Skip to content

Commit ff9818a

Browse files
maxstackmaxstack
committed
Merge branch 'stackhpc/2024.1' into 2024.1-sot-od-grafana-docker-selinux
2 parents a1a3651 + 7b30560 commit ff9818a

14 files changed

+461
-35
lines changed

‎.github/workflows/amphora-image-build.yml‎

Lines changed: 256 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,256 @@
1+
---
2+
name: Build Amphora image
3+
on:
4+
workflow_dispatch:
5+
secrets:
6+
KAYOBE_VAULT_PASSWORD:
7+
required: true
8+
CLOUDS_YAML:
9+
required: true
10+
OS_APPLICATION_CREDENTIAL_ID:
11+
required: true
12+
OS_APPLICATION_CREDENTIAL_SECRET:
13+
required: true
14+
15+
env:
16+
ANSIBLE_FORCE_COLOR: True
17+
KAYOBE_ENVIRONMENT: ci-builder
18+
KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
19+
jobs:
20+
amphora-image-build:
21+
name: Build Amphora image
22+
if: github.repository == 'stackhpc/stackhpc-kayobe-config'
23+
runs-on: arc-skc-host-image-builder-runner
24+
permissions: {}
25+
steps:
26+
27+
- name: Install Package
28+
uses: ConorMacBride/install-package@main
29+
with:
30+
apt: git unzip nodejs python3-pip python3-venv openssh-server openssh-client jq
31+
32+
- name: Start the SSH service
33+
run: |
34+
sudo /etc/init.d/ssh start
35+
36+
- name: Checkout
37+
uses: actions/checkout@v4
38+
with:
39+
path: src/kayobe-config
40+
41+
- name: Determine OpenStack release
42+
id: openstack_release
43+
run: |
44+
BRANCH=$(awk -F'=' '/defaultbranch/ {print $2}' src/kayobe-config/.gitreview)
45+
echo "BRANCH=$BRANCH" >> $GITHUB_OUTPUT
46+
echo "openstack_release=${BRANCH}" | sed -E "s,(stable|unmaintained)/,," >> $GITHUB_OUTPUT
47+
48+
# Generate a tag to apply to all built Amphora image.
49+
- name: Generate Amphora image tag
50+
id: image_tag
51+
run: |
52+
echo "image_tag=$(date +${{ steps.openstack_release.outputs.openstack_release }}-%Y%m%dT%H%M%S)" >> $GITHUB_OUTPUT
53+
54+
- name: Display Amphora image tag
55+
run: |
56+
echo "${{ steps.image_tag.outputs.image_tag }}"
57+
58+
- name: Install Kayobe
59+
run: |
60+
mkdir -p venvs &&
61+
pushd venvs &&
62+
python3 -m venv kayobe &&
63+
source kayobe/bin/activate &&
64+
pip install -U pip &&
65+
pip install -r ../src/kayobe-config/requirements.txt
66+
67+
- name: Install terraform
68+
uses: hashicorp/setup-terraform@v2
69+
70+
- name: Initialise terraform
71+
run: terraform init
72+
working-directory: ${{ github.workspace }}/src/kayobe-config/terraform/aio
73+
74+
- name: Generate SSH keypair
75+
run: ssh-keygen -f id_rsa -N ''
76+
working-directory: ${{ github.workspace }}/src/kayobe-config/terraform/aio
77+
78+
- name: Generate clouds.yaml
79+
run: |
80+
cat << EOF > clouds.yaml
81+
${{ secrets.CLOUDS_YAML }}
82+
EOF
83+
working-directory: ${{ github.workspace }}/src/kayobe-config/terraform/aio
84+
85+
- name: Generate terraform.tfvars
86+
run: |
87+
cat << EOF > terraform.tfvars
88+
ssh_public_key = "id_rsa.pub"
89+
ssh_username = "ubuntu"
90+
aio_vm_name = "skc-amphora-image-builder"
91+
# Must be an Ubuntu Jammy host to successfully build all images
92+
# This MUST NOT be an LVM image. It can cause confusing conficts with the built image.
93+
aio_vm_image = "Ubuntu-22.04"
94+
aio_vm_flavor = "en1.medium"
95+
aio_vm_network = "stackhpc-ci"
96+
aio_vm_subnet = "stackhpc-ci"
97+
aio_vm_interface = "ens3"
98+
EOF
99+
working-directory: ${{ github.workspace }}/src/kayobe-config/terraform/aio
100+
101+
- name: Terraform Plan
102+
run: terraform plan
103+
working-directory: ${{ github.workspace }}/src/kayobe-config/terraform/aio
104+
env:
105+
OS_CLOUD: "openstack"
106+
OS_APPLICATION_CREDENTIAL_ID: ${{ secrets.OS_APPLICATION_CREDENTIAL_ID }}
107+
OS_APPLICATION_CREDENTIAL_SECRET: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
108+
109+
- name: Terraform Apply
110+
run: |
111+
for attempt in $(seq 5); do
112+
if terraform apply -auto-approve; then
113+
echo "Created infrastructure on attempt $attempt"
114+
exit 0
115+
fi
116+
echo "Failed to create infrastructure on attempt $attempt"
117+
sleep 10
118+
terraform destroy -auto-approve
119+
sleep 60
120+
done
121+
echo "Failed to create infrastructure after $attempt attempts"
122+
exit 1
123+
working-directory: ${{ github.workspace }}/src/kayobe-config/terraform/aio
124+
env:
125+
OS_CLOUD: "openstack"
126+
OS_APPLICATION_CREDENTIAL_ID: ${{ secrets.OS_APPLICATION_CREDENTIAL_ID }}
127+
OS_APPLICATION_CREDENTIAL_SECRET: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
128+
129+
- name: Get Terraform outputs
130+
id: tf_outputs
131+
run: |
132+
terraform output -json
133+
working-directory: ${{ github.workspace }}/src/kayobe-config/terraform/aio
134+
135+
- name: Write Terraform outputs
136+
run: |
137+
cat << EOF > src/kayobe-config/etc/kayobe/environments/ci-builder/tf-outputs.yml
138+
${{ steps.tf_outputs.outputs.stdout }}
139+
EOF
140+
141+
- name: Write Terraform network config
142+
run: |
143+
cat << EOF > src/kayobe-config/etc/kayobe/environments/ci-builder/tf-network-allocation.yml
144+
---
145+
aio_ips:
146+
builder: "{{ access_ip_v4.value }}"
147+
EOF
148+
149+
- name: Write Terraform network interface config
150+
run: |
151+
mkdir -p src/kayobe-config/etc/kayobe/environments/$KAYOBE_ENVIRONMENT/inventory/group_vars/seed
152+
rm -f src/kayobe-config/etc/kayobe/environments/$KAYOBE_ENVIRONMENT/inventory/group_vars/seed/network-interfaces
153+
cat << EOF > src/kayobe-config/etc/kayobe/environments/$KAYOBE_ENVIRONMENT/inventory/group_vars/seed/network-interfaces
154+
admin_interface: "{{ access_interface.value }}"
155+
aio_interface: "{{ access_interface.value }}"
156+
EOF
157+
158+
- name: Manage SSH keys
159+
run: |
160+
mkdir -p ~/.ssh
161+
touch ~/.ssh/authorized_keys
162+
cat src/kayobe-config/terraform/aio/id_rsa.pub >> ~/.ssh/authorized_keys
163+
cp src/kayobe-config/terraform/aio/id_rsa* ~/.ssh/
164+
165+
- name: Bootstrap the control host
166+
run: |
167+
source venvs/kayobe/bin/activate &&
168+
source src/kayobe-config/kayobe-env --environment ci-builder &&
169+
kayobe control host bootstrap
170+
171+
- name: Configure the seed host (Builder VM)
172+
run: |
173+
source venvs/kayobe/bin/activate &&
174+
source src/kayobe-config/kayobe-env --environment ci-builder &&
175+
kayobe seed host configure -e seed_bootstrap_user=ubuntu --skip-tags network
176+
177+
- name: Install dependencies
178+
run: |
179+
source venvs/kayobe/bin/activate &&
180+
source src/kayobe-config/kayobe-env --environment ci-builder &&
181+
kayobe seed host command run \
182+
--command "sudo apt update && sudo apt -y install gcc git libffi-dev python3-dev python-is-python3 python3-venv" --show-output
183+
env:
184+
KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
185+
186+
- name: Create Amphora image output directory
187+
run: |
188+
source venvs/kayobe/bin/activate &&
189+
source src/kayobe-config/kayobe-env --environment ci-builder &&
190+
kayobe seed host command run \
191+
--command "mkdir -p /opt/kayobe/images/amphora" --show-output
192+
env:
193+
KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
194+
195+
- name: Build Octavia Amphora image
196+
id: build_amphora
197+
run: |
198+
source venvs/kayobe/bin/activate &&
199+
source src/kayobe-config/kayobe-env --environment ci-builder &&
200+
kayobe playbook run src/kayobe-config/etc/kayobe/ansible/octavia-amphora-image-build.yml -e amphora_image_dest=/opt/kayobe/images/amphora/amphora-x64-haproxy.qcow2
201+
env:
202+
KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
203+
204+
- name: Show last error logs
205+
continue-on-error: true
206+
run: |
207+
source venvs/kayobe/bin/activate &&
208+
source src/kayobe-config/kayobe-env --environment ci-builder &&
209+
kayobe seed host command run --command "tail -200 /var/log/octavia-amphora-image-build.log" --show-output
210+
env:
211+
KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
212+
if: steps.build_amphora.outcome == 'failure'
213+
214+
- name: Upload Octavia Amphora image to Ark
215+
run: |
216+
source venvs/kayobe/bin/activate &&
217+
source src/kayobe-config/kayobe-env --environment ci-builder &&
218+
kayobe playbook run \
219+
src/kayobe-config/etc/kayobe/ansible/pulp-artifact-upload.yml \
220+
-e artifact_path=/opt/kayobe/images/amphora \
221+
-e artifact_tag=${{ steps.image_tag.outputs.image_tag }} \
222+
-e file_regex="*.qcow2" \
223+
-e repository_name="amphora-images-${{ steps.openstack_release.outputs.openstack_release }}" \
224+
-e pulp_base_path="amphora-images/${{ steps.openstack_release.outputs.openstack_release }}"
225+
env:
226+
KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
227+
if: steps.build_amphora.outcome == 'success'
228+
229+
- name: Copy logs back to runner
230+
continue-on-error: true
231+
run: |
232+
mkdir artifact
233+
scp stack@$(jq -r .access_ip_v4.value src/kayobe-config/etc/kayobe/environments/ci-builder/tf-outputs.yml):/var/log/octavia-amphora-image-build.log ./artifact
234+
if: always()
235+
236+
- name: Fail if Amphora image builds failed
237+
run: |
238+
echo "Builds failed. See workflow artifacts for details." &&
239+
exit 1
240+
if: steps.build_amphora.outcome == 'failure'
241+
242+
- name: Upload logs & image artifact
243+
uses: actions/upload-artifact@v4
244+
with:
245+
name: amphora-image-build-log
246+
path: ./artifact
247+
if: always()
248+
249+
- name: Destroy
250+
run: terraform destroy -auto-approve
251+
working-directory: ${{ github.workspace }}/src/kayobe-config/terraform/aio
252+
env:
253+
OS_CLOUD: openstack
254+
OS_APPLICATION_CREDENTIAL_ID: ${{ secrets.OS_APPLICATION_CREDENTIAL_ID }}
255+
OS_APPLICATION_CREDENTIAL_SECRET: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
256+
if: always()

‎.github/workflows/amphora-image-promote.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
---
2+
name: Promote Amphora image
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
image_tag:
7+
description: Tag to promote
8+
type: string
9+
required: true
10+
env:
11+
ANSIBLE_FORCE_COLOR: True
12+
jobs:
13+
amphora-image-promote:
14+
name: Promote Amphora image
15+
if: github.repository == 'stackhpc/stackhpc-kayobe-config'
16+
runs-on: ubuntu-22.04
17+
steps:
18+
- uses: actions/checkout@v4
19+
with:
20+
path: src/kayobe-config
21+
22+
- name: Determine OpenStack release
23+
id: openstack_release
24+
run: |
25+
BRANCH=$(awk -F'=' '/defaultbranch/ {print $2}' .gitreview)
26+
echo "openstack_release=${BRANCH}" | sed -E "s,(stable|unmaintained)/,," >> $GITHUB_OUTPUT
27+
working-directory: src/kayobe-config
28+
29+
- name: Setup networking
30+
run: |
31+
if ! ip l show breth1 >/dev/null 2>&1; then
32+
sudo ip l add breth1 type bridge
33+
fi
34+
sudo ip l set breth1 up
35+
if ! ip a show breth1 | grep 192.168.33.3/24; then
36+
sudo ip a add 192.168.33.3/24 dev breth1
37+
fi
38+
if ! ip l show dummy1 >/dev/null 2>&1; then
39+
sudo ip l add dummy1 type dummy
40+
fi
41+
sudo ip l set dummy1 up
42+
sudo ip l set dummy1 master breth1
43+
44+
- name: Install Kayobe
45+
run: |
46+
mkdir -p venvs &&
47+
pushd venvs &&
48+
python3 -m venv kayobe &&
49+
source kayobe/bin/activate &&
50+
pip install -U pip &&
51+
pip install -r ../src/kayobe-config/requirements.txt
52+
53+
- name: Bootstrap the control host
54+
run: |
55+
source venvs/kayobe/bin/activate &&
56+
source src/kayobe-config/kayobe-env --environment ci-builder &&
57+
kayobe control host bootstrap
58+
59+
- name: Promote Amphora image artifact
60+
run: |
61+
source venvs/kayobe/bin/activate &&
62+
source src/kayobe-config/kayobe-env --environment ci-builder &&
63+
kayobe playbook run \
64+
src/kayobe-config/etc/kayobe/ansible/pulp-artifact-promote.yml \
65+
-e repository_name="amphora-images-${{ steps.openstack_release.outputs.openstack_release }}" \
66+
-e pulp_base_path="amphora-images/${{ steps.openstack_release.outputs.openstack_release }}"
67+
env:
68+
ARTIFACT_TAG: ${{ inputs.image_tag }}
69+
KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}

‎.github/workflows/overcloud-host-image-upload.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ jobs:
8080
- name: Install OpenStack client
8181
run: |
8282
source venvs/kayobe/bin/activate &&
83-
pip install python-openstackclient -c https://releases.openstack.org/constraints/upper/${{ steps.openstack_release.outputs.openstack_release }}
83+
pip install python-openstackclient -c https://raw.githubusercontent.com/stackhpc/requirements/refs/heads/stackhpc/${{ steps.openstack_release.outputs.openstack_release }}/upper-constraints.txt
8484
8585
- name: Output Rocky Linux 9 image tag
8686
id: rocky_9_image_tag

‎.github/workflows/stackhpc-ci-cleanup.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
3535
- name: Install OpenStack client
3636
run: |
37-
pip install python-openstackclient -c https://releases.openstack.org/constraints/upper/${{ steps.openstack_release.outputs.openstack_release }}
37+
pip install python-openstackclient -c https://raw.githubusercontent.com/stackhpc/requirements/refs/heads/stackhpc/${{ steps.openstack_release.outputs.openstack_release }}/upper-constraints.txt
3838
3939
- name: Clean up aio instances over 3 hours old
4040
run: |

‎doc/source/operations/upgrading-openstack.rst‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ This behavior can be overridden manually:
4949
5050
Wherever possible, Magnum deployments should be migrated to the CAPI Helm
5151
driver. Instructions for enabling the driver can be found `here
52-
<../configuration/magnum-capi.rst>`_. Enable the driver, recreate any clusters
52+
<../configuration/magnum-capi.html>`_. Enable the driver, recreate any clusters
5353
using Heat, and disable the service.
5454

5555
After the upgrade (so that alerts don't fire) you can remove Heat with the
@@ -167,6 +167,15 @@ Support for the ``AvailabilityZoneFilter`` filter has been dropped in Nova.
167167
Remove it from any Nova config files before upgrading. It will cause errors in
168168
Caracal and halt the Nova scheduler.
169169

170+
Keystone LDAP TLS configuration
171+
-------------------------------
172+
173+
Either ``[ldap] tls_cacertfile`` or ``[ldap] tls_cacertdir`` must be configured
174+
if ``[ldap] use_tls`` is true or LDAP URL uses the ``ldaps://`` scheme. LDAP
175+
authentication will fail if this configuration is absent. See `upstream
176+
Keystone change <https://review.opendev.org/c/openstack/keystone/+/833876>`__
177+
for more details.
178+
170179
Known issues
171180
============
172181

@@ -219,7 +228,7 @@ been done, they should be completed before the upgrade begins.
219228
220229
* Enable `host firewalling <TODO>`_
221230
222-
* Enable `Center for Internet Security (CIS) compliance <../configuration/security-hardening.rst>`_
231+
* Enable `Center for Internet Security (CIS) compliance <../configuration/security-hardening.html>`_
223232
* Enable TLS on the :kayobe-doc:`public API network
224233
<configuration/reference/kolla-ansible.html#tls-encryption-of-apis>`
225234
* Enable TLS on the `internal API network <../configuration/vault.html>`_

0 commit comments

Comments
 (0)