Set PrivateDevices=false for Galera

This patch sets the `galera_disable_privatedevices` variable in the
galera_server role. If galera is deployed with a container, the
PrivateDevices configuration will be disabled in MariaDB's systemd
unit file.

Related-Bug: 1697531
Change-Id: I3dce66a5fa94d8a1a27280244622ca68036e6ad1
(cherry picked from commit d10f52bb18)

ansible-role-requirements.yml

@@ -13,7 +13,7 @@
 - name: galera_server
   scm: git
   src: https://git.openstack.org/openstack/openstack-ansible-galera_server
-  version: e47877adc99bf64b900c83056716dfc09f2bcc0b
+  version: c6d36689655586971fbd4be8a6cba2f54b5f44b3
 - name: ceph_client
   scm: git
   src: https://git.openstack.org/openstack/openstack-ansible-ceph_client

playbooks/inventory/group_vars/galera_all.yml

@@ -17,3 +17,7 @@ galera_client_drop_config_file: true
 
 # Ensure that the package state matches the global setting
 galera_server_package_state: "{{ package_state }}"
+
+# Disable PrivateDevices for MariaDB on CentOS 7
+# See https://bugs.launchpad.net/openstack-ansible/+bug/1697531 for details.
+galera_disable_privatedevices: "{{ ((properties.is_metal | default(false)) | bool) | ternary('false', 'true') }}"

releasenotes/notes/centos-galera-privatedevices-4958f0be6cffa466.yaml

@@ -0,0 +1,14 @@
+---
+issues:
+  - |
+    OpenStack-Ansible sets a new variable, `galera_disable_privatedevices`,
+    that controls whether the `PrivateDevices` configuration in MariaDB's
+    systemd unit file is enabled.
+
+    If the `galera_server` role is deployed on a bare metal host, the MariaDB
+    default is maintained (`PrivateDevices=true`). If the `galera_server` role
+    is deployed within a container, the `PrivateDevices` configuration is set
+    to `true` to work around a systemd bug with a bind mounted `/dev/ptmx`.
+
+    See `Launchpad Bug 1697531 <https://bugs.launchpad.net/openstack-ansible/+bug/1697531>`_
+    for more details.