We exuberantly announce the release of: tripleo-heat-templates 12.6.0: Heat templates for deploying OpenStack with OpenStack. This release is part of the victoria release series. The source is available from: https://opendev.org/openstack/tripleo-heat-templates Download the package from: https://tarballs.openstack.org/tripleo-heat-templates/ Please report issues through: https://bugs.launchpad.net/tripleo/+bugs For more details, please see below. 12.6.0 ^^^^^^ New Features ************ * Adds a new ContainerNovaLibvirtPidsLimit parameter in order to set the PIDs limit for nova_libvirt container. Defaults to 65536, set to 0 for unlimited. * This change updates the multiple-nics and multiple-nics-vlans templates so that an external bridge is created if either the role uses the External network or the "external_bridge" tag is set in the role definition. This is done instead of checking if the role name is "Controller". This change also assigns the "external_bridge" tag to the Controller as well as the Compute roles so that both roles can access the Neutron external bridge for floating IPs or SNAT by default so that OVN can use DVR. * The following parameters were added to support configuration of gnocchi nfs backend. * GnocchiNfsEnabled * GnocchiNfsShare * GnocchiNfsOptions * The MariaDB tuning parameter for Innodb_buffer_pool_size can now be set via a new TripleO Heat Template parameter 'MySQLInnodbBufferPoolSize'. By default this is undefined. * The following parameters are now role specific: * IronicConductorGroup * IronicCleaningNetwork * IronicProvisioningNetwork * IronicRescuingNetwork This allow operators to deploy the Baremetal service in a configuration with multiple conductor groups utilizing different networks for provisioning, cleaning and rescuing per conductor group or conductor. * The nova-ironic setting for 'max_concurrent_builds' can now be set via the use of a new TripleO Heat templates parameter 'IronicMaxConcurrentBuilds'. It is set to the service default of 10 by default in TripleO Heat templates. * Add the NovaImageCacheTTL to the nova compute service. This exposes the remove_unused_original_minimum_age_seconds from nova.conf which controls the time (in seconds) that nova compute should continue caching an image once it is no longer used by and instances on the host. Defaults to 86400 (24hrs) * Floating IP port forwarding is now supported under ML2/OVN. A more detailed explanation can be found in bug 1877447 (https://bugs.launchpad.net/neutron/+bug/1877447). * Adding support for PowerFlex cinder driver. * Support for PowerStore backend cinder driver. Supports both iSCSI and FC protocols and support deploying one or multiple cinder PowerStore storage backends. * When SwiftRawDisks is set, try to mount the disks using uuids instead of paths. This makes mounts more stable, eg. if a kernel gets updates and device orders are changed. Upgrade Notes ************* * The "external_bridge" tag is now used for the Compute node. An external network bridge is required on the compute nodes in order to host floating IPs when using DVR. OVN deploys with DVR by default. * The CIDR for the StorageNFS network in the sample network_data_ganesha.yaml file has been modified to provide more usable IPs for the corresponding Neutron overcloud StorageNFS provider network. Since the CIDR of an existing network cannot be modified, deployments with existing StorageNFS networks should be sure to customize the StorageNFS network definition to use the same CIDR as that in their existing deployment in order to avoid a heat resource failure when updating or upgrading the overcloud. * Operators utilizing the "firstboot/os-net-config-mappings.yaml" should remove the resource registry entry. The template was replaced by a module in ansible. The data format and parameter "NetConfigDataLookup" is still used. * The deprecated``ManilaCephFSDataPoolPGNum`` and "ManilaCephFSMetadataPoolPGNum" parameters have been removed. As with the other Ceph pools, use the "CephPoolDefaultPgNum" parameter for the default value, or "CephPools" to override pg_num for specific pools. Deprecation Notes ***************** * The firstboot template "firstboot/os-net-config-mappings.yaml" that was used to create an os-net-config mapping file has been deprecated and replaced by an ansible module. The parameter "NetConfigDataLookup" remains with no data format change for compatibility. * As the fast forward upgrade workflow to skip multiple releases now relies on the very same upgrade_tasks, there is no need to mantain the fast_forward_upgrade_tasks, as well as any of its references. * Resource OS::TripleO::Services::CinderBackendDellEMCVxFlexOS is deprecated. Use the new resource OS::TripleO::Services::CinderBackendDellEMCPowerFlex. Bug Fixes ********* * Designate producers will no longer be deployed in standalone mode and produce duplicates as they are now configured to coordinate via redis. * Fixed issue in the sample network_data_ganesha.yaml file where the IPv4 allocation range for the StorageNFS network occupies almost the whole of its CIDR. If network_data_ganesha.yaml is used without modification in a customer deployment then there are too few IPs left over in its CIDR for use by the corresponding overcloud Neutron StorageNFS provider network for its overcloud DHCP service. (See bug: #1889682 (https://bugs.launchpad.net/tripleo/+bug/1889682)) * Previously, HorizonDebug and Debug parameters change the value of horizon::django_debug. However, those parameters didn't set DEBUG log level to horizon logger components. By this change, if those are true, horizon::log_level is set to 'DEBUG'. * Fix Swift ring synchronization to ensure every node on the overcloud has the same copy to start with. This is especially required when replacing nodes or using manually modifed rings. Changes in tripleo-heat-templates 12.5.0..12.6.0 ------------------------------------------------ a584099b9 Make sure we noop the Rabbitmq_ providers 4b0cc36ef Make sure we noop the Mysql_ providers 87b365afd Fix Flakes and lower-constraints errors 884be2060 Replace deprecated nova::compute::ironic::max_concurrent_builds 7b9199de9 os-net-config-mappings move out of firsboot 89e35393d Add parameter and CI config to enable Ceph OTW encryption 168961d66 Add environment to enable nova on undercloud ab25f7d4d Remove ipa-client install task from undercloud-tls playbook dc959f17c Make sure IPA has the right ACI 88ca5928e Remove CI env for net-config-multinode-os-net-config.yaml 83d1cb585 pcs commands on host: redis bundle 4e76e1fb7 pcs commands on host: ovn dbs f37f21f31 pcs commands on host: cinder backup/volume 0e03ba791 Add the NovaImageCacheTTL to the nova compute service 13cc41a23 Fix Swift ring file synchronization issue 62a22a831 Add post_upgrade_task and remove puppet-ceph pkg a1bee3913 pcs commands on host: manila-share fdf873861 Mount libpod container volume into collectd container cd6aae1ec reno only - ironic role specific parameters 846cb94bc Add new ansible tag for network configuration 29bc3de01 pcs commands on host: rabbitmq da3d5e805 pcs commands on host: mysql a11622359 pcs commands on host: haproxy bundle 05d943107 Expose Innodb_buffer_pool_size 2035b88f5 DCN: use FQDN in glance endpoint with internal TLS 8c358e2e7 Fix nCipher (aka thales) ansible role name 500ba0479 Remove Etcd from DCN roles that don't need it cdcadbadc Ironic role_specific parameters efe179190 Expose max_concurrent_builds as a Heat parameter ccee58a60 Remove usage of RetryFilter b81035d00 Default to storage_dashboard, when set, for the CephDashboard service 4e8a05833 Use appropriate allocation pools for StorageNFS e4fd78880 Re-enable driver agent for scenario 10 c7ec72627 Use container_file_t for Cinder*NfsMountOptions by default 9d71882a4 Set a higher PIDs limit for nova_libvirt container f860ca59a dpdk_telemetry is not used 1890ab0fb Expose mistral::rpc_response_timeout as Heat parameter 4d8c87a09 Modify how libvirt related containers use SELinux 6206d1959 Use UUID for mounted SwiftRawDisks 7010c60ee Revert "Disable Designate service for scenario 03" 164fac75a minor update: only migrate HA VIP away when needed 798010fab Remove deprecated Manila PGNum parameters 6d5ecfcdf Remove all UIConfig endpoints 4ac4524b1 Fix wrong description about cinder db purge a9be4c6a3 [FFWD Ceph] Fix ceph post_upgrade_tasks for osd options ec6305988 enable ovs_stats and ovs_events plugins for neutron ovs dpdk agent 94997223b Fix endpoint map tls - zaqar wss port bc5b6133f Create external bridge on Compute nodes by default for OVN with DVR dcfc98d23 Fix pcs restart in composable HA 973b056d9 Remove rrdtool from collectdExtraPLugins e892d4004 Fix up ovn-dbs update tasks a26638224 Create Container configs with a new module 1e1ea11be Create container config scripts with a new module bdca0a03f Set keystone::cache parameters 40fa5244c [ovn]: Enable port forwarding in neutron service plugins 67dfa755e Revert "Workaround rhel8,0 iptables bug causing neutron_ovs_agent to restart continuously" 20131fd66 Do not hard-code vars_from a9e95b26b [ovn] Don't add conntrack entries for Geneve dcab84386 Add redis password for designate coordination 357a3eeb2 undercloud_upgrade: tear-down keepalived 1547fc8e3 Fix delegation with FreeIPA cleanup 2f460accb pcmk_remote FFU support for Instance HA c4a270eec Run external_deploy_tasks per step for each role 52fdbaf9b Remove YAQL queries for RabbitCookie 7858b573e Deprecating VxFlex OS Cinder Config b5dad0cf1 Switch host sshd configuration to ansible d8e5ccb8c Add PermitRootLogin option in sshd_config before leapp. 2e76336c4 Remove remaining Skydive references b3ec03464 Reset sriov_numvfs to 0 before leapp upgrade dc171d249 Remove all broken references to ./puppet/services 19402ff04 Consolidate the barbican-api client configurations f217eccc7 Align kernel args for system upgrade using leapp ba471ee46 Fix HA resource restart when no replicas are running e1d2ece78 Use sensible defaults for novnc TLS minimum versions and ciphers 6c33feb30 Add CephAnsibleRepo warning to make this validation more flexible b3fd483c2 Use tripleo_network_config 08415cb54 Support for PowerFlex Cinder Backend ead85251e Add new Luna HSM parameter for Barbican 0f5923d1d Update Nova VNC puppet variables 0f5488940 Rolling certificate update for HA services 8ca2b598c Add openvswitch special treatment to update too. 56e2702f4 Support for PowerStore Cinder Backend 7bcdd2448 Revamp how etcd's cert and key are handled in containers 0a27ab493 Small improvement on the default gateway(s) detection 2b7181352 Do not manage healthcheck for nova-compute anymore 812aa726e Set 'DEBUG' to horizon::log_level if HorizonDebug or Debug is true 9b894ecb6 Remove redundant file management for /run/redis a6bbb4941 Add support for Gnocchi NFS Backend ac50d6483 Unset keystone::public_endpoint 5e553da93 Update, avoid task skipping by directly importing step file. 7ff794663 Add dashboard_protocol variable when internal_tls is enabled 8783ec9c4 Remove ffwd-upgrade leftovers from THT. 52831ef10 Memcached collectd plugin uses host URI instead of IP address. ea62bcf15 Stop using a conditional for role tasks 7a46a91e7 Remove strategy comment d5820dba4 Generated passthrough_whitelist shall use all the user_configs fields bf279de03 Attempt to remove octavia tls proxy service only present 86d5adf3a Add missing config_files kolla directives adef06e43 Use parameters in new neutron::server::notifications::nova class 6c3c8b41d Avoid failing on deleted file b91a1a09c Ensure redis_tls_proxy starts after all redis instances c8d4429e9 Remove usage of ineffective parameter in nova::api class 3353d8cbd Cleanup parameters for keystone::bootstrap a6f0a8eae Enable Dashboard on scenario004 4697bc2a5 Fix typos Diffstat (except docs and test files) ------------------------------------- ci/common/net-config-multinode-os-net-config.yaml | 271 ----- ci/environments/multinode-containers.yaml | 4 +- ci/environments/scenario001-standalone.yaml | 7 +- ci/environments/scenario003-standalone.yaml | 18 +- ci/environments/scenario004-standalone.yaml | 6 +- .../scenario007-multinode-containers.yaml | 4 +- ci/environments/scenario010-standalone.yaml | 1 - common/deploy-steps-tasks-step-1.yaml | 29 +- common/deploy-steps.j2 | 276 +---- common/services/role.role.j2.yaml | 20 - .../nova_statedir_ownership.py | 68 +- .../pacemaker_mutex_restart_bundle.sh | 90 ++ .../pacemaker_resource_lock.sh | 237 ++++ .../pacemaker_restart_bundle.sh | 13 +- container_config_scripts/wait-port-and-run.sh | 18 + deployment/README.rst | 30 - deployment/aodh/aodh-api-container-puppet.yaml | 46 - .../aodh/aodh-evaluator-container-puppet.yaml | 18 - .../aodh/aodh-listener-container-puppet.yaml | 18 - .../aodh/aodh-notifier-container-puppet.yaml | 18 - .../barbican/barbican-api-container-puppet.yaml | 79 +- deployment/barbican/barbican-client-puppet.yaml | 15 +- .../ceilometer-agent-central-container-puppet.yaml | 18 - .../ceilometer-agent-compute-container-puppet.yaml | 18 - .../ceilometer-agent-ipmi-container-puppet.yaml | 18 - ...ometer-agent-notification-container-puppet.yaml | 18 - deployment/ceph-ansible/ceph-base.yaml | 70 +- deployment/ceph-ansible/ceph-mds.yaml | 3 +- deployment/ceph-ansible/ceph-mgr.yaml | 1 + deployment/ceph-ansible/ceph-mon.yaml | 3 +- deployment/ceph-ansible/ceph-osd.yaml | 52 +- deployment/ceph-ansible/ceph-rgw.yaml | 3 +- .../certs/certmonger-user-baremetal-puppet.yaml | 9 + deployment/cinder/cinder-api-container-puppet.yaml | 55 +- .../cinder/cinder-backend-dellemc-powerflex.yaml | 149 +++ .../cinder-backend-dellemc-powerstore-puppet.yaml | 105 ++ .../cinder/cinder-backend-netapp-puppet.yaml | 2 +- .../cinder/cinder-backup-container-puppet.yaml | 11 +- .../cinder/cinder-backup-pacemaker-puppet.yaml | 107 +- deployment/cinder/cinder-base.yaml | 18 +- .../cinder/cinder-common-container-puppet.yaml | 4 +- .../cinder/cinder-scheduler-container-puppet.yaml | 27 +- .../cinder/cinder-volume-container-puppet.yaml | 46 +- .../cinder/cinder-volume-pacemaker-puppet.yaml | 101 +- deployment/containers-common.yaml | 9 + deployment/database/mysql-base.yaml | 11 + deployment/database/mysql-container-puppet.yaml | 23 - deployment/database/mysql-pacemaker-puppet.yaml | 71 +- deployment/database/redis-container-puppet.yaml | 3 - deployment/database/redis-pacemaker-puppet.yaml | 128 +- .../cinder-backend-dellemc-vxflexos-puppet.yaml | 27 + .../sahara/sahara-api-container-puppet.yaml | 30 - .../sahara/sahara-engine-container-puppet.yaml | 18 - deployment/etcd/etcd-container-puppet.yaml | 55 +- .../designate-producer-container-puppet.yaml | 5 + deployment/glance/glance-api-container-puppet.yaml | 28 - .../glance/glance-api-edge-container-puppet.yaml | 22 +- .../gnocchi/gnocchi-api-container-puppet.yaml | 128 +- .../gnocchi/gnocchi-metricd-container-puppet.yaml | 34 +- .../gnocchi/gnocchi-statsd-container-puppet.yaml | 36 +- .../haproxy/haproxy-edge-container-puppet.yaml | 22 +- deployment/haproxy/haproxy-pacemaker-puppet.yaml | 71 +- deployment/heat/heat-api-cfn-container-puppet.yaml | 18 - .../heat/heat-api-cloudwatch-disabled-puppet.yaml | 24 - deployment/heat/heat-api-container-puppet.yaml | 30 - deployment/heat/heat-engine-container-puppet.yaml | 18 - deployment/horizon/horizon-container-puppet.yaml | 12 + deployment/ipa/ipaservices-baremetal-ansible.yaml | 2 +- deployment/ironic/ironic-api-container-puppet.yaml | 36 - .../ironic/ironic-conductor-container-puppet.yaml | 59 +- .../kernel-boot-params-baremetal-ansible.yaml | 20 + deployment/keystone/keystone-container-puppet.yaml | 61 +- deployment/manila/manila-api-container-puppet.yaml | 32 - .../manila/manila-scheduler-container-puppet.yaml | 20 - .../manila/manila-share-container-puppet.yaml | 20 - .../manila/manila-share-pacemaker-puppet.yaml | 101 +- .../memcached/memcached-container-puppet.yaml | 21 +- deployment/metrics/collectd-container-puppet.yaml | 19 +- deployment/mistral/mistral-base.yaml | 6 +- .../neutron/derive_pci_passthrough_whitelist.py | 11 +- .../neutron/neutron-api-container-puppet.yaml | 51 +- .../neutron/neutron-dhcp-container-puppet.yaml | 18 - .../neutron/neutron-l3-container-puppet.yaml | 18 - .../neutron/neutron-metadata-container-puppet.yaml | 18 - .../neutron-ovn-dpdk-config-container-puppet.yaml | 6 - .../neutron-ovs-agent-container-puppet.yaml | 22 - .../neutron-ovs-dpdk-agent-container-puppet.yaml | 7 +- .../neutron-sriov-agent-container-puppet.yaml | 31 +- deployment/nova/nova-api-container-puppet.yaml | 159 --- deployment/nova/nova-compute-container-puppet.yaml | 42 +- .../nova/nova-conductor-container-puppet.yaml | 18 - deployment/nova/nova-ironic-container-puppet.yaml | 33 +- deployment/nova/nova-libvirt-container-puppet.yaml | 38 +- .../nova/nova-scheduler-container-puppet.yaml | 18 - .../nova/nova-vnc-proxy-container-puppet.yaml | 37 +- deployment/nova/novajoin-container-puppet.yaml | 10 + .../octavia/octavia-api-container-puppet.yaml | 36 +- .../ovn/ovn-controller-container-puppet.yaml | 16 + deployment/ovn/ovn-dbs-pacemaker-puppet.yaml | 51 +- .../pacemaker/pacemaker-baremetal-puppet.yaml | 4 +- .../pacemaker-remote-baremetal-puppet.yaml | 60 + deployment/podman/podman-baremetal-ansible.yaml | 2 - deployment/rabbitmq/rabbitmq-container-puppet.yaml | 16 +- ...rabbitmq-messaging-notify-container-puppet.yaml | 15 +- ...rabbitmq-messaging-notify-pacemaker-puppet.yaml | 94 +- .../rabbitmq-messaging-pacemaker-puppet.yaml | 94 +- .../rabbitmq-messaging-rpc-container-puppet.yaml | 15 +- .../rabbitmq-messaging-rpc-pacemaker-puppet.yaml | 104 +- deployment/sshd/sshd-baremetal-ansible.yaml | 105 ++ deployment/swift/swift-proxy-container-puppet.yaml | 22 - .../swift/swift-ringbuilder-container-puppet.yaml | 2 +- .../swift/swift-storage-container-puppet.yaml | 42 +- deployment/tls/undercloud-tls.yaml | 4 - .../tripleo-packages-baremetal-puppet.yaml | 272 +---- deployment/undercloud/undercloud-upgrade.yaml | 163 +-- environments/barbican-backend-pkcs11-lunasa.yaml | 29 +- environments/cavium-liquidio.yaml | 2 +- environments/ceph-ansible/ceph-ansible.yaml | 7 + environments/cinder-dellemc-powerflex-config.yaml | 35 + environments/cinder-dellemc-powerstore-config.yaml | 28 + environments/cinder-dellemc-vxflexos-config.yaml | 4 + environments/cinder-netapp-config.yaml | 2 +- environments/computealt.yaml | 2 +- environments/lifecycle/ffwd-upgrade-prepare.yaml | 1 - environments/low-memory-usage.yaml | 2 - environments/ovs-hw-offload.yaml | 2 +- .../services-baremetal/neutron-ovn-dvr-ha.yaml | 4 +- .../services-baremetal/neutron-ovn-ha.yaml | 2 +- environments/services-baremetal/neutron-sriov.yaml | 2 +- environments/services/ironic.yaml | 1 - environments/services/neutron-mlnx-agent.yaml | 2 +- environments/services/neutron-ovn-dvr-ha.yaml | 2 +- environments/services/neutron-ovn-ha.yaml | 2 +- environments/services/neutron-ovn-sriov.yaml | 2 +- environments/services/neutron-ovn-standalone.yaml | 2 +- environments/services/neutron-sriov.yaml | 2 +- environments/ssl/no-tls-endpoints-public-ip.yaml | 9 +- environments/ssl/tls-endpoints-public-dns.yaml | 11 +- environments/ssl/tls-endpoints-public-ip.yaml | 11 +- environments/ssl/tls-everywhere-endpoints-dns.yaml | 11 +- environments/storage-environment.yaml | 2 +- environments/storage/cinder-netapp-config.yaml | 2 +- environments/storage/cinder-nfs.yaml | 2 +- environments/undercloud-enable-nova.yaml | 33 + environments/undercloud.yaml | 27 +- firstboot/os-net-config-mappings.yaml | 141 +-- lower-constraints.txt | 8 +- .../config/multiple-nics-vlans/role.role.j2.yaml | 4 +- network/config/multiple-nics/role.role.j2.yaml | 6 +- network/endpoints/build_endpoint_map.py | 2 +- network/endpoints/endpoint_data.yaml | 40 - network/endpoints/endpoint_map.yaml | 1250 ++------------------ network/scripts/run-os-net-config.sh | 4 - network/service_net_map.j2.yaml | 4 +- network_data_ganesha.yaml | 50 +- overcloud-resource-registry-puppet.j2.yaml | 13 +- overcloud.j2.yaml | 35 + plan-samples/plan-environment-derived-params.yaml | 6 +- ...ainerNovaLibvirtPidsLimit-cdad2166b6c0195f.yaml | 6 + ...ignate-redis-coordination-b4afdcc8855cc0ca.yaml | 4 + ...dge-by-default-on-compute-f3ff6bf46ab80640.yaml | 15 + ...e-for-StorageNFS-net.yaml-bd77be924e8b7056.yaml | 20 + .../gnocchi-nfs-backend-90febc9f87e7df08.yaml | 9 + .../horizon_logger_debug-cd70c45c1b695e4b.yaml | 8 + .../innodb-tuning-param-e71d2fd727c450ec.yaml | 6 + ...ductor-group-and-networks-9c5c409253ebe3c8.yaml | 14 + ...ova-max_concurrent_builds-f900d84f35704452.yaml | 6 + .../nova_image_cache_ttl-824f241363b9dd4e.yaml | 8 + ...-mappings-move-to-ansible-940a48711870ac58.yaml | 14 + .../ovn-port-forwarding-1c954c1c57e136d0.yaml | 6 + .../notes/powerflex-driver-abd8e372280c44e7.yaml | 3 + .../notes/powerstore-driver-e528e372280c44e6.yaml | 6 + ...ila-ceph-pgnum-parameters-b7bb9c95e30467d5.yaml | 7 + .../notes/remove_ffwd_tasks-d1ab630d96a66a59.yaml | 6 + .../swift-fix-ring-sync-7bf3ddbb1ea1e342.yaml | 6 + .../swift-mount-by-uuid-7744fe7696db4b85.yaml | 6 + ...vxflexos-deprecate-driver-cd38e372280c44e6.yaml | 5 + roles/Controller.yaml | 5 + roles/ControllerNoCeph.yaml | 2 + roles/ControllerNovaStandalone.yaml | 2 + roles/ControllerSriov.yaml | 2 - roles/ControllerStorageDashboard.yaml | 2 + roles/ControllerStorageNfs.yaml | 2 + roles/DistributedCompute.yaml | 1 - roles/DistributedComputeHCI.yaml | 2 +- roles/DistributedComputeHCIScaleOut.yaml | 3 +- roles/DistributedComputeScaleOut.yaml | 3 +- roles/NetworkerSriov.yaml | 1 - roles/Standalone.yaml | 2 + roles_data.yaml | 5 + sample-env-generator/ssl.yaml | 38 +- sample-env-generator/standalone.yaml | 2 +- sample-env-generator/storage.yaml | 1 + sample-env-generator/undercloud-minion.yaml | 2 +- test-requirements.txt | 2 +- tools/render-ansible-tasks.py | 3 +- tools/yaml-validate.py | 35 +- tox.ini | 2 +- validation-scripts/all-nodes.sh | 2 +- 201 files changed, 2569 insertions(+), 4598 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index 31a7e4d0b..e11f7e2c1 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -4 +4 @@ -hacking>=1.1.0,<1.2.0 # Apache-2.0 +hacking>=3.0.1,<3.1.0 # Apache-2.0