Skip to content

Commit 1979659

Browse files
GregWhiteyBialasGregWhiteyBialas
authored
Merge branch 'stackhpc/2023.1' into INFRA-629
2 parents ca6324a + 754282b commit 1979659

File tree

14 files changed

+208
-6
lines changed

14 files changed

+208
-6
lines changed

‎doc/source/contributor/environments/ci-builder.rst

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,13 @@ Pulp proxy that injects an HTTP basic auth header into requests that it
151151
proxies. Because this proxy bypasses Pulp's authentication, it must not be
152152
exposed to any untrusted environment.
153153

154+
Ensure that ``localhost`` is resolvable if Docker bridge networking is
155+
disabled. This may be achieved by adding the following to ``/etc/hosts``:
156+
157+
.. parsed-literal::
158+
159+
127.0.0.1 localhost
160+
154161
To deploy the proxy:
155162

156163
.. parsed-literal::

‎doc/source/operations/upgrading.rst

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -132,13 +132,13 @@ Some things to watch out for:
132132

133133
.. code-block:: sql
134134
135-
UPDATE trust_role
135+
UPDATE trust_role as tr
136136
SET role_id = '<MEMBER-ROLE-ID>'
137137
WHERE role_id = '<OLD-ROLE-ID>'
138138
AND NOT EXISTS (
139139
SELECT 1
140140
FROM trust_role
141-
WHERE trust_id = trust_role.trust_id
141+
WHERE trust_id = tr.trust_id
142142
AND role_id = '<MEMBER-ROLE-ID>'
143143
);
144144

‎etc/kayobe/ansible/pulp-auth-proxy.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
- import_role:
99
name: pulp_auth_proxy
1010
vars:
11-
pulp_auth_proxy_url: "{{ stackhpc_repo_mirror_url }}"
11+
pulp_auth_proxy_url: "{{ stackhpc_release_pulp_url }}"
1212
pulp_auth_proxy_username: "{{ stackhpc_repo_mirror_username }}"
1313
pulp_auth_proxy_password: "{{ stackhpc_repo_mirror_password }}"
1414
pulp_auth_proxy_conf_path: "{{ base_path }}/containers/pulp_proxy"

‎etc/kayobe/ansible/roles/pulp_auth_proxy/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ any untrusted environment.
1515

1616
## Role variables
1717

18-
* `pulp_auth_proxy_pulp_url`: URL of the Pulp server to proxy requests to.
18+
* `pulp_auth_proxy_url`: URL of the Pulp server to proxy requests to.
1919
* `pulp_auth_proxy_username`: Username of the Pulp server to proxy requests to.
2020
* `pulp_auth_proxy_password`: Password of the Pulp server to proxy requests to.
2121
* `pulp_auth_proxy_conf_path`: Path to a directory in which to write Nginx

‎etc/kayobe/ansible/roles/pulp_auth_proxy/defaults/main.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,4 @@ pulp_auth_proxy_password:
55
pulp_auth_proxy_conf_path:
66
pulp_auth_proxy_listen_ip: 127.0.0.1
77
pulp_auth_proxy_listen_port: 80
8+
pulp_auth_proxy_network_mode:

‎etc/kayobe/ansible/roles/pulp_auth_proxy/tasks/main.yml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,24 @@
11
---
2+
- when: pulp_auth_proxy_network_mode is none
3+
block:
4+
- name: Check if Docker bridge network exists
5+
community.docker.docker_host_info:
6+
networks: true
7+
register: docker_host_info
8+
9+
- name: Set a fact about the network mode
10+
ansible.builtin.set_fact:
11+
pulp_auth_proxy_network_mode: "{{ 'host' if docker_host_info.networks | selectattr('Driver', 'equalto', 'bridge') | list | length == 0 else 'bridge' }}"
12+
13+
- name: Assert that localhost is resolvable when using host networking
14+
assert:
15+
that:
16+
- "'localhost' is ansible.utils.resolvable"
17+
fail_msg: >-
18+
localhost must be resolvable when using Docker host networking with this container.
19+
Consider adding '127.0.0.1 localhost' to /etc/hosts.
20+
when: pulp_auth_proxy_network_mode == 'host'
21+
222
- name: "Ensure {{ pulp_auth_proxy_conf_path }} exists"
323
ansible.builtin.file:
424
path: "{{ pulp_auth_proxy_conf_path }}"
@@ -18,9 +38,18 @@
1838
community.docker.docker_container:
1939
name: pulp_proxy
2040
image: nginx:stable-alpine
41+
network_mode: "{{ pulp_auth_proxy_network_mode }}"
2142
ports:
2243
- "{{ pulp_auth_proxy_listen_ip }}:{{ pulp_auth_proxy_listen_port }}:80"
2344
restart_policy: "no"
2445
restart: "{{ pulp_proxy_conf is changed }}"
2546
volumes:
2647
- "{{ pulp_auth_proxy_conf_path }}/pulp_proxy.conf:/etc/nginx/conf.d/default.conf:ro"
48+
49+
- name: Wait for pulp_proxy container to become accessible
50+
ansible.builtin.uri:
51+
url: http://localhost/pulp/api/v3/status/
52+
register: uri_result
53+
until: uri_result is success
54+
retries: 30
55+
delay: 2

‎etc/kayobe/kolla/config/fluentd/output/00-local.conf

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
{% raw %}
2+
{% for item in syslog_facilities | selectattr('enabled') %}
3+
<match syslog.{{ item.facility }}.**>
4+
@type copy
5+
<store>
6+
@type file
7+
path /var/log/kolla/{{ item.logdir }}/{{ item.logfile }}
8+
append true
9+
# Disable timestamp in filename for logs
10+
<buffer []>
11+
path /var/log/kolla/{{ item.logdir }}/{{ item.logfile }}.*.buffer
12+
</buffer>
13+
<format>
14+
output_tag {{ item.output_tag | default(false) | lower }}
15+
output_time {{ item.output_time | default(false) | lower }}
16+
</format>
17+
</store>
18+
{% if log_direct_to_elasticsearch %}
19+
<store>
20+
@type elasticsearch
21+
host {{ elasticsearch_address }}
22+
port {{ elasticsearch_port | default('9200') }}
23+
scheme {{ fluentd_elasticsearch_scheme }}
24+
{% if fluentd_elasticsearch_path != '' %}
25+
path {{ fluentd_elasticsearch_path }}
26+
{% endif %}
27+
{% if fluentd_elasticsearch_scheme == 'https' %}
28+
ssl_version {{ fluentd_elasticsearch_ssl_version }}
29+
ssl_verify {{ fluentd_elasticsearch_ssl_verify }}
30+
{% if fluentd_elasticsearch_cacert | length > 0 %}
31+
ca_file {{ fluentd_elasticsearch_cacert }}
32+
{% endif %}
33+
{% endif %}
34+
{% if fluentd_elasticsearch_user != '' and fluentd_elasticsearch_password != ''%}
35+
user {{ fluentd_elasticsearch_user }}
36+
password {{ fluentd_elasticsearch_password }}
37+
{% endif %}
38+
logstash_format true
39+
logstash_prefix {{ opensearch_log_index_prefix }}
40+
reconnect_on_error true
41+
request_timeout {{ fluentd_elasticsearch_request_timeout }}
42+
suppress_type_name true
43+
<buffer>
44+
@type file
45+
path /var/lib/fluentd/data/elasticsearch.buffer/{{ item.facility }}.*
46+
flush_interval 15s
47+
</buffer>
48+
</store>
49+
{% elif log_direct_to_opensearch %}
50+
<store>
51+
@type opensearch
52+
host {{ opensearch_address }}
53+
port {{ opensearch_port }}
54+
scheme {{ fluentd_opensearch_scheme }}
55+
{% if fluentd_opensearch_path != '' %}
56+
path {{ fluentd_opensearch_path }}
57+
{% endif %}
58+
{% if fluentd_opensearch_scheme == 'https' %}
59+
ssl_version {{ fluentd_opensearch_ssl_version }}
60+
ssl_verify {{ fluentd_opensearch_ssl_verify }}
61+
{% if fluentd_opensearch_cacert | length > 0 %}
62+
ca_file {{ fluentd_opensearch_cacert }}
63+
{% endif %}
64+
{% endif %}
65+
{% if fluentd_opensearch_user != '' and fluentd_opensearch_password != ''%}
66+
user {{ fluentd_opensearch_user }}
67+
password {{ fluentd_opensearch_password }}
68+
{% endif %}
69+
logstash_format true
70+
logstash_prefix {{ opensearch_log_index_prefix }}
71+
reconnect_on_error true
72+
request_timeout {{ fluentd_opensearch_request_timeout }}
73+
suppress_type_name true
74+
bulk_message_request_threshold 20M
75+
<buffer>
76+
@type file
77+
path /var/lib/fluentd/data/opensearch.buffer/{{ item.facility }}.*
78+
flush_interval 15s
79+
chunk_limit_size 8M
80+
</buffer>
81+
</store>
82+
{% endif %}
83+
</match>
84+
{% endfor %}
85+
{% endraw %}

‎etc/kayobe/kolla/config/fluentd/output/03-opensearch.conf

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{% raw %}
2+
{% if enable_caso | bool and inventory_hostname in groups['caso'] %}
3+
<match apel.events>
4+
@type copy
5+
<store>
6+
@type opensearch
7+
host { opensearch_address }}
8+
port {{ opensearch_port }}
9+
logstash_format true
10+
logstash_prefix apel
11+
flush_interval 15s
12+
</store>
13+
</match>
14+
{% endif %}
15+
16+
<match **>
17+
@type copy
18+
<store>
19+
@type opensearch
20+
host {{ opensearch_address }}
21+
port {{ opensearch_port }}
22+
scheme {{ fluentd_opensearch_scheme }}
23+
{% if fluentd_opensearch_path != '' %}
24+
path {{ fluentd_opensearch_path }}
25+
{% endif %}
26+
{% if fluentd_opensearch_scheme == 'https' %}
27+
ssl_version {{ fluentd_opensearch_ssl_version }}
28+
ssl_verify {{ fluentd_opensearch_ssl_verify }}
29+
{% if fluentd_opensearch_cacert | length > 0 %}
30+
ca_file {{ fluentd_opensearch_cacert }}
31+
{% endif %}
32+
{% endif %}
33+
{% if fluentd_opensearch_user != '' and fluentd_opensearch_password != ''%}
34+
user {{ fluentd_opensearch_user }}
35+
password {{ fluentd_opensearch_password }}
36+
{% endif %}
37+
logstash_format true
38+
logstash_prefix {{ opensearch_log_index_prefix }}
39+
reconnect_on_error true
40+
request_timeout {{ fluentd_opensearch_request_timeout }}
41+
suppress_type_name true
42+
bulk_message_request_threshold 20M
43+
<buffer>
44+
@type file
45+
path /var/lib/fluentd/data/opensearch.buffer/openstack.*
46+
flush_interval 15s
47+
chunk_limit_size 8M
48+
</buffer>
49+
</store>
50+
</match>
51+
{% endraw %}

‎etc/kayobe/kolla/config/prometheus/fluentd.rules

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{% raw %}
2+
groups:
3+
- name: Fluentd
4+
rules:
5+
- alert: FluentdBufferTooLarge
6+
expr: (fluentd_output_status_buffer_total_bytes / 1024^2) > 128
7+
for: 15m
8+
labels:
9+
severity: warning
10+
annotations:
11+
summary: "Fluentd at {{ $labels.instance }} reports large queue buffers"
12+
description: "Fluentd queue buffers on {{ $labels.instance }} are using {{ $value }} MiB."
13+
{% endraw %}

‎etc/kayobe/kolla/config/prometheus/prometheus-blackbox-exporter.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ modules:
2727
- expect: "^SSH-2.0-"
2828
icmp:
2929
prober: icmp
30-
http_2xx_os_dashboards:
30+
http_2xx_opensearch_dashboards:
3131
prober: http
3232
timeout: 5s
3333
http:

‎etc/kayobe/pulp-repo-versions.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ stackhpc_pulp_repo_rocky_9_3_baseos_version: 20240413T014042
3131
stackhpc_pulp_repo_rocky_9_3_crb_version: 20240413T014042
3232
stackhpc_pulp_repo_rocky_9_3_extras_version: 20240413T014042
3333
stackhpc_pulp_repo_rocky_9_3_highavailability_version: 20240404T012937
34-
stackhpc_pulp_repo_rocky_9_sig_security_common_version: 20240705T092559
34+
stackhpc_pulp_repo_rocky_9_sig_security_common_version: 20240708T235303
3535
stackhpc_pulp_repo_ubuntu_cloud_archive_version: 20240418T070026
3636
stackhpc_pulp_repo_ubuntu_jammy_security_version: 20240418T043733
3737
stackhpc_pulp_repo_ubuntu_jammy_version: 20240418T043733

‎releasenotes/notes/fix-blackbox-opensearch-dashboard-d973b43c557c8103.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
fixes:
3+
- |
4+
Fixed incorrect Opensearch Dashboards Prometheus Blackbox Exporter
5+
configuration.

‎releasenotes/notes/fluentd-buffer-too-large-alert-682893410855387f.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
features:
3+
- |
4+
Adds a new Prometheus alert ``FluentdBufferTooLarge`` which is raised when
5+
the total size of queue buffers grows above 128 MiB.

‎releasenotes/notes/rl9-security-common-cve-2024-6409-d36de799a29c3f74.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
security:
3+
- |
4+
Updates the Rocky Linux 9 SIG Security Common repository to address
5+
`CVE-2024-6409 <https://sig-security.rocky.page/issues/CVE-2024-6409/>`__
6+
in OpenSSH.

0 commit comments

Comments
 (0)