Merge pull request #201 from stackhpc/sync-upstream-wallaby

markgoddard · web-flow · commit d2753a1102b7 · 2022-03-28T16:53:25.000+01:00
Sync upstream wallaby
diff --git a/ansible/roles/cinder/defaults/main.yml b/ansible/roles/cinder/defaults/main.yml
@@ -201,6 +201,15 @@ cinder_logging_debug: "{{ openstack_logging_debug }}"
 
 openstack_cinder_auth: "{{ openstack_auth }}"
 
+# After upgrading cinder, services will have an RPC version cap in place.  We
+# need to restart all services in order to allow them to use the latest RPC
+# version. Ideally, there would be a way to check whether all cinder services
+# are using the latest version, but currently there is not. Instead, wait a
+# short time for all cinder services to update the version of their service in
+# the database.  This seems to take around 10 seconds, but the default is 30 to
+# allow room for slowness.
+cinder_rpc_version_startup_delay: 30
+
 
 ####################
 # Cinder
diff --git a/ansible/roles/cinder/handlers/main.yml b/ansible/roles/cinder/handlers/main.yml
@@ -66,3 +66,23 @@
     healthcheck: "{{ service.healthcheck | default(omit) }}"
   when:
     - kolla_action != "config"
+
+# NOTE(mgoddard): After upgrading cinder, services will have an RPC version cap
+# in place.  We need to restart all services in order to allow them to use the
+# latest RPC version. Ideally, there would be a way to check whether all cinder
+# services are using the latest version, but currently there is not. Instead,
+# wait a short time for all cinder services to update the version of their
+# service in the database.  This seems to take around 10 seconds, but the
+# default is 30 to allow room for slowness.
+
+- name: Wait for cinder services to update service versions
+  pause:
+    seconds: "{{ cinder_rpc_version_startup_delay }}"
+  run_once: true
+  when:
+    - kolla_action == 'upgrade'
+  listen:
+    - Restart cinder-api container
+    - Restart cinder-scheduler container
+    - Restart cinder-volume container
+    - Restart cinder-backup container
diff --git a/ansible/roles/cinder/tasks/reload.yml b/ansible/roles/cinder/tasks/reload.yml
@@ -0,0 +1,10 @@
+---
+- name: Reload cinder services to remove RPC version pin
+  vars:
+    service: "{{ item.value }}"
+  become: true
+  kolla_docker:
+    action: "restart_container"
+    common_options: "{{ docker_common_options }}"
+    name: "{{ service.container_name }}"
+  with_dict: "{{ cinder_services | select_services_enabled_and_mapped_to_host }}"
diff --git a/ansible/roles/cinder/tasks/upgrade.yml b/ansible/roles/cinder/tasks/upgrade.yml
@@ -13,6 +13,8 @@
 - name: Flush handlers
   meta: flush_handlers
 
+- import_tasks: reload.yml
+
 - name: Running Cinder online schema migration
   vars:
     cinder_api: "{{ cinder_services['cinder-api'] }}"
diff --git a/ansible/roles/common/tasks/config.yml b/ansible/roles/common/tasks/config.yml
@@ -220,14 +220,15 @@
       - { name: "monasca", enabled: "{{ enable_monasca | bool }}" }
       - { name: "murano", enabled: "{{ enable_murano | bool }}" }
       - { name: "neutron", enabled: "{{ enable_neutron | bool }}" }
-      - { name: "neutron-tls-proxy", enabled: "{{ neutron_enable_tls_backend |
-      bool }}" }
+      - { name: "neutron-tls-proxy", enabled: "{{ neutron_enable_tls_backend | bool }}" }
       - { name: "nova", enabled: "{{ enable_nova | bool }}" }
       - { name: "nova-libvirt", enabled: "{{ enable_nova | bool and nova_compute_virt_type in ['kvm', 'qemu'] }}" }
       - { name: "octavia", enabled: "{{ enable_octavia | bool }}" }
+      - { name: "openvswitch", enabled: "{{ enable_openvswitch | bool }}" }
       - { name: "outward-rabbitmq", enabled: "{{ enable_outward_rabbitmq | bool }}" }
       - { name: "panko", enabled: "{{ enable_panko | bool }}" }
       - { name: "placement", enabled: "{{ enable_placement | bool }}" }
+      - { name: "prometheus", enabled: "{{ enable_prometheus | bool }}" }
       - { name: "rabbitmq", enabled: "{{ enable_rabbitmq | bool }}" }
       - { name: "rally", enabled: "{{ enable_rally | bool }}" }
       - { name: "sahara", enabled: "{{ enable_sahara | bool }}" }
diff --git a/ansible/roles/common/templates/cron-logrotate-openvswitch.conf.j2 b/ansible/roles/common/templates/cron-logrotate-openvswitch.conf.j2
@@ -0,0 +1,3 @@
+"/var/log/kolla/openvswitch/*.log"
+{
+}
diff --git a/ansible/roles/common/templates/cron-logrotate-prometheus.conf.j2 b/ansible/roles/common/templates/cron-logrotate-prometheus.conf.j2
@@ -0,0 +1,3 @@
+"/var/log/kolla/prometheus/*.log"
+{
+}
diff --git a/ansible/roles/grafana/templates/grafana.ini.j2 b/ansible/roles/grafana/templates/grafana.ini.j2
@@ -23,14 +23,6 @@ user = {{ grafana_database_user }}
 password = {{ grafana_database_password }}
 ssl_mode = disable
 
-[session]
-provider = mysql
-provider_config = {{ grafana_database_user }}:{{ grafana_database_password }}@tcp({{ grafana_database_address }})/{{ grafana_database_name }}
-
-cookie_name = grafana_sess
-cookie_secure = false
-session_life_time = 86400
-
 [analytics]
 reporting_enabled = false
 check_for_updates = false
diff --git a/ansible/roles/ironic/tasks/precheck.yml b/ansible/roles/ironic/tasks/precheck.yml
@@ -44,7 +44,6 @@
     timeout: 1
     state: stopped
   when:
-    - enable_ironic_ipxe | bool
     - container_facts['ironic_ipxe'] is not defined
     - inventory_hostname in groups['ironic-ipxe']
 
diff --git a/ansible/roles/keystone/defaults/main.yml b/ansible/roles/keystone/defaults/main.yml
@@ -212,4 +212,5 @@ keystone_trusted_dashboards: "{{ ['%s://%s/auth/websso/' % (public_protocol, kol
 keystone_enable_federation_openid: "{{ enable_keystone_federation | bool and keystone_identity_providers | selectattr('protocol','equalto','openid') | list | count > 0 }}"
 keystone_should_remove_attribute_mappings: False
 keystone_should_remove_identity_providers: False
+keystone_federation_oidc_response_type: "id_token"
 keystone_federation_oidc_scopes: "openid email profile"
diff --git a/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 b/ansible/roles/keystone/templates/wsgi-keystone.conf.j2
@@ -56,7 +56,7 @@ LogLevel info
 {% if keystone_enable_federation_openid %}
     OIDCClaimPrefix "OIDC-"
     OIDCClaimDelimiter ";"
-    OIDCResponseType "id_token"
+    OIDCResponseType "{{ keystone_federation_oidc_response_type }}"
     OIDCScope "{{ keystone_federation_oidc_scopes }}"
     OIDCMetadataDir {{ keystone_container_federation_oidc_metadata_folder }}
 {% if keystone_federation_openid_certificate_key_ids | length > 0 %}
diff --git a/ansible/roles/neutron/defaults/main.yml b/ansible/roles/neutron/defaults/main.yml
@@ -548,6 +548,7 @@ openstack_neutron_auth: "{{ openstack_auth }}"
 
 # Set to KOLLA_SKIP to skip setting these (even if set already - total ignore).
 # Set to KOLLA_UNSET to make Kolla unset these in the managed sysctl.conf file.
+neutron_l3_agent_host_ipv4_ip_forward: KOLLA_UNSET
 neutron_l3_agent_host_rp_filter_mode: 0
 neutron_l3_agent_host_ipv4_neigh_gc_thresh1: 128
 neutron_l3_agent_host_ipv4_neigh_gc_thresh2: 28672
diff --git a/ansible/roles/neutron/tasks/config-host.yml b/ansible/roles/neutron/tasks/config-host.yml
@@ -25,6 +25,8 @@
     sysctl_set: "{{ should_set }}"
     sysctl_file: "{{ kolla_sysctl_conf_path }}"
   with_items:
+    # TODO(mgoddard): Remove net.ipv4.ip_forward from this list in Zed cycle.
+    - { name: "net.ipv4.ip_forward", value: "{{ neutron_l3_agent_host_ipv4_ip_forward }}"}
     - { name: "net.ipv4.conf.all.rp_filter", value: "{{ neutron_l3_agent_host_rp_filter_mode }}"}
     - { name: "net.ipv4.conf.default.rp_filter", value: "{{ neutron_l3_agent_host_rp_filter_mode }}"}
     - { name: "net.ipv4.neigh.default.gc_thresh1", value: "{{ neutron_l3_agent_host_ipv4_neigh_gc_thresh1 }}"}
diff --git a/ansible/roles/nova-cell/defaults/main.yml b/ansible/roles/nova-cell/defaults/main.yml
@@ -530,6 +530,14 @@ migration_hostname: "{{ ansible_facts.nodename }}"
 # It does not change that often (in fact, most likely never ever).
 qemu_user_gid: 42427
 
+# Whether to enable libvirt SASL authentication.
+libvirt_enable_sasl: true
+# Username for libvirt SASL.
+libvirt_sasl_authname: "nova"
+# List of enabled libvirt SASL authentication mechanisms.
+libvirt_sasl_mech_list:
+  - "{{ 'SCRAM-SHA-256' if libvirt_tls | bool else 'DIGEST-MD5' }}"
+
 ####################
 # Kolla
 ####################
diff --git a/ansible/roles/nova-cell/handlers/main.yml b/ansible/roles/nova-cell/handlers/main.yml
@@ -93,6 +93,7 @@
   vars:
     service_name: "nova-libvirt"
     service: "{{ nova_cell_services[service_name] }}"
+    nova_libvirt_notify: "{{ ['Create libvirt SASL user'] if libvirt_enable_sasl | bool else [] }}"
   become: true
   kolla_docker:
     action: "recreate_or_restart_container"
@@ -112,6 +113,20 @@
   until: restart_nova_libvirt is success
   when:
     - kolla_action != "config"
+  notify: "{{ nova_libvirt_notify }}"
+
+# The SASL user needs to exist in order for nova-compute to start successfully.
+- name: Create libvirt SASL user
+  become: true
+  shell:
+    cmd: >
+      set -o pipefail &&
+      echo {{ libvirt_sasl_password }} |
+      docker exec -i nova_libvirt
+      saslpasswd2 -c -p -a libvirt {{ libvirt_sasl_authname }}
+    executable: /bin/bash
+  changed_when: true
+  no_log: true
 
 - name: Restart nova-compute container
   vars:
diff --git a/ansible/roles/nova-cell/tasks/config.yml b/ansible/roles/nova-cell/tasks/config.yml
@@ -97,6 +97,26 @@
     - libvirt_tls | bool
     - libvirt_tls_manage_certs | bool
 
+- name: Copying over libvirt SASL configuration
+  become: true
+  vars:
+    service_name: "{{ item.service }}"
+    service: "{{ nova_cell_services[service_name] }}"
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ node_config_directory }}/{{ service_name }}/{{ item.dest }}"
+    mode: "0660"
+  when:
+    - libvirt_enable_sasl | bool
+    - inventory_hostname in groups[service.group]
+    - service.enabled | bool
+  with_items:
+    - { src: "auth.conf.j2", dest: "auth.conf", service: "nova-compute" }
+    - { src: "auth.conf.j2", dest: "auth.conf", service: "nova-libvirt" }
+    - { src: "sasl.conf.j2", dest: "sasl.conf", service: "nova-libvirt" }
+  notify:
+    - Restart {{ service_name }} container
+
 - name: Copying files for nova-ssh
   become: true
   vars:
diff --git a/ansible/roles/nova-cell/templates/auth.conf.j2 b/ansible/roles/nova-cell/templates/auth.conf.j2
@@ -0,0 +1,6 @@
+[credentials-default]
+authname={{ libvirt_sasl_authname }}
+password={{ libvirt_sasl_password }}
+
+[auth-libvirt-default]
+credentials=default
diff --git a/ansible/roles/nova-cell/templates/libvirtd.conf.j2 b/ansible/roles/nova-cell/templates/libvirtd.conf.j2
@@ -5,10 +5,11 @@ tls_port = "{{ nova_libvirt_port }}"
 key_file = "/etc/pki/libvirt/private/serverkey.pem"
 cert_file = "/etc/pki/libvirt/servercert.pem"
 ca_file = "/etc/pki/CA/cacert.pem"
+auth_tls = "{{ 'sasl' if libvirt_enable_sasl | bool else 'none' }}"
 {% else %}
 listen_tcp = 1
 listen_tls = 0
-auth_tcp = "none"
+auth_tcp = "{{ 'sasl' if libvirt_enable_sasl | bool else 'none' }}"
 tcp_port = "{{ nova_libvirt_port }}"
 ca_file = ""
 {% endif %}
diff --git a/ansible/roles/nova-cell/templates/nova-compute.json.j2 b/ansible/roles/nova-cell/templates/nova-compute.json.j2
@@ -55,7 +55,13 @@
             "owner": "nova",
             "perm": "0600",
             "optional": true
-        }
+        }{% if nova_compute_virt_type in ['kvm', 'qemu'] and libvirt_enable_sasl | bool %},
+        {
+            "source": "{{ container_config_directory }}/auth.conf",
+            "dest": "/var/lib/nova/.config/libvirt/auth.conf",
+            "owner": "nova",
+            "perm": "0600"
+        }{% endif %}
     ],
     "permissions": [
         {
diff --git a/ansible/roles/nova-cell/templates/nova-libvirt.json.j2 b/ansible/roles/nova-cell/templates/nova-libvirt.json.j2
@@ -54,6 +54,18 @@
             "dest": "/etc/ceph/ceph.conf",
             "owner": "nova",
             "perm": "0600"
+        }{% endif %}{% if libvirt_enable_sasl | bool %},
+        {
+            "source": "{{ container_config_directory }}/sasl.conf",
+            "dest": "/etc/sasl2/libvirt.conf",
+            "owner": "root",
+            "perm": "0600"
+        },
+        {
+            "source": "{{ container_config_directory }}/auth.conf",
+            "dest": "/root/.config/libvirt/auth.conf",
+            "owner": "root",
+            "perm": "0600"
         }{% endif %}
     ]
 }
diff --git a/ansible/roles/nova-cell/templates/sasl.conf.j2 b/ansible/roles/nova-cell/templates/sasl.conf.j2
@@ -0,0 +1,2 @@
+mech_list: {{ libvirt_sasl_mech_list | join(' ') }}
+sasldb_path: /etc/libvirt/passwd.db
diff --git a/doc/source/reference/compute/libvirt-guide.rst b/doc/source/reference/compute/libvirt-guide.rst
@@ -1,5 +1,3 @@
-.. libvirt-tls-guide:
-
 ====================================
 Libvirt - Nova Virtualisation Driver
 ====================================
@@ -23,16 +21,39 @@ hardware virtualisation (e.g. Virtualisation Technology (VT) BIOS configuration
 on Intel systems), ``qemu`` may be used to provide less performant
 software-emulated virtualisation.
 
+SASL Authentication
+===================
+
+The default configuration of Kolla Ansible is to run libvirt over TCP,
+authenticated with SASL. This should not be considered as providing a secure,
+encrypted channel, since the username/password SASL mechanisms available for
+TCP are no longer considered cryptographically secure. However, it does at
+least provide some authentication for the libvirt API. For a more secure
+encrypted channel, use :ref`libvirt TLS <libvirt-tls>`.
+
+SASL is enabled according to the ``libvirt_enable_sasl`` flag, which defaults
+to ``true``.
+
+The username is configured via ``libvirt_sasl_authname``, and defaults to
+``kolla``. The password is configured via ``libvirt_sasl_password``, and is
+generated with other passwords using and stored in ``passwords.yml``.
+
+The list of enabled authentication mechanisms is configured via
+``libvirt_sasl_mech_list``, and defaults to ``["SCRAM-SHA-256"]`` if libvirt
+TLS is enabled, or ``["DIGEST-MD5"]`` otherwise.
+
+.. libvirt-tls:
+
 Libvirt TLS
 ===========
 
 The default configuration of Kolla Ansible is to run libvirt over TCP, with
-authentication disabled. As long as one takes steps to protect who can access
-the port this works well. However, in the case where you want live-migration to
-be allowed across hypervisors one may want to either add some level of
-authentication to the connections or make sure VM data is passed between
-hypervisors in a secure manner. To do this we can enable TLS for libvirt and
-make nova use it.
+SASL authentication. As long as one takes steps to protect who can access
+the network this works well. However, in a less trusted environment one may
+want to use encryption when accessing the libvirt API. To do this we can enable
+TLS for libvirt and make nova use it. Mutual TLS is configured, providing
+authentication of clients via certificates. SASL authentication provides a
+further level of security.
 
 Using libvirt TLS
 ~~~~~~~~~~~~~~~~~
diff --git a/etc/kolla/passwords.yml b/etc/kolla/passwords.yml
@@ -256,3 +256,8 @@ keystone_federation_openid_crypto_password:
 # Ceph RadosGW options
 ####################
 ceph_rgw_keystone_password:
+
+##################
+# libvirt options
+##################
+libvirt_sasl_password:
diff --git a/releasenotes/notes/bug-1945453-2-287bfcaf060689d8.yaml b/releasenotes/notes/bug-1945453-2-287bfcaf060689d8.yaml
@@ -0,0 +1,16 @@
+---
+security:
+  - |
+    Explicitly removes the ``net.ipv4.ip_forward`` sysctl from
+    ``/etc/sysctl.conf`` on hosts with Neutron L3 Agent. In the absence of
+    another source for this sysctl, it should revert to the default of 0 after
+    the next reboot. This is a follow up to a previous change which stopped
+    setting the sysctl, but leaves existing systems with the original value of
+    1 set.
+
+    A deployer looking to more aggressively change the value may set
+    ``neutron_l3_agent_host_ipv4_ip_forward`` to 0 using a Yoga release of
+    Kolla Ansible. This option will be removed in future. Any deployments
+    still relying on the previous value may set
+    ``neutron_l3_agent_host_ipv4_ip_forward`` to 1.
+    `LP#1945453 <https://launchpad.net/bugs/1945453>`__
diff --git a/releasenotes/notes/bug-1961795-16fb2ac27152fc03.yaml b/releasenotes/notes/bug-1961795-16fb2ac27152fc03.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Fixes logrotate config missing for openvswitch and
+    prometheus services.
+    `LP#1961795 <https://launchpad.net/bugs/1961795>`__
diff --git a/releasenotes/notes/fix-hardcoded-oidc-response-fc0f115f0b56cddf.yaml b/releasenotes/notes/fix-hardcoded-oidc-response-fc0f115f0b56cddf.yaml
@@ -0,0 +1,7 @@
+---
+fixes:
+  - |
+    Fixes an issue with setting up OIDC based Keystone federation against IDP
+    that has a different response type than id_token. This can now be set using
+    a new variable ``keystone_federation_oidc_response_type``.
+    `LP#1959781 <https://bugs.launchpad.net/bugs/1959781>`__
diff --git a/releasenotes/notes/implement-docker-healthchecks-for-ironic-neutron-agent-61ec4d0d237da075.yaml b/releasenotes/notes/implement-docker-healthchecks-for-ironic-neutron-agent-61ec4d0d237da075.yaml
diff --git a/releasenotes/notes/libvirt-sasl-404199143610fb75.yaml b/releasenotes/notes/libvirt-sasl-404199143610fb75.yaml
@@ -0,0 +1,27 @@
+---
+features:
+  - |
+    Adds support for libvirt SASL authentication. It is enabled by default.
+    `LP#1964013 <https://bugs.launchpad.net/kolla-ansible/+bug/1964013>`__
+security:
+  - |
+    Fixes an issue where the default configuration of libvirt did not use
+    authentication for the API exposed over TCP on the internal API network.
+    This allowed anyone with access to the internal API network read-write
+    access to libvirt. While the internal API network is typically trusted,
+    other services on this network generally at least require authentication.
+
+    SASL authentication is now enabled for libvirt by default. Kolla Ansible
+    supports libvirt TLS since the Train release, and this is recommended to
+    provide a higher level of security. `LP#1964013
+    <https://bugs.launchpad.net/kolla-ansible/+bug/1964013>`__
+upgrade:
+  - |
+    The addition of libvirt SASL authentication requires a new password in
+    ``passwords.yml``, ``libvirt_sasl_password``. This may be generated using
+    the existing ``kolla-genpwd`` and ``kolla-mergepwd`` tooling.
+  - |
+    The addition of libvirt SASL authentication requires both the
+    ``nova_libvirt`` and ``nova_compute`` containers to be updated
+    simultaneously, using new images with the necessary Cyrus SASL
+    dependencies, as well as configuration containing the SASL credentials.
diff --git a/releasenotes/notes/unpin-cinder-rpcs-8eb7e0858a91b9b8.yaml b/releasenotes/notes/unpin-cinder-rpcs-8eb7e0858a91b9b8.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Fixes an issue with Cinder upgrade where Cinder services would remain
+    pinned to the previous release's RPC & object versions. `LP#1954932
+    <https://bugs.launchpad.net/kolla-ansible/+bug/1954932>`__
diff --git a/test-requirements.txt b/test-requirements.txt
diff --git a/tests/check-logs.sh b/tests/check-logs.sh
diff --git a/zuul.d/base.yaml b/zuul.d/base.yaml
diff --git a/zuul.d/jobs.yaml b/zuul.d/jobs.yaml
diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+"/var/log/kolla/openvswitch/*.log"`
	`2`	`+{`
	`3`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+"/var/log/kolla/prometheus/*.log"`
	`2`	`+{`
	`3`	`+}`