-09-04 08:03:03 +00:00
Zuul bf6aaf7ab0 Merge "Enable multiple console proxies where requried in deployments" 2023-08-30 09:49:31 +00:00
Dmitriy Rabotyagov da9793f18e Add quorum queues support for the service
This change implements and enables by default quorum support
for rabbitmq as well as providing default variables to globally tune
it's behaviour.

In order to ensure upgrade path and ability to switch back to HA queues
we change vhost names with removing leading `/`, as enabling quorum
requires to remove exchange which is tricky thing to do with running
services.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/875399
Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/873618
Change-Id: I792595dac8b651debcd364cd245145721575a516
2023-08-28 08:17:52 +00:00
Zuul 2928f95e1a Merge "Fix linters and metadata" 2023-08-14 11:19:50 +00:00
Andrew Bonney d0877c6fd3 Enable multiple console proxies where requried in deployments
When Nova is deployed with a mix of x86 and arm systems
(for example), it may be necessary to deploy both 'novnc' and
'serialconsole' proxy services on the same host in order to
service the mixed compute estate.

This patch introduces a list which defines the required proxy
console types.

Change-Id: I93cece8babf35854e5a30938eeb9b25538fb37f6
2023-08-07 08:19:06 +01:00
Dmitriy Rabotyagov 9b9bc21121 Fix linters and metadata
With update of ansible-lint to version >=6.0.0 a lot of new
linters were added, that enabled by default. In order to comply
with linter rules we're applying changes to the role.

With that we also update metdata to reflect current state.

Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/888223
Change-Id: I730ae569f199fc8542a5a61beb149f459465d7e2
2023-07-17 16:17:30 +02:00
Damian Dabrowski 7000bc3f3f Deprecate nova_ram_weight_multiplier
Long time ago a variable `nova_ram_weight_multiplier` was implemented
and its default value was set to 5.0.
There are 2 issues with this:
1. Default value in nova is 1.0 [1] so our value is much bigger than
nova's default without having a strong reason for that.
2. OSA does not provide similar variables for other multipliers like
`cpu_weight_multiplier`.

Because there are a couple of different multipliers and more of them
can be implemented in the future(for ex.
`hypervisor_version_weight_multiplier` was implemented in 2023.2) it
would be hard for the OSA project to maintain variables for all of them.
It is better to deprecate `nova_ram_weight_multiplier` and let users
define multipliers with `nova_nova_conf_overrides` if necessary.

[1] https://docs.openstack.org/nova/2023.1/configuration/config.html#filter_scheduler.ram_weight_multiplier

Change-Id: I4f82840e94312d38696e3ddd05ef494821233f4d
2023-07-11 21:35:41 +02:00
Dmitriy Rabotyagov efe64725e1 Add way to periodically trim Nova DB
We're adding 2 services that are responsible for executing db purge and
archive_deleted_rows. Services will be deployed by default, but left
stopped/disabled. This way we allow deployers to enable/disable
feature by changing value of nova_archive/purge_deleted.

Otherwise, when variables set to true once, setting them to false won't
lead to stopoing of DB trimming and that would need to be done manualy.

Change-Id: I9f110f663fae71f5f3c01c6d09e6d1302d517466
2023-05-18 08:11:02 +00:00
Zuul dd00e710d7 Merge "Add TLS support to nova API backends" 2023-05-03 14:57:07 +00:00
Damian Dabrowski e02e56fc93 Add TLS support to nova API backends
By overriding the variable `nova_backend_ssl: True` HTTPS will
be enabled, disabling HTTP support on the nova backend api.

The ansible-role-pki is used to generate the required TLS
certificates if this functionality is enabled.

`nova_pki_console_certificates` are used to encrypt:
- traffic between console proxy and compute hosts

`nova_pki_certificates` are used to encrypt:
- traffic between haproxy and its backends(including console proxy)

It would be complex to use nova_pki_console_certificates to encrypt
traffic between haproxy and console proxy because they don't have valid
key_usage for that and changing key_usage would require to manually set
`pki_regen_cert` for existing environments.

Certs securing traffic between haproxy and console proxy are provided in
execstarts because otherwise they would have to be defined in nova.conf
that may be shared with nova-api(which stands behind uwsgi and should
not use TLS).

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/879085
Change-Id: Ibff3bf0b5eedc87c221bbb1b5976b12972fda608
2023-04-29 18:49:39 +02:00
Dmitriy Rabotyagov b6e904213e Remove nova_network_services mapping
At the moment we don't really utilize neutron_provider_networks
mapping except of 2 quite specific drivers, that are NSX and Nuage.
For these 2 usecases we suggest using overrides functionality instead.

Change-Id: I7d905a1dbda1ec722b161b96742247c806bed162
2023-04-04 13:17:03 +00:00
Dmitriy Rabotyagov 0e59a29947 Remove use_forwarded_for definition for nova-api
use_forwarded_for option for api has been deprecated since 26.0.0
as this feature is the duplicate of the HTTPProxyToWSGI that
has being enabled by default now.

Change-Id: I45e70e42605455df944ced63f106a76f351052e8
2023-04-04 13:32:05 +02:00
Dmitriy Rabotyagov 6dfcf9d4c8 Remove calico driver reference
Calico driver support has been removed from OpenStack-Ansible
starting in Antelope release [1]. We clean-up nove role to drop calico
support from it as well.

[1] https://review.opendev.org/c/openstack/openstack-ansible/+/866119

Change-Id: Ie9c118b8bab265e5bf06b6ec05731cd673ee4d95
2023-04-04 13:27:03 +02:00
Jonathan Rosser b0fcbce66f Support configuration of resource providers with config files
Resource providers can be configured using the API or CLI, or they
can also be configured on a per-compute node basis using config
files stored in /etc/nova/provider_config.

This patch adds support for a user defined list of provider config
files to be created on the compute nodes. This can be specified in
user_variables or perhaps more usefully in group_vars/host_vars.
A typical use case would be describing the resources made available
as a result of GPU or other hardware installed in a compute node.

Change-Id: I13d70a1030b1173b1bc051f00323e6fb0781872b
2023-01-16 15:16:29 +00:00
Zuul ab92656a36 Merge "Add nova_ironic_serialconsole_type default setting" 2022-12-06 21:28:44 +00:00
Zuul 43f9881a0b Merge "Improve way of cache backend selection" 2022-10-31 14:13:31 +00:00
Jonathan Rosser 91ef7e41d3 Add nova_ironic_serialconsole_type default setting
This variable determines if one of the nova console proxies is
deployed alongside the nova-compute service for ironic. Currently
the only supported values are "disabled" and "serialconsole"

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/860947
Change-Id: I8eae97f9c60956049072de8b04e557671a8cdcfa
2022-10-11 14:29:31 +01:00
Jonathan Rosser f8dd01ebdc Clarify nova serial proxy bind address
This should be nova_management_address which by default is
equivalent to ansible_host, but the use of ansible_host is confusing
when the whole of the rest of os_nova uses nova_managment_address
for the address to bind services to.

Change-Id: Ie34acf0115d8e89e2888952e1c2d3dc03a284aff
2022-10-06 17:38:02 +01:00
Dmitriy Rabotyagov 242ebe2b54 Improve way of cache backend selection
At the moment we don't provide any option rather then use memcached
backend. With that we also hardocde list of packages that should be
installed inside virtualenv for selected backend.

Adding bmemcached requirement to oslo_cache.memcache_pool [1] gives us
opportunity to refactor this bit of deployment and allow to be more
flexible in backend selection and requirements installation for it.

[1] https://review.opendev.org/c/openstack/oslo.cache/+/854628

Change-Id: I48e193ef29e56aa8639511c5b5dcddc70f5e1198
2022-10-06 16:01:22 +00:00
Dmitriy Rabotyagov 611722ffd7 Remove AvailabilityZoneFilter from scheduler
The 'AvailabilityZoneFilter' is deprecated since the 24.0.0 (Xena)
release. The feature is enabled by query_placement_for_availability_zone
config option and is now enabled by default.

Change-Id: I6be16f7621899a45271a70e7c39d76b837d8c5c9
2022-06-17 08:03:30 +02:00
Dmitriy Rabotyagov c36fdaa960 Support service tokens
Implement support for service_tokens. For that we convert
role_name to be a list along with renaming corresponding variable.

Additionally service_type is defined now for keystone_authtoken which
enables to validate tokens with restricted access rules

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/845690
Change-Id: I04b22722b32b6dc8b1dc95e18c3fe96ad17e51ac
2022-06-15 11:08:48 +02:00
Jonathan Rosser 7a4a35fa7d Ensure that openstack_ssh_keyspairs_dir has a default value
This is otherwise undefined in functional tests

Change-Id: I5a387566d5bdb9ee4c34976c55f86f31fc65f87e
2022-05-04 07:57:01 +01:00
Zuul 9b3081fccf Merge "Implement nova direct RBD image retrieve" 2022-04-26 13:14:04 +00:00
Jonathan Rosser e2fc7361cf Use ssh_keypairs role to generate cold migration ssh keys
This uses ssh signed certificates so there is no longer the need
to distribute the nova public key from each compute  host to all
other compute hosts.

The legacy scripts and authorized key files are removed as a
migration step.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/825292
Change-Id: I3456bdf7bed66a2675b8a410d4cf6b2174598a22
2022-04-11 15:29:15 +00:00
Dmitriy Rabotyagov 3a68118d9b Implement nova direct RBD image retrieve
When nova don't use rbd images (ie local storage) it still might be good
idea to use direct connection to rbd to get images rather then
connect through HTTP.

Change-Id: I4f2d7cf54e07376c7a25d45093f5d83be5422234
2022-03-21 17:29:41 +00:00
Andrew Bonney b1e38084cc Add configuration option for heartbeat_in_pthread
This configuration option has been observed to result in file
descriptor leaks in certain circumstances. A variable is added
here so that it can be easily overridden.

Change-Id: I7de034307da9352e6f5d1f5f175a330fb8c86463
Related-Bug: #1961603
2022-03-15 10:53:42 +00:00
Zuul 559eb382b1 Merge "Drop nova_glance_api_servers variable" 2022-02-15 18:37:04 +00:00
Dmitriy Rabotyagov 5846e4d0b1 Remove secure_proxy_ssl_header logic
According to nova doc, secure_proxy_ssl_header has been deprecated and
has no effect [1]. Since these variables are not used for other purpose
we drop them.

[1] https://docs.openstack.org/nova/latest/configuration/config.html#oslo_middleware.secure_proxy_ssl_header

Change-Id: Ibc3ac4f0f3fb038463748f8c1608fa475374cf67
2022-02-09 09:41:55 +02:00
Dmitriy Rabotyagov 6775f57c75 Drop nova_glance_api_servers variable
Since api_servers from [glance] secton is deprecated and can be
silently ignored [1], we drop corresponsive OSA variable

[1] https://docs.openstack.org/nova/latest/configuration/config.html#glance.api_servers

Change-Id: I52de65a4629f23fd2c0c3735033a8e2d57a82024
2022-02-09 08:55:17 +02:00
Zuul b9dea9e4a0 Merge "Enable recursion in combine() filter" 2022-01-12 11:55:12 +00:00
Damian Dabrowski 0a0776df36 Enable recursion in combine() filter
Ansible's combine() filter needs recursive=True parameter in order to recursively merge nested hashes.

https: //docs.ansible.com/ansible/latest/user_guide/playbooks_filters.html#combining-hashes-dictionaries
Change-Id: I2e84c0370c04336c124e5b6549b638483f107601
2022-01-11 19:22:26 +01:00
Andrew Bonney 7a33271509 Revert "Disable shell for nova when tunneled migration not used"
This reverts commit ca352be75b.

Change-Id: I19e1cc491e2441ab8d1bd39d383dd2e09a5b7077
2022-01-07 11:20:04 +00:00
Dmitriy Rabotyagov ca352be75b Disable shell for nova when tunneled migration not used
Change-Id: If4d036794cf8edb14e6b0ed491cf0de78f425b2c
2021-12-23 16:37:44 +02:00
Zuul 6015ee227c Merge "Database connection pooling improvements" 2021-12-02 15:48:47 +00:00
Damian Dabrowski fcd582731b Database connection pooling improvements
- Implemented new variable ``connection_recycle_time`` responsible for SQLAlchemy's connection recycling
- Set new default values for db pooling variables which are inherited from the global ones.

Change-Id: Ibc876f2744c271e9c4ad797597c15af8d73867c1
2021-12-01 22:04:50 +01:00
Zuul 9200186888 Merge "Refactor definition of lock path" 2021-12-01 19:51:06 +00:00
Dmitriy Rabotyagov 93ef742841 Refactor definition of lock path
Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/819300
Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/819298
Change-Id: If5622f736e17f0f187a0740d60ea435d03a131bb
2021-11-30 12:18:27 +02:00
Dmitriy Rabotyagov b0a26dbd7d Fix certificates group permissions
Change-Id: I6fded616989ccae02d9d34efb68543336f87f848
2021-11-30 10:51:38 +02:00
Zuul e9f3c79832 Merge "Allow to provide mdev addresses as list" 2021-11-16 17:51:29 +00:00
Zuul db6e446bc7 Merge "Enable TLS for VNC from novncproxy to compute hosts" 2021-11-15 12:37:45 +00:00
Dmitriy Rabotyagov ab3bbd50d5 Allow to provide mdev addresses as list
With new Ampere GPUs you need to explicitly define explicit lists of PCI
devices which length depends on picked type as placement can't pick them
automatically due to nvidia driver brokeness.

In order to have readable representation of the variable it's worth
to make it iterable but keep a simple string for
backwards compatability.

Change-Id: I2a1e85efc8ad4f6a2596e6d53b1d793b2f934758
2021-11-12 13:02:06 +02:00
Zuul d62950ac51 Merge "Enable TLS for live migrations" 2021-11-12 00:49:13 +00:00