Merge pull request #615 from stackhpc/upstream/2023.1-2024-09-16

Synchronise 2023.1 with upstream

ansible/library/kolla_toolbox.py

@@ -181,7 +181,9 @@ def main():
                        "ANSIBLE_LOAD_CALLBACK_PLUGINS": "True"}
         job = client.exec_create(kolla_toolbox, command_line,
                                  environment=environment, **kwargs)
-        json_output = client.exec_start(job)
+        json_output, error = client.exec_start(job, demux=True)
+        if error:
+            module.log(msg='Inner module stderr: %s' % error)
 
         try:
             output = json.loads(json_output)

ansible/roles/common/defaults/main.yml

@@ -17,6 +17,7 @@ common_services:
     environment:
       ANSIBLE_NOCOLOR: "1"
       ANSIBLE_LIBRARY: "/usr/share/ansible"
+      REQUESTS_CA_BUNDLE: "{{ openstack_cacert }}"
     privileged: True
     volumes: "{{ kolla_toolbox_default_volumes + kolla_toolbox_extra_volumes }}"
     dimensions: "{{ kolla_toolbox_dimensions }}"

ansible/roles/haproxy-config/tasks/main.yml

@@ -54,8 +54,9 @@
 
 - name: "Configuring firewall for {{ project_name }}"
   firewalld:
-    offline: "yes"
-    permanent: "yes"
+    immediate: true
+    offline: true
+    permanent: true
     port: "{{ item.value.port }}/tcp"
     state: "enabled"
     zone: "{{ external_api_firewalld_zone }}"
@@ -68,5 +69,3 @@
     - enable_external_api_firewalld | bool
     - kolla_action != "config"
   with_dict: "{{ project_services | extract_haproxy_services }}"
-  notify:
-    - "Reload firewalld"

ansible/roles/loadbalancer/handlers/main.yml

@@ -1,10 +1,4 @@
 ---
-- name: Reload firewalld
-  become: True
-  service:
-    name: "firewalld"
-    state: reloaded
-
 # NOTE(yoctozepto): this handler dance is to ensure we delay restarting master
 # keepalived and haproxy which control VIP address until we have working backups.
 # This could be improved by checking if backup keepalived do not report FAULT state.

ansible/roles/swift/tasks/start.yml

@@ -60,6 +60,7 @@
       - "{{ node_config_directory }}/swift-account-server/:{{ container_config_directory }}/:ro"
       - "{{ swift_devices_mount_point }}:{{ swift_devices_mount_point }}:shared"
       - "/etc/localtime:/etc/localtime:ro"
+      - "swift_recon_cache:/var/cache/swift"
   when: inventory_hostname in groups['swift-account-server']
 
 - name: Starting swift-account-auditor container
@@ -138,6 +139,7 @@
       - "{{ node_config_directory }}/swift-container-server/:{{ container_config_directory }}/:ro"
       - "{{ swift_devices_mount_point }}:{{ swift_devices_mount_point }}:shared"
       - "/etc/localtime:/etc/localtime:ro"
+      - "swift_recon_cache:/var/cache/swift"
   when: inventory_hostname in groups['swift-container-server']
 
 - name: Starting swift-container-auditor container

releasenotes/notes/bug-923105-d451a78930973a82.yaml

@@ -0,0 +1,7 @@
+---
+fixes:
+  - |
+    Fixes the Python requests library issue when using custom
+    CA by adding the REQUESTS_CA environment variable to the
+    kolla-toolbox container.
+    See `LP#1967132 <https://launchpad.net/bugs/1967132>`__

releasenotes/notes/firewalld-immediate-c2abf09977c455a9.yaml

@@ -0,0 +1,7 @@
+---
+features:
+  - |
+    Modifies public API firewalld rules to be applied immediately to a running
+    firewalld service. This requires firewalld to be running, but avoids
+    reloading firewalld, which is disruptive due to the way in which firewalld
+    builds its firewall chains.

releasenotes/notes/kolla-toolbox-demux-c5e8d27bc7214069.yaml

@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Fixes parsing of JSON output of inner modules called by ``kolla-toolbox``
+    when data was returned on standard error.
+    `LP#2080544 <https://launchpad.net/bugs/2080544>`__