openstack-ansible-os_nova

Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e

2015年02月14日 10:06:50 -06:00

---

#

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

# http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

Implement Xenial Support This implements support for Ubuntu 16.04. The changes primarily relate to implementing systemd service files instead of upstart init scripts. Implements: blueprint support-ubuntu-1604 Change-Id: If0d4de3519e04a45795e64fca9c8ca7b56729a88

2016年06月01日 13:59:24 -04:00

- name:Gather variables for each operating system

Refactor use of include_vars Use a first_found lookup instead of a with_first_found loop so that the 'paths' parameter can be used. This ensures that only vars from the role are included, and not vars from a parent calling role. This can happen when a parent role has a higher priority vars file available for inclusion than the role it calls. Change-Id: I046def5a5cc94f680bc0daa3a2a1734f325d8022

2022年01月12日 08:18:07 +00:00

include_vars:"{{ lookup('first_found', params) }}"

vars:

params:

files:

- "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_version'] | lower }}.yml"

- "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower }}.yml"

- "{{ ansible_facts['os_family'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower }}.yml"

- "{{ ansible_facts['distribution'] | lower }}.yml"

- "{{ ansible_facts['os_family'] | lower }}.yml"

paths:

- "{{ role_path }}/vars"

Implement Xenial Support This implements support for Ubuntu 16.04. The changes primarily relate to implementing systemd service files instead of upstart init scripts. Implements: blueprint support-ubuntu-1604 Change-Id: If0d4de3519e04a45795e64fca9c8ca7b56729a88

2016年06月01日 13:59:24 -04:00

tags:

- always

Fix linting issues for ansible-lint 3.4.1 Preparing this role for the ansible-lint version bump Change-Id: Ia5d254d43f9541c82c700080aafee276dafad0a7

2016年11月02日 12:48:25 +00:00

- name:Fail when virt type is unsupported

Ensure tasks are not skipped - The lookup of the first file should only be skipped when necessary (the apt bits). - On the block/rescue: The rescue task didn't run, so if the when didn't trigger, no virt will be set, unless the ``cat /proc/cpuinfo`` failed. Change-Id: I6e89de1c9d1828003a83c5ca2b5b56d64c12f30c

2017年05月22日 11:15:31 +00:00

fail:

msg:"Unsupported Virt Type Provided {{ nova_supported_virt_types }}"

Implement nova-lxd driver This patch set is designed to allow deployers to select the virt_type = 'lxc', which will deploy the nova-lxd driver instead of the usual kvm driver. Change-Id: I8b298080faaef9da1ab0040de437086a1a393296

2016年07月14日 11:59:57 -04:00

when:

- nova_virt_type is defined

- nova_virt_type not in nova_supported_virt_types

tags:

- always

Add support for using distribution packages for OpenStack services Distributions provide packages for the OpenStack services so we add support for using these instead of the pip ones. Depends-On: https://review.openstack.org/#/c/579151/ Depends-On: https://review.openstack.org/#/c/579071/ Change-Id: Iff373b5402c664206b940b8e95a0b8845050213b Implements: blueprint openstack-distribution-packages

2018年05月09日 15:31:57 +01:00

- name:Fail if service was deployed using a different installation method

fail:

msg:"Switching installation methods for OpenStack services is not supported"

when:

- ansible_local is defined

- ansible_local.openstack_ansible is defined

- ansible_local.openstack_ansible.nova is defined

- ansible_local.openstack_ansible.nova.install_method is defined

- ansible_local.openstack_ansible.nova.install_method != nova_install_method

- name:Gather variables for installation method

include_vars:"{{ nova_install_method }}_install.yml"

tags:

- always

Fix linters and metadata With update of ansible-lint to version >=6.0.0 a lot of new linters were added, that enabled by default. In order to comply with linter rules we're applying changes to the role. With that we also update metdata to reflect current state. Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/888223 Change-Id: I730ae569f199fc8542a5a61beb149f459465d7e2

2023年07月17日 16:17:30 +02:00

- name:Including osa.db_setup role

include_role:

Use common service setup tasks from a collection rather than in-role Change-Id: I01fdeb2cca9d5315fd486500cc8d6330cb23ce84

2022年01月12日 10:50:02 +00:00

name:openstack.osa.db_setup

apply:

tags:

- common-db

- nova-config

db_setup: refactor database setup to a common file This patch refactors the database creation to db_setup.yml which will eventually be managed by openstack-ansible-tests. This also re-orders the mq_setup to be done earlier so these system level dependencies are ready before service activation. Change-Id: I53de65d666a014b23a69b246591fc0445f3ad64d

2019年05月03日 14:43:09 -06:00

when:

Define condition for the first play host one time We use the same condition, which defines against what host some "service" tasks should run against, several times. It's hard to keep it the same across the role and ansible spending additional resources to evaluate it each time, so it's simpler and better for the maintenance to set a boolean variable which will say for all tasks, that we want to run only against signle host, if they should run or not now. Change-Id: I78d44704a0224b2c73832a607e84ea8d9499f8c2

2020年10月06日 18:14:34 +03:00

- _nova_is_first_play_host

db_setup: refactor database setup to a common file This patch refactors the database creation to db_setup.yml which will eventually be managed by openstack-ansible-tests. This also re-orders the mq_setup to be done earlier so these system level dependencies are ready before service activation. Change-Id: I53de65d666a014b23a69b246591fc0445f3ad64d

2019年05月03日 14:43:09 -06:00

vars:

_oslodb_setup_host:"{{ nova_db_setup_host }}"

Use the utility host for db setup tasks Move it to the service setup host (defaults to utility[0]) instead of the galera[0] host, and use galera_address (defaults to internal VIP) as the endpoint instead of a local connection on the db host. Change-Id: Ic4a2dfeeb022e1dbe0b1ba8aa0d0dd5feb7a8ffe

2020年08月19日 18:14:34 +00:00

_oslodb_ansible_python_interpreter:"{{ nova_db_setup_python_interpreter }}"

_oslodb_setup_endpoint:"{{ nova_galera_address }}"

_oslodb_setup_port:"{{ nova_galera_port }}"

db_setup: refactor database setup to a common file This patch refactors the database creation to db_setup.yml which will eventually be managed by openstack-ansible-tests. This also re-orders the mq_setup to be done earlier so these system level dependencies are ready before service activation. Change-Id: I53de65d666a014b23a69b246591fc0445f3ad64d

2019年05月03日 14:43:09 -06:00

_oslodb_databases:

- name:"{{ nova_galera_database }}"

users:

- username:"{{ nova_galera_user }}"

password:"{{ nova_container_mysql_password }}"

- name:"{{ nova_api_galera_database }}"

users:

- username:"{{ nova_api_galera_user }}"

password:"{{ nova_api_container_mysql_password }}"

- name:"{{ nova_cell0_database }}"

users:

- username:"{{ nova_api_galera_user }}"

password:"{{ nova_api_container_mysql_password }}"

tags:

Use common service setup tasks from a collection rather than in-role Change-Id: I01fdeb2cca9d5315fd486500cc8d6330cb23ce84

2022年01月12日 10:50:02 +00:00

- always

db_setup: refactor database setup to a common file This patch refactors the database creation to db_setup.yml which will eventually be managed by openstack-ansible-tests. This also re-orders the mq_setup to be done earlier so these system level dependencies are ready before service activation. Change-Id: I53de65d666a014b23a69b246591fc0445f3ad64d

2019年05月03日 14:43:09 -06:00

Fix linters and metadata With update of ansible-lint to version >=6.0.0 a lot of new linters were added, that enabled by default. In order to comply with linter rules we're applying changes to the role. With that we also update metdata to reflect current state. Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/888223 Change-Id: I730ae569f199fc8542a5a61beb149f459465d7e2

2023年07月17日 16:17:30 +02:00

- name:Including osa.mq_setup role

include_role:

Use common service setup tasks from a collection rather than in-role Change-Id: I01fdeb2cca9d5315fd486500cc8d6330cb23ce84

2022年01月12日 10:50:02 +00:00

name:openstack.osa.mq_setup

apply:

tags:

- common-mq

- nova-config

db_setup: refactor database setup to a common file This patch refactors the database creation to db_setup.yml which will eventually be managed by openstack-ansible-tests. This also re-orders the mq_setup to be done earlier so these system level dependencies are ready before service activation. Change-Id: I53de65d666a014b23a69b246591fc0445f3ad64d

2019年05月03日 14:43:09 -06:00

when:

Define condition for the first play host one time We use the same condition, which defines against what host some "service" tasks should run against, several times. It's hard to keep it the same across the role and ansible spending additional resources to evaluate it each time, so it's simpler and better for the maintenance to set a boolean variable which will say for all tasks, that we want to run only against signle host, if they should run or not now. Change-Id: I78d44704a0224b2c73832a607e84ea8d9499f8c2

2020年10月06日 18:14:34 +03:00

- _nova_is_first_play_host

db_setup: refactor database setup to a common file This patch refactors the database creation to db_setup.yml which will eventually be managed by openstack-ansible-tests. This also re-orders the mq_setup to be done earlier so these system level dependencies are ready before service activation. Change-Id: I53de65d666a014b23a69b246591fc0445f3ad64d

2019年05月03日 14:43:09 -06:00

vars:

_oslomsg_rpc_setup_host:"{{ nova_oslomsg_rpc_setup_host }}"

_oslomsg_rpc_userid:"{{ nova_oslomsg_rpc_userid }}"

_oslomsg_rpc_password:"{{ nova_oslomsg_rpc_password }}"

_oslomsg_rpc_vhost:"{{ nova_oslomsg_rpc_vhost }}"

_oslomsg_rpc_transport:"{{ nova_oslomsg_rpc_transport }}"

Add service policies defenition In order to allow definition of policies per service, we need to add variables so service roles, that will be passed to openstack.osa.mq_setup. Currently this can be handled by leveraging group_vars and overriding `oslomsg_rpc_policies` as a whole, but it's not obvious and can be non-trivial for some groups which are co-locating multiple services or in case of metal deployments. Change-Id: I6a4989df2cd53cc50faae120e96aa4480268f42d

2024年05月10日 17:00:41 +02:00

_oslomsg_rpc_policies:"{{ nova_oslomsg_rpc_policies }}"

db_setup: refactor database setup to a common file This patch refactors the database creation to db_setup.yml which will eventually be managed by openstack-ansible-tests. This also re-orders the mq_setup to be done earlier so these system level dependencies are ready before service activation. Change-Id: I53de65d666a014b23a69b246591fc0445f3ad64d

2019年05月03日 14:43:09 -06:00

_oslomsg_notify_setup_host:"{{ nova_oslomsg_notify_setup_host }}"

_oslomsg_notify_userid:"{{ nova_oslomsg_notify_userid }}"

_oslomsg_notify_password:"{{ nova_oslomsg_notify_password }}"

_oslomsg_notify_vhost:"{{ nova_oslomsg_notify_vhost }}"

_oslomsg_notify_transport:"{{ nova_oslomsg_notify_transport }}"

Add service policies defenition In order to allow definition of policies per service, we need to add variables so service roles, that will be passed to openstack.osa.mq_setup. Currently this can be handled by leveraging group_vars and overriding `oslomsg_rpc_policies` as a whole, but it's not obvious and can be non-trivial for some groups which are co-locating multiple services or in case of metal deployments. Change-Id: I6a4989df2cd53cc50faae120e96aa4480268f42d

2024年05月10日 17:00:41 +02:00

_oslomsg_notify_policies:"{{ nova_oslomsg_notify_policies }}"

Add variable to globally control notifications enablement In order to be able to globally enable notification reporting for all services, without an need to have ceilometer deployed or bunch of overrides for each service, we add `oslomsg_notify_enabled` variable that aims to control behaviour of enabled notifications. Presence of ceilometer is still respected by default and being referenced. Potential usecase are various billing panels that do rely on notifications but do not require presence of Ceilometer. Change-Id: Ib5d4f174be922f9b6f5ece35128a604fddb58e59

2024年05月10日 17:03:04 +02:00

_oslomsg_notify_configure:"{{ nova_oslomsg_notify_configure }}"

db_setup: refactor database setup to a common file This patch refactors the database creation to db_setup.yml which will eventually be managed by openstack-ansible-tests. This also re-orders the mq_setup to be done earlier so these system level dependencies are ready before service activation. Change-Id: I53de65d666a014b23a69b246591fc0445f3ad64d

2019年05月03日 14:43:09 -06:00

tags:

Use common service setup tasks from a collection rather than in-role Change-Id: I01fdeb2cca9d5315fd486500cc8d6330cb23ce84

2022年01月12日 10:50:02 +00:00

- always

db_setup: refactor database setup to a common file This patch refactors the database creation to db_setup.yml which will eventually be managed by openstack-ansible-tests. This also re-orders the mq_setup to be done earlier so these system level dependencies are ready before service activation. Change-Id: I53de65d666a014b23a69b246591fc0445f3ad64d

2019年05月03日 14:43:09 -06:00

Fix linters and metadata With update of ansible-lint to version >=6.0.0 a lot of new linters were added, that enabled by default. In order to comply with linter rules we're applying changes to the role. With that we also update metdata to reflect current state. Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/888223 Change-Id: I730ae569f199fc8542a5a61beb149f459465d7e2

2023年07月17日 16:17:30 +02:00

- name:Including nova_virt_detect tasks

include_tasks:nova_virt_detect.yml

Apply always tag to nova_virt_detect.yml Running nova playbook with tag limit may lead to an error: The conditional check 'nova_virt_type != 'ironic'' failed. The error was: error while evaluating conditional (nova_virt_type != 'ironic'): 'nova_virt_type' is undefined\n\nThe error appears to be in '/etc/ansible/roles/os_nova/tasks/main.yml': line 289, column 3, but may be elsewhere in the file depending on the exact syntax problem. It can be easily fixed by applying always tag to tasks from nova_virt_detect.yml Change-Id: I56aee80180804b8a3e3316cffc6fa8115513b8f1

2023年06月06日 07:35:36 +02:00

args:

apply:

tags:

- always

Avoid including nova_virt_detect if nova_virt_type is set There's no need for us to actually run through that entire set of tasks if the value is specified already. Change-Id: I6f3503fdfbe8fa43334da4360827078cd450ffcd

2018年11月02日 18:59:52 +01:00

when:

- nova_virt_type is not defined

Fix nova_virt_type auto-detection In https://review.openstack.org/243098 nova_virt_type auto-detection was implemented, but the default nova_virt_type value of kvm was left in place, resulting in the auto-detection never happening. This patch implements the auto-detection if nova-virt_type is not set and removes the default value for nova-virt_type. Change-Id: Ic1c8f042bc6bbee542373d335f338866efa06dc7

2015年12月02日 14:40:47 +00:00

tags:

Always include nova_virt_detect.yml Currently, if you run the os-nova-install.yml playbook with the nova-config or nova-install tags, the run will fail as nova_virt_type is not defined anywhere. This commit updates os_nova/tasks/main.yml by adding the always tag so that nova_virt_detect.yml is always included. Change-Id: Id0fdd12aecc63c066da985fbb058cb85926b2ff3

2016年01月27日 10:23:44 +00:00

- always

Fix nova_virt_type auto-detection In https://review.openstack.org/243098 nova_virt_type auto-detection was implemented, but the default nova_virt_type value of kvm was left in place, resulting in the auto-detection never happening. This patch implements the auto-detection if nova-virt_type is not set and removes the default value for nova-virt_type. Change-Id: Ic1c8f042bc6bbee542373d335f338866efa06dc7

2015年12月02日 14:40:47 +00:00

Fix linters and metadata With update of ansible-lint to version >=6.0.0 a lot of new linters were added, that enabled by default. In order to comply with linter rules we're applying changes to the role. With that we also update metdata to reflect current state. Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/888223 Change-Id: I730ae569f199fc8542a5a61beb149f459465d7e2

2023年07月17日 16:17:30 +02:00

- name:Importing nova_mdev_detect tasks

import_tasks:nova_mdev_detect.yml

Compute: Enable vGPU in Nova if exist on the host Since Queens release Nova support vGPUs. In order to use it, nova must have the right configuration. This commit will enable vGPU in the nova configuration if some mdev[1] devices exist on the compute node. [1] - https://docs.openstack.org/nova/latest/admin/virtual-gpu.html#how-to-discover-a-gpu-type Change-Id: Ia30b1a4fe38eb966f029f16142b8302707107bfc Signed-off-by: Valentin Boucher <valentin.boucher@kontron.com>

2018年08月28日 12:57:23 -04:00

tags:

- always

Fix linters and metadata With update of ansible-lint to version >=6.0.0 a lot of new linters were added, that enabled by default. In order to comply with linter rules we're applying changes to the role. With that we also update metdata to reflect current state. Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/888223 Change-Id: I730ae569f199fc8542a5a61beb149f459465d7e2

2023年07月17日 16:17:30 +02:00

- name:Importing nova_pre_install tasks

import_tasks:nova_pre_install.yml

Bring consistency to tags Some tags were not applied on the highest level and forced duplication. We apply here our practices to have role_name-(config|install) [1]. Compute being completely reversed, an exception is done here, and a tag is applied on top level, instead of refactoring all the includes. [1]: http://docs.openstack.org/developer/openstack-ansible/developer-docs/contribute.html#ansible-style-guide Change-Id: Ie48fe950a0cdc3909f1df565f7279a5df905cc16

2017年01月13日 12:36:42 +00:00

tags:

- nova-install

Fix linters and metadata With update of ansible-lint to version >=6.0.0 a lot of new linters were added, that enabled by default. In order to comply with linter rules we're applying changes to the role. With that we also update metdata to reflect current state. Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/888223 Change-Id: I730ae569f199fc8542a5a61beb149f459465d7e2

2023年07月17日 16:17:30 +02:00

- name:Importing nova_install tasks

import_tasks:nova_install.yml

Bring consistency to tags Some tags were not applied on the highest level and forced duplication. We apply here our practices to have role_name-(config|install) [1]. Compute being completely reversed, an exception is done here, and a tag is applied on top level, instead of refactoring all the includes. [1]: http://docs.openstack.org/developer/openstack-ansible/developer-docs/contribute.html#ansible-style-guide Change-Id: Ie48fe950a0cdc3909f1df565f7279a5df905cc16

2017年01月13日 12:36:42 +00:00

tags:

- nova-install

Fix linters and metadata With update of ansible-lint to version >=6.0.0 a lot of new linters were added, that enabled by default. In order to comply with linter rules we're applying changes to the role. With that we also update metdata to reflect current state. Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/888223 Change-Id: I730ae569f199fc8542a5a61beb149f459465d7e2

2023年07月17日 16:17:30 +02:00

- name:Refresh local facts

Implement data migrations for rolling upgrades In order to cater for artifact-based installed, and rolling upgrades, this patch implements a set of local facts to inform the online migrations task. The 'nova_all_software_updated' variable will be set by the playbook on each run to ensure that the online migrations only happen once all venvs are homogenous. This ensures that the playbook can be executed in a serialised fashion and the data will not be corrupted. The ``upgrade_levels`` setting for ``compute`` is set to ``auto`` to ensure that a mixed RPC version deployment can operate properly when doing a rolling upgrade as suggested by [1]. Additional changes are made to improve the role's ability to be executed using serialised playbooks. Finally, the nova-manage command references to the config file location have been removed as they refer to the default location. [1] https://docs.openstack.org/developer/nova/upgrade.html Change-Id: I08e5a7f0ce526b11aa52c35ee29c458954a5f22d

2017年06月30日 19:35:01 +01:00

setup:

filter:ansible_local

gather_subset:"!all"

tags:

- nova-config

Add TLS support to nova API backends By overriding the variable `nova_backend_ssl: True` HTTPS will be enabled, disabling HTTP support on the nova backend api. The ansible-role-pki is used to generate the required TLS certificates if this functionality is enabled. `nova_pki_console_certificates` are used to encrypt: - traffic between console proxy and compute hosts `nova_pki_certificates` are used to encrypt: - traffic between haproxy and its backends(including console proxy) It would be complex to use nova_pki_console_certificates to encrypt traffic between haproxy and console proxy because they don't have valid key_usage for that and changing key_usage would require to manually set `pki_regen_cert` for existing environments. Certs securing traffic between haproxy and console proxy are provided in execstarts because otherwise they would have to be defined in nova.conf that may be shared with nova-api(which stands behind uwsgi and should not use TLS). Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/879085 Change-Id: Ibff3bf0b5eedc87c221bbb1b5976b12972fda608

2023年02月22日 22:16:33 +01:00

# Create certs after nova groups have been created but before handlers

Include PKI role only once This patch proposes to move condition on when to install certificates from the role include statement to a combined "view" for API and Consoles. While adding computes to the same logic might be beneficial for CI and AIO metal deployments, it potentially might have a negative effect for real deployments, as it will create bunch of Skipped tasks for computes so we leave them separated. With that API and Console are usually placed on same hosts, so it makes sense to distribute certs towards them once but keeping possibility of different hosts in mind. Change-Id: I8e28a79a6e3a5be1fe54004ea1d2c3a3ccdc20bc

2024年04月10日 13:26:33 +02:00

- name:Create and install SSL certificates for API and Consoles

Add TLS support to nova API backends By overriding the variable `nova_backend_ssl: True` HTTPS will be enabled, disabling HTTP support on the nova backend api. The ansible-role-pki is used to generate the required TLS certificates if this functionality is enabled. `nova_pki_console_certificates` are used to encrypt: - traffic between console proxy and compute hosts `nova_pki_certificates` are used to encrypt: - traffic between haproxy and its backends(including console proxy) It would be complex to use nova_pki_console_certificates to encrypt traffic between haproxy and console proxy because they don't have valid key_usage for that and changing key_usage would require to manually set `pki_regen_cert` for existing environments. Certs securing traffic between haproxy and console proxy are provided in execstarts because otherwise they would have to be defined in nova.conf that may be shared with nova-api(which stands behind uwsgi and should not use TLS). Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/879085 Change-Id: Ibff3bf0b5eedc87c221bbb1b5976b12972fda608

2023年02月22日 22:16:33 +01:00

include_role:

name:pki

tasks_from:main_certs.yml

apply:

tags:

- nova-config

- pki

vars:

pki_setup_host:"{{ nova_pki_setup_host }}"

pki_dir:"{{ nova_pki_dir }}"

pki_create_certificates:"{{ nova_user_ssl_cert is not defined and nova_user_ssl_key is not defined }}"

pki_regen_cert:"{{ nova_pki_regen_cert }}"

Include PKI role only once This patch proposes to move condition on when to install certificates from the role include statement to a combined "view" for API and Consoles. While adding computes to the same logic might be beneficial for CI and AIO metal deployments, it potentially might have a negative effect for real deployments, as it will create bunch of Skipped tasks for computes so we leave them separated. With that API and Console are usually placed on same hosts, so it makes sense to distribute certs towards them once but keeping possibility of different hosts in mind. Change-Id: I8e28a79a6e3a5be1fe54004ea1d2c3a3ccdc20bc

2024年04月10日 13:26:33 +02:00

pki_certificates:"{{ nova_pki_certificates + nova_pki_console_certificates }}"

pki_install_certificates:"{{ nova_pki_install_certificates + nova_pki_console_install_certificates }}"

Add TLS support to nova API backends By overriding the variable `nova_backend_ssl: True` HTTPS will be enabled, disabling HTTP support on the nova backend api. The ansible-role-pki is used to generate the required TLS certificates if this functionality is enabled. `nova_pki_console_certificates` are used to encrypt: - traffic between console proxy and compute hosts `nova_pki_certificates` are used to encrypt: - traffic between haproxy and its backends(including console proxy) It would be complex to use nova_pki_console_certificates to encrypt traffic between haproxy and console proxy because they don't have valid key_usage for that and changing key_usage would require to manually set `pki_regen_cert` for existing environments. Certs securing traffic between haproxy and console proxy are provided in execstarts because otherwise they would have to be defined in nova.conf that may be shared with nova-api(which stands behind uwsgi and should not use TLS). Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/879085 Change-Id: Ibff3bf0b5eedc87c221bbb1b5976b12972fda608

2023年02月22日 22:16:33 +01:00

when:

Include PKI role only once This patch proposes to move condition on when to install certificates from the role include statement to a combined "view" for API and Consoles. While adding computes to the same logic might be beneficial for CI and AIO metal deployments, it potentially might have a negative effect for real deployments, as it will create bunch of Skipped tasks for computes so we leave them separated. With that API and Console are usually placed on same hosts, so it makes sense to distribute certs towards them once but keeping possibility of different hosts in mind. Change-Id: I8e28a79a6e3a5be1fe54004ea1d2c3a3ccdc20bc

2024年04月10日 13:26:33 +02:00

- nova_pki_certificates_condition | bool or nova_pki_console_condition | bool

Add TLS support to nova API backends By overriding the variable `nova_backend_ssl: True` HTTPS will be enabled, disabling HTTP support on the nova backend api. The ansible-role-pki is used to generate the required TLS certificates if this functionality is enabled. `nova_pki_console_certificates` are used to encrypt: - traffic between console proxy and compute hosts `nova_pki_certificates` are used to encrypt: - traffic between haproxy and its backends(including console proxy) It would be complex to use nova_pki_console_certificates to encrypt traffic between haproxy and console proxy because they don't have valid key_usage for that and changing key_usage would require to manually set `pki_regen_cert` for existing environments. Certs securing traffic between haproxy and console proxy are provided in execstarts because otherwise they would have to be defined in nova.conf that may be shared with nova-api(which stands behind uwsgi and should not use TLS). Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/879085 Change-Id: Ibff3bf0b5eedc87c221bbb1b5976b12972fda608

2023年02月22日 22:16:33 +01:00

tags:

- always

Enable TLS for VNC from novncproxy to compute hosts To secure communications from the proxy server to the compute nodes using VeNCrypt authentication scheme. In a previous patch a TLS server certificate was deployed to compute nodes, this patch makes use of this same server cert for securing VNC sessions on compute nodes. It is recommended that this certificate be issued by a dedicated certificate authority solely for the VNC service, as libvirt does not currently have a mechanism to restrict what certificates can be presented by the proxy server. This has not been implemented to reduce complexity. In addition the noVNC proxy needs to present a client certificate so only approved VNC proxy servers can connect to the Compute nodes. The PKI role has been used to create a client certificate for the nova console nodes. Related Nova docs: https://docs.openstack.org/nova/latest/admin/remote-console-access.html To help with the transition from from unencrypted VNC to VeNCrypt, initially compute nodes auth scheme allows for both encrypted and unencrypted sessions using the variable `nova_vencrypt_auth_scheme`, this will be removed in future releases. Change-Id: Iafb788f80fd401c6ce6e4576bafd06c92431bd65

2021年11月08日 15:40:27 +00:00

- name:Create and install SSL certificates for compute hosts

Enable TLS for live migrations Instead of using SSH to live migrate VM's use TLS as this is more secure and SSH migrations are deprecated. https://docs.openstack.org/nova/xena/admin/secure-live-migration-with-qemu-native-tls.html A pre-existing PKI (Public Key Infrastruture) setup is required. TLS live migrations require that all compute hosts can communcate with each other on port 16514 and port range 49152 to 49261. To enable TLS live migrations, both libvirt and QEMU require server and client certificates, the server certicicates is used to verify servers and the client cert is used by servers to authenticate clients. A single cert is created by the pki role, that can be used by both libvirt and QEMU for both client and server auth. The client, server and CA certifcates need to installed in a number of locations on each compute host: * For Libvirt https://libvirt.org/tlscerts.html * For QEMU https://github.com/libvirt/libvirt/blob/master/src/qemu/qemu.conf Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815007 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815849 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/816857 Change-Id: Iddbe8764bb6d3cd3eaee122b2d5ddc02fa3f7662

2021年10月25日 08:32:04 +01:00

include_role:

name:pki

tasks_from:main_certs.yml

Add TLS support to nova API backends By overriding the variable `nova_backend_ssl: True` HTTPS will be enabled, disabling HTTP support on the nova backend api. The ansible-role-pki is used to generate the required TLS certificates if this functionality is enabled. `nova_pki_console_certificates` are used to encrypt: - traffic between console proxy and compute hosts `nova_pki_certificates` are used to encrypt: - traffic between haproxy and its backends(including console proxy) It would be complex to use nova_pki_console_certificates to encrypt traffic between haproxy and console proxy because they don't have valid key_usage for that and changing key_usage would require to manually set `pki_regen_cert` for existing environments. Certs securing traffic between haproxy and console proxy are provided in execstarts because otherwise they would have to be defined in nova.conf that may be shared with nova-api(which stands behind uwsgi and should not use TLS). Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/879085 Change-Id: Ibff3bf0b5eedc87c221bbb1b5976b12972fda608

2023年02月22日 22:16:33 +01:00

apply:

tags:

- nova-config

- pki

Enable TLS for live migrations Instead of using SSH to live migrate VM's use TLS as this is more secure and SSH migrations are deprecated. https://docs.openstack.org/nova/xena/admin/secure-live-migration-with-qemu-native-tls.html A pre-existing PKI (Public Key Infrastruture) setup is required. TLS live migrations require that all compute hosts can communcate with each other on port 16514 and port range 49152 to 49261. To enable TLS live migrations, both libvirt and QEMU require server and client certificates, the server certicicates is used to verify servers and the client cert is used by servers to authenticate clients. A single cert is created by the pki role, that can be used by both libvirt and QEMU for both client and server auth. The client, server and CA certifcates need to installed in a number of locations on each compute host: * For Libvirt https://libvirt.org/tlscerts.html * For QEMU https://github.com/libvirt/libvirt/blob/master/src/qemu/qemu.conf Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815007 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815849 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/816857 Change-Id: Iddbe8764bb6d3cd3eaee122b2d5ddc02fa3f7662

2021年10月25日 08:32:04 +01:00

vars:

pki_setup_host:"{{ nova_pki_setup_host }}"

pki_dir:"{{ nova_pki_dir }}"

pki_create_certificates:"{{ nova_user_ssl_cert is not defined and nova_user_ssl_key is not defined }}"

Pass valid cert regen variable to pki role Currently we're passing non-existant variable into PKI role when defining whether to regen certificates or not. This change fixes behaviour. Change-Id: Ib1c8f820ccfe00923fcbc7aec2457a94629673fe

2022年05月12日 18:36:55 +02:00

pki_regen_cert:"{{ nova_pki_regen_cert }}"

Enable TLS for VNC from novncproxy to compute hosts To secure communications from the proxy server to the compute nodes using VeNCrypt authentication scheme. In a previous patch a TLS server certificate was deployed to compute nodes, this patch makes use of this same server cert for securing VNC sessions on compute nodes. It is recommended that this certificate be issued by a dedicated certificate authority solely for the VNC service, as libvirt does not currently have a mechanism to restrict what certificates can be presented by the proxy server. This has not been implemented to reduce complexity. In addition the noVNC proxy needs to present a client certificate so only approved VNC proxy servers can connect to the Compute nodes. The PKI role has been used to create a client certificate for the nova console nodes. Related Nova docs: https://docs.openstack.org/nova/latest/admin/remote-console-access.html To help with the transition from from unencrypted VNC to VeNCrypt, initially compute nodes auth scheme allows for both encrypted and unencrypted sessions using the variable `nova_vencrypt_auth_scheme`, this will be removed in future releases. Change-Id: Iafb788f80fd401c6ce6e4576bafd06c92431bd65

2021年11月08日 15:40:27 +00:00

pki_certificates:"{{ nova_pki_compute_certificates }}"

pki_install_certificates:"{{ nova_pki_compute_install_certificates }}"

Enable TLS for live migrations Instead of using SSH to live migrate VM's use TLS as this is more secure and SSH migrations are deprecated. https://docs.openstack.org/nova/xena/admin/secure-live-migration-with-qemu-native-tls.html A pre-existing PKI (Public Key Infrastruture) setup is required. TLS live migrations require that all compute hosts can communcate with each other on port 16514 and port range 49152 to 49261. To enable TLS live migrations, both libvirt and QEMU require server and client certificates, the server certicicates is used to verify servers and the client cert is used by servers to authenticate clients. A single cert is created by the pki role, that can be used by both libvirt and QEMU for both client and server auth. The client, server and CA certifcates need to installed in a number of locations on each compute host: * For Libvirt https://libvirt.org/tlscerts.html * For QEMU https://github.com/libvirt/libvirt/blob/master/src/qemu/qemu.conf Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815007 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815849 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/816857 Change-Id: Iddbe8764bb6d3cd3eaee122b2d5ddc02fa3f7662

2021年10月25日 08:32:04 +01:00

when:

- nova_libvirtd_listen_tls == 1

- "'nova_compute' in group_names"

Fix PKI include condition In order for AIO to pass against ironic role, we need to cover the case when ironic_compute == nova_compute host. For that we use more common condition and verifying virt_type which must be set for Ironic. Change-Id: I7540e4c6848bad80c368a1227b09437428fe64a2 Closes-Bug: #1952649

2021年12月02日 06:00:26 +02:00

- nova_virt_type != 'ironic'

Add TLS support to nova API backends By overriding the variable `nova_backend_ssl: True` HTTPS will be enabled, disabling HTTP support on the nova backend api. The ansible-role-pki is used to generate the required TLS certificates if this functionality is enabled. `nova_pki_console_certificates` are used to encrypt: - traffic between console proxy and compute hosts `nova_pki_certificates` are used to encrypt: - traffic between haproxy and its backends(including console proxy) It would be complex to use nova_pki_console_certificates to encrypt traffic between haproxy and console proxy because they don't have valid key_usage for that and changing key_usage would require to manually set `pki_regen_cert` for existing environments. Certs securing traffic between haproxy and console proxy are provided in execstarts because otherwise they would have to be defined in nova.conf that may be shared with nova-api(which stands behind uwsgi and should not use TLS). Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/879085 Change-Id: Ibff3bf0b5eedc87c221bbb1b5976b12972fda608

2023年02月22日 22:16:33 +01:00

tags:

- always

Enable TLS for live migrations Instead of using SSH to live migrate VM's use TLS as this is more secure and SSH migrations are deprecated. https://docs.openstack.org/nova/xena/admin/secure-live-migration-with-qemu-native-tls.html A pre-existing PKI (Public Key Infrastruture) setup is required. TLS live migrations require that all compute hosts can communcate with each other on port 16514 and port range 49152 to 49261. To enable TLS live migrations, both libvirt and QEMU require server and client certificates, the server certicicates is used to verify servers and the client cert is used by servers to authenticate clients. A single cert is created by the pki role, that can be used by both libvirt and QEMU for both client and server auth. The client, server and CA certifcates need to installed in a number of locations on each compute host: * For Libvirt https://libvirt.org/tlscerts.html * For QEMU https://github.com/libvirt/libvirt/blob/master/src/qemu/qemu.conf Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815007 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815849 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/816857 Change-Id: Iddbe8764bb6d3cd3eaee122b2d5ddc02fa3f7662

2021年10月25日 08:32:04 +01:00

Fix linters and metadata With update of ansible-lint to version >=6.0.0 a lot of new linters were added, that enabled by default. In order to comply with linter rules we're applying changes to the role. With that we also update metdata to reflect current state. Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/888223 Change-Id: I730ae569f199fc8542a5a61beb149f459465d7e2

2023年07月17日 16:17:30 +02:00

- name:Including nova_post_install tasks

import_tasks:nova_post_install.yml

Bring consistency to tags Some tags were not applied on the highest level and forced duplication. We apply here our practices to have role_name-(config|install) [1]. Compute being completely reversed, an exception is done here, and a tag is applied on top level, instead of refactoring all the includes. [1]: http://docs.openstack.org/developer/openstack-ansible/developer-docs/contribute.html#ansible-style-guide Change-Id: Ie48fe950a0cdc3909f1df565f7279a5df905cc16

2017年01月13日 12:36:42 +00:00

tags:

- nova-config

Add tag to enable targeting of post-install config elements only <service>-config tags are quite broad and have a long execution time. Where you only need to modify a service's '.conf' file and similar it is useful to have a quicker method to do so. Change-Id: Idf0a0a7033d8f6c4d6efebff456ea3f19ea81185

2024年05月08日 13:32:54 +01:00

- post-install

Bring consistency to tags Some tags were not applied on the highest level and forced duplication. We apply here our practices to have role_name-(config|install) [1]. Compute being completely reversed, an exception is done here, and a tag is applied on top level, instead of refactoring all the includes. [1]: http://docs.openstack.org/developer/openstack-ansible/developer-docs/contribute.html#ansible-style-guide Change-Id: Ie48fe950a0cdc3909f1df565f7279a5df905cc16

2017年01月13日 12:36:42 +00:00

Fix linters and metadata With update of ansible-lint to version >=6.0.0 a lot of new linters were added, that enabled by default. In order to comply with linter rules we're applying changes to the role. With that we also update metdata to reflect current state. Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/888223 Change-Id: I730ae569f199fc8542a5a61beb149f459465d7e2

2023年07月17日 16:17:30 +02:00

- name:Including osa.service_setup tasks

include_role:

Use common service setup tasks from a collection rather than in-role Change-Id: I01fdeb2cca9d5315fd486500cc8d6330cb23ce84

2022年01月12日 10:50:02 +00:00

name:openstack.osa.service_setup

apply:

tags:

- common-service

- nova-config

service_setup: refactor service setup to a single file This patch refactors the openstack user/service/endpoints creation to service_setup.yml which will eventually be managed by openstack-ansible-tests. Change-Id: I8c5162a95d193a1a5f0b3e594e3962cce406913a

2019年06月17日 14:45:06 +03:00

vars:

_service_adminuri_insecure:"{{ keystone_service_adminuri_insecure }}"

_service_in_ldap:"{{ nova_service_in_ldap }}"

_service_setup_host:"{{ nova_service_setup_host }}"

_service_setup_host_python_interpreter:"{{ nova_service_setup_host_python_interpreter }}"

_service_project_name:"{{ nova_service_project_name }}"

Pass nova_service_region to service_setup tasks This was missing so the default RegionOne would always be used. Change-Id: I490cca6caba471ee1a32ea7eb2a3a9b261af6925

2019年12月07日 12:30:39 +00:00

_service_region:"{{ nova_service_region }}"

service_setup: Update services tasks During distribution of service_setup.yml it appeared that some services have extra requirments and usecases. So this patch updated service_setup and brings it into accordance across the roles. Change-Id: I834109f6e0420642e61eac828efe1fbec9b1fdd8

2019年07月29日 13:54:28 +03:00

_service_users:

- name:"{{ nova_service_user_name }}"

password:"{{ nova_service_password }}"

Support service tokens Implement support for service_tokens. For that we convert role_name to be a list along with renaming corresponding variable. Additionally service_type is defined now for keystone_authtoken which enables to validate tokens with restricted access rules Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/845690 Change-Id: I04b22722b32b6dc8b1dc95e18c3fe96ad17e51ac

2022年06月15日 11:08:48 +02:00

role:"{{ nova_service_role_names }}"

service_setup: refactor service setup to a single file This patch refactors the openstack user/service/endpoints creation to service_setup.yml which will eventually be managed by openstack-ansible-tests. Change-Id: I8c5162a95d193a1a5f0b3e594e3962cce406913a

2019年06月17日 14:45:06 +03:00

_service_endpoints:

- service:"{{ nova_service_name }}"

interface:"public"

url:"{{ nova_service_publicurl }}"

- service:"{{ nova_service_name }}"

interface:"internal"

url:"{{ nova_service_internalurl }}"

- service:"{{ nova_service_name }}"

interface:"admin"

url:"{{ nova_service_adminurl }}"

_service_catalog:

- name:"{{ nova_service_name }}"

type:"{{ nova_service_type }}"

description:"{{ nova_service_description }}"

Setup service users and endpoints before database setup As part of the nova-status upgrade check process, it makes sure that the credentials setup for the service are working. Because we run that in nova_db_setup.yml, it means that the endpoints and users don't exist yet and it cannot validate it. This instead sets up the service much earlier in order to make sure that Nova can find it. Change-Id: Idf14240a9843a55575fd1816c78ba9d4a8a19632

2018年06月20日 16:47:30 -04:00

when:

Define condition for the first play host one time We use the same condition, which defines against what host some "service" tasks should run against, several times. It's hard to keep it the same across the role and ansible spending additional resources to evaluate it each time, so it's simpler and better for the maintenance to set a boolean variable which will say for all tasks, that we want to run only against signle host, if they should run or not now. Change-Id: I78d44704a0224b2c73832a607e84ea8d9499f8c2

2020年10月06日 18:14:34 +03:00

- _nova_is_first_play_host

Setup service users and endpoints before database setup As part of the nova-status upgrade check process, it makes sure that the credentials setup for the service are working. Because we run that in nova_db_setup.yml, it means that the endpoints and users don't exist yet and it cannot validate it. This instead sets up the service much earlier in order to make sure that Nova can find it. Change-Id: Idf14240a9843a55575fd1816c78ba9d4a8a19632

2018年06月20日 16:47:30 -04:00

tags:

Use common service setup tasks from a collection rather than in-role Change-Id: I01fdeb2cca9d5315fd486500cc8d6330cb23ce84

2022年01月12日 10:50:02 +00:00

- always

Setup service users and endpoints before database setup As part of the nova-status upgrade check process, it makes sure that the credentials setup for the service are working. Because we run that in nova_db_setup.yml, it means that the endpoints and users don't exist yet and it cannot validate it. This instead sets up the service much earlier in order to make sure that Nova can find it. Change-Id: Idf14240a9843a55575fd1816c78ba9d4a8a19632

2018年06月20日 16:47:30 -04:00

Fix linters and metadata With update of ansible-lint to version >=6.0.0 a lot of new linters were added, that enabled by default. In order to comply with linter rules we're applying changes to the role. With that we also update metdata to reflect current state. Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/888223 Change-Id: I730ae569f199fc8542a5a61beb149f459465d7e2

2023年07月17日 16:17:30 +02:00

- name:Including nova_db_setup tasks

include_tasks:nova_db_setup.yml

Use include instead of import for conditional tasks When import is used ansible loads imported role or tasks which results in plenty of skipped tasks which also consume time. With includes ansible does not try to load play so time not wasted on skipping things. Depends-On: https://review.opendev.org/c/openstack/ansible-role-uwsgi/+/880344 Change-Id: I47c6623e166254802ed0b479b2353c5f2ceb5cfa

2023年02月23日 18:41:22 +01:00

args:

apply:

tags:

- nova-config

Add tag to enable targeting of post-install config elements only <service>-config tags are quite broad and have a long execution time. Where you only need to modify a service's '.conf' file and similar it is useful to have a quicker method to do so. Change-Id: Idf0a0a7033d8f6c4d6efebff456ea3f19ea81185

2024年05月08日 13:32:54 +01:00

- post-install

Streamline task execution This change moves the compute drivers into their own directory which will isolate the compute execution tasks which will limit the loaded tasks and ensure we're not excessively skipping tasks. Change-Id: I67895687906c3ba4cbdc8c3cb6a3b17f07bceee1 Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>

2017年05月18日 13:17:01 -05:00

when:

Define condition for the first play host one time We use the same condition, which defines against what host some "service" tasks should run against, several times. It's hard to keep it the same across the role and ansible spending additional resources to evaluate it each time, so it's simpler and better for the maintenance to set a boolean variable which will say for all tasks, that we want to run only against signle host, if they should run or not now. Change-Id: I78d44704a0224b2c73832a607e84ea8d9499f8c2

2020年10月06日 18:14:34 +03:00

- _nova_is_first_play_host

Bring consistency to tags Some tags were not applied on the highest level and forced duplication. We apply here our practices to have role_name-(config|install) [1]. Compute being completely reversed, an exception is done here, and a tag is applied on top level, instead of refactoring all the includes. [1]: http://docs.openstack.org/developer/openstack-ansible/developer-docs/contribute.html#ansible-style-guide Change-Id: Ie48fe950a0cdc3909f1df565f7279a5df905cc16

2017年01月13日 12:36:42 +00:00

tags:

Use include instead of import for conditional tasks When import is used ansible loads imported role or tasks which results in plenty of skipped tasks which also consume time. With includes ansible does not try to load play so time not wasted on skipping things. Depends-On: https://review.opendev.org/c/openstack/ansible-role-uwsgi/+/880344 Change-Id: I47c6623e166254802ed0b479b2353c5f2ceb5cfa

2023年02月23日 18:41:22 +01:00

- always

Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e

2015年02月14日 10:06:50 -06:00

Start using uWSGI role Move service to use uWSGI role instead of iternal task for uwsgi deployment. This aims to ease the maintenance of uWSGI and speedup metal deployments as the same uwsgi environment will be used across all services. Depends-On: https://review.opendev.org/678200/ Depends-On: https://review.opendev.org/678055/ Change-Id: If5aeeefb93c8ba3c1368970de61ea1300218f637

2019年08月23日 15:41:03 +03:00

- name:Import uwsgi role

import_role:

name:uwsgi

vars:

uwsgi_services:"{{ uwsgi_nova_services }}"

uwsgi_install_method:"{{ nova_install_method }}"

Use include instead of import for conditional tasks When import is used ansible loads imported role or tasks which results in plenty of skipped tasks which also consume time. With includes ansible does not try to load play so time not wasted on skipping things. Depends-On: https://review.opendev.org/c/openstack/ansible-role-uwsgi/+/880344 Change-Id: I47c6623e166254802ed0b479b2353c5f2ceb5cfa

2023年02月23日 18:41:22 +01:00

when:

- uwsgi_nova_services | length > 0

Move to use UWsgi for Nova The placement service is already setup to use UWsgi, we need to move the other Nova services to follow suit as part of our community goal for Pike. Additionally, we need to clean up the nginx configuration as we are moving away from fronting uWSGI with nginx inside the roles. Depends-On: Ib66b9709fb88205eaf3f133c87357a4dbbdde5ae Change-Id: If6c30e00c1c753692c970457b75e3ae7f5cc066c Implements: blueprint goal-deploy-api-in-wsgi

2017年03月28日 13:42:09 +01:00

tags:

- nova-config

Start using uWSGI role Move service to use uWSGI role instead of iternal task for uwsgi deployment. This aims to ease the maintenance of uWSGI and speedup metal deployments as the same uwsgi environment will be used across all services. Depends-On: https://review.opendev.org/678200/ Depends-On: https://review.opendev.org/678055/ Change-Id: If5aeeefb93c8ba3c1368970de61ea1300218f637

2019年08月23日 15:41:03 +03:00

- uwsgi

Move to use UWsgi for Nova The placement service is already setup to use UWsgi, we need to move the other Nova services to follow suit as part of our community goal for Pike. Additionally, we need to clean up the nginx configuration as we are moving away from fronting uWSGI with nginx inside the roles. Depends-On: Ib66b9709fb88205eaf3f133c87357a4dbbdde5ae Change-Id: If6c30e00c1c753692c970457b75e3ae7f5cc066c Implements: blueprint goal-deploy-api-in-wsgi

2017年03月28日 13:42:09 +01:00

Convert role to use a common systemd service role This removes the systemd service templates and tasks from this role and leverages a common systemd service role instead. This change removes a lot of code duplication across all roles all without sacrificing features or functionality. The intention of this change is to ensure uniformity and reduce the maintenance burden on the community when sweeping changes are needed. The exterior role is built to be OSA compatible and may be pulled into tree should we deem it necessary. Change-Id: I44c6b656c02d60fde97fcaac6bc4fd8a7388cba1 Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>

2017年05月19日 00:03:05 -05:00

- name:Run the systemd service role

Update role for new source build process The variables nova_developer_mode and nova_venv_download no longer carry any meaning. This review changes nova to do the equivalent of what developer_mode was all the time, meaning that it always builds the venv and never requires the repo server, but it will use a repo server when available. We also change include_tasks to import_tasks and include_role to import_role so that the tags in the python_venv_build role will work. Change-Id: I1a1ac5948f3bd647eb0ee5e10e9e7ae06b740bb7

2019年03月27日 10:34:52 +00:00

import_role:

Convert role to use a common systemd service role This removes the systemd service templates and tasks from this role and leverages a common systemd service role instead. This change removes a lot of code duplication across all roles all without sacrificing features or functionality. The intention of this change is to ensure uniformity and reduce the maintenance burden on the community when sweeping changes are needed. The exterior role is built to be OSA compatible and may be pulled into tree should we deem it necessary. Change-Id: I44c6b656c02d60fde97fcaac6bc4fd8a7388cba1 Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>

2017年05月19日 00:03:05 -05:00

name:systemd_service

vars:

systemd_user_name:"{{ nova_system_user_name }}"

systemd_group_name:"{{ nova_system_group_name }}"

systemd_tempd_prefix:openstack

Refactor definition of lock path Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/819300 Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/819298 Change-Id: If5622f736e17f0f187a0740d60ea435d03a131bb

2021年11月30日 12:18:27 +02:00

systemd_slice_name:"{{ nova_system_slice_name }}"

systemd_lock_dir:"{{ nova_lock_dir }}"

Fix linters and metadata With update of ansible-lint to version >=6.0.0 a lot of new linters were added, that enabled by default. In order to comply with linter rules we're applying changes to the role. With that we also update metdata to reflect current state. Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/888223 Change-Id: I730ae569f199fc8542a5a61beb149f459465d7e2

2023年07月17日 16:17:30 +02:00

systemd_service_cpu_accounting:true

systemd_service_block_io_accounting:true

systemd_service_memory_accounting:true

systemd_service_tasks_accounting:true

remove loop control when running include_role When running an included role with_items + loop control is slow. This change feeds the role the entire list of curated services which will improve execution speed, especially when dealing with hundreds of hosts. Change-Id: Ib022360f9eb17b7c8ef4b10f059a1dcdee126d58 Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>

2018年10月04日 00:52:24 -05:00

systemd_services:|-

{% set services = [] %}

{% for service in filtered_nova_services %}

{%

set _ = service.update(

{

'enabled':'yes',

'state':'started',

'config_overrides':service.init_config_overrides

}

)

%}

{% set _ = service.pop('init_config_overrides') -%}

{% set _ = services.append(service) -%}

{% endfor %}

{{services }}

Bring consistency to tags Some tags were not applied on the highest level and forced duplication. We apply here our practices to have role_name-(config|install) [1]. Compute being completely reversed, an exception is done here, and a tag is applied on top level, instead of refactoring all the includes. [1]: http://docs.openstack.org/developer/openstack-ansible/developer-docs/contribute.html#ansible-style-guide Change-Id: Ie48fe950a0cdc3909f1df565f7279a5df905cc16

2017年01月13日 12:36:42 +00:00

tags:

- nova-config

Add systemd tags to include role There are times when a deployer will need to reconfigure parts of an environment and having a general purpose tag to run said operation will be important especicially should the deployer be needing to reconfigure systemd unit files in a downtime event. This change adds a general purpose systemd tag where include_role and systemd is found which will assit operators with day2 operational tasks. Change-Id: Ie277102ec307cc3189aae65bfc058d5f5c49baba Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>

2018年06月27日 19:00:19 -05:00

- systemd-service

Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e

2015年02月14日 10:06:50 -06:00

Fix linters and metadata With update of ansible-lint to version >=6.0.0 a lot of new linters were added, that enabled by default. In order to comply with linter rules we're applying changes to the role. With that we also update metdata to reflect current state. Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/888223 Change-Id: I730ae569f199fc8542a5a61beb149f459465d7e2

2023年07月17日 16:17:30 +02:00

- name:Including nova_compute tasks

include_tasks:nova_compute.yml

Use include instead of import for conditional tasks When import is used ansible loads imported role or tasks which results in plenty of skipped tasks which also consume time. With includes ansible does not try to load play so time not wasted on skipping things. Depends-On: https://review.opendev.org/c/openstack/ansible-role-uwsgi/+/880344 Change-Id: I47c6623e166254802ed0b479b2353c5f2ceb5cfa

2023年02月23日 18:41:22 +01:00

args:

apply:

tags:

- nova-compute

Streamline task execution This change moves the compute drivers into their own directory which will isolate the compute execution tasks which will limit the loaded tasks and ensure we're not excessively skipping tasks. Change-Id: I67895687906c3ba4cbdc8c3cb6a3b17f07bceee1 Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>

2017年05月18日 13:17:01 -05:00

when:

tasks: add conditionals for ironic This patch avoids running the nova_compute.yml playbook entirely because we already skip the setup portion and we don't need to setup SSH keys (as there's no live migration) nor setting up NFS. It also gets rid of the set_fact inside nova_virt_detect.yml because it was non-functional in the first place. This is because the nova_virt_type was set to 'ironic' in the group_vars which meant that the autodetect code was skipped and therefore that portion never ran. Change-Id: Ic5548f08d200402538a0334f801834ee7ef8a39b

2019年07月29日 11:47:57 -04:00

- nova_virt_type != 'ironic'

Use group_names to check a host belongs to group Also, use nova_services dict to get group name Change-Id: Iec090937b0213120854847eebf099df4ffc03528

2017年11月17日 13:56:34 +07:00

- "nova_services['nova-compute']['group'] in group_names"

Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e

2015年02月14日 10:06:50 -06:00

tags:

Use include instead of import for conditional tasks When import is used ansible loads imported role or tasks which results in plenty of skipped tasks which also consume time. With includes ansible does not try to load play so time not wasted on skipping things. Depends-On: https://review.opendev.org/c/openstack/ansible-role-uwsgi/+/880344 Change-Id: I47c6623e166254802ed0b479b2353c5f2ceb5cfa

2023年02月23日 18:41:22 +01:00

- always

Nova Kilofication Work * API Versions 1.1 and 3 have been deprecated from nova, plays have been modified to completely remove v1.1 and make v3 optional via nova_v3_deprecated_but_enabled boolean. * Addition of v2.1 api configuration. * Elimination of the unused nova_api_ec2 container. * nova_spice_console has been renamed to nova_console and nova_spice_console_container has been renamed to nova_console_container to facilitate different consoles in the future. * Spice has been made the default console. * A standalone task and init scripts for nova_spice. - Fixed some typos - Modified HAProxy role to remove nova_api_ec2 and rename nova_spice_console to nova_console - Updated user_secrets.yml - Unbroke things that I broke Partially Implements Blueprint: master-kilofication Change-Id: Ia87dfb1e8c0316103a30e2121f11996a9ca87c25

2015年04月06日 13:41:11 -05:00

Include ceph_client role if needed Moves the ceph_client role execution inside the os_nova role instead of executing it at the playbook level. Change-Id: Iea317a20d37ae6f187df3eb7db6290d6b99e6997

2017年07月12日 13:20:10 -05:00

- name:Include ceph_client role

Use include instead of import for conditional tasks When import is used ansible loads imported role or tasks which results in plenty of skipped tasks which also consume time. With includes ansible does not try to load play so time not wasted on skipping things. Depends-On: https://review.opendev.org/c/openstack/ansible-role-uwsgi/+/880344 Change-Id: I47c6623e166254802ed0b479b2353c5f2ceb5cfa

2023年02月23日 18:41:22 +01:00

include_role:

Include ceph_client role if needed Moves the ceph_client role execution inside the os_nova role instead of executing it at the playbook level. Change-Id: Iea317a20d37ae6f187df3eb7db6290d6b99e6997

2017年07月12日 13:20:10 -05:00

name:ceph_client

Use include instead of import for conditional tasks When import is used ansible loads imported role or tasks which results in plenty of skipped tasks which also consume time. With includes ansible does not try to load play so time not wasted on skipping things. Depends-On: https://review.opendev.org/c/openstack/ansible-role-uwsgi/+/880344 Change-Id: I47c6623e166254802ed0b479b2353c5f2ceb5cfa

2023年02月23日 18:41:22 +01:00

apply:

tags:

- ceph

Include ceph_client role if needed Moves the ceph_client role execution inside the os_nova role instead of executing it at the playbook level. Change-Id: Iea317a20d37ae6f187df3eb7db6290d6b99e6997

2017年07月12日 13:20:10 -05:00

vars:

openstack_service_system_user:"{{ nova_system_user_name }}"

Do not symlink ceph libraries for distro path ceph_client role checks length of the `openstack_service_venv_bin` variable to determine if libraries symlinking into venv should occur. So for distro path this should be empty string as no symlinking should be done. Change-Id: I7395ba58e10d1c0ed57b53fc9c797297d94df6f8

2020年10月30日 17:37:56 +02:00

openstack_service_venv_bin:"{{ (nova_install_method == 'source') | ternary(nova_bin, '') }}"

Include ceph_client role if needed Moves the ceph_client role execution inside the os_nova role instead of executing it at the playbook level. Change-Id: Iea317a20d37ae6f187df3eb7db6290d6b99e6997

2017年07月12日 13:20:10 -05:00

when:

tasks: add conditionals for ironic This patch avoids running the nova_compute.yml playbook entirely because we already skip the setup portion and we don't need to setup SSH keys (as there's no live migration) nor setting up NFS. It also gets rid of the set_fact inside nova_virt_detect.yml because it was non-functional in the first place. This is because the nova_virt_type was set to 'ironic' in the group_vars which meant that the autodetect code was skipped and therefore that portion never ran. Change-Id: Ic5548f08d200402538a0334f801834ee7ef8a39b

2019年07月29日 11:47:57 -04:00

- nova_virt_type != 'ironic'

rbd: add var for inuse and enable setting secret This patch refactors a variable to determine if we RBD is in use (either directly or via cinder-volume). It also uses this to make sure to always set rbd_user and the rbd_secret_uuid both are set so booting from Cinder with local storage works. Change-Id: I052f50cd527ea222e74fdc3684613499f2b55d8e

2019年07月30日 12:32:33 -04:00

- nova_services['nova-compute']['group'] in group_names

Run ceph_client when cinder uses Ceph In usecases where only cinder is using ceph we currently do not execute ceph_client role, which makes nodes failing to spawn instances from RBD volumes. Sample usecase where Glance might be using Swift and it might be desired to use local storage for Nova ephemeral drives, but cinder spawning volumes on Ceph Currently this can be workarounded with setting `nova_rbd_inuse: True` but at the same time `nova_libvirt_images_rbd_pool: ''`, though this is counter-intuitive and this patch aims to improve this. Change-Id: I412d1e9ccb51f0cd33a98333bfa1a01510867fbe

2024年01月16日 18:26:06 +01:00

- (nova_rbd_inuse | bool) or (nova_glance_rbd_inuse | bool) or (nova_cinder_rbd_inuse | bool)

Include ceph_client role if needed Moves the ceph_client role execution inside the os_nova role instead of executing it at the playbook level. Change-Id: Iea317a20d37ae6f187df3eb7db6290d6b99e6997

2017年07月12日 13:20:10 -05:00

tags:

Use include instead of import for conditional tasks When import is used ansible loads imported role or tasks which results in plenty of skipped tasks which also consume time. With includes ansible does not try to load play so time not wasted on skipping things. Depends-On: https://review.opendev.org/c/openstack/ansible-role-uwsgi/+/880344 Change-Id: I47c6623e166254802ed0b479b2353c5f2ceb5cfa

2023年02月23日 18:41:22 +01:00

- always

Include ceph_client role if needed Moves the ceph_client role execution inside the os_nova role instead of executing it at the playbook level. Change-Id: Iea317a20d37ae6f187df3eb7db6290d6b99e6997

2017年07月12日 13:20:10 -05:00

Add handler flushing to roles that need it This patch adds handler flushing as the last task in each role to ensure that there are log files present when the rsyslog client configuration task is executed a little later in the playbook that consumes the role. Closes-Bug: #1458822 Change-Id: I92a26b620aa7bc0fbe33175594d37da7d5aca7df

2015年05月26日 17:43:50 +01:00

- name:Flush handlers

meta:flush_handlers

Add nova-placement-api service and cell_v2 setup This patch adds Nova requirements for Ocata: * Nova Placement API running as uwsgi with Nginx. * cell_v2 setup for cell0 and cell1 * All required settings for these services with sane defaults It fixes up some ordering for DB operations: * online_db_migrations should only happen after a full upgrade. * Cell setup needs to happen after api_db sync but before db sync. * Discover_hosts for cell_v2 needs to happen after compute is restarted This adds functionality to allow uwsgi apps in the init scripts: * Allowing the "--log" line to be adjusted. * Setting the condition value so that only enabled services are deployed * Fixes a bug for program_override which mean this value was never being used. Depends-On: I082f37bb3ce61a900e06a58f21c7882f83671355 Change-Id: I282d25988377d18257b708859f89a7ae4260ac07

2017年01月09日 17:03:47 +00:00

Fix linters and metadata With update of ansible-lint to version >=6.0.0 a lot of new linters were added, that enabled by default. In order to comply with linter rules we're applying changes to the role. With that we also update metdata to reflect current state. Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/888223 Change-Id: I730ae569f199fc8542a5a61beb149f459465d7e2

2023年07月17日 16:17:30 +02:00

- name:Importing nova_compute_wait tasks

import_tasks:nova_compute_wait.yml

Execute service setup against a delegated host using Ansible built-in modules In order to reduce the packages required to pip install on to the hosts, we allow the service setup to be delegated to a specific host, defaulting to the deploy host. We also switch as many tasks as possible to using the built-in Ansible modules which make use of the shade library. The 'virtualenv' package is now installed appropriately by the openstack_hosts role, so there's no need to install it any more. The 'httplib2' package is a legacy Ansible requirement for the get_url/get_uri module which is no longer needed. The keystone client library is not required any more now that we're using the upstream modules. As there are no required packages left, the task to install them is also removed. Unfortunately we need to use the openstack client to wait for a compute host to register, so we add it into the nova venv and implement a change in the way we do the wait so that openrc/clouds.yaml is only implemented on a single compute host and the wait task is executed there. Depends-On: https://review.openstack.org/582359 Change-Id: I702480a5188a583a03f66bb39609f7d25a996e4a

2018年07月12日 18:49:56 +01:00

when:

- "nova_services['nova-compute']['group'] in group_names"

- "nova_discover_hosts_in_cells_interval | int < 1"

vars:

Use ansible_facts[] instead of fact variables See https://github.com/ansible/ansible/issues/73654 Change-Id: I3cf2a30e0929835a84f0502bc4e87522b688b538

2021年02月25日 14:23:52 +00:00

compute_host_to_wait_for:"{{ ansible_facts['nodename'] }}"

Execute service setup against a delegated host using Ansible built-in modules In order to reduce the packages required to pip install on to the hosts, we allow the service setup to be delegated to a specific host, defaulting to the deploy host. We also switch as many tasks as possible to using the built-in Ansible modules which make use of the shade library. The 'virtualenv' package is now installed appropriately by the openstack_hosts role, so there's no need to install it any more. The 'httplib2' package is a legacy Ansible requirement for the get_url/get_uri module which is no longer needed. The keystone client library is not required any more now that we're using the upstream modules. As there are no required packages left, the task to install them is also removed. Unfortunately we need to use the openstack client to wait for a compute host to register, so we add it into the nova venv and implement a change in the way we do the wait so that openrc/clouds.yaml is only implemented on a single compute host and the wait task is executed there. Depends-On: https://review.openstack.org/582359 Change-Id: I702480a5188a583a03f66bb39609f7d25a996e4a

2018年07月12日 18:49:56 +01:00

tags:

- nova-config

openstack/openstack-ansible-os_nova - openstack-ansible-os_nova - OpenDev: Free Software Needs Free Tools

327 lines

10 KiB

YAML

Raw Normal View History

openstack/openstack-ansible-os_nova - openstack-ansible-os_nova - OpenDev: Free Software Needs Free Tools

327 lines 10 KiB YAML Raw Normal View History Unescape Escape

327 lines

10 KiB

YAML

Raw Normal View History