Skip to content

Commit d8a3f49

Browse files
assumptionsandgassumptionsandg
authored
Merge branch 'stackhpc/2023.1' into blazar-test-image2
2 parents 48601fe + e8c03a2 commit d8a3f49

File tree

15 files changed

+116
-83
lines changed

15 files changed

+116
-83
lines changed

‎.github/workflows/stackhpc-all-in-one.yml

Lines changed: 6 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,7 @@ jobs:
167167
VM_NETWORK: ${{ inputs.vm_network }}
168168
VM_SUBNET: ${{ inputs.vm_subnet }}
169169
VM_INTERFACE: ${{ inputs.vm_interface }}
170-
VM_VOLUME_SIZE: ${{ inputs.upgrade && '55' || '40' }}
170+
VM_VOLUME_SIZE: ${{ inputs.upgrade && '65' || '50' }}
171171
VM_TAGS: '["skc-ci-aio", "PR=${{ github.event.number }}"]'
172172

173173
- name: Terraform Plan
@@ -214,22 +214,12 @@ jobs:
214214
- name: Write Terraform network config
215215
run: |
216216
cat << EOF > etc/kayobe/environments/$KAYOBE_ENVIRONMENT/tf-networks.yml
217-
218-
admin_oc_net_name: admin
219-
admin_cidr: "{{ access_cidr.value }}"
220-
admin_allocation_pool_start: 0.0.0.0
221-
admin_allocation_pool_end: 0.0.0.0
222-
admin_gateway: "{{ access_gw.value }}"
223-
admin_bootproto: dhcp
224-
admin_ips:
217+
admin_oc_net_name: ethernet
218+
ethernet_cidr: "{{ access_cidr.value }}"
219+
ethernet_allocation_pool_start: 0.0.0.0
220+
ethernet_allocation_pool_end: 0.0.0.0
221+
ethernet_ips:
225222
controller0: "{{ access_ip_v4.value }}"
226-
admin_zone: admin
227-
EOF
228-
229-
- name: Write Terraform network interface config
230-
run: |
231-
cat << EOF > etc/kayobe/environments/$KAYOBE_ENVIRONMENT/inventory/group_vars/controllers/tf-network-interfaces
232-
admin_interface: "{{ access_interface.value }}"
233223
EOF
234224
235225
- name: Write all-in-one scenario config

‎etc/kayobe/ansible/deploy-os-capacity-exporter.yml

Lines changed: 53 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -15,59 +15,61 @@
1515
tags: os_capacity
1616
gather_facts: false
1717
tasks:
18-
- name: Create os-capacity directory
19-
ansible.builtin.file:
20-
path: /opt/kayobe/os-capacity/
21-
state: directory
22-
when: stackhpc_enable_os_capacity
23-
24-
- name: Read admin-openrc credential file
25-
ansible.builtin.command:
26-
cmd: "cat {{ lookup('ansible.builtin.env', 'KOLLA_CONFIG_PATH') }}/admin-openrc.sh"
18+
- name: Check if admin-openrc.sh exists
19+
ansible.builtin.stat:
20+
path: "{{ lookup('ansible.builtin.env', 'KOLLA_CONFIG_PATH') }}/admin-openrc.sh"
2721
delegate_to: localhost
28-
register: credential
29-
when: stackhpc_enable_os_capacity
30-
changed_when: false
22+
register: openrc_file_stat
23+
run_once: true
3124

32-
- name: Set facts for admin credentials
33-
ansible.builtin.set_fact:
34-
stackhpc_os_capacity_auth_url: "{{ credential.stdout_lines | select('match', '.*OS_AUTH_URL*.') | first | split('=') | last | replace(\"'\",'') }}"
35-
stackhpc_os_capacity_project_name: "{{ credential.stdout_lines | select('match', '.*OS_PROJECT_NAME*.') | first | split('=') | last | replace(\"'\",'') }}"
36-
stackhpc_os_capacity_domain_name: "{{ credential.stdout_lines | select('match', '.*OS_PROJECT_DOMAIN_NAME*.') | first | split('=') | last | replace(\"'\",'') }}"
37-
stackhpc_os_capacity_openstack_region_name: "{{ credential.stdout_lines | select('match', '.*OS_REGION_NAME*.') | first | split('=') | last | replace(\"'\",'') }}"
38-
stackhpc_os_capacity_username: "{{ credential.stdout_lines | select('match', '.*OS_USERNAME*.') | first | split('=') | last | replace(\"'\",'') }}"
39-
stackhpc_os_capacity_password: "{{ credential.stdout_lines | select('match', '.*OS_PASSWORD*.') | first | split('=') | last | replace(\"'\",'') }}"
40-
when: stackhpc_enable_os_capacity
25+
- block:
26+
- name: Create os-capacity directory
27+
ansible.builtin.file:
28+
path: /opt/kayobe/os-capacity/
29+
state: directory
4130

42-
- name: Template clouds.yml
43-
ansible.builtin.template:
44-
src: templates/os_capacity-clouds.yml.j2
45-
dest: /opt/kayobe/os-capacity/clouds.yaml
46-
when: stackhpc_enable_os_capacity
47-
register: clouds_yaml_result
31+
- name: Read admin-openrc credential file
32+
ansible.builtin.command:
33+
cmd: "cat {{ lookup('ansible.builtin.env', 'KOLLA_CONFIG_PATH') }}/admin-openrc.sh"
34+
delegate_to: localhost
35+
register: credential
36+
changed_when: false
4837

49-
- name: Copy CA certificate to OpenStack Capacity nodes
50-
ansible.builtin.copy:
51-
src: "{{ stackhpc_os_capacity_openstack_cacert }}"
52-
dest: /opt/kayobe/os-capacity/cacert.pem
53-
when:
54-
- stackhpc_enable_os_capacity
55-
- stackhpc_os_capacity_openstack_cacert | length > 0
56-
register: cacert_result
38+
- name: Set facts for admin credentials
39+
ansible.builtin.set_fact:
40+
stackhpc_os_capacity_auth_url: "{{ credential.stdout_lines | select('match', '.*OS_AUTH_URL*.') | first | split('=') | last | replace(\"'\",'') }}"
41+
stackhpc_os_capacity_project_name: "{{ credential.stdout_lines | select('match', '.*OS_PROJECT_NAME*.') | first | split('=') | last | replace(\"'\",'') }}"
42+
stackhpc_os_capacity_domain_name: "{{ credential.stdout_lines | select('match', '.*OS_PROJECT_DOMAIN_NAME*.') | first | split('=') | last | replace(\"'\",'') }}"
43+
stackhpc_os_capacity_openstack_region_name: "{{ credential.stdout_lines | select('match', '.*OS_REGION_NAME*.') | first | split('=') | last | replace(\"'\",'') }}"
44+
stackhpc_os_capacity_username: "{{ credential.stdout_lines | select('match', '.*OS_USERNAME*.') | first | split('=') | last | replace(\"'\",'') }}"
45+
stackhpc_os_capacity_password: "{{ credential.stdout_lines | select('match', '.*OS_PASSWORD*.') | first | split('=') | last | replace(\"'\",'') }}"
5746

58-
- name: Ensure os_capacity container is running
59-
community.docker.docker_container:
60-
name: os_capacity
61-
image: ghcr.io/stackhpc/os-capacity:master
62-
env:
63-
OS_CLOUD: openstack
64-
OS_CLIENT_CONFIG_FILE: /etc/openstack/clouds.yaml
65-
mounts:
66-
- type: bind
67-
source: /opt/kayobe/os-capacity/
68-
target: /etc/openstack/
69-
network_mode: host
70-
restart: "{{ clouds_yaml_result is changed or cacert_result is changed }}"
71-
restart_policy: unless-stopped
72-
become: true
73-
when: stackhpc_enable_os_capacity
47+
- name: Template clouds.yml
48+
ansible.builtin.template:
49+
src: templates/os_capacity-clouds.yml.j2
50+
dest: /opt/kayobe/os-capacity/clouds.yaml
51+
register: clouds_yaml_result
52+
53+
- name: Copy CA certificate to OpenStack Capacity nodes
54+
ansible.builtin.copy:
55+
src: "{{ stackhpc_os_capacity_openstack_cacert }}"
56+
dest: /opt/kayobe/os-capacity/cacert.pem
57+
when: stackhpc_os_capacity_openstack_cacert | length > 0
58+
register: cacert_result
59+
60+
- name: Ensure os_capacity container is running
61+
community.docker.docker_container:
62+
name: os_capacity
63+
image: ghcr.io/stackhpc/os-capacity:master
64+
env:
65+
OS_CLOUD: openstack
66+
OS_CLIENT_CONFIG_FILE: /etc/openstack/clouds.yaml
67+
mounts:
68+
- type: bind
69+
source: /opt/kayobe/os-capacity/
70+
target: /etc/openstack/
71+
network_mode: host
72+
restart: "{{ clouds_yaml_result is changed or cacert_result is changed }}"
73+
restart_policy: unless-stopped
74+
become: true
75+
when: stackhpc_enable_os_capacity and openrc_file_stat.stat.exists

‎etc/kayobe/environments/ci-aio/automated-setup.sh

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,10 +76,6 @@ fi
7676
sudo ip l set dummy1 up
7777
sudo ip l set dummy1 master breth1
7878

79-
if type apt; then
80-
sudo cp /run/systemd/network/* /etc/systemd/network
81-
fi
82-
8379
export KAYOBE_VAULT_PASSWORD=$(cat $BASE_PATH/vault-pw)
8480
pushd $BASE_PATH/src/kayobe-config
8581
source kayobe-env --environment ci-aio

‎etc/kayobe/environments/ci-aio/controllers.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@
66
# to setup the Kayobe user account. Default is {{ os_distribution }}.
77
controller_bootstrap_user: "{{ os_distribution if os_distribution == 'ubuntu' else 'cloud-user' }}"
88

9+
controller_extra_network_interfaces:
10+
- ethernet
11+
912
# Controller lvm configuration. See intentory/group_vars/controllers/lvm.yml
1013
# for the exact configuration.
1114
controller_lvm_groups:

‎etc/kayobe/environments/ci-aio/inventory/group_vars/controllers/network-interfaces

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,11 @@
22
###############################################################################
33
# Network interface definitions for the controller group.
44

5+
# Ethernet interface is the `primary` or `physical` interface associated
6+
# with the instance that the AIO deployment runs inside of. It is the interface used
7+
# to reach the instance.
8+
ethernet_interface: "{{ ansible_facts['default_ipv4']['interface'] }}"
9+
510
# Controller interface on all-in-one network.
611
aio_interface: breth1
712
# Use dummy1 if it exists, otherwise the bridge will have no ports.

‎etc/kayobe/environments/ci-aio/networks.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,12 @@ cleaning_net_name: aio
8080
###############################################################################
8181
# Network definitions.
8282

83+
# This network is required to be defined within `ci-aio` environment to ensure that
84+
# the network interface files are created appropriately and to provide easy inclusion
85+
# within the firewall configuration.
86+
ethernet_bootproto: dhcp
87+
ethernet_zone: trusted
88+
8389
# All-in-one network.
8490
aio_cidr: 192.168.33.0/24
8591
aio_allocation_pool_start: 192.168.33.3

‎etc/kayobe/kolla-image-tags.yml

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,14 @@ kolla_image_tags:
1717
haproxy_ssh:
1818
ubuntu-jammy: 2023.1-ubuntu-jammy-20240509T102329
1919
ironic:
20-
rocky-9: 2023.1-rocky-9-20240906T144646
21-
ubuntu-jammy: 2023.1-ubuntu-jammy-20240906T144646
20+
rocky-9: 2023.1-rocky-9-20241022T090717
21+
ubuntu-jammy: 2023.1-ubuntu-jammy-20241022T090717
2222
ironic_dnsmasq:
23-
rocky-9: 2023.1-rocky-9-20240709T132012
24-
ubuntu-jammy: 2023.1-ubuntu-jammy-20240621T104542
23+
rocky-9: 2023.1-rocky-9-20241022T090717
24+
ubuntu-jammy: 2023.1-ubuntu-jammy-20241022T090717
2525
ironic_neutron_agent:
26-
rocky-9: 2023.1-rocky-9-20240916T114629
27-
ubuntu-jammy: 2023.1-ubuntu-jammy-20240916T114629
26+
rocky-9: 2023.1-rocky-9-20241022T090717
27+
ubuntu-jammy: 2023.1-ubuntu-jammy-20241022T090717
2828
kolla_toolbox:
2929
rocky-9: 2023.1-rocky-9-20240809T102431
3030
letsencrypt:
@@ -35,8 +35,8 @@ kolla_image_tags:
3535
manila:
3636
rocky-9: 2023.1-rocky-9-20240809T102431
3737
neutron:
38-
rocky-9: 2023.1-rocky-9-20240926T151818
39-
ubuntu-jammy: 2023.1-ubuntu-jammy-20240926T151818
38+
rocky-9: 2023.1-rocky-9-20241011T212435
39+
ubuntu-jammy: 2023.1-ubuntu-jammy-20241011T212435
4040
nova:
4141
rocky-9: 2023.1-rocky-9-20240926T151818
4242
ubuntu-jammy: 2023.1-ubuntu-jammy-20240926T151818

‎etc/kayobe/kolla.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -460,6 +460,8 @@ kolla_build_customizations_common:
460460
nova_compute_packages_append:
461461
- python3-libvirt
462462
- python3-ethtool
463+
neutron_mlnx_agent_pip_packages_override:
464+
- networking-mlnx@git+https://github.com/stackhpc/networking-mlnx@stackhpc/{{ openstack_release }}
463465

464466
kolla_build_customizations_rocky:
465467
kolla_toolbox_packages_remove:

‎etc/kayobe/kolla/config/prometheus/prometheus.rules

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,23 @@ groups:
77
rules:
88

99
- alert: PrometheusTargetMissing
10-
expr: up == 0
10+
expr: up{job!="redfish-exporter-seed"} == 0
1111
for: 5m
1212
labels:
1313
severity: critical
1414
annotations:
1515
summary: "Prometheus target missing (instance {{ $labels.instance }})"
1616
description: "A Prometheus target has disappeared. An exporter might have crashed."
1717

18+
- alert: PrometheusTargetMissing
19+
expr: up{job="redfish-exporter-seed"} == 0
20+
for: 15m
21+
labels:
22+
severity: critical
23+
annotations:
24+
summary: "Prometheus target missing (instance {{ $labels.instance }})"
25+
description: "A Prometheus target has disappeared. An exporter might have crashed."
26+
1827
- alert: PrometheusAllTargetsMissing
1928
expr: count by (job) (up) == 0
2029
for: 1m

‎etc/kayobe/kolla/config/prometheus/prometheus.yml.d/60-redfish.yml

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,11 @@ scrape_configs:
1515
replacement: "{{ lookup('vars', admin_oc_net_name ~ '_ips')[groups.seed.0] }}:9610"
1616
static_configs:
1717
{% for host in groups.get('redfish_exporter_targets', []) %}
18-
{% if hostvars[host]["redfish_exporter_scrape_group"] | default('overcloud') == 'overcloud' %}
1918
- targets:
2019
- '{{ hostvars[host]["redfish_exporter_target_address"] }}'
2120
labels:
2221
server: '{{ host }}'
2322
env: "{{ kayobe_environment | default('openstack') }}"
2423
group: "{{ hostvars[host]['redfish_exporter_scrape_group'] | default('overcloud') }}"
25-
{% endif %}
2624
{% endfor %}
2725
{% endif %}

‎releasenotes/notes/fix-issue-with-redfish-exporter-scrape-group-b10eaac6ee1e6af3.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
fixes:
3+
- |
4+
Fixes an issue where setting ``redfish_exporter_scrape_group`` to a value
5+
other than ``overcloud`` would exclude those nodes from the redfish
6+
exporter scrapes.

‎releasenotes/notes/fix-ossa-2024-004-f732e58c12e26785.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
security:
3+
- |
4+
Fixes `OSSA-2024-004
5+
<https://security.openstack.org/ossa/OSSA-2024-004.html>`_ with updated
6+
container images for Ironic.

‎releasenotes/notes/reduces-sensitivity-of-redfish-target-alerts-a3d77a3f0c3dac8a.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
fixes:
3+
- |
4+
Changes the duration for which redfish exporter must continually fail
5+
scrapes before triggering an alert to 15 minutes. This should hopefully
6+
reduce some alert spam.

‎terraform/aio/vm.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ variable "aio_vm_subnet" {
3535

3636
variable "aio_vm_volume_size" {
3737
type = number
38-
default = 40
38+
default = 50
3939
}
4040

4141
variable "aio_vm_tags" {

‎tools/scan-images.sh

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,10 @@ for image in $images; do
5454
--severity HIGH,CRITICAL \
5555
--output image-scan-output/${filename}.json \
5656
--ignore-unfixed \
57+
--db-repository ghcr.io/aquasecurity/trivy-db:2 \
58+
--db-repository public.ecr.aws/aquasecurity/trivy-db \
59+
--java-db-repository ghcr.io/aquasecurity/trivy-java-db:1 \
60+
--java-db-repository public.ecr.aws/aquasecurity/trivy-java-db \
5761
$image); then
5862
# Clean up the output file for any images with no vulnerabilities
5963
rm -f image-scan-output/${filename}.json

0 commit comments

Comments
 (0)