Commit Graph

78 Commits

Author SHA1 Message Date
Stephen Taylor 2fd438b4b1 Update Ceph images to patched 18.2.2 and restore debian-reef repo
This change updates the Ceph images to 18.2.2 images patched with a
fix for https://tracker.ceph.com/issues/63684. It also reverts the
package repository in the deployment scripts to use the debian-reef
directory on download.ceph.com instead of debian-18.2.1. The issue
with the repo that prompted the previous change to debian-18.2.1
has been resolved and the more generic debian-reef directory may
now be used again.

Change-Id: I85be0cfa73f752019fc3689887dbfd36cec3f6b2
2024-03-12 13:45:42 -06:00
Stephen Taylor f641f34b00 [ceph] Update Ceph images to Jammy and Reef 18.2.1
This change updates all Ceph images in openstack-helm-infra to
ubuntu_jammy_18.2.1-1-20240130.

Change-Id: I16d9897bc5f8ca410059a5f53cc637eb8033ba47
2024-01-30 07:58:03 -07:00
Mosher, Jaymes (jm616v) 07c735f632 Add watch verb to cert-manager Role for vencrypt
Change-Id: I32717302aee97748574d8767b1d19824577ad41b
2023-10-16 09:10:08 -06:00
Stephen Taylor 5e5a52cc04 Update Rook to 1.12.5 and Ceph to 18.2.0
This change updates Rook to the 1.12.5 release and Ceph to the
18.2.0 (Reef) release.

Change-Id: I546780ce33b6965aa699f1578d1db9790dc4e002
2023-10-13 12:58:56 -06:00
Vladimir Kozhukalov 47b94340e9 Add 2023.2 Ubuntu Jammy overrides for libvirt chart
Change-Id: I4c9c3f290622df19953b94c61424bcece98d904f
2023-10-09 17:24:12 -05:00
Mohammed Naser b12e6fb436 fix(libvirt): add HOSTNAME_FQDN to certificate
Change-Id: I2d9e0053aa0f774b6621d6b5aadbd84c3a59a97b
2023-10-04 15:29:21 -04:00
Mosher, Jaymes (jm616v) f234218dba Allow enabling vencrypt for VNC
This patchset allows enabling vencrypt for VNC, based on a
downstream patchset. [1]

Primary differences:
- script to generate pod-specific certs has been moved under
  values.conf.vencrypt.cert_init_sh to allow for it to be
  overridden if necessary
- leaves the creation of a (sub)issuer for vencrypt as
  outside the scope of this (and the nova) chart
- issuer to use to sign these certs configurable under:
  values.conf.vencrypt.issuer.kind
  values.conf.vencrypt.issuer.name
- added manifests.role_cert_manager to control creation of
  roles needed to create/update certs

1. https://github.com/vexxhost/atmosphere/pull/483

Change-Id: I955015874fed2b24570251c4cad01412bbab6045
2023-08-29 09:18:44 -06:00
root 8a650594b8 Set targeted dependency of libvirt with ovn networking backend
Change-Id: I95fb525f4b91224cfd12a26eb7b873147de4e818
2023-08-25 14:50:19 +00:00
Sadegh Hayeri 4fc46f1808 Disable libvirt cgroup functionality for cgroup v2
Change-Id: I5a9f1828d7c2f36e14de89323868c4a1dbebba64
2023-07-08 10:18:58 +03:30
Stephen Taylor 45b492bcf7 [ceph] Update Ceph to 17.2.6
This change updates the openstack-helm-infra charts to use 17.2.6
Quincy images based on Focal.

See https://review.opendev.org/c/openstack/openstack-helm-images/+/881217

Change-Id: Ibb89435ae22f6d634846755e8121facd13d5d331
2023-05-09 12:25:07 +00:00
Vladimir Kozhukalov d67ce6740b Update kubernetes cgroup value for libvirt
The reason for this PR is that in most cases
we utilize systemd cgroup driver nowadays.
So it worth it to set kubepods.slice cgroup root
by default.

https: //github.com/kubernetes/kubernetes/blob/release-1.26/pkg/kubelet/cm/cgroup_manager_linux.go#L77-L81
Change-Id: I0cad148eb827439815c7e5bad1d6b6108cd1ab8d
2023-03-31 04:28:55 +03:00
Samuel Liu 6034a00bf7 Replace node-role.kubernetes.io/master with control-plane
The master label is no longer present on kubeadm control plane nodes(v1.24). For new clusters, the label 'node-role.kubernetes.io/master' will no longer be added to control plane nodes, only the label 'node-role.kubernetes.io/control-plane' will be added. For more information, refer to KEP-2067[https://github.com/kubernetes/enhancements/tree/master/keps/sig-cluster-lifecycle/kubeadm/2067-rename-master-label-taint]: Rename the kubeadm "master" label and taint.

the kubernetes pr: https://github.com/kubernetes/kubernetes/pull/107533

Change-Id: I3056b642db0a1799089998e3c020b4203c9a93ab
2023-03-20 13:38:07 +08:00
Sadegh Hayeri 6c5206a01c Add ovn
Change-Id: I2b1457042afcbe1375b771161acfa929a91e6813
2023-03-17 22:11:55 +03:00
Stephen Taylor fc92933346 [ceph] Update all Ceph images to Focal
This change updates all Ceph image references to use Focal images
for all charts in openstack-helm-infra.

Change-Id: I759d3bdcf1ff332413e14e367d702c3b4ec0de44
2023-03-16 16:39:37 -06:00
Karl Kloppenborg 4035a5e4f2 feat: adding support for external-ceph keyrings to be present in libvirt deployments without local ceph needing to be available
chore: updated release notes
feat: update libvirt launch script for external ceph
Change-Id: Ie44f962d1ba538f6f8badfd1a627cb99e190c7b0
2023-01-16 02:06:30 +00:00
SPEARS, DUSTIN (ds443n) d279c5ecdf [libvirt] Remove use of exec
Using the combination of `exec` and `systemd-run` is not compatable with containerd v1.6.6.

Change-Id: I80e3b92915830f7d2377688c9b229631348d4354
2022-09-01 10:57:25 -04:00
Brian Haley f31cfb2ef9 support image registries with authentication
Based on spec in openstack-helm repo,
support-OCI-image-registry-with-authentication-turned-on.rst

Each Helm chart can configure an OCI image registry and
credentials to use. A Kubernetes secret is then created with these
info. Service Accounts then specify an imagePullSecret specifying
the Secret with creds for the registry. Then any pod using one
of these ServiceAccounts may pull images from an authenticated
container registry.

Change-Id: Iebda4c7a861aa13db921328776b20c14ba346269
2022-07-20 14:28:47 -05:00
root 58becf2886 Add libvirt exporter as a sidecar in the libvirt chart
Users can enable the libvirt exporter sidecar by set
values.sidecars.libvirt_exporter as true.

Change-Id: I7451aa278982bced3178ac3e001eaad3b63d005d
2022-05-11 02:51:45 +10:00
Gage Hugo 668de27da3 Remove unused overrides and update default image
This change updates the default libvirt image value and removes
several unused values overrides for the libvirt chart.

Change-Id: I0a0b81de017f33c2cabf5311f5288c8f46191d8b
2022-04-27 11:25:07 -05:00
Thiago Brito 1e2b18f6c3 Enable taint toleration for libvirt
This adds taint toleration support for openstack jobs

Signed-off-by: Lucas Cavalcante <lucasmedeiros.cavalcante@windriver.com>
Change-Id: I8e1a719235b364907491df25ce7e32133163ecf9
2022-03-23 18:09:12 +00:00
Ritchie, Frank (fr801x) ec69dd0ef9 Exec libvirt even when creating secrets
With "hostPid: true" we want the entrypoint process to be libvirtd not a wrapper so that process lifecycle management works as expected.

The fix for now is

  * start libvirtd
  * create secrets (libvirtd needs to be running for this)
  * kill it

then start it again using exec so libvirtd is the entrypoint pid
and container lifecycle should work as expected.

Change-Id: I9ef8a66da0fba70e8db4be3301833263de0617e8
2022-03-22 14:08:26 +00:00
Gage Hugo 22e50a5569 Update htk requirements
This change updates the helm-toolkit path in each chart as part
of the move to helm v3. This is due to a lack of helm serve.

Change-Id: I011e282616bf0b5a5c72c1db185c70d8c721695e
2021-10-06 01:02:28 +00:00
Andrii Ostapenko 15b43d939e Use focal libvirt image for victoria and wallaby
Change-Id: I70a989aeaac3d763b110cc854e00fa33d5f8861a
Signed-off-by: Andrii Ostapenko <andrii.ostapenko@att.com>
2021-07-31 20:54:08 +00:00
Anjeev Kumar b11b4ae6c3 Enable probes override from values.yaml for libvirt
This PS enables overriding liveness/readiness probes configurations
for libvirt pods via values.yaml. In addition, updating the values
for some of the fields of the probes as the default values seem to
be too aggresive.

Change-Id: I64033a1d67461851d8f2d86905ef7068c2ec43b6

Co-authored-by: Huy Tran <ht095u@att.com>
Change-Id: Ib10379829e2989d3de385ad6d1944565b2f9953f
2021-07-13 14:08:59 -05:00
Thiago Brito 5a0ba49d50 Prepending library/ to docker official images
This will ease mirroring capabilities for the docker official images.

Signed-off-by: Thiago Brito <thiago.brito@windriver.com>
Change-Id: I0f9177b0b83e4fad599ae0c3f3820202bf1d450d
2021-06-02 15:04:38 -03:00
okozachenko 054c5fde24 Set unix socket auth method as none
We are gonna use libvirt unix socket in nova.
We are trying to realize live migration in libvirt while guarantee
secure. To realize this, replaced 127.0.0.1 with 0.0.0.0 for listen
address and plus enabled tls instead bare tcp.
And in the nova, used libvirt unix socket to connect instead of tcp
127.0.0.1 connection.
fyi, https://review.opendev.org/752108/
and https://review.opendev.org/752125/

Change-Id: Idb7d3a0d90be84d96b541c41fb90abdd33b7de94
2021-02-13 20:20:18 +00:00
Huang, Sophie (sh879n) df3918b4fe [Libvirt] Values overrides for external Ceph Cinder backend
Example values_overrides file is added to indicate how to
override the Libvirt manifest for configure an additional
externally managed Ceph Cinder backend.

Change-Id: I8e7a294059a2d98fb7854a281a29dcff80530d2b
2020-10-08 15:01:58 +00:00
okozachenko 3bcb347a5b Realize libvirt SSL
Motivation: libvirt 127.0.0.1 listen is terrible for live migration.
To resolve that, we can use 0.0.0.0 but it is not secure so tried
to realize SSL.
Once create secrets for cacert, client&server cert and keys then it will
 mounted on libvirt daemonset.
It means all instances use the same key and cert. This is not ideal
 but can be considered as the first stage.

Change-Id: Ic3407e484039afaf98495e0f6028254c4c2a0a78
2020-09-25 16:36:42 +03:00
Andrii Ostapenko 1532958c80
Change helm-toolkit dependency version to ">= 0.1.0"
Since we introduced chart version check in gates, requirements are not
satisfied with strict check of 0.1.0

Change-Id: I15950b735b4f8566bc0018fe4f4ea9ba729235fc
Signed-off-by: Andrii Ostapenko <andrii.ostapenko@att.com>
2020-09-24 12:19:28 -05:00
Huang, Sophie (sh879n) b0fcd5a411 [Libvirt] Add support for Cinder external ceph backend
This patchset adds a libvirt secret for the Cinder uuid of external
ceph backend when Cinder externally managed ceph backend is
enabled.

Change-Id: I3667c13c31e49f00d2be02efa6d791ce0a580a8d
2020-09-17 22:40:19 +00:00
Mohammed Naser c7a45f166f Run chart-testing on all charts
Added chart lint in zuul CI to enhance the stability for charts.
Fixed some lint errors in the current charts.

Change-Id: I9df4024c7ccf8b3510e665fc07ba0f38871fcbdb
2020-09-11 18:02:38 +03:00
Andrii Ostapenko 824f168efc Undo octal-values restriction together with corresponding code
Unrestrict octal values rule since benefits of file modes readability
exceed possible issues with yaml 1.2 adoption in future k8s versions.
These issues will be addressed when/if they occur.

Also ensure osh-infra is a required project for lint job, that matters
when running job against another project.

Change-Id: Ic5e327cf40c4b09c90738baff56419a6cef132da
Signed-off-by: Andrii Ostapenko <andrii.ostapenko@att.com>
2020-07-07 15:42:53 +00:00
Andrii Ostapenko 83e27e600c Enable key-duplicates and octal-values yamllint checks
With corresponding code changes.

Change-Id: I11cde8971b3effbb6eb2b69a7d31ecf12140434e
2020-06-17 13:14:30 -05:00
Andrii Ostapenko 8f24a74bc7 Introduces templates linting
This commit rewrites lint job to make template linting available.
Currently yamllint is run in warning mode against all templates
rendered with default values. Duplicates detected and issues will be
addressed in subsequent commits.

Also all y*ml files are added for linting and corresponding code changes
are made. For non-templates warning rules are disabled to improve
readability. Chart and requirements yamls are also modified in the name
of consistency.

Change-Id: Ife6727c5721a00c65902340d95b7edb0a9c77365
2020-06-11 23:29:42 -05:00
Andrii Ostapenko 731a6b4cfa Enable yamllint checks
- document-end
- document-start
- empty-lines
- hyphens
- indentation
- key-duplicates
- new-line-at-end-of-file
- new-lines
- octal-values

with corresponding code adjustment.

Change-Id: I92d6aa20df82aa0fe198f8ccd535cfcaf613f43a
2020-05-29 19:49:05 +00:00
Gage Hugo d14d826b26 Remove OSH Authors copyright
The current copyright refers to a non-existent group
"openstack helm authors" with often out-of-date references that
are confusing when adding a new file to the repo.

This change removes all references to this copyright by the
non-existent group and any blank lines underneath.

Change-Id: I1882738cf9757c5350a8533876fd37b5920b5235
2020-05-07 02:11:15 +00:00
diwakar thyagaraj 6632b114b8 [FIX] Fixes libvirt apparmor and gate jobs
This change refactors the apparmor job to utilize the feature
gates system instead of relying on separate scripts.

Change-Id: I51b36c1972ff3ee8d4366bf2d5027e433721d740
2020-04-03 18:17:58 +00:00
Chris Wedgwood 14d8118e2e [libvirt] update values.yaml to use train libvirt image
this means the chart works 'as-is' (with the rest of the currently
released components) in most cases without the explicit need for an
image override.

Change-Id: Id11079b5ce3a8d1010e604300f457e4060aee582
2020-03-14 12:49:02 +00:00
Zuul 266a3eb457 Merge "Revert "Make more sections in daemonset overridable."" 2020-03-13 19:53:46 +00:00
Pete Birley 0a2ecabb2b Revert "Make more sections in daemonset overridable."
This reverts commit d74e937726.

This change looks ok, but we need use cases, and tests to make a change to such a complex and heavily used part of osh

(see: http://eavesdrop.openstack.org/meetings/openstack_helm/2020/openstack_helm.2020-03-03-16.00.log.html)

Change-Id: Ice77dcb53fee0e7a64ade9415f9cbf25f5d51d0e
2020-03-13 16:18:52 +00:00
Chinasubbareddy Mallavarapu 444a5ae67f [libvirt] Use ceph image for ceph related scripts
This is to update two of init containers to use ceph confighelper image as
they are executing ceph based scripts and the image also will have latest
clients installed for ceph activities.

Change-Id: Ie4fbd8af2645d5bc5b7e4f0fd22874987a0f55f6
2020-03-03 15:31:42 +00:00
songgongjun d74e937726 Make more sections in daemonset overridable.
The work of enable dpdk in starlingx needs to achieve the overrides
of parameters such as images, tags, labels, and pods. This function
is being implemented through the support of ovs per-host overrides.
In order to transfer the parameters such as images after overrides
to the daemonset file to achieve the corresponding functions, the
functions of overrides need to be upgraded. Move the $daemonset_yaml
parameter in the daemonset file to the overrides file, so that
daemonset file uses parameters after overrides.This patch and
https://review.opendev.org/#/c/707775/ depend on each other.

Change-Id: I210e54b28e32ba1b8e281659fee8e6eda38d79d0
Story: 2007291
Task: 38754
Depends-on: https://review.opendev.org/#/c/708894/
Signed-off-by: songgongjun <gongjun.song@intel.com>
2020-03-03 05:28:53 +00:00
Tin Lam aa48b16896 Add train release support
This patch set adds in needed override to support OpenStack Train
release by moving the libvirt version to > 3.0.0.

Change-Id: I36097544024df5c6dfc87a032bd8383be98f1a3a
Signed-off-by: Tin Lam <tin@irrational.io>
2020-02-07 08:56:21 -06:00
Roy Tang 57c2c0620c Fix apparmor annotation of libvirt.
Change-Id: I9b37bea8fe3476e4586c261156f15ca63f4658be
2019-12-11 10:44:53 -06:00
Steve Wilkerson cbeb7f149b Move charts off using the :latest built tags
This updates charts that consume images built from osh-images to
use tags other than the :latest tags. This will be followed up
with the definition of jobs to allow for vetting out of updated
images, as reliance on :latest tags assumes any change merged into
osh-images will result in functionally correct behavior (which has
shown to not be the case traditionally)

Change-Id: I181aa56ed187604dc7583d8081e53cc69eb27310
Signed-off-by: Steve Wilkerson <sw5822@att.com>
2019-11-21 19:57:07 +00:00
Zuul 56a743e061 Merge "Kill libvirtd proc if any before start libvertd" 2019-10-21 15:43:00 +00:00
Steve Wilkerson b50fae62a4 Update kubernetes-entrypoint image reference
This updates the kubernetes-entrypoint image reference to consume
the publicly available kubernetes-entrypoint image that is built
and maintained under the airshipit namespace, as the stackanetes
image is no longer actively maintained

Change-Id: I5bfdc156ae228ab16da57569ac6b05a9a125cb6a
Signed-off-by: Steve Wilkerson <sw5822@att.com>
2019-10-18 18:20:11 +00:00
Huang, Sophie (sh879n) 4374c3fd74 Kill libvirtd proc if any before start libvertd
In the startup script of libvirtd, existing libvirt process,
if any, is killed before new process is created.

Change-Id: If0276353e38896962697a3f451d25d4930745c53
2019-10-17 21:20:52 +00:00
Gage Hugo f0779e2825 Add network policy value overrides
This change adds network policy overrides for multiple infra
services for the openstack-helm network policy gate.

Change-Id: If051ec1749cb9ed1e289f0cf82a8876371e36531
2019-09-24 13:48:10 +00:00
Gage Hugo ab3ab66bcb Add open egress rules to multiple infra charts
This change adds egress rules to the following charts:
- ingress
- memcache
- libvirt
- rabbitmq

These rules will be tightend down in future changes

Change-Id: I6f297d50ca4c06234c7c79986a12cccf3beb5efb
2019-09-12 13:07:19 -05:00