Ukaea/2024.1 update

ansible/inventory/group_vars/all/ipa

@@ -23,12 +23,14 @@ ipa_builder_source_version: "{{ openstack_branch }}"
 ipa_build_dib_host_packages_extra: []
 
 # List of default Diskimage Builder (DIB) elements to use when building IPA
-# images. Default is ["centos", "enable-serial-console",
+# images. Default is ["centos", "dynamic-login", "enable-serial-console",
 # "ironic-python-agent-ramdisk"] when os_distribution is "rocky", and
-# ["ubuntu", "enable-serial-console", "ironic-python-agent-ramdisk"] otherwise.
+# ["ubuntu", "dynamic-login", "enable-serial-console",
+# "ironic-python-agent-ramdisk"] otherwise.
 ipa_build_dib_elements_default:
   # TODO(mattcrees): Use {{ os_distribution }} here when Rocky IPA builds work.
   - "{{ 'centos' if os_distribution == 'rocky' else os_distribution }}"
+  - dynamic-login
   - enable-serial-console
   - ironic-python-agent-ramdisk
 
@@ -50,6 +52,7 @@ ipa_build_dib_env_default:
   DIB_RELEASE: "{{ '9-stream' if os_distribution == 'rocky' else os_release }}"
   DIB_REPOLOCATION_ironic_python_agent: "{{ ipa_build_source_url }}"
   DIB_REPOREF_ironic_python_agent: "{{ ipa_build_source_version }}"
+  DIB_REPOREF_requirements: "{{ ipa_build_source_version }}"
 
 # Dictionary of additional environment variables to provide to Diskimage
 # Builder (DIB) during IPA image build.

ansible/inventory/group_vars/all/kolla

@@ -233,6 +233,8 @@ overcloud_container_image_regex_map:
     enabled: "{{ kolla_enable_placement | bool }}"
   - regex: ^prometheus
     enabled: "{{ kolla_enable_prometheus | bool }}"
+  - regex: ^proxysql
+    enabled: "{{ kolla_enable_proxysql | bool }}"
   - regex: ^qdrouterd
     enabled: "{{ kolla_enable_qdrouterd | bool }}"
   - regex: ^rabbitmq
@@ -400,6 +402,7 @@ kolla_overcloud_inventory_pass_through_host_vars_default:
   - "kolla_external_vip_interface"
   - "kolla_neutron_external_interfaces"
   - "kolla_neutron_bridge_names"
+  - "kolla_neutron_physical_networks"
 
 # List of names of additional host variables to pass through from kayobe hosts
 # to kolla-ansible hosts, if set. See also
@@ -430,6 +433,7 @@ kolla_overcloud_inventory_pass_through_host_vars_map_default:
   kolla_tunnel_interface: "tunnel_interface"
   kolla_neutron_external_interfaces: "neutron_external_interface"
   kolla_neutron_bridge_names: "neutron_bridge_name"
+  kolla_neutron_physical_networks: "neutron_physical_networks"
 
 # Dict mapping names of additional variables in
 # kolla_overcloud_inventory_pass_through_host_vars to the variable to use in
@@ -508,6 +512,7 @@ kolla_enable_mariadb: "yes"
 kolla_enable_memcached: "yes"
 kolla_enable_neutron: "{{ kolla_enable_openstack_core | bool }}"
 kolla_enable_nova: "{{ kolla_enable_openstack_core | bool }}"
+kolla_enable_proxysql: "no"
 kolla_enable_rabbitmq: "yes"
 
 # OpenStack services can be enabled or disabled with these options

ansible/inventory/group_vars/all/proxy

@@ -19,3 +19,4 @@ no_proxy:
   - "127.0.0.1"
   - "localhost"
   - "{{ ('http://' ~ docker_registry) | urlsplit('hostname') if docker_registry else '' }}"
+  - "{{ kolla_internal_vip_address }}"

ansible/inventory/group_vars/all/time

@@ -38,3 +38,17 @@ chrony_ntp_servers:
 
 # Synchronise hardware clock with system time. Default is true.
 chrony_rtcsync_enabled: true
+
+# Force synchronisation from NTP sources. This methods may jump the clock by
+# large values which can cause issues with some software. Disabled by default.
+ntp_force_sync: false
+
+# Maximum number of tries used by the `chronyc waitsync` command. Only used
+# when ntp_force_sync is true. Default is 60 which waits for a maximum of 10
+# minutes (60 times 10 seconds).
+chrony_waitsync_max_tries: 60
+
+# Maximum correction used by the `chronyc waitsync` command. Only used when
+# ntp_force_sync is true. Default is 0.01 which waits for the remaining
+# correction to be less than 10 milliseconds.
+chrony_waitsync_max_correction: 0.01

ansible/kolla-ansible.yml

@@ -169,11 +169,11 @@
           - var_name: "kolla_network_interface"
             description: "Default network"
             network: "{{ internal_net_name }}"
-            required: True
+            required: False
           - var_name: "kolla_api_interface"
             description: "API network"
             network: "{{ internal_net_name }}"
-            required: True
+            required: False
           - var_name: "kolla_storage_interface"
             description: "Storage network"
             network: "{{ storage_net_name }}"

ansible/logging.yml

@@ -18,8 +18,8 @@
       file:
         path: /var/log/journal
         owner: "root"
-        group: "root"
-        mode: 0755
+        group: "systemd-journal"
+        mode: 02755
         state: directory
       notify: Flush journal to disk
       when: journald_storage == "persistent"

ansible/overcloud-deprovision.yml

@@ -37,7 +37,7 @@
     - name: confirm_deprovision
       prompt: |
         The following hosts will be deprovisioned:
-        {{ play_hosts | join(', ') }}
+        {{ play_hosts | intersect(groups['overcloud'] | default([])) | join(', ') }}
         If you want to proceed type: yes
       default: "no"
       private: false

ansible/roles/image-download/defaults/main.yml

@@ -21,3 +21,23 @@ image_download_dest:
 # Host from which to fetch the image.
 # Only used when image_download_path is set.
 image_download_host: "{{ inventory_hostname }}"
+
+# Username for Digest, Basic or WSSE authentication. Default is unset, in which
+# case the parameter is omitted.
+image_download_url_username:
+
+# Password for Digest, Basic or WSSE authentication. Default is unset, in which
+# case the parameter is omitted.
+image_download_url_password:
+
+# Force sending the Basic authentication header upon initial request. Useful if
+# the remote endpoint does not respond with HTTP 401 to the initial
+# unauthenticated request. Must be a boolean. Default is unset, in which case
+# the parameter is omitted.
+image_download_force_basic_auth:
+
+# List of header names that will not be sent on subsequent redirected requests.
+# Set to ['Authorization'] if being redirected from an authenticated endpoint
+# to an unauthenticated endpoint. Default is unset, in which case the parameter
+# is omitted.
+image_download_unredirected_headers:

ansible/roles/image-download/tasks/main.yml

@@ -15,6 +15,10 @@
           uri:
             url: "{{ image_download_checksum_url }}"
             return_content: true
+            url_username: "{{ image_download_url_username or omit }}"
+            url_password: "{{ image_download_url_password or omit }}"
+            force_basic_auth: "{{ image_download_force_basic_auth or omit }}"
+            unredirected_headers: "{{ image_download_unredirected_headers or omit }}"
           register: expected_checksum
           until: expected_checksum is successful
           retries: 3
@@ -35,6 +39,10 @@
         # Always download the image if we have no checksum to compare with.
         force: "{{ expected_checksum is skipped }}"
         backup: true
+        url_username: "{{ image_download_url_username or omit }}"
+        url_password: "{{ image_download_url_password or omit }}"
+        force_basic_auth: "{{ image_download_force_basic_auth or omit }}"
+        unredirected_headers: "{{ image_download_unredirected_headers or omit }}"
       register: result
       until: result is successful
       retries: 3

ansible/roles/infra-vms/tasks/deploy.yml

@@ -4,7 +4,7 @@
   include_role:
     name: jriguera.configdrive
   vars:
-    configdrive_os_family: "{{ vm_hostvars.infra_vm_os_family }}"
+    configdrive_os_family: "{{ vm_os_family }}"
     configdrive_uuid: "{{ vm_name | to_uuid }}"
     # Must set configdrive_instance_dir when using a loop
     # https://github.com/jriguera/ansible-role-configdrive/blob/8438592c84585c86e62ae07e526d3da53629b377/tasks/main.yml#L17
@@ -16,13 +16,10 @@
     configdrive_volume_path: "{{ image_cache_path }}"
     configdrive_config_dir_delete: False
     configdrive_resolv:
-      domain: "{{ vm_hostvars.resolv_domain | default }}"
-      search: "{{ vm_hostvars.resolv_search | default }}"
-      dns: "{{ vm_hostvars.resolv_nameservers | default([]) }}"
-    configdrive_network_device_list: >
-      {{ vm_hostvars.network_interfaces |
-          map('net_configdrive_network_device', vm_hostvars.inventory_hostname) |
-          list }}
+      domain: "{{ vm_resolv_domain | default }}"
+      search: "{{ vm_resolv_search | default }}"
+      dns: "{{ vm_resolv_nameservers | default([]) }}"
+    configdrive_network_device_list: "{{ vm_network_device_list }}"
 
 - name: "[{{ vm_name }}] Set a fact containing the configdrive image path"
   set_fact:
@@ -56,7 +53,7 @@
 - name: "[{{ vm_name }}] Stat image files"
   stat:
     path: "{{ image_cache_path }}/{{ item.image | basename }}"
-  with_items: "{{ vm_hostvars.infra_vm_volumes | selectattr('image', 'defined') }}"
+  with_items: "{{ vm_volumes | selectattr('image', 'defined') }}"
   register: image_stat_result
 
 - name: "[{{ vm_name }}] Fix image ownership"
@@ -75,7 +72,7 @@
     vm_configdrive_device: cdrom
     vm_configdrive_volume:
       name: "{{ vm_name }}-configdrive"
-      pool: "{{ vm_hostvars.infra_vm_pool }}"
+      pool: "{{ vm_pool }}"
       # Round size up to next multiple of 4096.
       capacity: "{{ (stat_result.stat.size + 4095) // 4096 * 4096 }}"
       device: "{{ vm_configdrive_device }}"
@@ -85,10 +82,10 @@
     libvirt_vm_image_cache_path: "{{ image_cache_path }}"
     libvirt_vms:
       - name: "{{ vm_name }}"
-        boot_firmware: "{{ vm_hostvars.infra_vm_boot_firmware | default }}"
-        machine: "{{ vm_hostvars.infra_vm_machine | default }}"
-        memory_mb: "{{ vm_hostvars.infra_vm_memory_mb }}"
-        vcpus: "{{ vm_hostvars.infra_vm_vcpus }}"
-        volumes: "{{ vm_hostvars.infra_vm_volumes + [vm_configdrive_volume] }}"
-        interfaces: "{{ vm_hostvars.infra_vm_interfaces }}"
+        boot_firmware: "{{ vm_boot_firmware | default }}"
+        machine: "{{ vm_machine | default }}"
+        memory_mb: "{{ vm_memory_mb }}"
+        vcpus: "{{ vm_vcpus }}"
+        volumes: "{{ vm_volumes + [vm_configdrive_volume] }}"
+        interfaces: "{{ vm_interfaces }}"
         console_log_enabled: true

ansible/roles/infra-vms/tasks/destroy.yml

@@ -6,12 +6,12 @@
   vars:
     infra_vm_configdrive_volume:
       name: "{{ vm_name }}-configdrive"
-      pool: "{{ hostvars[vm_hostvars.infra_vm_hypervisor].infra_vm_pool }}"
+      pool: "{{ vm_pool }}"
     libvirt_vms:
       - name: "{{ vm_name }}"
-        boot_firmware: "{{ vm_hostvars.infra_vm_boot_firmware | default }}"
-        memory_mb: "{{ vm_hostvars.infra_vm_memory_mb }}"
-        vcpus: "{{ vm_hostvars.infra_vm_vcpus }}"
-        volumes: "{{ vm_hostvars.infra_vm_volumes + [infra_vm_configdrive_volume] }}"
+        boot_firmware: "{{ vm_boot_firmware | default }}"
+        memory_mb: "{{ vm_memory_mb }}"
+        vcpus: "{{ vm_vcpus }}"
+        volumes: "{{ vm_volumes + [infra_vm_configdrive_volume] }}"
         state: "absent"
   become: True

ansible/roles/infra-vms/tasks/main.yml

@@ -10,8 +10,21 @@
 - name: "{{ infra_vm_action | capitalize }} infra VMs (loop)"
   include_tasks: "{{ infra_vm_action }}.yml"
   vars:
-    vm_name: "{{ vm_hostvars.infra_vm_name }}"
-    vm_hostvars: "{{ hostvars[vm_item] }}"
+    vm_name: "{{ hostvars[vm_item].infra_vm_name }}"
+    vm_os_family: "{{ hostvars[vm_item].infra_vm_os_family }}"
+    vm_resolv_domain: "{{ hostvars[vm_item].resolv_domain }}"
+    vm_resolv_search: "{{ hostvars[vm_item].resolv_search }}"
+    vm_resolv_nameservers: "{{ hostvars[vm_item].resolv_nameservers }}"
+    vm_network_device_list: "{{ hostvars[vm_item].network_interfaces |
+              map('net_configdrive_network_device', hostvars[vm_item].inventory_hostname) |
+                        list }}"
+    vm_volumes: "{{ hostvars[vm_item].infra_vm_volumes }}"
+    vm_pool: "{{ hostvars[vm_item].infra_vm_pool }}"
+    vm_boot_firmware: "{{ hostvars[vm_item].infra_vm_boot_firmware }}"
+    vm_machine: "{{ hostvars[vm_item].infra_vm_machine }}"
+    vm_memory_mb: "{{ hostvars[vm_item].infra_vm_memory_mb }}"
+    vm_vcpus: "{{ hostvars[vm_item].infra_vm_vcpus }}"
+    vm_interfaces: "{{ hostvars[vm_item].infra_vm_interfaces }}"
   loop: "{{ infra_vm_vms }}"
   when: (infra_vm_action == "deploy" and vm_name not in all_vms.list_vms) or infra_vm_action == "destroy"
   loop_control:

ansible/roles/ipa-images/tasks/set-driver-info.yml

@@ -20,12 +20,19 @@
   set_fact:
     ipa_images_ramdisk_uuid: "{{ ipa_images_glance.results[1].images[0].id }}"
 
+- name: Change system scope to all for Ironic operations
+  set_fact:
+    ipa_images_ironic_openstack_auth_env: "{{ ipa_images_openstack_auth_env |
+    combine ({ 'OS_PROJECT_NAME': omit }) |
+    combine ({ 'OS_PROJECT_DOMAIN_NAME': omit }) |
+    combine ({ 'OS_SYSTEM_SCOPE': 'all' }) }}"
+
 - name: Get a list of ironic nodes
   command: |
     {{ ipa_images_venv }}/bin/openstack baremetal node list --fields name uuid driver_info -f json
   register: ipa_images_ironic_node_list
   changed_when: False
-  environment: "{{ ipa_images_openstack_auth_env }}"
+  environment: "{{ ipa_images_ironic_openstack_auth_env }}"
 
 - name: Make sure openstack nodes are in baremetal-compute group
   add_host:
@@ -59,4 +66,4 @@
   when:
     item["Driver Info"].deploy_kernel != ipa_images_kernel_uuid or
     item["Driver Info"].deploy_ramdisk != ipa_images_ramdisk_uuid
-  environment: "{{ ipa_images_openstack_auth_env }}"
+  environment: "{{ ipa_images_ironic_openstack_auth_env }}"

ansible/roles/kolla-ansible-host-vars/tests/test.yml

@@ -16,6 +16,7 @@
         kolla_dns_interface: "eth5"
         kolla_neutron_external_interfaces: "eth6,eth7"
         kolla_neutron_bridge_names: "br0,br1"
+        kolla_neutron_physical_networks: "physnet1,physnet2"
         kolla_provision_interface: "eth8"
         kolla_inspector_dnsmasq_interface: "eth9"
         kolla_tunnel_interface: "eth10"
@@ -32,6 +33,7 @@
         kolla_storage_interface: "eth3"
         kolla_neutron_external_interfaces: "eth4,eth5"
         kolla_neutron_bridge_names: "br0,br1"
+        kolla_neutron_physical_networks: "physnet2,physnet3"
         kolla_tunnel_interface: "eth6"
 
 - name: Test kolla-ansible-host-vars role extras
@@ -68,6 +70,7 @@
               - "kolla_external_vip_interface"
               - "kolla_neutron_external_interfaces"
               - "kolla_neutron_bridge_names"
+              - "kolla_neutron_physical_networks"
             kolla_ansible_pass_through_host_vars_map:
               kolla_network_interface: "network_interface"
               kolla_api_interface: "api_interface"
@@ -81,6 +84,7 @@
               kolla_tunnel_interface: "tunnel_interface"
               kolla_neutron_external_interfaces: "neutron_external_interface"
               kolla_neutron_bridge_names: "neutron_bridge_name"
+              kolla_neutron_physical_networks: "neutron_physical_networks"
             kolla_ansible_inventory_path: "{{ temp_path }}"
 
         - name: Check whether inventory host vars files exist
@@ -125,6 +129,7 @@
                 kolla_external_vip_interface: "eth1"
                 neutron_external_interface: "eth6,eth7"
                 neutron_bridge_name: "br0,br1"
+                neutron_physical_networks: "physnet1,physnet2"
               test-compute: |
                 ---
                 ansible_host: "1.2.3.6"
@@ -134,6 +139,7 @@
                 tunnel_interface: "eth6"
                 neutron_external_interface: "eth4,eth5"
                 neutron_bridge_name: "br0,br1"
+                neutron_physical_networks: "physnet2,physnet3"
 
       always:
         - name: Ensure the temporary directory is removed

ansible/roles/kolla-ansible/templates/overcloud-services.j2

@@ -453,6 +453,9 @@ ovn-database
 [ovn-sb-db:children]
 ovn-database
 
+[ovn-sb-db-relay:children]
+ovn-database
+
 [venus-api:children]
 venus
 

ansible/roles/kolla-ansible/vars/main.yml

@@ -200,6 +200,7 @@ kolla_feature_flags:
   - openvswitch
   - osprofiler
   - ovn
+  - ovn_sb_db_relay
   - ovs_dpdk
   - placement
   - prometheus

ansible/roles/ntp/defaults/main.yml

@@ -1,5 +1,8 @@
 ---
-ntp_actions: ["validate", "prepare", "deploy"]
+ntp_actions: ["validate", "prepare", "deploy", "sync"]
+
+# Do not jump clock by default
+ntp_force_sync: False
 
 ntp_service_disable_list:
   - ntp.service

ansible/roles/ntp/tasks/main.yml

@@ -10,3 +10,7 @@
 - name: Deploy service
   include_tasks: deploy.yml
   when: '"deploy" in ntp_actions'
+
+- name: Synchronise time
+  include_tasks: sync.yml
+  when: '"sync" in ntp_actions'

ansible/roles/ntp/tasks/sync.yml

@@ -0,0 +1,21 @@
+---
+# NOTE(priteau): We need to run handlers to restart chronyd before forcing
+# clock synchronisation, or the system clock could appear as not synchronised
+# during CI jobs because the tests run too quickly after the chronyd restart.
+- meta: flush_handlers
+
+- name: Force time synchronisation
+  become: True
+  block:
+    - name: Configure burst
+      command: chronyc 'burst 4/4'
+
+    - name: Step the clock
+      command: chronyc makestep
+
+    - name: Wait before hardware clock synchronisation
+      command: "chronyc waitsync {{ chrony_waitsync_max_tries }} {{ chrony_waitsync_max_correction }}"
+
+    - name: Force hardware clock synchronisation
+      command: hwclock --systohc
+  when: ntp_force_sync | bool