Merge pull request #175 from stackhpc/stable/victoria

sync stackhpc/victoria

Author: bbezak

ansible/roles/baremetal/defaults/main.yml

@@ -30,6 +30,9 @@ change_selinux: True
 
 selinux_state: "permissive"
 
+# If true, the host firewall service (firewalld or ufw) will be disabled.
+disable_firewall: True
+
 docker_storage_driver: ""
 docker_custom_option: ""
 docker_custom_config: {}

ansible/roles/baremetal/tasks/install.yml

@@ -6,34 +6,36 @@
   when: ansible_facts.os_family == 'Debian'
 
 # TODO(inc0): Gates don't seem to have ufw executable, check for it instead of ignore errors
-- name: Set firewall default policy
-  become: True
-  ufw:
-    state: disabled
-    policy: allow
-  when: ansible_facts.os_family == 'Debian'
-  ignore_errors: yes
-
-- name: Check if firewalld is installed
-  command: rpm -q firewalld
-  register: firewalld_check
-  changed_when: false
-  failed_when: firewalld_check.rc > 1
-  args:
-    warn: false
-  when: ansible_facts.os_family == 'RedHat'
+- block:
+    - name: Set firewall default policy
+      become: True
+      ufw:
+        state: disabled
+        policy: allow
+      when: ansible_facts.os_family == 'Debian'
+      ignore_errors: yes
+
+    - name: Check if firewalld is installed
+      command: rpm -q firewalld
+      register: firewalld_check
+      changed_when: false
+      failed_when: firewalld_check.rc > 1
+      args:
+        warn: false
+      when: ansible_facts.os_family == 'RedHat'
 
-- name: Disable firewalld
-  become: True
-  service:
-    name: "{{ item }}"
-    enabled: false
-    state: stopped
-  with_items:
-    - firewalld
-  when:
-    - ansible_facts.os_family == 'RedHat'
-    - firewalld_check.rc == 0
+    - name: Disable firewalld
+      become: True
+      service:
+        name: "{{ item }}"
+        enabled: false
+        state: stopped
+      with_items:
+        - firewalld
+      when:
+        - ansible_facts.os_family == 'RedHat'
+        - firewalld_check.rc == 0
+  when: disable_firewall | bool
 
 # Upgrading docker engine may cause containers to stop. Take a snapshot of the
 # running containers prior to a potential upgrade of Docker.

ansible/roles/common/tasks/config.yml

@@ -14,7 +14,6 @@
     - - service_name: "cron"
         paths:
           - "cron"
-          - "cron/logrotate"
       - service_name: "fluentd"
         paths:
           - "fluentd"

ansible/roles/common/templates/conf/output/00-local.conf.j2

@@ -1,3 +1,4 @@
+{% if enable_swift | bool and (inventory_hostname in groups['swift-proxy-server'] or inventory_hostname in groups['swift-account-server'] or inventory_hostname in groups['swift-container-server'] or inventory_hostname in groups['swift-object-server']) %}
 <match syslog.{{ syslog_swift_facility }}.**>
   @type copy
   <store>
@@ -58,7 +59,9 @@
   </store>
 {% endif %}
 </match>
+{% endif %}
 
+{% if enable_haproxy | bool and inventory_hostname in groups['haproxy'] %}
 <match syslog.{{ syslog_haproxy_facility }}.**>
   @type copy
   <store>
@@ -121,6 +124,7 @@
   </store>
 {% endif %}
 </match>
+{% endif %}
 
 {% if glance_enable_tls_backend | bool %}
 <match syslog.{{ syslog_glance_tls_proxy_facility }}.**>

ansible/roles/common/templates/fluentd.json.j2

@@ -29,11 +29,13 @@
             "owner": "{{ fluentd_user }}:{{ fluentd_user }}",
             "recurse": true
         },
+{% if enable_haproxy | bool and inventory_hostname in groups['haproxy'] %}
         {
             "path": "/var/log/kolla/haproxy",
             "owner": "{{ fluentd_user }}:{{ fluentd_user }}",
             "recurse": true
         },
+{% endif %}
 {% if glance_enable_tls_backend | bool %}
         {
             "path": "/var/log/kolla/glance-tls-proxy",
@@ -48,11 +50,13 @@
             "recurse": true
         },
 {% endif %}
+{% if enable_swift | bool and (inventory_hostname in groups['swift-proxy-server'] or inventory_hostname in groups['swift-account-server'] or inventory_hostname in groups['swift-container-server'] or inventory_hostname in groups['swift-object-server']) %}
         {
             "path": "/var/log/kolla/swift",
             "owner": "{{ fluentd_user }}:{{ fluentd_user }}",
             "recurse": true
         },
+{% endif %}
         {
             "path": "/var/lib/fluentd/data",
             "owner": "{{ fluentd_user }}:{{ fluentd_user }}",

ansible/roles/mariadb/defaults/main.yml

@@ -117,4 +117,4 @@ mariadb_backup_type: "full"
 ####################
 # Clustercheck
 ####################
-enable_mariadb_clustercheck: "yes"
+enable_mariadb_clustercheck: "{{ enable_haproxy }}"

ansible/roles/neutron/tasks/config-host.yml

@@ -25,7 +25,6 @@
     sysctl_set: "{{ should_set }}"
     sysctl_file: "{{ kolla_sysctl_conf_path }}"
   with_items:
-    - { name: "net.ipv4.ip_forward", value: 1}
     - { name: "net.ipv4.conf.all.rp_filter", value: "{{ neutron_l3_agent_host_rp_filter_mode }}"}
     - { name: "net.ipv4.conf.default.rp_filter", value: "{{ neutron_l3_agent_host_rp_filter_mode }}"}
     - { name: "net.ipv4.neigh.default.gc_thresh1", value: "{{ neutron_l3_agent_host_ipv4_neigh_gc_thresh1 }}"}

ansible/roles/neutron/templates/dhcp_agent.ini.j2

@@ -17,5 +17,7 @@ dhcp_override_mac = {{ vmware_dvs_dhcp_override_mac }}
 {% endif %}
 {% endif %}
 
+{% if neutron_plugin_agent in ['openvswitch', 'ovn'] %}
 [ovs]
 ovsdb_connection = tcp:127.0.0.1:{{ ovsdb_port }}
+{% endif %}

ansible/roles/neutron/templates/l3_agent.ini.j2

@@ -26,5 +26,7 @@ enable_detailed_logging = {{ neutron_logging_debug }}
 vpn_device_driver = {{ vpn_device_driver }}
 {% endif %}
 
+{% if neutron_plugin_agent in ['openvswitch', 'ovn'] %}
 [ovs]
 ovsdb_connection = tcp:127.0.0.1:{{ ovsdb_port }}
+{% endif %}

ansible/roles/octavia/tasks/prepare.yml

@@ -126,7 +126,7 @@
       allocation_pool_end: "{{ octavia_amp_network['subnet']['allocation_pool_end'] | default(omit, true) }}"
       enable_dhcp: "{{ octavia_amp_network['subnet']['enable_dhcp'] | default(omit) }}"
       no_gateway_ip: "{{ octavia_amp_network['subnet']['no_gateway_ip'] | default(omit) }}"
-      gateway_ip: "{{ octavia_amp_network['gateway_ip'] | default(omit, true) }}"
+      gateway_ip: "{{ octavia_amp_network['subnet']['gateway_ip'] | default(omit, true) }}"
       ip_version: "{{ octavia_amp_network['subnet']['ip_version'] | default(omit) }}"
       ipv6_address_mode: "{{ octavia_amp_network['subnet']['ipv6_address_mode'] | default(omit) }}"
       ipv6_ra_mode: "{{ octavia_amp_network['subnet']['ipv6_ra_mode'] | default(omit) }}"