Merge pull request #169 from stackhpc/stable/wallaby

Sync stable/wallaby

Author: cityofships

ansible/gather-facts.yml

@@ -5,8 +5,15 @@
 - name: Gather facts for all hosts
   hosts: all
   serial: '{{ kolla_serial|default("0") }}'
-  gather_facts: true
+  gather_facts: false
   tasks:
+    - name: Gather facts
+      setup:
+        filter: "{{ kolla_ansible_setup_filter }}"
+        gather_subset: "{{ kolla_ansible_setup_gather_subset }}"
+      when:
+        - not ansible_facts
+
     - name: Group hosts to determine when using --limit
       group_by:
         key: "all_using_limit_{{ (ansible_play_batch | length) != (groups['all'] | length) }}"
@@ -32,10 +39,12 @@
   tasks:
     - name: Gather facts
       setup:
+        filter: "{{ kolla_ansible_setup_filter }}"
+        gather_subset: "{{ kolla_ansible_setup_gather_subset }}"
       delegate_facts: True
       delegate_to: "{{ item }}"
       with_items: "{{ delegate_hosts }}"
       # We gathered facts for all hosts in the batch during the first play.
       when:
-        - not hostvars[item].ansible_facts.module_setup | default(false)
+        - not hostvars[item].ansible_facts
   tags: always

ansible/group_vars/all.yml

@@ -20,6 +20,21 @@ node_config_directory: "/etc/kolla"
 config_owner_user: "root"
 config_owner_group: "root"
 
+###################
+# Ansible options
+###################
+
+# This variable is used as the "filter" argument for the setup module.  For
+# instance, if one wants to remove/ignore all Neutron interface facts:
+# kolla_ansible_setup_filter: "ansible_[!qt]*"
+# By default, we do not provide a filter.
+kolla_ansible_setup_filter: "{{ omit }}"
+
+# This variable is used as the "gather_subset" argument for the setup module.
+# For instance, if one wants to avoid collecting facts via facter:
+# kolla_ansible_setup_gather_subset: "all,!facter"
+# By default, we do not provide a gather subset.
+kolla_ansible_setup_gather_subset: "{{ omit }}"
 
 ###################
 # Kolla options
@@ -704,6 +719,7 @@ nova_keystone_user: "nova"
 placement_keystone_user: "placement"
 murano_keystone_user: "murano"
 cinder_keystone_user: "cinder"
+glance_keystone_user: "glance"
 
 # Nova fake driver and the number of fake driver per compute node
 enable_nova_fake: "no"
@@ -1048,7 +1064,7 @@ ceph_cinder_user: "cinder"
 ceph_glance_user: "glance"
 ceph_gnocchi_user: "gnocchi"
 ceph_manila_user: "manila"
-ceph_nova_user: "nova"
+ceph_nova_user: "{{ ceph_cinder_user }}"
 
 # External Ceph keyrings
 ceph_cinder_keyring: "ceph.client.cinder.keyring"

ansible/library/kolla_docker.py

@@ -264,6 +264,9 @@
 '''
 
 
+COMPARE_CONFIG_CMD = ['/usr/local/bin/kolla_set_configs', '--check']
+
+
 def get_docker_client():
     return docker.APIClient
 
@@ -348,7 +351,9 @@ def get_container_info(self):
 
     def compare_container(self):
         container = self.check_container()
-        if not container or self.check_container_differs():
+        if (not container or
+                self.check_container_differs() or
+                self.compare_config()):
             self.changed = True
         return self.changed
 
@@ -614,6 +619,43 @@ def compare_healthcheck(self, container_info):
             if current_healthcheck:
                 return True
 
+    def compare_config(self):
+        try:
+            job = self.dc.exec_create(
+                self.params['name'],
+                COMPARE_CONFIG_CMD,
+                user='root',
+            )
+            output = self.dc.exec_start(job)
+            exec_inspect = self.dc.exec_inspect(job)
+        except docker.errors.APIError as e:
+            # NOTE(yoctozepto): If we have a client error, then the container
+            # cannot be used for config check (e.g., is restarting, or stopped
+            # in the mean time) - assume config is stale = return True.
+            # Else, propagate the server error back.
+            if e.is_client_error():
+                return True
+            else:
+                raise
+        # Exit codes:
+        # 0: not changed
+        # 1: changed
+        # 137: abrupt exit -> changed
+        # else: error
+        if exec_inspect['ExitCode'] == 0:
+            return False
+        elif exec_inspect['ExitCode'] == 1:
+            return True
+        elif exec_inspect['ExitCode'] == 137:
+            # NOTE(yoctozepto): This is Docker's command exit due to container
+            # exit. It means the container is unstable so we are better off
+            # marking it as requiring a restart due to config update.
+            return True
+        else:
+            raise Exception('Failed to compare container configuration: '
+                            'ExitCode: %s Message: %s' %
+                            (exec_inspect['ExitCode'], output))
+
     def parse_image(self):
         full_image = self.params.get('image')
 

ansible/roles/aodh/tasks/pull.yml

@@ -1,11 +1,3 @@
 ---
-- name: Pulling aodh images
-  become: true
-  kolla_docker:
-    action: "pull_image"
-    common_options: "{{ docker_common_options }}"
-    image: "{{ item.value.image }}"
-  when:
-    - inventory_hostname in groups[item.value.group]
-    - item.value.enabled | bool
-  with_dict: "{{ aodh_services }}"
+- import_role:
+    role: service-images-pull

ansible/roles/barbican/tasks/pull.yml

@@ -1,11 +1,3 @@
 ---
-- name: Pulling barbican images
-  become: true
-  kolla_docker:
-    action: "pull_image"
-    common_options: "{{ docker_common_options }}"
-    image: "{{ item.value.image }}"
-  when:
-    - inventory_hostname in groups[item.value.group]
-    - item.value.enabled | bool
-  with_dict: "{{ barbican_services }}"
+- import_role:
+    role: service-images-pull

ansible/roles/baremetal/defaults/main.yml

@@ -32,6 +32,9 @@ change_selinux: True
 
 selinux_state: "permissive"
 
+# If true, the host firewall service (firewalld or ufw) will be disabled.
+disable_firewall: True
+
 docker_storage_driver: ""
 docker_custom_option: ""
 docker_custom_config: {}

ansible/roles/baremetal/tasks/install.yml

@@ -6,34 +6,36 @@
   when: ansible_facts.os_family == 'Debian'
 
 # TODO(inc0): Gates don't seem to have ufw executable, check for it instead of ignore errors
-- name: Set firewall default policy
-  become: True
-  ufw:
-    state: disabled
-    policy: allow
-  when: ansible_facts.os_family == 'Debian'
-  ignore_errors: yes
-
-- name: Check if firewalld is installed
-  command: rpm -q firewalld
-  register: firewalld_check
-  changed_when: false
-  failed_when: firewalld_check.rc > 1
-  args:
-    warn: false
-  when: ansible_facts.os_family == 'RedHat'
+- block:
+    - name: Set firewall default policy
+      become: True
+      ufw:
+        state: disabled
+        policy: allow
+      when: ansible_facts.os_family == 'Debian'
+      ignore_errors: yes
+
+    - name: Check if firewalld is installed
+      command: rpm -q firewalld
+      register: firewalld_check
+      changed_when: false
+      failed_when: firewalld_check.rc > 1
+      args:
+        warn: false
+      when: ansible_facts.os_family == 'RedHat'
 
-- name: Disable firewalld
-  become: True
-  service:
-    name: "{{ item }}"
-    enabled: false
-    state: stopped
-  with_items:
-    - firewalld
-  when:
-    - ansible_facts.os_family == 'RedHat'
-    - firewalld_check.rc == 0
+    - name: Disable firewalld
+      become: True
+      service:
+        name: "{{ item }}"
+        enabled: false
+        state: stopped
+      with_items:
+        - firewalld
+      when:
+        - ansible_facts.os_family == 'RedHat'
+        - firewalld_check.rc == 0
+  when: disable_firewall | bool
 
 # Upgrading docker engine may cause containers to stop. Take a snapshot of the
 # running containers prior to a potential upgrade of Docker.

ansible/roles/baremetal/tasks/pre-install.yml

@@ -144,7 +144,7 @@
         - name: Install docker rpm gpg key
           rpm_key:
             state: present
-            key: "{{ docker_yum_url }}/gpg"
+            key: "{{ docker_yum_gpgkey }}"
           become: True
           when: docker_yum_gpgcheck | bool
       when: ansible_facts.os_family == 'RedHat'

ansible/roles/blazar/tasks/pull.yml

@@ -1,11 +1,3 @@
 ---
-- name: Pulling blazar images
-  become: true
-  kolla_docker:
-    action: "pull_image"
-    common_options: "{{ docker_common_options }}"
-    image: "{{ item.value.image }}"
-  when:
-    - inventory_hostname in groups[item.value.group]
-    - item.value.enabled | bool
-  with_dict: "{{ blazar_services }}"
+- import_role:
+    role: service-images-pull

ansible/roles/blazar/templates/blazar.conf.j2

@@ -4,7 +4,7 @@ log_dir = /var/log/kolla/blazar
 transport_url = {{ rpc_transport_url }}
 host = {{ api_interface_address }}
 port = {{ blazar_api_port }}
-os_auth_host = {{ kolla_internal_fqdn }}
+os_auth_host = {{ keystone_internal_fqdn }}
 os_auth_port = {{ keystone_admin_port }}
 os_auth_protocol = {{ admin_protocol }}
 os_auth_version = v3