2456 Commits

Author SHA1 Message Date
Jean-Charles Lopez
1cb646e7d1 Restrict Cinder, Glance and libvirt Ceph access scope.
Depends-On: I78bffe6764e9cbb16b2a615be766c910ba5d4e48
Change-Id: I112f2d9137f00ab2d0c246b6c0b52e4a546d648a
2018-10-29 15:53:36 +00:00
OpenStack Proposal Bot
9d72fe1a50 Imported Translations from Zanata
For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: I93ce1fdbbb68d11706cc65dd09d653bc2276dcd6
2018-10-26 08:33:46 +00:00
OpenStack Proposal Bot
d0aa21b3c1 Imported Translations from Zanata
For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: I67b69acc26089eff593804fbebcf66ae0ecb04b0
2018-10-25 06:31:14 +00:00
Zuul
5a9ba5c066 Merge "VBMC: remove from osh and update ironic gate setup script" 2018-10-24 23:42:22 +00:00
Zuul
b1cad144a3 Merge "Enable network policy enforcement" 2018-10-24 09:29:23 +00:00
Pete Birley
f0edbafb78 VBMC: remove from osh and update ironic gate setup script
This PS removes the vmbc image from osh, and also fixes some linting
issues with the ironic gate setup script.

Depends-On: https://review.openstack.org/608689
Change-Id: I2f95445a49dfaced19cab058f94966f11c4a8877
Signed-off-by: Pete Birley <pete@port.direct>
2018-10-23 16:53:35 +00:00
Tin Lam
29f32a07ac Enable network policy enforcement
This patch set updates the gate to by default uses network policy
for all components and enforces them in Openstack-helm.

Change-Id: I70c90b5808075797f02670f21481a4f968205325
Depends-On: I78e87ef3276e948ae4dd2eb462b4b8012251c8c8
Co-Authored-By: Mike Pham <tp6510@att.com>
Signed-off-by: Tin Lam <tin@irrational.io>
2018-10-23 14:58:13 +00:00
Jean-Philippe Evrard
e46d98bf05 Prepare migration of base jobs to OSH-infra
Without this patch, openstack-helm-functional and
openstack-helm-multinode are a repetition of the
openstack-helm-infra-functional and openstack-helm-infra-multinode
jobs.

This is a problem, as multiple patches are required to change a base
job, and can lead to inconsistencies.

Instead the abstract jobs should be defined in only one place, the
openstack-helm-infra repositories. This will therefore be the location
of the openstack-helm project lint, functional, and multinode "base"
jobs.

From that point, openstack-helm-infra and openstack-helm can implement
their own job variants should this be required.

This patch fixes the link dependency between the two repositories by
ensuring all the OSH jobs are using their own local job definition
("-temp" jobs) during the migration.

Change-Id: I3d3193415ba65d58c5dd9bbb1fc515f5399edece
Depends-On: https://review.openstack.org/610482
Depends-On: https://review.openstack.org/610488
Depends-On: https://review.openstack.org/611239
2018-10-21 16:18:20 +00:00
Zuul
6a9c12c910 Merge "Set report_discard_supported to true for the RBD Cinder backend." 2018-10-21 07:44:12 +00:00
Zuul
bcd756e3c2 Merge "Allow pool size change when pools are protected" 2018-10-19 20:53:59 +00:00
Matthew Heler
80e0dfc1b9 Set report_discard_supported to true for the RBD Cinder backend.
This enables Ceph discard/trim support with cinder volumes.
Note: that you still need to use a paravirtualized storage backend that 
supports discard/trim (virtio-scsi for example).

Change-Id: I7d564ac22ee8faedda0336ee5c67f8312c9f7d06
2018-10-19 15:28:10 +00:00
confi-surya
b9fab949aa Add the project source code repository in README
Change-Id: Ia0d7bb09a8eb475a1fcfb4adcd89529bc15a63e1
2018-10-19 14:22:25 +00:00
Jean-Charles Lopez
1e740816a7 Allow pool size change when pools are protected
Change-Id: I1ae4c0788288e3d05f009355fe0831259bbd969a
2018-10-18 13:38:58 -07:00
Zuul
b7c8ba6d81 Merge "Fix typos in doc" 2018-10-18 07:33:40 +00:00
ardentpark
b067309b89 Fix typos in doc
Fix some typos that I found in documents(except specs)
 * fix trivial mistakes(typos)
 * fix the link error(rst->html)
 * restore it's -> its
 * fix k8s -> K8s

Change-Id: I6ec65e9d04441adac210cc9fd476a37a1cb9644f
2018-10-18 10:40:33 +09:00
Zuul
3d5fcddffe Merge "Keystone: remove rally ec2 credential test" 2018-10-17 19:44:53 +00:00
Pete Birley
a2c47a78c3 Keystone: remove rally ec2 credential test
This PS removes the rally ec2 credential test. As Rally left old
encrypted ec2 credentials in the database which were not being
cleaned up between upgrades and key changes.

Change-Id: Id0c5411521adebc8c977fd9a24f511f6925f16d0
Signed-off-by: Pete Birley <pete@port.direct>
2018-10-17 09:57:13 -05:00
Zuul
0fbf00585f Merge "Ceph test - Node failure and expansion" 2018-10-17 05:00:59 +00:00
Jean-Philippe Evrard
7646b85160 Use the openstack-helm-lint job from central location
This moves the job definitions into a single location, the zuul.d
folder, like it is done in the openstack-helm-infra repository.

The job playbooks and definitions of this repository will be moved
away to the openstack-helm-infra repository in a later commit.

This patch implements the first job reuse with the job
openstack-helm-lint from openstack-helm-infra's repository.

Change-Id: I233da952548d69f040771007455955131139e860
Depends-On: https://review.openstack.org/#/c/608662/
2018-10-15 09:21:42 +00:00
OpenStack Proposal Bot
90fd191cfc Imported Translations from Zanata
For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: I2a074a69f363cfdcc22dcf581e8b3cb5df2b061e
2018-10-14 06:31:13 +00:00
Tin Lam
3cd4d0898a Upgrade default from newton to ocata
This patch set moves the default deployment to ocata from newton.
Newton zuul job is now moved into its separate job.

Change-Id: Ic534c8ee02179f23c7855d93a4707e5a2fd77354
Signed-off-by: Tin Lam <tin@irrational.io>
2018-10-13 04:18:46 +00:00
Zuul
5fd3ce575a Merge "Armada: Add Elasticsearch admin password to nagios chart" 2018-10-12 19:17:03 +00:00
Zuul
e97655a80f Merge "Update Neutron TaaS Rootwrap Filter" 2018-10-09 22:09:37 +00:00
Renis
aa4b01a3a0 Ceph test - Node failure and expansion
- Document effect of node restart, node failure
and adding new node to ceph cluster
- Document recovery steps

Change-Id: I5fa952bef4934974d5657bac05c887564b7c471a
2018-10-09 12:11:17 -07:00
Steve Wilkerson
eb0fa9f7a4 Armada: Add Elasticsearch admin password to nagios chart
This adds the Elasticsearch admin password to the nagios chart
document overrides to account for the Elasticsearch plugin for
alerting on queries to Elasticsearch for particular logged events

Change-Id: I589fabf94a537730c3bfe86a6aa2af2c6fc3c88a
2018-10-09 15:56:36 +00:00
Zuul
11914228d7 Merge "Armada: Use single rabbitmq deployment" 2018-10-08 23:45:48 +00:00
Zuul
3b999a0e7b Merge "Add missing labels to cronJobs" 2018-10-08 21:41:36 +00:00
Steve Wilkerson
821256da3a Armada: Use single rabbitmq deployment
This moves to use a single rabbitmq deployment for the openstack
services in the armada gate to reduce the resources required for
this check to run.

Change-Id: I81bba3c9a4d9cdaad6ddcaa066441a70f1908415
2018-10-08 13:45:36 +00:00
Chris Wedgwood
8ae990e622 [nova] Allow deterministic setting of 'ironic.memcache_secret_key
If conf.nova.ironic.memcache_secret_key is not explicitly set, derive
it from endpoints.oslo_cache.auth.memcache_secret_key or use a random
value.

This means when installing charts where we explicitly set
endpoints.oslo_cache.auth.memcache_secret_key upgrades without changes
won't churn.

Change-Id: I686297e25627d88ff9bd32df0a3f7ee8afc11f58
2018-10-07 07:26:29 +00:00
Mike Pham
829d7b9923 Add missing labels to cronJobs
While implementing network policies, we noticed a handful of pods created
as part of a CronJobs are missing labels causing them to be unable to
targed by the policy. This patch set adds in the missing labels found
in that effort.

Change-Id: I1ca3cfd68ff20dc39a1e952414f3dddd3fc8d3b4
2018-10-06 22:28:35 -05:00
Zuul
a82fdd2491 Merge "Libvirt: Remove libvirt dockerfile from repo" 2018-10-06 20:28:34 +00:00
Zuul
0f4180d4f3 Merge "Switch to the latest Configuration Guide" 2018-10-06 04:17:00 +00:00
Pete Birley
bdacef72eb Libvirt: Remove libvirt dockerfile from repo
This PS removes the libvirt dockerfile from the repo, as it and the
chart beling in openstack-helm-infra.

Depends-On: https://review.openstack.org/#/c/608355/

Change-Id: I3ccc41f3ab97868ecfef7517185c92b0124924ac
Signed-off-by: Pete Birley <pete@port.direct>
2018-10-05 20:51:59 +00:00
Dae Seong Kim
72172aae5a Specification: Value File Ordering
This specification proposes a value file ordering guideline
to enforce uniformity across all the charts in openstack-helm
project.

Story: 2002206
Task: 21742

Change-Id: I55691f4fb1c1e6aa5b430f5c287fd3f94e12f071
2018-10-05 02:59:37 +00:00
Roy Tang
fed088d84b Update Neutron TaaS Rootwrap Filter
Need to adjust taas rootwrap filter for i40e_sysfs_command.
Add code to allow sriov agent init script to run best effort.
Update way to set nic promisc mode.

Change-Id: Id1e22ea4b636ae7e05b880739a88c410a4da587c
2018-10-04 08:15:00 +00:00
Steve Wilkerson
f97e644aa6 Glance: Disable registry service template in manifests
This updates the glance chart to disable the service for the
glance registry by default, as we disable the other glance
registry templates by default. This updates the gates to enable
the service when newton is deployed

Change-Id: I453d28d9c552754b66e94d9da2e2b9ea6549a5aa
2018-10-01 09:17:30 -05:00
Zuul
093a8ae0e2 Merge "Rally: Update chart" 2018-10-01 13:19:59 +00:00
Zuul
a49a39f604 Merge "Clean up the tempest.conf section of the values.yaml" 2018-10-01 13:17:06 +00:00
Zuul
c2929b40b2 Merge "fix tox python3 overrides" 2018-10-01 13:13:54 +00:00
Zuul
f9231d720c Merge "Gate: Update tempest deployment script" 2018-10-01 07:55:32 +00:00
Zuul
653ee1330b Merge "Horizon: HTTP Verb Tampering vulnerability fix" 2018-10-01 07:34:14 +00:00
Zuul
0f6b734946 Merge "SRIOV: Limit number of vfs to n-1 created by default" 2018-10-01 07:25:40 +00:00
Zuul
09746fb395 Merge "Minor: memory allocation mistypes fix" 2018-10-01 07:25:39 +00:00
Doug Hellmann
16df480a3c fix tox python3 overrides
We want to default to running all tox environments under python 3, so
set the basepython value in each environment.

We do not want to specify a minor version number, because we do not
want to have to update the file every time we upgrade python.

We do not want to set the override once in testenv, because that
breaks the more specific versions used in default environments like
py35 and py36.

Change-Id: I5b07c573ea3594c011adc0ffbe629f0229e611f0
Signed-off-by: Doug Hellmann <doug@doughellmann.com>
2018-10-01 06:46:25 +00:00
OpenStack Proposal Bot
12a4df5a5c Imported Translations from Zanata
For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: I916ad35e4b1034ce78473526d6a2a43921387661
2018-09-30 06:37:59 +00:00
Dmitrii Kabanov
b8eb8b3581 Horizon: HTTP Verb Tampering vulnerability fix
The patch fixes the HTTP verb tampering issue. The idea is to disable
unnecessary HTTP methods for the Horizon. You can find a link to
the description [0] and a link to the White Paper [1] below:

CAPEC-274: HTTP Verb Tampering
[0] https://capec.mitre.org/data/definitions/274.html

Bypassing Web Authentication and Authorization with HTTP Verb Tampering
(Bypassing_VBAAC_with_HTTP_Verb_Tampering.pdf)
[1] https://dl.packetstormsecurity.net/papers/web/Bypassing_VBAAC_with_HTTP_Verb_Tampering.pdf

Change-Id: I98169973410bc1dce779ac1e870256b9a45d2cc8
2018-09-28 12:12:41 -07:00
Zuul
c573ba198f Merge "Imported Translations from Zanata" 2018-09-28 14:44:39 +00:00
Doug Schveninger
9fe7c07e4d Clean up the tempest.conf section of the values.yaml
While running chart internal to AT&T we found some
tempest.conf values that are not mapped to the correct section of the
tempest config.py.  This commmit is to address these changes:

1) tempest.auth.admin_domain_scope should be in
tempest.identity.admin_domain_scope
default is false and existing code is
setting the value to true so it is needed
https://github.com/openstack/tempest/blob/master/tempest/config.py#L109

2) tempest.auth.min_compute_nodes should be in
tempest.compute.min_compute_nodes but it is setting the default value so
this is not needed and I am dropping it
https://github.com/openstack/tempest/blob/14.0.0/tempest/config.py#L231

Also while learning about the chart we found that the admin_domain_scope
configmap-etc was mappinng the wrong data type so we removed the map
and set the admin_domain_scope  to true.

Change-Id: I52f115c3a1afee0fd58ef9422c6353ea1a93e814
2018-09-27 12:44:08 +00:00
Steve Wilkerson
64842660ff Gate: Update tempest deployment script
This updates the Tempest deployment script for the experimental
checks. Executing make pull-images isn't required, as the initial
setup-client step should verify the Tempest chart lints correctly

Change-Id: I6e5ead298737fd34824ffa97d4d9396f5a8173a4
2018-09-27 07:41:54 -05:00
Roman Gorshunov
1e8488d253 Minor: memory allocation mistypes fix
Memory allocation mistypes fix:
"1204Mi" -> "1024Mi"
"124Mi" -> "128Mi"

Change-Id: Ic1abc86f3e9b3ba478645ee2b4e46a8310948540
2018-09-27 12:29:08 +02:00