Pike Series Release Notes

Pike Series Release Notes

16.0.3

New Features

  • The installation of Erlang and is now optimized for CentOS. Erlang 19.x is now installed via a single package that is maintained by RabbitMQ developers and it provides the minimal features required for RabbitMQ to function. It also includes HiPE support for increased performance.

    The version of Erlang is kept constant using yum’s versionlock plugin.

  • RabbitMQ is now installed via an RPM repository provided by RabbitMQ developers. The version is kept constant via yum’s versionlock plugin. This allows the tasks to lock the RabbitMQ version to a particular revision and prevent changes to that version.

Upgrade Notes

  • The ceph-ansible integration has been updated to support the ceph-ansible v3.0 series tags. The new v3.0 series brings a significant refactoring of the ceph-ansible roles and vars, so it is strongly recommended to consult the upstream ceph-ansible documentation to perform any required vars migrations before you upgrade.
  • The ceph-ansible common roles are no longer namespaced with a galaxy-style ‘.’ (ie. ceph.ceph-common is now cloned as ceph-common), due to a change in the way upstream meta dependencies are handled in the ceph roles. The roles will be cloned according to the new naming, and an upgrade playbook ceph-galaxy-removal.yml has been added to clean up the stale galaxy-named roles.

Critical Issues

  • The ceph-ansible integration has been updated to support the ceph-ansible v3.0 series tags. The new v3.0 series brings a significant refactoring of the ceph-ansible roles and vars, so it is strongly recommended to consult the upstream ceph-ansible documentation to perform any required vars migrations before you upgrade.

Bug Fixes

  • The sysstat package was installed on all distributions, but it was only configured to run on Ubuntu and OpenSUSE. It would not run on CentOS due to bad SELinux contexts and file permissions on /etc/cron.d/sysstat. This has been fixed and sysstat now runs properly on CentOS.

16.0.2

Security Issues

  • The net.bridge.bridge-nf-call-* kernel parameters were set to 0 in previous releases to improve performance and it was left up to neutron to adjust these parameters when security groups are applied. This could cause situations where bridge traffic was not sent through iptables and this rendered security groups ineffective. This could allow unexpected ingress and egress traffic within the cloud.

    These kernel parameters are now set to 1 on all hosts by the openstack_hosts role, which ensures that bridge traffic is always sent through iptables.

16.0.1

New Features

  • The Ceph stable release used by openstack-ansible and its ceph-ansible integration has been changed to the recent Ceph LTS Luminous release.

Upgrade Notes

  • The Ceph stable release used by openstack-ansible and its ceph-ansible integration has been changed to the recent Ceph LTS Luminous release.

16.0.0

Prelude

The first release of the Red Hat Enterprise Linux 7 STIG was entirely renumbered from the pre-release versions. Many of the STIG configurations simply changed numbers, but some were removed or changed. A few new configurations were added as well.

New Features

  • CentOS7/RHEL support has been added to the ceph_client role.
  • Only Ceph repos are supported for now.
  • There is now experimental support to deploy OpenStack-Ansible on CentOS 7 for both development and test environments.
  • Simplifies configuration of lbaas-mgmt network.
  • Adds iptables rules to block taffic from the octavia managment network to the octavia container for both ipv4 and ipv6.
  • Experimental support has been added to allow the deployment of the OpenStack Octavia Load Balancing service when hosts are present in the host group octavia-infra_hosts.
  • OpenStack-Ansible now supports the openSUSE Leap 42.X distributions mainly targeting the latest 42.3 release.
  • The os_swift role now supports the swift3 middleware, allowing access to swift via the Amazon S3 API. This feature can enabled by setting swift_swift3_enabled to true.
  • A variable named bootstrap_user_variables_template has been added to the bootstrap-host role so the user can define the user variable template filename for AIO deployments
  • Adds a way for the system to automatically create the Octavia management network if octavia_service_net_setup is enabled (DEFAULT). Additional parameters can control the setup.
  • Adds support for glance-image-id and automatic uploading of the image if octavia_amp_image_upload_enabled is True (Default is False). This is mostly tp work around the limitations of Ansible’s OpenStack support and should not be used in prodcution settings. Instead refer to the documentation to upload images yourself.
  • Deployers can now specify a custom package name or URL for an EPEL release package. CentOS systems use epel-release by default, but some deployers have a customized package that redirects servers to internal mirrors.
  • New variables have been added to allow a deployer to customize a aodh systemd unit file to their liking.
  • The task dropping the aodh systemd unit files now uses the config_template action plugin allowing deployers access to customize the unit files as they see fit without having to load extra options into the defaults and polute the generic systemd unit file with jinja2 variables and conditionals.
  • For the os_aodh role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the aodh_*_init_config_overrides variables which use the config_template task to change template defaults.
  • New variables have been added to allow a deployer to customize a barbican systemd unit file to their liking.
  • The task dropping the barbican systemd unit files now uses the config_template action plugin allowing deployers access to customize the unit files as they see fit without having to load extra options into the defaults and polute the generic systemd unit file with jinja2 variables and conditionals.
  • For the os_barbican role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the barbican_*_init_config_overrides variables which use the config_template task to change template defaults.
  • The number of worker threads for neutron will now be capped at 16 unless a specific value is specified. Previously, the calculated number of workers could get too high on systems with a large number of processors. This was particularly evident on POWER systems.
  • Capping the default value for the variable aodh_wsgi_processes to 16 when the user doesn’t configure this variable. Default value is twice the number of vCPUs available on the machine with a capping value of 16.
  • Capping the default value for the variable cinder_osapi_volume_workers to 16 when the user doesn’t configure this variable. Default value is half the number of vCPUs available on the machine with a capping value of 16.
  • Capping the default value for the variables glance_api_workers and glance_registry_workers to 16 when the user doesn’t configure these variables. Default value is half the number of vCPUs available on the machine with a capping value of 16.
  • Capping the default value for the variable gnocchi_wsgi_processes to 16 when the user doesn’t configure this variable. Default value is twice the number of vCPUs available on the machine with a capping value of 16.
  • Capping the default value for the variables heat_api_workers and heat_engine_workers to 16 when the user doesn’t configure these variables. Default value is half the number of vCPUs available on the machine with a capping value of 16.
  • Capping the default value for the variables horizon_wsgi_processes and horizon_wsgi_threads to 16 when the user doesn’t configure these variables. Default value is half the number of vCPUs available on the machine with a capping value of 16.
  • Capping the default value for the variable ironic_wsgi_processes to 16 when the user doesn’t configure this variable. Default value is one fourth the number of vCPUs available on the machine with a capping value of 16.
  • Capping the default value for the variable keystone_wsgi_processes to 16 when the user doesn’t configure this variable. Default value is half the number of vCPUs available on the machine with a capping value of 16.
  • Capping the default value for the variables neutron_api_workers, neutron_num_sync_threads and neutron_metadata_workers to 16 when the user doesn’t configure these variables. Default value is half the number of vCPUs available on the machine with a capping value of 16.
  • Capping the default value for the variables nova_wsgi_processes, nova_osapi_compute_workers, nova_metadata_workers and nova_conductor_workers to 16 when the user doesn’t configure these variables. Default value is half the number of vCPUs available on the machine with a capping value of 16.
  • Capping the default value for the variable repo_nginx_workers to 16 when the user doesn’t configure this variable. Default value is half the number of vCPUs available on the machine with a capping value of 16.
  • Capping the default value for the variable sahara_api_workers to 16 when the user doesn’t configure this variable. Default value is half the number of vCPUs available on the machine with a capping value of 16.
  • Capping the default value for the variable swift_proxy_server_workers to 16 when the user doesn’t configure this variable and if the swift proxy is in a container. Default value is half the number of vCPUs available on the machine if the swift proxy is not in a container. Default value is half the number of vCPUs available on the machine with a capping value of 16 if the proxy is in a container.
  • New variables have been added to allow a deployer to customize a ceilometer systemd unit file to their liking.
  • The task dropping the ceilometer systemd unit files now uses the config_template action plugin allowing deployers access to customize the unit files as they see fit without having to load extra options into the defaults and pollute the generic systemd unit file with jinja2 variables and conditionals.
  • New variables have been added to allow a deployer to customize a ceilometer systemd unit file to their liking.
  • The task dropping the ceilometer systemd unit files now uses the config_template action plugin allowing deployers access to customize the unit files as they see fit without having to load extra options into the defaults and polute the generic systemd unit file with jinja2 variables and conditionals.
  • For the os_ceilometer role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the ceilometer_*_init_config_overrides variables which use the config_template task to change template defaults.
  • Several configuration files that were not templated for the os_ceilometer role are now retrieved from git. The git repository used can be changed using the ceilometer_git_config_lookup_location variable. By default this points to git.openstack.org. These files can still be changed using the ceilometer_x_overrides variables.
  • Deployers can set pip_install_centos_mirror_url to use their preferred mirror for the RDO repositories.
  • A new variable called ceph_extra_components is available for the ceph_client role. Extra components, packages, and services that are not shipped by default by OpenStack-Ansible can be defined here.
  • Added cinder_auth_strategy variable to configure Cinder’s auth strategy since Cinder can work in noauth mode as well.
  • The os_cinder role now provides for doing online data migrations once the db sync has been completed. The data migrations will not be executed until the boolean variable cinder_all_software_updated is true. This variable will need to be set by the playbook consuming the role.
  • New variables have been added to allow a deployer to customize a cinder systemd unit file to their liking.
  • The task dropping the cinder systemd unit files now uses the config_template action plugin allowing deployers access to customize the unit files as they see fit without having to load extra options into the defaults and polute the generic systemd unit file with jinja2 variables and conditionals.
  • The os-cinder-install.yml playbook will now execute a rolling upgrade of cinder including database migrations (both schema and online) as per the procedure described in the cinder documentation. When haproxy is used as the load balancer, the backend being changed will be drained before changes are made, then added back to the pool once the changes are complete.
  • Add support for the cinder v3 api. This is enabled by default, but can be disabled by setting the cinder_enable_v3_api variable to false.
  • For the os_cinder role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the cinder_*_init_config_overrides variables which use the config_template task to change template defaults.
  • The cinder-api service has moved to run as a uWSGI application. You can set the max number of WSGI processes, the number of processes, threads, and buffer size utilizing the cinder_wsgi_processes_max, cinder_wsgi_processes, cinder_wsgi_threads, and cinder_wsgi_buffer_size. Additionally, you can override any settings in the uWSGI ini configuration file using the cinder_api_uwsgi_ini_overrides setting. The uWSGI application will listen on the address specified by cinder_uwsgi_bind_address which defaults to 0.0.0.0.
  • Tags have been added to all of the common tags with the prefix “common-“. This has been done to allow a deployer to rapidly run any of the common on a need basis without having to rerun an entire playbook.
  • The config_template template module now supports writing out valueless INI options without suffixing them with ‘=’ or ‘:’. This is done via the ‘ignore_none_type’ attribute. If ignore_none_type is set to true, these key/value entries will be ignored, if it’s set to false, then ConfigTemplateParser will write out only the option name without the ‘=’ or ‘:’ suffix. The default is true.
  • The COPR repository for installing LXC on CentOS 7 is now set to a higher priority than the default to ensure that LXC packages always come from the COPR repository.
  • Deployers can provide a customized login banner via a new Ansible variable: security_login_banner_text. This banner text is used for non-graphical logins, which includes console and ssh logins.
  • The os_ceilometer role now includes a facility where you can place your own templates in /etc/openstack_deploy/ceilometer (by default) and it will be deployed to the target host after being interpreted by the template engine. If no file is found there, the fallback of the git sourced template is used.
  • The Designate pools.yaml file can now be generated via the designate_pools_yaml attribute, if desired. This allows users to populate the Designate DNS server configuration using attributes from other plays and obviates the need to manage the file outside of the Designate role.
  • For the os_designate role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the designate_*_init_config_overrides variables which use the config_template task to change template defaults.
  • A new repository for installing modern erlang from ESL (erlang solutions) has been added giving us the ability to install and support modern stable erlang over numerous operating systems.
  • The ability to set the RabbitMQ repo URL for both erlang and RabbitMQ itself has been added. This has been done to allow deployers to define the location of a given repo without having to fully redefine the entire set of definitions for a specific repository. The default variables rabbitmq_gpg_keys, rabbitmq_repo_url, and rabbitmq_erlang_repo_url have been created to facilitate this capability.
  • Extra headers can be added to Keystone responses by adding items to keystone_extra_headers. Example:

    keystone_extra_headers:
      - parameter: "Access-Control-Expose-Headers"
        value: "X-Subject-Token"
      - parameter: "Access-Control-Allow-Headers"
        value: "Content-Type, X-Auth-Token"
      - parameter: "Access-Control-Allow-Origin"
        value: "*"
    
  • Fedora 26 is now supported.
  • The galera_client role will default to using the galera_repo_url URL if the value for it is set. This simplifies using an alternative mirror for the MariaDB server and client as only one variable needs to be set to cover them both.
  • The get_nested filter has been added, allowing for simplified value lookups inside of nested dictionaries. ansible_local|get_nested(‘openstack_ansible.swift’), for example, will look 2 levels down and return the result.
  • New variables have been added to allow a deployer to customize a glance systemd unit file to their liking.
  • The task dropping the glance systemd unit files now uses the config_template action plugin allowing deployers access to customize the unit files as they see fit without having to load extra options into the defaults and polute the generic systemd unit file with jinja2 variables and conditionals.
  • For the os_glance role, the systemd unit RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. This value can be adjusted by using the glance_*_init_config_overrides variables which use the config_template task to change template defaults.
  • The glance-api service has moved to run as a uWSGI application. You can set the max number of WSGI processes, the number of processes, threads, and buffer size utilizing the glance_wsgi_processes_max, glance_wsgi_processes, glance_wsgi_threads, and glance_wsgi_buffer_size. Additionally, you can override any settings in the uWSGI ini configuration file using the glance_api_uwsgi_ini_overrides setting.
  • The os_gnocchi role now includes a facility where you can place your own default api-paste.ini or policy.json file in /etc/openstack_deploy/gnocchi (by default) and it will be deployed to the target host after being interpreted by the template engine.
  • New variables have been added to allow a deployer to customize a gnocchi systemd unit file to their liking.
  • The task dropping the gnocchi systemd unit files now uses the config_template action plugin allowing deployers access to customize the unit files as they see fit without having to load extra options into the defaults and polute the generic systemd unit file with jinja2 variables and conditionals.
  • For the os_gnocchi role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the gnocchi_*_init_config_overrides variables which use the config_template task to change template defaults.
  • Several configuration files that were not templated for the os_gnocchi` role are now retrieved from git. The git repository used can be changed using the ``gnocchi_git_config_lookup_location variable. By default this points to git.openstack.org. These files can still be changed using the gnocchi_x_overrides variables.
  • From now on, a deployer can override any group_var in userspace, by creating a folder /etc/openstack_deploy/group_vars/. This folder has precedence over OpenStack-Ansible default group_vars, and the merge behavior is similar to Ansible merge behavior. The group_vars folder precedence can still be changed with the GROUP_VARS_PATH. Same applies for host vars.
  • The new option haproxy_backend_arguments can be utilized to add arbitrary options to a HAProxy backend like tcp-check or http-check.
  • New variables have been added to allow a deployer to customize a heat systemd unit file to their liking.
  • The task dropping the heat systemd unit files now uses the config_template action plugin allowing deployers access to customize the unit files as they see fit without having to load extra options into the defaults and polute the generic systemd unit file with jinja2 variables and conditionals.
  • For the os_heat role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the heat_*_init_config_overrides variables which use the config_template task to change template defaults.
  • The heat-api, heat-api-cfn, and heat-api-cloudwatch services have moved to run as a uWSGI applications. You can set the max number of WSGI processes, the number of processes, threads, and buffer size utilizing the heat_wsgi_processes_max, heat_wsgi_processes, heat_wsgi_threads, and heat_wsgi_buffer_size. Additionally, you can override any settings in the uWSGI ini configuration file using the heat_api_uwsgi_ini_overrides, heat_api_cfn_uwsgi_ini_overrides, and heat_api_cloudwatch_uwsgi_ini_overrides settings. The uWSGI applications will listen on the addresses specified by heat_api_uwsgi_bind_address, heat_api_cfn_uwsgi_bind_address, and heat_api_cloudwatch_uwsgi_bind_address respectively. Which all default to 0.0.0.0.
  • It’s now possible to disable heat stack password field in horizon. horizon_enable_heatstack_user_pass variable has been added and default to True.
  • The horizon_images_allow_location variable is added to support the IMAGES_ALLOW_LOCATION setting in the horizon_local_settings.py file to allow to specify and external location during the image creation.
  • Allows SSL connection to Galera with SSL support. galera_use_ssl option has to be set to true, in this case self-signed CA cert or user-provided CA cert will be delivered to the container/host.
  • Implements SSL connection ability to MySQL. galera_use_ssl option has to be set to true (default), in this case playbooks create self-signed SSL bundle and sets up MySQL configs to use it or distributes user-provided bundle throughout Galera nodes.
  • Haproxy-server role allows to set up tunable parameters. For doing that it is necessary to set up a dictionary of options in the config files, mentioning those which have to be changed (defaults for the remaining ones are programmed in the template). Also “maxconn” global option made to be tunable.
  • New variables have been added to allow a deployer to customize a ironic systemd unit file to their liking.
  • The task dropping the ironic systemd unit files now uses the config_template action plugin allowing deployers access to customize the unit files as they see fit without having to load extra options into the defaults and polute the generic systemd unit file with jinja2 variables and conditionals.
  • For the os_ironic role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the ironic_*_init_config_overrides variables which use the config_template task to change template defaults.
  • New variables have been added to allow a deployer to customize a keystone systemd unit file to their liking.
  • The task dropping the keystone systemd unit files now uses the config_template action plugin allowing deployers access to customize the unit files as they see fit without having to load extra options into the defaults and polute the generic systemd unit file with jinja2 variables and conditionals.
  • The os_keystone role will now (by default) source the keystone-paste.ini, policy.json and sso_callback_template.html templates from the service git source instead of from the role. It also now includes a facility where you can place your own templates in /etc/openstack_deploy/keystone (by default) and it will be deployed to the target host after being interpreted by the template engine.
  • For the os_keystone role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the keystone_*_init_config_overrides variables which use the config_template task to change template defaults.
  • The default behaviour of ensure_endpoint in the keystone module has changed to update an existing endpoint, if one exists that matches the service name, type, region and interface. This ensures that no duplicate service entries can exist per region.
  • Removed dependency for cinder_backends_rbd_inuse in nova.conf when setting rbd_user and rbd_secret_uuid variables. Cinder delivers all necessary values via RPC when attaching the volume, so those variables are only necessary for ephemeral disks stored in Ceph. These variables are required to be set up on cinder-volume side under backend section.
  • LXC on CentOS is now installed via package from a COPR repository rather than installed from the upstream source.
  • In the lxc_container_create role, the keys preup, postup, predown, and postdown are now supported in the container_networks dict for Ubuntu systems. This allows operators to configure custom scripts to be run by Ubuntu’s ifupdown system when network interface states are changed.
  • The variable lxc_image_cache_server_mirrors has been added to the “lxc_hosts” role. This is a list type variable and gives deployers the ability to specify multiple lxc-image mirrors at the same time.
  • The variable lxc_net_manage_iptables has been added. This variable can be overridden by deployers if system wide iptables rules are already in place or managed by deployers chioce.
  • New variables have been added to allow a deployer to customize a magnum systemd unit file to their liking.
  • The task dropping the magnum systemd unit files now uses the config_template action plugin allowing deployers access to customize the unit files as they see fit without having to load extra options into the defaults and polute the generic systemd unit file with jinja2 variables and conditionals.
  • For the os_magnum role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the magnum_*_init_config_overrides variables which use the config_template task to change template defaults.
  • The repo server file system structure has been updated to allow for multiple Operating systems running multiple architectures to be run at the same time and served from a single server without impacting pools, venvs, wheel archives, and manifests. The new structure follows the following pattern $RELEASE/$OS_TYPE-$ARCH and has been applied to os-releases, venvs, and pools.
  • The dragonflow plugin for neutron is now available. You can set the neutron_plugin_type to ml2.dragonflow to utilize this code path. The dragonflow code path is currently experimental.
  • New variables have been added to allow a deployer to customize a neutron systemd unit file to their liking.
  • The task dropping the neutron systemd unit files now uses the config_template action plugin allowing deployers access to customize the unit files as they see fit without having to load extra options into the defaults and polute the generic systemd unit file with jinja2 variables and conditionals.
  • The os-neutron-install.yml playbook will now execute a rolling upgrade of neutron including database migrations (both expand and contract) as per the procedure described in the neutron documentation.
  • For the os_neutron role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the neutron_*_init_config_overrides variables which use the config_template task to change template defaults.
  • The os_nova role now provides for doing online data migrations once the db sync has been completed. The data migrations will not be executed until the boolean variable nova_all_software_updated is true. This variable will need to be set by the playbook consuming the role.
  • New variables have been added to allow a deployer to customize a nova systemd unit file to their liking.
  • The task dropping the nova systemd unit files now uses the config_template action plugin allowing deployers access to customize the unit files as they see fit without having to load extra options into the defaults and polute the generic systemd unit file with jinja2 variables and conditionals.
  • The nova-placement service is now configured by default. nova_placement_service_enabled can be set to False to disable the nova-placement service.
  • The nova-placement api service will run as its own ansible group nova_api_placement.
  • Nova cell_v2 support has been added. The default cell is cell1 which can be overridden by the nova_cell1_name. Support for multiple cells is not yet available.
  • The os-nova-install.yml playbook will now execute a rolling upgrade of nova including database migrations as per the procedure described in the nova documentation.
  • Nova may now use an encrypted database connection. This is enabled by setting nova_galera_use_ssl to True.
  • For the os_nova role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the nova_*_init_config_overrides variables which use the config_template task to change template defaults.
  • The nova-api, and nova-metadata services have moved to run as uWSGI applications. You can override their uwsgi configuration files using the nova_api_os_compute_uwsgi_ini_overrides, and nova_api_metadata_uwsgi_ini_overrides settings.
  • New variables have been added to allow a deployer to customize a octavia systemd unit file to their liking.
  • The task dropping the octavia systemd unit files now uses the config_template action plugin allowing deployers access to customize the unit files as they see fit without having to load extra options into the defaults and polute the generic systemd unit file with jinja2 variables and conditionals.
  • For the os_octavia role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the octavia_*_init_overrides variables which use the config_template task to change template defaults.
  • The octavia-api service has moved to run as a uWSGI application. You can set the max number of WSGI processes, the number of processes, threads, and buffer size utilizing the octavia_wsgi_processes_max, octavia_wsgi_processes, octavia_wsgi_threads, and octavia_wsgi_buffer_size. Additionally, you can override any settings in the uWSGI ini configuration file using the octavia_api_uwsgi_ini_overrides setting. The uWSGI application will listen on the address specified by octavia_uwsgi_bind_address which defaults to 0.0.0.0.
  • Deployers may provide a list of custom haproxy template files to copy from the deployment host through the octavia_user_haproxy_templates variable and configure Octavia to make use of a custom haproxy template file with with octavia_haproxy_amphora_template variable.
  • The password minimum and maximum lifetimes are now opt-in changes that can take action against user accounts instead of printing debug warnings. Refer to the documentation for STIG requirements V-71927 and V-71931 to review the opt-in process and warnings.
  • Added the lxc_container_recreate option, which will destroy then recreate LXC containers. The container names and IP addresses will remain the same, as will the MAC addresses of any containers using the lxc_container_fixed_mac setting.
  • Gnocchi is now used as the default publisher.
  • In the Ocata release, Trove added support for encrypting the rpc communication between the guest DBaaS instances and the control plane. The default values for trove_taskmanager_rpc_encr_key and trove_inst_rpc_key_encr_key should be overridden to specify installation specific values.
  • Added storage policy so that deployers can override how to store the logs. per_host stores logs in a sub-directory per host. per_program stores logs in a single file per application which facilitates troubleshooting easy.
  • New variables have been added to allow a deployer to customize a sahara systemd unit file to their liking.
  • The task dropping the sahara systemd unit files now uses the config_template action plugin allowing deployers access to customize the unit files as they see fit without having to load extra options into the defaults and polute the generic systemd unit file with jinja2 variables and conditionals.
  • For the os_sahara role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the sahara_*_init_config_overrides variables which use the config_template task to change template defaults.
  • The sahara-api service has moved to run as a uWSGI application. You can set the max number of WSGI processes, the number of processes, threads, and buffer size utilizing the sahara_wsgi_processes_max, sahara_wsgi_processes, sahara_wsgi_threads, and sahara_wsgi_buffer_size. Additionally, you can override any settings in the uWSGI ini configuration file using the sahara_api_uwsgi_ini_overrides setting. The uWSGI application will listen on the address specified by sahara_uwsgi_bind_address which defaults to 0.0.0.0.
  • MAC addresses for containers with a fixed MAC (lxc_container_fixed_mac variable) are now saved to the /etc/ansible/facts.d/mac.fact file. Should such a container be destroyed but not removed from inventory, the interfaces will be recreated with the same MAC address when the container is recreated.
  • You can set the endpoint_type used when creating the Trove service network by specifying the trove_service_net_endpoint_type variable. This will default to internal. Other possible options are public and admin.
  • The ability to disable the certificate validation when checking and interacting with the internal cinder endpoint has been implemented. In order to do so, set the following in /etc/openstack_deploy/user_variables.yml.

    cinder_service_internaluri_insecure: yes
    
  • The role now supports SUSE based distributions. Required packages can now be installed using the zypper package manager.
  • The role now supports SUSE based distributions. Required packages can now be installed using the zypper package manager.
  • New variables have been added to allow a deployer to customize a swift systemd unit file to their liking.
  • The task dropping the swift systemd unit files now uses the config_template action plugin allowing deployers access to customize the unit files as they see fit without having to load extra options into the defaults and polute the generic systemd unit file with jinja2 variables and conditionals.
  • For the os_swift role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the swift_*_init_config_overrides variables which use the config_template task to change template defaults.
  • Swift container-sync has been updated to use internal-client. This means a new configuration file internal-client.conf has been added. Configuration can be overridden using the variable swift_internal_client_conf_overrides.
  • New variables have been added to allow a deployer to customize a trove systemd unit file to their liking.
  • The task dropping the trove systemd unit files now uses the config_template action plugin allowing deployers access to customize the unit files as they see fit without having to load extra options into the defaults and polute the generic systemd unit file with jinja2 variables and conditionals.
  • For the os_trove role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the trove_*_init_config_overrides variables which use the config_template task to change template defaults.
  • Add support for Ubuntu on IBM z Systems (s390x).
  • Add support for Ubuntu on IBM z Systems (s390x).
  • The default ulimit for RabbitMQ is now 65536. Deployers can still adjust this limit using the rabbitmq_ulimit Ansible variable.
  • Added new variable tempest_volume_backend_names and updated templates/tempest.conf.j2 to point backend_names at this variable
  • You can force update the translations direct from Zanata by setting horizon_translations_update to True. This will call the pull_catalog option built into horizon-manage.py. You should only use this when testing translations, otherwise this should remain set to the default of False.
  • The deployer can now define an environment variable GROUP_VARS_PATH with the folders of its choice (separated by the colon sign) to define an user space group_vars folder. These vars will apply but be (currently) overriden by the OpenStack-Ansible default group vars, by the set facts, and by the user_* variables. If the deployer defines multiple paths, the variables found are merged, and precedence is increasing from left to right (the last defined in GROUP_VARS_PATH wins)
  • The deployer can now define an environment variable HOST_VARS_PATH with the folders of its choice (separated by the colon sign) to define an user space host_vars folder. These vars will apply but be (currently) overriden by the OpenStack-Ansible default host vars, by the set facts, and by the user_* variables. If the deployer defines multiple paths, the variables found are merged, and precedence is increasing from left to right (the last defined in HOST_VARS_PATH wins)

Known Issues

  • Ceph storage backend is known not to work on openSUSE Leap 42.X yet. This is due to missing openSUSE support in the upstream Ceph Ansible playbooks.
  • There is currently an Ansible bug in regards to HOSTNAME. If the host .bashrc holds a var named HOSTNAME, the container where the lxc_container module attaches will inherit this var and potentially set the wrong $HOSTNAME. See the Ansible fix which will be released in Ansible version 2.3.
  • OpenStack-Ansible sets a new variable, galera_disable_privatedevices, that controls whether the PrivateDevices configuration in MariaDB’s systemd unit file is enabled.

    If the galera_server role is deployed on a bare metal host, the MariaDB default is maintained (PrivateDevices=true). If the galera_server role is deployed within a container, the PrivateDevices configuration is set to true to work around a systemd bug with a bind mounted /dev/ptmx.

    See Launchpad Bug 1697531 for more details.

  • OpenStack-Ansible sets a new variable, memcached_disable_privatedevices, that controls whether the PrivateDevices configuration in MemcacheD’s systemd unit file is enabled.

    If the memcached_server role is deployed on a bare metal host, the default is maintained (PrivateDevices=true). If the role is deployed within a container, the PrivateDevices configuration is set to true to work around a systemd bug with a bind mounted /dev/ptmx.

    See Launchpad Bug 1697531 for more details.

  • MemcacheD sets PrivateDevices=true in its systemd unit file to add extra security around mount namespaces. While this is useful when running MemcacheD on a bare metal host with other services, it is less useful when MemcacheD is already in a container with its own namespaces. In addition, LXC 2.0.8 presents /dev/ptmx as a bind mount within the container and systemd 219 (on CentOS 7) cannot make an additional bind mount of /dev/ptmx when PrivateDevices is enabled.

    Deployers can memcached_disable_privatedevices to yes to set PrivateDevices=false in the systemd unit file for MariaDB on CentOS 7. The default is no, which keeps the default systemd unit file settings from the MemcacheD package.

    For additional information, refer to the following bugs:

  • MariaDB 10.1+ includes PrivateDevices=true in its systemd unit files to add extra security around mount namespaces for MariaDB. While this is useful when running MariaDB on a bare metal host with other services, it is less useful when MariaDB is already in a container with its own namespaces. In addition, LXC 2.0.8 presents /dev/ptmx as a bind mount within the container and systemd 219 (on CentOS 7) cannot make an additional bind mount of /dev/ptmx when PrivateDevices is enabled.

    Deployers can galera_disable_privatedevices to yes to set PrivateDevices=false in the systemd unit file for MariaDB on CentOS 7. The default is no, which keeps the default systemd unit file settings from the MariaDB package.

    For additional information, refer to the following bugs:

Upgrade Notes

  • For the os_aodh role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the aodh_*_init_config_overrides variables which use the config_template task to change template defaults.
  • For the os_barbican role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the barbican_*_init_config_overrides variables which use the config_template task to change template defaults.
  • For the os_ceilometer role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the ceilometer_*_init_config_overrides variables which use the config_template task to change template defaults.
  • The variables cinder_sigkill_timeout and cinder_restart_wait have been removed. The previous default values have now been set in the template directly and can be adjusted by using the cinder_*_init_overrides variables which use the config_template task to change template defaults.
  • The EPEL repository is only installed and configured when the deployer sets security_enable_virus_scanner to yes. This allows the ClamAV packages to be installed. If security_enable_virus_scanner is set to no (the default), the EPEL repository will not be added.

    See Bug 1702167 for more details.

  • Deployers now have the option to prevent the EPEL repository from being installed by the role. Setting security_epel_install_repository to no prevents EPEL from being installed. This setting may prevent certain packages from installing, such as ClamAV.
  • The following variables have been removed from the os_ceilometer role as their respective upstream files are no longer present. * ceilometer_event_definitions_yaml_overrides * ceilometer_event_pipeline_yaml_overrides
  • The Designate pools.yaml file can now be generated via the designate_pools_yaml attribute, if desired. This ability is toggled by the designate_use_pools_yaml_attr attribute. In the future this behavior may become default and designate_pools_yaml may become a required variable.
  • For the os_designate role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the designate_*_init_config_overrides variables which use the config_template task to change template defaults.
  • The endpoint which designate uses to communicate with neutron has been set to the internalURL by default. This change has been done within the template designate.conf.j2 and can be changed using the designate_designate_conf_overrides variable.
  • Changing to the ESL repos has no upgrade impact. The version of erlang provided by ESL is newer than that what is found in the distro repos. Furthermore, a pin has been added to ensure that APT always uses the ESL repos as it’s preferred source which has been done to simply ensure APT is always pointed at ESL.
  • For the os_glance role, the systemd unit RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. This value can be adjusted by using the glance_*_init_config_overrides variables which use the config_template task to change template defaults.
  • For the os_gnocchi role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the gnocchi_*_init_config_overrides variables which use the config_template task to change template defaults.
  • For the os_heat role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the heat_*_init_config_overrides variables which use the config_template task to change template defaults.
  • The entire repo build process is now idempotent. From now on when the repo build is re-run, it will only fetch updated git repositories and rebuild the wheels/venvs if the requirements have changed, or a new release is being deployed.
  • The git clone part of the repo build process now only happens when the requirements change. A git reclone can be forced by using the boolean variable repo_build_git_reclone.
  • The python wheel build process now only happens when requirements change. A wheel rebuild may be forced by using the boolean variable repo_build_wheel_rebuild.
  • The python venv build process now only happens when requirements change. A venv rebuild may be forced by using the boolean variable repo_build_venv_rebuild.
  • The repo build process now only has the following tags, providing a clear path for each deliverable. The tag repo-build-install completes the installation of required packages. The tag repo-build-wheels completes the wheel build process. The tag repo-build-venvs completes the venv build process. Finally, the tag repo-build-index completes the manifest preparation and indexing of the os-releases and links folders.
  • The haproxy_bufsize variable has been removed and made a part of the haproxy_tuning_params dictionary.
  • For the os_ironic role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the ironic_*_init_config_overrides variables which use the config_template task to change template defaults.
  • If you had your own keepalived configuration file, please rename and move it to the openstack-ansible user space, for example by moving it to `/etc/openstack_deploy/keepalived/keepalived.yml`. Our haproxy playbook does not load an external variable files anymore. The keepalived variable override system has been standardised to the same method used elsewhere.
  • The keystone endpoints now have versionless URLs. Any existing endpoints will be updated.
  • Keystone now uses uWSGI exclusively (instead of Apache with mod_wsgi) and has the web server acting as a reverse proxy. The default web server is now set to Nginx instead of Apache, but Apache will automatically used if federation is configured.
  • For the os_keystone role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the keystone_*_init_config_overrides variables which use the config_template task to change template defaults.
  • The var lxc_container_ssh_delay along with SSH specific ping checks have been removed in favor of using Ansible’s wait_for_connection module, which will not rely on SSH to the container to verify connectivity. A new variable called lxc_container_wait_params has been added to allow configuration of the parameters passed to the wait_for_connection module.
  • The magnum client interaction will now make use of the public endpoints by default. Previously this was set to use internal endpoints.
  • The keystone endpoints for instances spawned by magnum will now be provided with the public endpoints by default. Previously this was set to use internal endpoints.
  • For the os_magnum role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the magnum_*_init_config_overrides variables which use the config_template task to change template defaults.
  • For the os_neutron role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the neutron_*_init_config_overrides variables which use the config_template task to change template defaults.
  • For the os_nova role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the nova_*_init_config_overrides variables which use the config_template task to change template defaults.
  • When upgrading nova the cinder catalog_info will change to use the cinderv3 endpoint. Ensure that you have upgraded cinder so that the cinderv3 endpoint exists in the keystone catalog.
  • The nova-placement service now runs as a uWSGI application that is not fronted by an nginx web-server by default. After upgrading, if the nova-placement service was running on a host or container without any other services requiring nginx, you should manually remove nginx.
  • For the os_octavia role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the octavia_*_init_overrides variables which use the config_template task to change template defaults.
  • The variable neutron_dhcp_domain has been renamed to neutron_dns_domain.
  • The neutron library has been removed from OpenStack-Ansible’s plugins. Upstream Ansible modules for managing OpenStack network resources should be used instead.
  • The ceilometer-api service/container can be removed as part of O->P upgrades. A ceilometer-central container will be created to contain the central ceilometer agents.
  • The following variables have been removed from the haproxy_server role as they are no longer necessary or used. - haproxy_repo - haproxy_gpg_keys - haproxy_required_distro_packages
  • The EPEL repository is now removed in favor of the RDO repository.

    This is a breaking change for existing CentOS deployments. The yum package manager will have errors when it finds that certain packages that it installed from EPEL are no longer available. Deployers may need to rebuild container or reinstall packages to complete this change.

  • For the os_sahara role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the sahara_*_init_config_overrides variables which use the config_template task to change template defaults.
  • For the os_swift role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the swift_*_init_config_overrides variables which use the config_template task to change template defaults.
  • The openstack_tempest_gate.sh script has been removed as it requires the use of the run_tempest.sh script which has been deprecated in Tempest. In order to facilitate the switch, the default for the variable tempest_run has been set to yes, forcing the role to execute tempest by default. This default can be changed by overriding the value to no. The test whitelist may be set through the list variable tempest_test_whitelist.
  • For the os_trove role, the systemd unit TimeoutSec value which controls the time between sending a SIGTERM signal and a SIGKILL signal when stopping or restarting the service has been reduced from 300 seconds to 120 seconds. This provides 2 minutes for long-lived sessions to drain while preventing new ones from starting before a restart or a stop. The RestartSec value which controls the time between the service stop and start when restarting has been reduced from 150 seconds to 2 seconds to make the restart happen faster. These values can be adjusted by using the trove_*_init_config_overrides variables which use the config_template task to change template defaults.
  • Gnocchi service endpoint variables were not named correctly. Renamed variables to be consistent with other roles.

Deprecation Notes

  • The cinder_keystone_auth_plugin variable has been deprecated. cinder_keystone_auth_type should be used instead to configure authentication type.
  • The neutron_keystone_auth_plugin variable has been deprecated. neutron_keystone_auth_type should be used instead to configure authentication type.
  • The swift_keystone_auth_plugin variable has been deprecated. swift_keystone_auth_type should be used instead to configure authentication type.
  • The trove_keystone_auth_plugin variable has been deprecated. trove_keystone_auth_type should be used instead to configure authentication type.
  • The aodh_keystone_auth_plugin variable has been deprecated. aodh_keystone_auth_type should be used instead to configure authentication type.
  • The ceilometer_keystone_auth_plugin variable has been deprecated. ceilometer_keystone_auth_type should be used instead to configure authentication type.
  • The gnocchi_keystone_auth_plugin variable has been deprecated. gnocchi_keystone_auth_type should be used instead to configure authentication type.
  • The octavia_keystone_auth_plugin variable has been deprecated. octavia_keystone_auth_type should be used instead to configure authentication type.
  • Fedora 25 support is deprecated and no longer tested on each commit.
  • The variables galera_client_apt_repo_url and galera_client_yum_repo_url are deprecated in favour of the common variable galera_client_repo_url.
  • The variable keepalived_uca_enable is deprecated, and replaced by keepalived_ubuntu_src. The keepalived_uca_enable variable will be removed in future versions of the keepalived role. The value of keepalived_ubuntu_src should be either “uca”, “ppa”, or “native”, for respectively installing from the Ubuntu Cloud archive, from keepalived stable ppa, or not installing from an external source.
  • The variable keepalived_use_latest_stable is deprecated, and replaced by keepalived_package_state. The keepalived_use_latest_stable variable will be removed in future versions of the keepalived role. The value of keepalived_package_state should be either “latest” or “present”.
  • The variables keystone_apache_enabled and keystone_mod_wsgi_enabled have been removed and replaced with a single variable keystone_web_server to optionally set the web server used for keystone.
  • The update state for the ensure_endpoint method of the keystone module is now deprecated, and will be removed in the Queens cycle. Setting state to present will achieve the same result.
  • The var lxc_container_ssh_delay along with SSH specific ping checks have been removed in favor of using Ansible’s wait_for_connection module, which will not rely on SSH to the container.
  • The variable lxc_image_cache_server has been deprecated in the “lxc_hosts” role. By default this value will pull the first item out of lxc_image_cache_server_mirrors list which is only done for compatibility (legacy) purposes. The default string type variable, lxc_image_cache_server, will be removed from the “lxc_hosts” role in the in “R” release.
  • The gnocchi ceph component has been moved out as a default component required by the ceph_client role. It can now be optionally specified through the use of the ceph_extra_components variable.
  • Several nova.conf options that were deprecated have been removed from the os_nova role. The following OpenStack-Ansible variables are no longer used and should be removed from any variable override files. * nova_dhcp_domain * nova_quota_fixed_ips * nova_quota_floating_ips * nova_quota_security_group_rules * nova_quota_security_groups
  • Settings related to nginx and the placement will no longer serve any purpose, and should be removed. Those settings are as follows - nova_placement_nginx_access_log_format_extras, nova_placement_nginx_access_log_format_combined, nova_placement_nginx_extra_conf, nova_placement_uwsgi_socket_port, and nova_placement_pip_packages.
  • The variable repo_build_pip_extra_index has been removed. The replacement list variable repo_build_pip_extra_indexes should be used instead.
  • The ceilometer API service is now deprecated. OpenStack-Ansible no longer deploys this service. To make queries against metrics, alarms, and/or events, please use the the gnocchi, aodh, and panko APIs, respectively.
  • The upstream noVNC developers recommend that the keymap be automatically detected for virtual machine consoles. Three Ansible variables have been removed:

    • nova_console_keymap
    • nova_novncproxy_vnc_keymap
    • nova_spice_console_keymap

    Deployers can still set a specific keymap using a nova configuration override if necessary.

  • The plumgrid network provider has been removed. This is being dropped without a full deprecation cycle because the company, plumgrid, no longer exists.
  • Remove cinder_glance_api_version option due to deprecation of glance_api_version option in Cinder.
  • Remove cinder_glance_api_version option due to deprecation of glance_api_version option in Cinder.
  • The nova_cpu_mode Ansible variable has been removed by default, to allow Nova to detect the default value automatically. Hard-coded values can cause problems. You can still set nova_cpu_mode to enforce a cpu_mode for Nova. Additionally, the default value for the qemu libvirt_type is set to none to avoid issues caused with qemu 2.6.0.
  • Remove heat_rpc_backend option due to deprecation of rpc_backend option in oslo.messaging.
  • Remove octavia_rpc_backend option due to deprecation of rpc_backend option in oslo.messaging.
  • Remove keystone_rpc_backend option due to deprecation of rpc_backend option in oslo.messaging.
  • Remove cinder_rpc_backend option due to deprecation of rpc_backend option in oslo.messaging.
  • Remove trove_rpc_backend option due to deprecation of rpc_backend option in oslo.messaging.
  • Remove neutron_rpc_backend option due to deprecation of rpc_backend option in oslo.messaging.
  • Remove sahara_rpc_backend option due to deprecation of rpc_backend option in oslo.messaging.
  • Remove magnum_rpc_backend option due to deprecation of rpc_backend option in oslo.messaging.
  • Remove glance_rpc_backend option due to deprecation of rpc_backend option in oslo.messaging.
  • Remove designate_rpc_backend option due to deprecation of rpc_backend option in oslo.messaging.
  • Removed tempest_volume_backend1_name and tempest_volume_backend1_name since backend1_name and backend2_name were removed from tempest in commit 27905cc (merged 26/04/2016)

Critical Issues

  • A bug that caused the Keystone credential keys to be lost when the playbook is run during a rebuild of the first Keystone container has been fixed. Please see launchpad bug 1667960 for more details.

Security Issues

  • The security role will no longer fix file permissions and ownership based on the contents of the RPM database by default. Deployers can opt in for these changes by setting security_reset_perm_ownership to yes.
  • The magnum client interaction will now make use of the public endpoints by default. Previously this was set to use internal endpoints.
  • The keystone endpoints for instances spawned by magnum will now be provided with the public endpoints by default. Previously this was set to use internal endpoints.
  • Nova may now use an encrypted database connection. This is enabled by setting nova_galera_use_ssl to True.
  • The tasks that search for .shosts and shosts.equiv files (STIG ID: RHEL-07-040330) are now skipped by default. The search takes a long time to complete on systems with lots of files and it also causes a significant amount of disk I/O while it runs.
  • PermitRootLogin in the ssh configuration has changed from yes to without-password. This will only allow ssh to be used to authenticate root via a key.
  • The latest version of the RHEL 7 STIG requires that a standard login banner is presented to users when they log into the system (V-71863). The security role now deploys a login banner that is used for console and ssh sessions.
  • The cn_map permissions and ownership adjustments included as part of RHEL-07-040070 and RHEL-07-040080 has been removed. This STIG configuration was removed in the most recent release of the RHEL 7 STIG.
  • The PKI-based authentication checks for RHEL-07-040030, RHEL-07-040040, and RHEL-07-040050 are no longer included in the RHEL 7 STIG. The tasks and documentation for these outdated configurations are removed.

Bug Fixes

  • In Ubuntu the dnsmasq package actually includes init scripts and service configuration which conflict with LXC and are best not included. The actual dependent package is dnsmasq-base. The package list has been adjusted and a task added to remove the dnsmasq package and purge the related configuration files from all LXC hosts.
  • Mysql cnf files can now be properly overridden. The config_template module has been extended to support valueless options, such as those that are found in the my.cnf file(i.e. quick under the mysqldump section). To use valueless options, use the ignore_none_type attribute of the config_template module.
  • Metal hosts were being inserted into the lxc_hosts group, even if they had no containers (Bug 1660996). This is now corrected for newly configured hosts. In addition, any hosts that did not belong in lxc_hosts will be removed on the next inventory run or playbook call.
  • The openstack service uri protocol variables were not being used to set the Trove specific uris. This resulted in ‘http’ always being used for the public, admin and internal uris even when ‘https’ was intended.
  • The sysctl configuration task was not skipping configurations where enabled was set to no. Instead, it was removing configurations when enabled: no was set.

    There is now a fix in place that ensures any sysctl configuration with enabled: no will be skipped and the configuration will be left unaltered on the system.

Other Notes

  • openSUSE Leap 42.X support is still work in progress and not fully tested besides basic coverange in the OpenStack CI and individual manual testing. Even though backporting fixes to the Pike release will be done on best effort basis, it’s advised to use the master branch when working on openSUSE hosts.
  • The inventory generation code has been switched to use standard Python packaging tools. For most, this should not be a visible change. However, running the dynamic inventory script on a local development environment should now be called via python dynamic_inventory.py.
  • From now on, external repo management (in use for RDO/UCA for example) will be done inside the pip-install role, not in the repo_build role.
Creative Commons Attribution 3.0 License

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.