# resource_properties_data

created_at: 2026-01-27 08:25:08.046300
data:
  {"type": "json", "value": {"ContainerOctaviaApiImage": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1", "ContainerOctaviaConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1"}}


created_at: 2026-01-27 08:25:08.241467
data:
  {"type": "json", "value": {"ContainerOctaviaWorkerImage": "registry.redhat.io/rhosp-rhel9/openstack-octavia-worker:17.1", "ContainerOctaviaConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1"}}


created_at: 2026-01-27 08:25:14.144677
data:
  {"tuple:('role_data', 'step_config')": "include tripleo::profile::base::database::mysql::client", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-59-p5kosh6m26vz-MySQLClient-c4pgwyfdsae6/2f4164f6-d048-47ef-aaf8-93a149f388d9"}


created_at: 2026-01-27 08:25:14.209684
data:
  {"tuple:('role_data', 'config_settings')": {"octavia::logging::debug": true, "octavia::purge_config": false, "octavia::notification_driver": ["messagingv2"], "octavia::db::database_connection": "mysql+pymysql://octavia:9L5MLYf8jSxgOBZhJVNqF7RoH@172.17.0.2/octavia?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "octavia::service_auth::auth_url": "http://172.17.0.2:5000/v3", "octavia::service_auth::auth_type": "password", "octavia::service_auth::username": "octavia", "octavia::service_auth::password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "octavia::service_auth::project_name": "service", "octavia::service_auth::project_domain_name": "Default", "octavia::service_auth::user_domain_name": "Default", "octavia::service_auth::region_name": "regionOne", "octavia::nova::endpoint_type": "internalURL", "octavia::neutron::endpoint_type": "internalURL", "octavia::glance::endpoint_type": "internalURL", "octavia::cinder::endpoint_type": "internalURL", "octavia::certificates::endpoint_type": "internalURL", "octavia::certificates::ca_certificate": "/etc/octavia/certs/ca_01.pem", "octavia::certificates::ca_private_key": "/etc/octavia/certs/private/cakey.pem", "octavia::certificates::client_cert": "/etc/octavia/certs/client.pem", "octavia::certificates::server_certs_key_passphrase": "MImlNSPGC7DYHSSZMapBACiP79svIAmm", "octavia::certificates::ca_private_key_passphrase": "CpqTe0gLs68jBEgpNZd1ehsv4", "octavia::worker::manage_nova_flavor": false, "octavia::controller::amp_boot_network_list": [], "octavia::controller::amp_flavor_id": "65", "octavia::controller::amp_image_tag": "amphora-image", "octavia::controller::amp_ssh_key_name": "octavia-ssh-key", "octavia::controller::enable_ssh_access": true, "octavia::controller::timeout_client_data": 50000, "octavia::controller::timeout_member_connect": 5000, "octavia::controller::timeout_member_data": 50000, "octavia::controller::timeout_tcp_inspect": 0, "octavia::controller::connection_max_retries": 120, "octavia::controller::connection_logging": true, "octavia::controller::build_active_retries": 120, "octavia::controller::port_detach_timeout": 300, "octavia::controller::administrative_log_facility": 1, "octavia::controller::forward_all_logs": true, "octavia::controller::user_log_facility": 0, "octavia::controller::disable_local_log_storage": false, "octavia::nova::enable_anti_affinity": true, "octavia::rabbit_heartbeat_in_pthread": false}, "tuple:('role_data', 'upgrade_tasks')": [{"name": "make sure that post-deploy.conf exists before restarting containers on update or upgrade", "when": "step|int == 5", "block": [{"name": "check for octavia post-deploy.conf file", "stat": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf"}, "register": "octavia_post_deploy_stat"}, {"name": "create an empty post-deploy.conf file if it does not exist", "file": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf", "state": "touch", "setype": "container_file_t", "mode": "0755"}, "when": ["octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists"]}]}, {"name": "pre-check to ensure redis is removed if the service is disabled", "when": ["step|int == 0", "\"redis\" not in enabled_services|list", "\"pacemaker\" in enabled_services|list"], "become": true, "shell": "export CIB_file=/var/lib/pacemaker/cib/cib.xml\nif crm_resource -r redis-bundle -q &>/dev/null; then\n  echo \"Redis resource present in pacemaker but disabled by default in TripleO\" >&2\n  echo \"Delete the resource in pacemaker or enable the redis service before upgrading\" >&2\n  exit 1\nfi"}], "tuple:('role_data', 'update_tasks')": [{"name": "make sure that post-deploy.conf exists before restarting containers on update or upgrade", "when": "step|int == 5", "block": [{"name": "check for octavia post-deploy.conf file", "stat": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf"}, "register": "octavia_post_deploy_stat"}, {"name": "create an empty post-deploy.conf file if it does not exist", "file": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf", "state": "touch", "setype": "container_file_t", "mode": "0755"}, "when": ["octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists"]}]}], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-59-p5kosh6m26vz-OctaviaBase-vzfxipoaoc4q/a4a283c9-dc31-413e-b7e6-1de4197e9250"}


created_at: 2026-01-27 08:25:14.257415
data:
  {"tuple:('role_data', 'kolla_config_files')": [], "tuple:('role_data', 'step_config')": "include tripleo::profile::base::octavia::provider::ovn", "tuple:('role_data', 'puppet_tags')": "octavia_ovn_provider_config", "tuple:('role_data', 'deploy_steps_tasks')": null, "tuple:('role_data', 'config_settings')": {"octavia::driver_agent::enabled_provider_agents": "ovn", "tripleo::profile::base::octavia::provider::ovn::protocol": "tcp"}, "tuple:('role_data', 'metadata_settings')": null, "tuple:('role_data', 'kolla_permissions')": [], "tuple:('role_data', 'volumes')": [], "tuple:('role_data', 'provider_driver_labels')": ["ovn: Octavia OVN driver."], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-59-p5kosh6m26vz-OctaviaProviderConfig-jo6zjxjdcsid/97392b95-2dca-4540-b416-c3e96179fcee"}


created_at: 2026-01-27 08:25:14.309332
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-59-p5kosh6m26vz-ContainersCommon-pki42rpenzbi/27a1c0d8-12da-41ef-9044-3042db0d1548"}


created_at: 2026-01-27 08:25:14.410333
data:
  {"tuple:('role_data', 'step_config')": "include tripleo::profile::base::database::mysql::client", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-59-p5kosh6m26vz-OctaviaWorker-skgctzviaxov-MySQLClient-gs77iodvdukp/a3f57ca0-565f-461e-bd34-820f1feed1ae"}


created_at: 2026-01-27 08:25:14.459398
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "healthcheck_rpc_port": {"test": "/openstack/healthcheck 5672"}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-59-p5kosh6m26vz-OctaviaWorker-skgctzviaxov-ContainersCommon-7oe276q2qilu/60e6456a-0681-4877-8403-97cbd8e598b0"}


created_at: 2026-01-27 08:25:14.517319
data:
  {"tuple:('role_data', 'config_settings')": {"octavia::logging::debug": true, "octavia::purge_config": false, "octavia::notification_driver": ["messagingv2"], "octavia::db::database_connection": "mysql+pymysql://octavia:9L5MLYf8jSxgOBZhJVNqF7RoH@172.17.0.2/octavia?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "octavia::service_auth::auth_url": "http://172.17.0.2:5000/v3", "octavia::service_auth::auth_type": "password", "octavia::service_auth::username": "octavia", "octavia::service_auth::password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "octavia::service_auth::project_name": "service", "octavia::service_auth::project_domain_name": "Default", "octavia::service_auth::user_domain_name": "Default", "octavia::service_auth::region_name": "regionOne", "octavia::nova::endpoint_type": "internalURL", "octavia::neutron::endpoint_type": "internalURL", "octavia::glance::endpoint_type": "internalURL", "octavia::cinder::endpoint_type": "internalURL", "octavia::certificates::endpoint_type": "internalURL", "octavia::certificates::ca_certificate": "/etc/octavia/certs/ca_01.pem", "octavia::certificates::ca_private_key": "/etc/octavia/certs/private/cakey.pem", "octavia::certificates::client_cert": "/etc/octavia/certs/client.pem", "octavia::certificates::server_certs_key_passphrase": "MImlNSPGC7DYHSSZMapBACiP79svIAmm", "octavia::certificates::ca_private_key_passphrase": "CpqTe0gLs68jBEgpNZd1ehsv4", "octavia::worker::manage_nova_flavor": false, "octavia::controller::amp_boot_network_list": [], "octavia::controller::amp_flavor_id": "65", "octavia::controller::amp_image_tag": "amphora-image", "octavia::controller::amp_ssh_key_name": "octavia-ssh-key", "octavia::controller::enable_ssh_access": true, "octavia::controller::timeout_client_data": 50000, "octavia::controller::timeout_member_connect": 5000, "octavia::controller::timeout_member_data": 50000, "octavia::controller::timeout_tcp_inspect": 0, "octavia::controller::connection_max_retries": 120, "octavia::controller::connection_logging": true, "octavia::controller::build_active_retries": 120, "octavia::controller::port_detach_timeout": 300, "octavia::controller::administrative_log_facility": 1, "octavia::controller::forward_all_logs": true, "octavia::controller::user_log_facility": 0, "octavia::controller::disable_local_log_storage": false, "octavia::nova::enable_anti_affinity": true, "octavia::rabbit_heartbeat_in_pthread": false}, "tuple:('role_data', 'upgrade_tasks')": [{"name": "make sure that post-deploy.conf exists before restarting containers on update or upgrade", "when": "step|int == 5", "block": [{"name": "check for octavia post-deploy.conf file", "stat": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf"}, "register": "octavia_post_deploy_stat"}, {"name": "create an empty post-deploy.conf file if it does not exist", "file": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf", "state": "touch", "setype": "container_file_t", "mode": "0755"}, "when": ["octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists"]}]}, {"name": "pre-check to ensure redis is removed if the service is disabled", "when": ["step|int == 0", "\"redis\" not in enabled_services|list", "\"pacemaker\" in enabled_services|list"], "become": true, "shell": "export CIB_file=/var/lib/pacemaker/cib/cib.xml\nif crm_resource -r redis-bundle -q &>/dev/null; then\n  echo \"Redis resource present in pacemaker but disabled by default in TripleO\" >&2\n  echo \"Delete the resource in pacemaker or enable the redis service before upgrading\" >&2\n  exit 1\nfi"}], "tuple:('role_data', 'update_tasks')": [{"name": "make sure that post-deploy.conf exists before restarting containers on update or upgrade", "when": "step|int == 5", "block": [{"name": "check for octavia post-deploy.conf file", "stat": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf"}, "register": "octavia_post_deploy_stat"}, {"name": "create an empty post-deploy.conf file if it does not exist", "file": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf", "state": "touch", "setype": "container_file_t", "mode": "0755"}, "when": ["octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists"]}]}], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-59-p5kosh6m26vz-OctaviaWorker-skgctzviaxov-OctaviaBase-met4urg3v3wb/f0779167-d5b5-40c9-822b-d76247591350"}


created_at: 2026-01-27 08:25:14.523590
data:
  {"value": {"ContainerOctaviaWorkerImage": "registry.redhat.io/rhosp-rhel9/openstack-octavia-worker:17.1", "ContainerOctaviaConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1"}}


created_at: 2026-01-27 08:25:14.532085
data:
  {"tuple:('role_data', 'config_settings')": {"octavia::logging::debug": true, "octavia::purge_config": false, "octavia::notification_driver": ["messagingv2"], "octavia::db::database_connection": "mysql+pymysql://octavia:9L5MLYf8jSxgOBZhJVNqF7RoH@172.17.0.2/octavia?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "octavia::service_auth::auth_url": "http://172.17.0.2:5000/v3", "octavia::service_auth::auth_type": "password", "octavia::service_auth::username": "octavia", "octavia::service_auth::password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "octavia::service_auth::project_name": "service", "octavia::service_auth::project_domain_name": "Default", "octavia::service_auth::user_domain_name": "Default", "octavia::service_auth::region_name": "regionOne", "octavia::nova::endpoint_type": "internalURL", "octavia::neutron::endpoint_type": "internalURL", "octavia::glance::endpoint_type": "internalURL", "octavia::cinder::endpoint_type": "internalURL", "octavia::certificates::endpoint_type": "internalURL", "octavia::certificates::ca_certificate": "/etc/octavia/certs/ca_01.pem", "octavia::certificates::ca_private_key": "/etc/octavia/certs/private/cakey.pem", "octavia::certificates::client_cert": "/etc/octavia/certs/client.pem", "octavia::certificates::server_certs_key_passphrase": "MImlNSPGC7DYHSSZMapBACiP79svIAmm", "octavia::certificates::ca_private_key_passphrase": "CpqTe0gLs68jBEgpNZd1ehsv4", "octavia::worker::manage_nova_flavor": false, "octavia::controller::amp_boot_network_list": [], "octavia::controller::amp_flavor_id": "65", "octavia::controller::amp_image_tag": "amphora-image", "octavia::controller::amp_ssh_key_name": "octavia-ssh-key", "octavia::controller::enable_ssh_access": true, "octavia::controller::timeout_client_data": 50000, "octavia::controller::timeout_member_connect": 5000, "octavia::controller::timeout_member_data": 50000, "octavia::controller::timeout_tcp_inspect": 0, "octavia::controller::connection_max_retries": 120, "octavia::controller::connection_logging": true, "octavia::controller::build_active_retries": 120, "octavia::controller::port_detach_timeout": 300, "octavia::controller::administrative_log_facility": 1, "octavia::controller::forward_all_logs": true, "octavia::controller::user_log_facility": 0, "octavia::controller::disable_local_log_storage": false, "octavia::nova::enable_anti_affinity": true, "octavia::rabbit_heartbeat_in_pthread": false}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-59-p5kosh6m26vz-OctaviaWorker-skgctzviaxov/abf179e3-d467-47fb-b4e8-5cc86909810c"}


created_at: 2026-01-27 08:25:14.536351
data:
  {"value": {"ContainerOctaviaApiImage": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1", "ContainerOctaviaConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1"}}


created_at: 2026-01-27 08:25:14.549398
data:
  {"tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'service_name')": "octavia_api", "tuple:('role_data', 'docker_config')": {"step_2": {"octavia_api_init_dirs": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1", "net": "none", "user": "root", "volumes": ["/var/lib/config-data/puppet-generated/octavia/etc/octavia:/etc/octavia", "/var/log/containers/octavia:/var/log/octavia:z", "/var/log/containers/httpd/octavia-api:/var/log/httpd:z"], "command": ["/bin/bash", "-c", "mkdir -p /etc/octavia/conf.d/octavia-api; chown -R octavia:octavia /etc/octavia/conf.d/octavia-api; chown -R octavia:octavia /var/log/octavia"]}}, "step_3": {"octavia_db_sync": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1", "cap_add": ["AUDIT_WRITE"], "net": "host", "privileged": false, "detach": false, "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/octavia_api_db_sync.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro", "/var/log/containers/octavia:/var/log/octavia:z", "/run/octavia:/run/octavia:shared,z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1769501968"}}}, "step_4": {"octavia_api": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1", "net": "host", "user": "root", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/octavia_api.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro", "/var/log/containers/octavia:/var/log/octavia:z", "/run/octavia:/run/octavia:shared,z", "/var/log/containers/httpd/octavia-api:/var/log/httpd:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "octavia_driver_agent": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1", "net": "host", "privileged": true, "restart": "always", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/octavia_driver_agent.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro", "/var/log/containers/octavia:/var/log/octavia:z", "/run/octavia:/run/octavia:shared,z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "role_data": {"service_name": "octavia_api", "firewall_rules": {"120 octavia api": {"dport": [9876]}}, "firewall_frontend_rules": {"100 octavia_haproxy_frontend": {"dport": [9876]}}, "firewall_ssl_frontend_rules": {"100 octavia_haproxy_frontend_ssl": {"dport": [13876]}}, "keystone_resources": {"octavia": {"endpoints": {"public": "http://172.21.0.2:9876", "internal": "http://172.17.0.2:9876", "admin": "http://172.17.0.2:9876"}, "project": "service", "users": {"octavia": {"name": "octavia", "password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "project": "service"}}, "region": "regionOne", "service": "load-balancer", "roles": ["load-balancer_admin", "load-balancer_quota_admin", "load-balancer_member", "load-balancer_global_observer", "load-balancer_observer"]}}, "monitoring_subscription": "overcloud-octavia-api", "config_settings": {"octavia::logging::debug": true, "octavia::purge_config": false, "octavia::notification_driver": ["messagingv2"], "octavia::db::database_connection": "mysql+pymysql://octavia:9L5MLYf8jSxgOBZhJVNqF7RoH@172.17.0.2/octavia?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "octavia::service_auth::auth_url": "http://172.17.0.2:5000/v3", "octavia::service_auth::auth_type": "password", "octavia::service_auth::username": "octavia", "octavia::service_auth::password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "octavia::service_auth::project_name": "service", "octavia::service_auth::project_domain_name": "Default", "octavia::service_auth::user_domain_name": "Default", "octavia::service_auth::region_name": "regionOne", "octavia::nova::endpoint_type": "internalURL", "octavia::neutron::endpoint_type": "internalURL", "octavia::glance::endpoint_type": "internalURL", "octavia::cinder::endpoint_type": "internalURL", "octavia::certificates::endpoint_type": "internalURL", "octavia::certificates::ca_certificate": "/etc/octavia/certs/ca_01.pem", "octavia::certificates::ca_private_key": "/etc/octavia/certs/private/cakey.pem", "octavia::certificates::client_cert": "/etc/octavia/certs/client.pem", "octavia::certificates::server_certs_key_passphrase": "MImlNSPGC7DYHSSZMapBACiP79svIAmm", "octavia::certificates::ca_private_key_passphrase": "CpqTe0gLs68jBEgpNZd1ehsv4", "octavia::worker::manage_nova_flavor": false, "octavia::controller::amp_boot_network_list": [], "octavia::controller::amp_flavor_id": "65", "octavia::controller::amp_image_tag": "amphora-image", "octavia::controller::amp_ssh_key_name": "octavia-ssh-key", "octavia::controller::enable_ssh_access": true, "octavia::controller::timeout_client_data": 50000, "octavia::controller::timeout_member_connect": 5000, "octavia::controller::timeout_member_data": 50000, "octavia::controller::timeout_tcp_inspect": 0, "octavia::controller::connection_max_retries": 120, "octavia::controller::connection_logging": true, "octavia::controller::build_active_retries": 120, "octavia::controller::port_detach_timeout": 300, "octavia::controller::administrative_log_facility": 1, "octavia::controller::forward_all_logs": true, "octavia::controller::user_log_facility": 0, "octavia::controller::disable_local_log_storage": false, "octavia::nova::enable_anti_affinity": true, "octavia::rabbit_heartbeat_in_pthread": false, "octavia::driver_agent::enabled_provider_agents": "ovn", "tripleo::profile::base::octavia::provider::ovn::protocol": "tcp", "octavia::keystone::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "octavia::keystone::authtoken::auth_url": "http://172.17.0.2:5000", "octavia::keystone::authtoken::project_name": "service", "octavia::keystone::authtoken::password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "octavia::keystone::authtoken::user_domain_name": "Default", "octavia::keystone::authtoken::project_domain_name": "Default", "octavia::keystone::authtoken::region_name": "regionOne", "octavia::keystone::authtoken::interface": "internal", "octavia::keystone::authtoken::memcache_use_advanced_pool": true, "octavia::policy::policies": {}, "octavia::api::service_name": "httpd", "octavia::api::enable_proxy_headers_parsing": true, "octavia::api::healthcheck_enabled": true, "octavia::api::tls_cipher_prohibit_list": [], "octavia::api::default_listener_tls_versions": ["TLSv1.2", "TLSv1.3"], "octavia::api::default_pool_tls_versions": ["TLSv1.2", "TLSv1.3"], "octavia::wsgi::apache::ssl": false, "octavia::wsgi::apache::bind_host": "%{hiera('internal_api')}", "octavia::wsgi::apache::servername": "%{hiera('fqdn_internal_api')}", "octavia::api::host": "%{hiera('internal_api')}", "tripleo::profile::base::octavia::enable_driver_agent": true, "octavia::api::provider_drivers": "amphora: The Octavia Amphora driver.,octavia: Deprecated alias of the Octavia Amphora driver.,ovn: Octavia OVN driver."}, "service_config_settings": {"rsyslog": {"tripleo_logging_sources_octavia_api": [{"tag": "openstack.octavia.api", "file": "/var/log/containers/octavia/octavia.log"}]}, "mysql": {"octavia::db::mysql::password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "octavia::db::mysql::user": "octavia", "octavia::db::mysql::host": "%", "octavia::db::mysql::dbname": "octavia", "octavia::db::mysql::persistence_dbname": "octavia_persistence"}}, "puppet_config": {"config_volume": "octavia", "puppet_tags": "octavia_config,octavia_ovn_provider_config", "step_config": "include tripleo::profile::base::octavia::api\ninclude tripleo::profile::base::octavia::provider::ovn\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/octavia_api.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/octavia", "owner": "octavia:octavia", "recurse": true}, {"path": "/run/octavia", "owner": "octavia:octavia", "recurse": true}]}, "/var/lib/kolla/config_files/octavia_driver_agent.json": {"command": "/usr/bin/octavia-driver-agent --config-file /usr/share/octavia/octavia-dist.conf --config-file /etc/octavia/octavia.conf --log-file /var/log/octavia/driver-agent.log --config-dir /etc/octavia/conf.d/common", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/octavia", "owner": "octavia:octavia", "recurse": true}, {"path": "/run/octavia", "owner": "octavia:octavia", "recurse": true}]}, "/var/lib/kolla/config_files/octavia_api_db_sync.json": {"command": "/usr/bin/bootstrap_host_exec octavia_api su octavia -s /bin/bash -c '/usr/bin/octavia-db-manage upgrade head && /usr/bin/octavia-db-manage upgrade_persistence'", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/octavia", "owner": "octavia:octavia", "recurse": true}, {"path": "/run/octavia", "owner": "octavia:octavia", "recurse": true}]}}, "metadata_settings": null, "deploy_steps_tasks": null, "docker_config": {"step_2": {"octavia_api_init_dirs": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1", "net": "none", "user": "root", "volumes": ["/var/lib/config-data/puppet-generated/octavia/etc/octavia:/etc/octavia", "/var/log/containers/octavia:/var/log/octavia:z", "/var/log/containers/httpd/octavia-api:/var/log/httpd:z"], "command": ["/bin/bash", "-c", "mkdir -p /etc/octavia/conf.d/octavia-api; chown -R octavia:octavia /etc/octavia/conf.d/octavia-api; chown -R octavia:octavia /var/log/octavia"]}}, "step_3": {"octavia_db_sync": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1", "cap_add": ["AUDIT_WRITE"], "net": "host", "privileged": false, "detach": false, "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/octavia_api_db_sync.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro", "/var/log/containers/octavia:/var/log/octavia:z", "/run/octavia:/run/octavia:shared,z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1769501968"}}}, "step_4": {"octavia_api": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1", "net": "host", "user": "root", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/octavia_api.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro", "/var/log/containers/octavia:/var/log/octavia:z", "/run/octavia:/run/octavia:shared,z", "/var/log/containers/httpd/octavia-api:/var/log/httpd:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "octavia_driver_agent": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1", "net": "host", "privileged": true, "restart": "always", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/octavia_driver_agent.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro", "/var/log/containers/octavia:/var/log/octavia:z", "/run/octavia:/run/octavia:shared,z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "host_prep_tasks": [{"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/log/containers/octavia", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/octavia-api", "setype": "container_file_t", "mode": "0750"}, {"path": "/run/octavia", "setype": "container_file_t", "mode": "0755"}]}, {"name": "ensure /run/octavia is present upon reboot", "copy": {"dest": "/etc/tmpfiles.d/run-octavia.conf", "content": "d /run/octavia 0755 root root - -\n"}}], "update_tasks": [{"name": "make sure that post-deploy.conf exists before restarting containers on update or upgrade", "when": "step|int == 5", "block": [{"name": "check for octavia post-deploy.conf file", "stat": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf"}, "register": "octavia_post_deploy_stat"}, {"name": "create an empty post-deploy.conf file if it does not exist", "file": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf", "state": "touch", "setype": "container_file_t", "mode": "0755"}, "when": ["octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists"]}]}, {"name": "octavia_api_tmpfile_cleanup", "when": "step|int == 1", "block": [{"name": "octavia_api_tmpfile_cleanup", "file": {"path": "/etc/tmpfiles.d/var-run-octavia.conf", "state": "absent"}}]}], "upgrade_tasks": [{"name": "make sure that post-deploy.conf exists before restarting containers on update or upgrade", "when": "step|int == 5", "block": [{"name": "check for octavia post-deploy.conf file", "stat": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf"}, "register": "octavia_post_deploy_stat"}, {"name": "create an empty post-deploy.conf file if it does not exist", "file": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf", "state": "touch", "setype": "container_file_t", "mode": "0755"}, "when": ["octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists"]}]}, {"name": "pre-check to ensure redis is removed if the service is disabled", "when": ["step|int == 0", "\"redis\" not in enabled_services|list", "\"pacemaker\" in enabled_services|list"], "become": true, "shell": "export CIB_file=/var/lib/pacemaker/cib/cib.xml\nif crm_resource -r redis-bundle -q &>/dev/null; then\n  echo \"Redis resource present in pacemaker but disabled by default in TripleO\" >&2\n  echo \"Delete the resource in pacemaker or enable the redis service before upgrading\" >&2\n  exit 1\nfi"}, {"name": "octavia_api_tmpfile_cleanup", "when": "step|int == 1", "block": [{"name": "octavia_api_tmpfile_cleanup", "file": {"path": "/etc/tmpfiles.d/var-run-octavia.conf", "state": "absent"}}]}], "external_upgrade_tasks": [{"when": ["step|int == 1"], "tags": ["never", "system_upgrade_transfer_data", "system_upgrade_stop_services"], "block": [{"name": "Stop octavia api container", "import_role": {"name": "tripleo_container_stop"}, "vars": {"tripleo_containers_to_stop": ["octavia_api"], "tripleo_delegate_to": "{{ groups['octavia_api'] | difference(groups['excluded_overcloud']) }}"}}]}]}, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'config_settings')": {"octavia::logging::debug": true, "octavia::purge_config": false, "octavia::notification_driver": ["messagingv2"], "octavia::db::database_connection": "mysql+pymysql://octavia:9L5MLYf8jSxgOBZhJVNqF7RoH@172.17.0.2/octavia?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "octavia::service_auth::auth_url": "http://172.17.0.2:5000/v3", "octavia::service_auth::auth_type": "password", "octavia::service_auth::username": "octavia", "octavia::service_auth::password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "octavia::service_auth::project_name": "service", "octavia::service_auth::project_domain_name": "Default", "octavia::service_auth::user_domain_name": "Default", "octavia::service_auth::region_name": "regionOne", "octavia::nova::endpoint_type": "internalURL", "octavia::neutron::endpoint_type": "internalURL", "octavia::glance::endpoint_type": "internalURL", "octavia::cinder::endpoint_type": "internalURL", "octavia::certificates::endpoint_type": "internalURL", "octavia::certificates::ca_certificate": "/etc/octavia/certs/ca_01.pem", "octavia::certificates::ca_private_key": "/etc/octavia/certs/private/cakey.pem", "octavia::certificates::client_cert": "/etc/octavia/certs/client.pem", "octavia::certificates::server_certs_key_passphrase": "MImlNSPGC7DYHSSZMapBACiP79svIAmm", "octavia::certificates::ca_private_key_passphrase": "CpqTe0gLs68jBEgpNZd1ehsv4", "octavia::worker::manage_nova_flavor": false, "octavia::controller::amp_boot_network_list": [], "octavia::controller::amp_flavor_id": "65", "octavia::controller::amp_image_tag": "amphora-image", "octavia::controller::amp_ssh_key_name": "octavia-ssh-key", "octavia::controller::enable_ssh_access": true, "octavia::controller::timeout_client_data": 50000, "octavia::controller::timeout_member_connect": 5000, "octavia::controller::timeout_member_data": 50000, "octavia::controller::timeout_tcp_inspect": 0, "octavia::controller::connection_max_retries": 120, "octavia::controller::connection_logging": true, "octavia::controller::build_active_retries": 120, "octavia::controller::port_detach_timeout": 300, "octavia::controller::administrative_log_facility": 1, "octavia::controller::forward_all_logs": true, "octavia::controller::user_log_facility": 0, "octavia::controller::disable_local_log_storage": false, "octavia::nova::enable_anti_affinity": true, "octavia::rabbit_heartbeat_in_pthread": false, "octavia::driver_agent::enabled_provider_agents": "ovn", "tripleo::profile::base::octavia::provider::ovn::protocol": "tcp", "octavia::keystone::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "octavia::keystone::authtoken::auth_url": "http://172.17.0.2:5000", "octavia::keystone::authtoken::project_name": "service", "octavia::keystone::authtoken::password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "octavia::keystone::authtoken::user_domain_name": "Default", "octavia::keystone::authtoken::project_domain_name": "Default", "octavia::keystone::authtoken::region_name": "regionOne", "octavia::keystone::authtoken::interface": "internal", "octavia::keystone::authtoken::memcache_use_advanced_pool": true, "octavia::policy::policies": {}, "octavia::api::service_name": "httpd", "octavia::api::enable_proxy_headers_parsing": true, "octavia::api::healthcheck_enabled": true, "octavia::api::tls_cipher_prohibit_list": [], "octavia::api::default_listener_tls_versions": ["TLSv1.2", "TLSv1.3"], "octavia::api::default_pool_tls_versions": ["TLSv1.2", "TLSv1.3"], "octavia::wsgi::apache::ssl": false, "octavia::wsgi::apache::bind_host": "%{hiera('internal_api')}", "octavia::wsgi::apache::servername": "%{hiera('fqdn_internal_api')}", "octavia::api::host": "%{hiera('internal_api')}", "tripleo::profile::base::octavia::enable_driver_agent": true, "octavia::api::provider_drivers": "amphora: The Octavia Amphora driver.,octavia: Deprecated alias of the Octavia Amphora driver.,ovn: Octavia OVN driver."}, "tuple:('role_data', 'step_config')": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-59-p5kosh6m26vz/d450480b-5254-48d6-a61e-2291a550e717"}


created_at: 2026-01-27 08:25:14.909607
data:
  {"type": "json", "value": {"vars": {"os_auth_type": "password", "os_identity_api_version": "3", "amp_image_name": "", "amp_image_filename": "", "amp_image_tag": "amphora-image", "amp_hw_arch": "x86_64", "amp_ssh_key_name": "octavia-ssh-key", "amp_ssh_key_path": "/root/.ssh/id_ecdsa.pub", "amp_ssh_key_dir": "/etc/octavia/ssh", "amp_to_raw": true, "auth_username": "octavia", "auth_password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "auth_project_name": "service", "lb_mgmt_net_name": "lb-mgmt-net", "lb_mgmt_subnet_name": "lb-mgmt-subnet", "lb_sec_group_name": "lb-mgmt-subnet", "lb_mgmt_subnet_cidr": "172.24.0.0/16", "lb_mgmt_subnet_gateway": "172.24.0.1", "lb_mgmt_subnet_pool_start": "172.24.0.2", "lb_mgmt_subnet_pool_end": "172.24.255.254", "ca_cert_path": "/etc/octavia/certs/ca_01.pem", "ca_private_key_path": "/etc/octavia/certs/private/cakey.pem", "server_certs_key_passphrase": "MImlNSPGC7DYHSSZMapBACiP79svIAmm", "ca_passphrase": "CpqTe0gLs68jBEgpNZd1ehsv4", "client_cert_path": "/etc/octavia/certs/client.pem", "generate_certs": true, "mgmt_port_dev": "o-hm0", "os_password": "qDHlgCO32Qyo9siBGOb3A5Egm", "os_project_name": "admin", "os_username": "admin", "octavia_ansible_playbook": "/usr/share/ansible/tripleo-playbooks/octavia-files.yaml", "os_auth_url": "http://172.21.0.2:5000/v3", "os_int_auth_url": "http://172.17.0.2:5000/", "octavia_local_tmpdir": "{{playbook_dir}}/octavia-ansible/local_dir", "octavia_group_vars_dir": "{{playbook_dir}}/octavia-ansible/group_vars", "container_cli": "podman", "enable_log_offloading": true, "log_offload_protocol": "udp", "octavia_flavor_id": "65", "octavia_flavor_properties": {"ram": "1024", "disk": "3", "vcpus": "1"}, "octavia_manage_nova_flavor": true, "octavia_multivcpu_flavor_properties": {"ram": "4096", "disk": "3", "vcpus": "4"}, "octavia_multivcpu_flavor_id": "amphora-mvcpu-ha", "octavia_admin_log_targets": [], "octavia_tenant_log_targets": []}}}


created_at: 2026-01-27 08:25:16.020227
data:
  {"value": {"vars": {"os_auth_type": "password", "os_identity_api_version": "3", "amp_image_name": "", "amp_image_filename": "", "amp_image_tag": "amphora-image", "amp_hw_arch": "x86_64", "amp_ssh_key_name": "octavia-ssh-key", "amp_ssh_key_path": "/root/.ssh/id_ecdsa.pub", "amp_ssh_key_dir": "/etc/octavia/ssh", "amp_to_raw": true, "auth_username": "octavia", "auth_password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "auth_project_name": "service", "lb_mgmt_net_name": "lb-mgmt-net", "lb_mgmt_subnet_name": "lb-mgmt-subnet", "lb_sec_group_name": "lb-mgmt-subnet", "lb_mgmt_subnet_cidr": "172.24.0.0/16", "lb_mgmt_subnet_gateway": "172.24.0.1", "lb_mgmt_subnet_pool_start": "172.24.0.2", "lb_mgmt_subnet_pool_end": "172.24.255.254", "ca_cert_path": "/etc/octavia/certs/ca_01.pem", "ca_private_key_path": "/etc/octavia/certs/private/cakey.pem", "server_certs_key_passphrase": "MImlNSPGC7DYHSSZMapBACiP79svIAmm", "ca_passphrase": "CpqTe0gLs68jBEgpNZd1ehsv4", "client_cert_path": "/etc/octavia/certs/client.pem", "generate_certs": true, "mgmt_port_dev": "o-hm0", "os_password": "qDHlgCO32Qyo9siBGOb3A5Egm", "os_project_name": "admin", "os_username": "admin", "octavia_ansible_playbook": "/usr/share/ansible/tripleo-playbooks/octavia-files.yaml", "os_auth_url": "http://172.21.0.2:5000/v3", "os_int_auth_url": "http://172.17.0.2:5000/", "octavia_local_tmpdir": "{{playbook_dir}}/octavia-ansible/local_dir", "octavia_group_vars_dir": "{{playbook_dir}}/octavia-ansible/group_vars", "container_cli": "podman", "enable_log_offloading": true, "log_offload_protocol": "udp", "octavia_flavor_id": "65", "octavia_flavor_properties": {"ram": "1024", "disk": "3", "vcpus": "1"}, "octavia_manage_nova_flavor": true, "octavia_multivcpu_flavor_properties": {"ram": "4096", "disk": "3", "vcpus": "4"}, "octavia_multivcpu_flavor_id": "amphora-mvcpu-ha", "octavia_admin_log_targets": [], "octavia_tenant_log_targets": []}}}


created_at: 2026-01-27 08:25:16.028304
data:
  {"tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'service_name')": "octavia_deployment_config", "tuple:('role_data', 'docker_config')": {}, "role_data": {"service_name": "octavia_deployment_config", "upgrade_tasks": [], "puppet_config": {}, "docker_config": {}, "config_settings": {}, "external_post_deploy_tasks": [{"name": "octavia_post_deploy", "block": [{"name": "Set up group_vars", "set_fact": {"octavia_ansible_group_vars": {"os_auth_type": "password", "os_identity_api_version": "3", "amp_image_name": "", "amp_image_filename": "", "amp_image_tag": "amphora-image", "amp_hw_arch": "x86_64", "amp_ssh_key_name": "octavia-ssh-key", "amp_ssh_key_path": "/root/.ssh/id_ecdsa.pub", "amp_ssh_key_dir": "/etc/octavia/ssh", "amp_to_raw": true, "auth_username": "octavia", "auth_password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "auth_project_name": "service", "lb_mgmt_net_name": "lb-mgmt-net", "lb_mgmt_subnet_name": "lb-mgmt-subnet", "lb_sec_group_name": "lb-mgmt-subnet", "lb_mgmt_subnet_cidr": "172.24.0.0/16", "lb_mgmt_subnet_gateway": "172.24.0.1", "lb_mgmt_subnet_pool_start": "172.24.0.2", "lb_mgmt_subnet_pool_end": "172.24.255.254", "ca_cert_path": "/etc/octavia/certs/ca_01.pem", "ca_private_key_path": "/etc/octavia/certs/private/cakey.pem", "server_certs_key_passphrase": "MImlNSPGC7DYHSSZMapBACiP79svIAmm", "ca_passphrase": "CpqTe0gLs68jBEgpNZd1ehsv4", "client_cert_path": "/etc/octavia/certs/client.pem", "generate_certs": true, "mgmt_port_dev": "o-hm0", "os_password": "qDHlgCO32Qyo9siBGOb3A5Egm", "os_project_name": "admin", "os_username": "admin", "octavia_ansible_playbook": "/usr/share/ansible/tripleo-playbooks/octavia-files.yaml", "os_auth_url": "http://172.21.0.2:5000/v3", "os_int_auth_url": "http://172.17.0.2:5000/", "octavia_local_tmpdir": "{{playbook_dir}}/octavia-ansible/local_dir", "octavia_group_vars_dir": "{{playbook_dir}}/octavia-ansible/group_vars", "container_cli": "podman", "enable_log_offloading": true, "log_offload_protocol": "udp", "octavia_flavor_id": "65", "octavia_flavor_properties": {"ram": "1024", "disk": "3", "vcpus": "1"}, "octavia_manage_nova_flavor": true, "octavia_multivcpu_flavor_properties": {"ram": "4096", "disk": "3", "vcpus": "4"}, "octavia_multivcpu_flavor_id": "amphora-mvcpu-ha", "octavia_admin_log_targets": [], "octavia_tenant_log_targets": []}}, "no_log": "{{ hide_sensitive_logs | bool }}"}, {"name": "Make needed directories on the undercloud", "become": true, "file": {"path": "{{item}}", "state": "directory", "owner": "{{ ansible_user }}"}, "with_items": ["{{playbook_dir}}/octavia-ansible", "{{ octavia_ansible_group_vars.octavia_local_tmpdir }}", "{{ octavia_ansible_group_vars.octavia_group_vars_dir }}"]}, {"name": "Write group_vars file", "become": true, "copy": {"dest": "{{ octavia_ansible_group_vars.octavia_group_vars_dir }}/octavia_vars.yaml", "content": "{{ octavia_ansible_group_vars|to_nice_yaml }}"}, "no_log": "{{ hide_sensitive_logs | bool }}"}, {"name": "Gather missing facts", "delegate_to": "{{item}}", "delegate_facts": true, "loop": "{{ groups['octavia_worker'] }}", "setup": {"gather_subset": ["!all", "min"]}}, {"name": "Write octavia inventory", "become": true, "copy": {"dest": "{{playbook_dir}}/octavia-ansible/inventory.yaml", "content": "octavia_nodes:\n  hosts:\n\n{%- set octavia_groups = ['worker'] -%}\n{%- for octavia_group in octavia_groups -%}\n{%- if 'octavia_' ~ octavia_groups %}\n\n    {% for host in groups['octavia_' ~ octavia_group] -%}\n    {{ hostvars.raw_get(host)['ansible_facts']['hostname'] | lower}}:\n      ansible_user: {{ hostvars.raw_get(host)['ansible_ssh_user'] | default('heat-admin') }}\n      ansible_host: {{ hostvars.raw_get(host)['ansible_host'] | default(host) | lower }}\n      canonical_hostname: {{ hostvars.raw_get(host)['canonical_hostname'] | default(host) | lower }}\n      ansible_become: true\n    {% endfor %}\n\n{%- endif -%}\n{%- endfor %}\n\nUndercloud:\n  hosts:\n    {% for host in groups['Undercloud'] -%}\n    {{ hostvars.raw_get(host)['ansible_facts']['hostname'] | lower}}:\n      ansible_host: {{ hostvars.raw_get(host)['ansible_host'] | default(host) | lower }}\n      ansible_become: false\n      ansible_connection: local\n\n    {%- endfor -%}\n"}}, {"name": "Check for ssh_private_key in working directory", "become": true, "stat": {"path": "{{ lookup('env', 'ANSIBLE_PRIVATE_KEY_FILE') }}"}, "register": "detect_private_key_file"}, {"name": "Set private key location", "set_fact": {"octavia_ansible_ssh_key": "{{ lookup('env', 'ANSIBLE_PRIVATE_KEY_FILE') }}"}, "when": "octavia_ansible_ssh_key is not defined and detect_private_key_file.stat.exists"}, {"name": "Configure octavia command", "set_fact": {"config_octavia_cmd": "ANSIBLE_CONFIG=\"{{playbook_dir}}/ansible.cfg\" ansible-playbook -i \"{{playbook_dir}}/octavia-ansible/inventory.yaml\" --extra-vars @{{ octavia_ansible_group_vars.octavia_group_vars_dir }}/octavia_vars.yaml {% if octavia_ansible_ssh_key is defined %}--private-key {{octavia_ansible_ssh_key}}{% endif %} {{ octavia_ansible_group_vars.octavia_ansible_playbook }}"}}, {"set_fact": {"octavia_log_dir": "{{playbook_dir}}/octavia-ansible/"}}, {"debug": {"msg": "Configure Octavia command is: {{ config_octavia_cmd }}"}}, {"name": "Configure octavia on overcloud", "become": true, "environment": {"ANSIBLE_HOST_KEY_CHECKING": false, "ANSIBLE_SSH_RETRIES": 3, "ANSIBLE_RETRY_FILES_ENABLED": false, "ANSIBLE_LOCAL_TEMP": "{{ octavia_ansible_group_vars.octavia_local_tmpdir }}", "ANSIBLE_LOG_PATH": "{{ octavia_log_dir }}/octavia-ansible.log"}, "shell": "{{ config_octavia_cmd }}"}, {"name": "Purge temp dirs", "become": true, "file": {"state": "absent", "path": "{{ item }}"}, "with_items": ["{{ octavia_ansible_group_vars.octavia_local_tmpdir }}"]}]}]}, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'config_settings')": {}, "tuple:('role_data', 'step_config')": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-60-5g5ra2zyhvlj/7055b78a-3c9f-42be-99c3-45e6f5e8e8ee"}


created_at: 2026-01-27 08:25:16.424198
data:
  {"type": "json", "value": {"ContainerOctaviaHealthManagerImage": "registry.redhat.io/rhosp-rhel9/openstack-octavia-health-manager:17.1", "ContainerOctaviaConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1", "ContainerOctaviaRsyslogImage": "registry.redhat.io/rhosp-rhel9/openstack-rsyslog:17.1"}}


created_at: 2026-01-27 08:25:21.642794
data:
  {"tuple:('role_data', 'step_config')": "include tripleo::profile::base::database::mysql::client", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-61-wmmshgy2cndf-MySQLClient-i2wbh3vzvvfx/e1937bfb-d51f-4ab1-8435-2d764e595ec3"}


created_at: 2026-01-27 08:25:21.672354
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-61-wmmshgy2cndf-ContainersCommon-qvujb5bjloaz/a9969034-01ec-4edb-a9e8-cea46dba6e55"}


created_at: 2026-01-27 08:25:21.726401
data:
  {"tuple:('role_data', 'config_settings')": {"octavia::logging::debug": true, "octavia::purge_config": false, "octavia::notification_driver": ["messagingv2"], "octavia::db::database_connection": "mysql+pymysql://octavia:9L5MLYf8jSxgOBZhJVNqF7RoH@172.17.0.2/octavia?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "octavia::service_auth::auth_url": "http://172.17.0.2:5000/v3", "octavia::service_auth::auth_type": "password", "octavia::service_auth::username": "octavia", "octavia::service_auth::password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "octavia::service_auth::project_name": "service", "octavia::service_auth::project_domain_name": "Default", "octavia::service_auth::user_domain_name": "Default", "octavia::service_auth::region_name": "regionOne", "octavia::nova::endpoint_type": "internalURL", "octavia::neutron::endpoint_type": "internalURL", "octavia::glance::endpoint_type": "internalURL", "octavia::cinder::endpoint_type": "internalURL", "octavia::certificates::endpoint_type": "internalURL", "octavia::certificates::ca_certificate": "/etc/octavia/certs/ca_01.pem", "octavia::certificates::ca_private_key": "/etc/octavia/certs/private/cakey.pem", "octavia::certificates::client_cert": "/etc/octavia/certs/client.pem", "octavia::certificates::server_certs_key_passphrase": "MImlNSPGC7DYHSSZMapBACiP79svIAmm", "octavia::certificates::ca_private_key_passphrase": "CpqTe0gLs68jBEgpNZd1ehsv4", "octavia::worker::manage_nova_flavor": false, "octavia::controller::amp_boot_network_list": [], "octavia::controller::amp_flavor_id": "65", "octavia::controller::amp_image_tag": "amphora-image", "octavia::controller::amp_ssh_key_name": "octavia-ssh-key", "octavia::controller::enable_ssh_access": true, "octavia::controller::timeout_client_data": 50000, "octavia::controller::timeout_member_connect": 5000, "octavia::controller::timeout_member_data": 50000, "octavia::controller::timeout_tcp_inspect": 0, "octavia::controller::connection_max_retries": 120, "octavia::controller::connection_logging": true, "octavia::controller::build_active_retries": 120, "octavia::controller::port_detach_timeout": 300, "octavia::controller::administrative_log_facility": 1, "octavia::controller::forward_all_logs": true, "octavia::controller::user_log_facility": 0, "octavia::controller::disable_local_log_storage": false, "octavia::nova::enable_anti_affinity": true, "octavia::rabbit_heartbeat_in_pthread": false}, "tuple:('role_data', 'upgrade_tasks')": [{"name": "make sure that post-deploy.conf exists before restarting containers on update or upgrade", "when": "step|int == 5", "block": [{"name": "check for octavia post-deploy.conf file", "stat": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf"}, "register": "octavia_post_deploy_stat"}, {"name": "create an empty post-deploy.conf file if it does not exist", "file": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf", "state": "touch", "setype": "container_file_t", "mode": "0755"}, "when": ["octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists"]}]}, {"name": "pre-check to ensure redis is removed if the service is disabled", "when": ["step|int == 0", "\"redis\" not in enabled_services|list", "\"pacemaker\" in enabled_services|list"], "become": true, "shell": "export CIB_file=/var/lib/pacemaker/cib/cib.xml\nif crm_resource -r redis-bundle -q &>/dev/null; then\n  echo \"Redis resource present in pacemaker but disabled by default in TripleO\" >&2\n  echo \"Delete the resource in pacemaker or enable the redis service before upgrading\" >&2\n  exit 1\nfi"}], "tuple:('role_data', 'update_tasks')": [{"name": "make sure that post-deploy.conf exists before restarting containers on update or upgrade", "when": "step|int == 5", "block": [{"name": "check for octavia post-deploy.conf file", "stat": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf"}, "register": "octavia_post_deploy_stat"}, {"name": "create an empty post-deploy.conf file if it does not exist", "file": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf", "state": "touch", "setype": "container_file_t", "mode": "0755"}, "when": ["octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists"]}]}], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-61-wmmshgy2cndf-OctaviaBase-hwwsh7czyc3e/d9561bb2-3cdd-48b8-b7ca-34fc5faf344b"}


created_at: 2026-01-27 08:25:21.729441
data:
  {"value": {"ContainerOctaviaHealthManagerImage": "registry.redhat.io/rhosp-rhel9/openstack-octavia-health-manager:17.1", "ContainerOctaviaConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1", "ContainerOctaviaRsyslogImage": "registry.redhat.io/rhosp-rhel9/openstack-rsyslog:17.1"}}


created_at: 2026-01-27 08:25:21.738054
data:
  {"tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'service_name')": "octavia_health_manager", "tuple:('role_data', 'docker_config')": {"step_2": {"octavia_health_manager_init_dirs": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-health-manager:17.1", "user": "root", "net": "none", "volumes": ["/var/lib/config-data/puppet-generated/octavia/etc/octavia:/etc/octavia:z"], "command": ["/bin/bash", "-c", "mkdir -p /etc/octavia/conf.d/octavia-health-manager; chown -R octavia:octavia /etc/octavia/conf.d/octavia-health-manager"]}}, "step_5": {"octavia_health_manager": {"start_order": 2, "stop_grace_period": 630, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-health-manager:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/octavia_health_manager.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro", "/var/log/containers/octavia:/var/log/octavia:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "octavia_rsyslog": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-rsyslog:17.1", "net": "host", "privileged": true, "restart": "always", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/octavia_rsyslog.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro", "/var/log/containers/octavia-amphorae:/var/log/octavia:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "role_data": {"service_name": "octavia_health_manager", "firewall_rules": {"200 octavia health manager interface": {"proto": "udp", "dport": 5555, "iniface": "o-hm0"}, "210 octavia lb-mgmt-net offload rsyslog": {"proto": "udp", "dport": 514, "iniface": "o-hm0"}}, "monitoring_subscription": "overcloud-octavia-health-manager", "config_settings": {"octavia::logging::debug": true, "octavia::purge_config": false, "octavia::notification_driver": ["messagingv2"], "octavia::db::database_connection": "mysql+pymysql://octavia:9L5MLYf8jSxgOBZhJVNqF7RoH@172.17.0.2/octavia?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "octavia::service_auth::auth_url": "http://172.17.0.2:5000/v3", "octavia::service_auth::auth_type": "password", "octavia::service_auth::username": "octavia", "octavia::service_auth::password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "octavia::service_auth::project_name": "service", "octavia::service_auth::project_domain_name": "Default", "octavia::service_auth::user_domain_name": "Default", "octavia::service_auth::region_name": "regionOne", "octavia::nova::endpoint_type": "internalURL", "octavia::neutron::endpoint_type": "internalURL", "octavia::glance::endpoint_type": "internalURL", "octavia::cinder::endpoint_type": "internalURL", "octavia::certificates::endpoint_type": "internalURL", "octavia::certificates::ca_certificate": "/etc/octavia/certs/ca_01.pem", "octavia::certificates::ca_private_key": "/etc/octavia/certs/private/cakey.pem", "octavia::certificates::client_cert": "/etc/octavia/certs/client.pem", "octavia::certificates::server_certs_key_passphrase": "MImlNSPGC7DYHSSZMapBACiP79svIAmm", "octavia::certificates::ca_private_key_passphrase": "CpqTe0gLs68jBEgpNZd1ehsv4", "octavia::worker::manage_nova_flavor": false, "octavia::controller::amp_boot_network_list": [], "octavia::controller::amp_flavor_id": "65", "octavia::controller::amp_image_tag": "amphora-image", "octavia::controller::amp_ssh_key_name": "octavia-ssh-key", "octavia::controller::enable_ssh_access": true, "octavia::controller::timeout_client_data": 50000, "octavia::controller::timeout_member_connect": 5000, "octavia::controller::timeout_member_data": 50000, "octavia::controller::timeout_tcp_inspect": 0, "octavia::controller::connection_max_retries": 120, "octavia::controller::connection_logging": true, "octavia::controller::build_active_retries": 120, "octavia::controller::port_detach_timeout": 300, "octavia::controller::administrative_log_facility": 1, "octavia::controller::forward_all_logs": true, "octavia::controller::user_log_facility": 0, "octavia::controller::disable_local_log_storage": false, "octavia::nova::enable_anti_affinity": true, "octavia::rabbit_heartbeat_in_pthread": false, "octavia::health_manager::heartbeat_key": "lFZ0QLhtxObKoiQ757yzZ3yWV"}, "service_config_settings": {"rsyslog": {"tripleo_logging_sources_octavia_health_manager": [{"tag": "openstack.octavia.health-manager", "file": "/var/log/containers/octavia/health-manager.log"}, {"tag": "openstack.octavia.amphora", "file": "/var/log/containers/octavia-amphorae/octavia-amphora.log", "startmsg.regex": "^[a-zA-Z]{3} [ 1-9][0-9] [:0-9]{8}"}, {"tag": "openstack.octavia.tenant", "file": "/var/log/containers/octavia-amphorae/octavia-tenant-traffic.log", "startmsg.regex": "^[a-zA-Z]{3} [ 1-9][0-9] [:0-9]{8}"}]}}, "puppet_config": {"config_volume": "octavia", "puppet_tags": "octavia_config", "step_config": "include tripleo::profile::base::octavia::health_manager\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/octavia_health_manager.json": {"command": "/usr/bin/octavia-health-manager --config-file /usr/share/octavia/octavia-dist.conf --config-file /etc/octavia/octavia.conf --config-file /etc/octavia/post-deploy.conf --log-file /var/log/octavia/health-manager.log --config-dir /etc/octavia/conf.d/octavia-health-manager", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/octavia", "owner": "octavia:octavia", "recurse": true}]}, "/var/lib/kolla/config_files/octavia_rsyslog.json": {"command": "/usr/sbin/rsyslogd -n -iNONE", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/octavia", "owner": "root:root", "recurse": true}]}}, "docker_config": {"step_2": {"octavia_health_manager_init_dirs": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-health-manager:17.1", "user": "root", "net": "none", "volumes": ["/var/lib/config-data/puppet-generated/octavia/etc/octavia:/etc/octavia:z"], "command": ["/bin/bash", "-c", "mkdir -p /etc/octavia/conf.d/octavia-health-manager; chown -R octavia:octavia /etc/octavia/conf.d/octavia-health-manager"]}}, "step_5": {"octavia_health_manager": {"start_order": 2, "stop_grace_period": 630, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-health-manager:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/octavia_health_manager.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro", "/var/log/containers/octavia:/var/log/octavia:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "octavia_rsyslog": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-rsyslog:17.1", "net": "host", "privileged": true, "restart": "always", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/octavia_rsyslog.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro", "/var/log/containers/octavia-amphorae:/var/log/octavia:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "update_tasks": [{"name": "make sure that post-deploy.conf exists before restarting containers on update or upgrade", "when": "step|int == 5", "block": [{"name": "check for octavia post-deploy.conf file", "stat": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf"}, "register": "octavia_post_deploy_stat"}, {"name": "create an empty post-deploy.conf file if it does not exist", "file": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf", "state": "touch", "setype": "container_file_t", "mode": "0755"}, "when": ["octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists"]}]}], "upgrade_tasks": [{"name": "make sure that post-deploy.conf exists before restarting containers on update or upgrade", "when": "step|int == 5", "block": [{"name": "check for octavia post-deploy.conf file", "stat": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf"}, "register": "octavia_post_deploy_stat"}, {"name": "create an empty post-deploy.conf file if it does not exist", "file": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf", "state": "touch", "setype": "container_file_t", "mode": "0755"}, "when": ["octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists"]}]}, {"name": "pre-check to ensure redis is removed if the service is disabled", "when": ["step|int == 0", "\"redis\" not in enabled_services|list", "\"pacemaker\" in enabled_services|list"], "become": true, "shell": "export CIB_file=/var/lib/pacemaker/cib/cib.xml\nif crm_resource -r redis-bundle -q &>/dev/null; then\n  echo \"Redis resource present in pacemaker but disabled by default in TripleO\" >&2\n  echo \"Delete the resource in pacemaker or enable the redis service before upgrading\" >&2\n  exit 1\nfi"}], "host_prep_tasks": [{"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/octavia", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/octavia-amphorae", "setype": "container_file_t", "mode": "0750"}]}, {"name": "create empty log files", "file": {"path": "{{ item.path }}", "state": "touch", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/octavia-amphorae/octavia-tenant-traffic.log", "setype": "container_file_t", "mode": "0644"}, {"path": "/var/log/containers/octavia-amphorae/octavia-amphora.log", "setype": "container_file_t", "mode": "0644"}]}], "external_upgrade_tasks": [{"when": ["step|int == 1"], "tags": ["never", "system_upgrade_transfer_data", "system_upgrade_stop_services"], "block": [{"name": "Stop octavia health manager container", "import_role": {"name": "tripleo_container_stop"}, "vars": {"tripleo_containers_to_stop": ["octavia_health_manager"], "tripleo_delegate_to": "{{ groups['octavia_health_manager'] | difference(groups['excluded_overcloud']) }}"}}]}]}, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'config_settings')": {"octavia::logging::debug": true, "octavia::purge_config": false, "octavia::notification_driver": ["messagingv2"], "octavia::db::database_connection": "mysql+pymysql://octavia:9L5MLYf8jSxgOBZhJVNqF7RoH@172.17.0.2/octavia?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "octavia::service_auth::auth_url": "http://172.17.0.2:5000/v3", "octavia::service_auth::auth_type": "password", "octavia::service_auth::username": "octavia", "octavia::service_auth::password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "octavia::service_auth::project_name": "service", "octavia::service_auth::project_domain_name": "Default", "octavia::service_auth::user_domain_name": "Default", "octavia::service_auth::region_name": "regionOne", "octavia::nova::endpoint_type": "internalURL", "octavia::neutron::endpoint_type": "internalURL", "octavia::glance::endpoint_type": "internalURL", "octavia::cinder::endpoint_type": "internalURL", "octavia::certificates::endpoint_type": "internalURL", "octavia::certificates::ca_certificate": "/etc/octavia/certs/ca_01.pem", "octavia::certificates::ca_private_key": "/etc/octavia/certs/private/cakey.pem", "octavia::certificates::client_cert": "/etc/octavia/certs/client.pem", "octavia::certificates::server_certs_key_passphrase": "MImlNSPGC7DYHSSZMapBACiP79svIAmm", "octavia::certificates::ca_private_key_passphrase": "CpqTe0gLs68jBEgpNZd1ehsv4", "octavia::worker::manage_nova_flavor": false, "octavia::controller::amp_boot_network_list": [], "octavia::controller::amp_flavor_id": "65", "octavia::controller::amp_image_tag": "amphora-image", "octavia::controller::amp_ssh_key_name": "octavia-ssh-key", "octavia::controller::enable_ssh_access": true, "octavia::controller::timeout_client_data": 50000, "octavia::controller::timeout_member_connect": 5000, "octavia::controller::timeout_member_data": 50000, "octavia::controller::timeout_tcp_inspect": 0, "octavia::controller::connection_max_retries": 120, "octavia::controller::connection_logging": true, "octavia::controller::build_active_retries": 120, "octavia::controller::port_detach_timeout": 300, "octavia::controller::administrative_log_facility": 1, "octavia::controller::forward_all_logs": true, "octavia::controller::user_log_facility": 0, "octavia::controller::disable_local_log_storage": false, "octavia::nova::enable_anti_affinity": true, "octavia::rabbit_heartbeat_in_pthread": false, "octavia::health_manager::heartbeat_key": "lFZ0QLhtxObKoiQ757yzZ3yWV"}, "tuple:('role_data', 'step_config')": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-61-wmmshgy2cndf/00adee8e-77b8-4b01-af38-88f5ece22cc2"}


created_at: 2026-01-27 08:25:23.164300
data:
  {"type": "json", "value": {"ContainerOctaviaHousekeepingImage": "registry.redhat.io/rhosp-rhel9/openstack-octavia-housekeeping:17.1", "ContainerOctaviaConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1"}}


created_at: 2026-01-27 08:25:27.292883
data:
  {"tuple:('role_data', 'step_config')": "include tripleo::profile::base::database::mysql::client", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-62-p2fhguvvljrl-MySQLClient-twwz544oq7or/97a65a52-9136-474e-8850-2a7081a04407"}


created_at: 2026-01-27 08:25:27.348035
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-62-p2fhguvvljrl-ContainersCommon-wwtojxkkjzic/716aec9a-4f36-47fe-b214-1e763a1f17e2"}


created_at: 2026-01-27 08:25:27.410203
data:
  {"tuple:('role_data', 'config_settings')": {"octavia::logging::debug": true, "octavia::purge_config": false, "octavia::notification_driver": ["messagingv2"], "octavia::db::database_connection": "mysql+pymysql://octavia:9L5MLYf8jSxgOBZhJVNqF7RoH@172.17.0.2/octavia?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "octavia::service_auth::auth_url": "http://172.17.0.2:5000/v3", "octavia::service_auth::auth_type": "password", "octavia::service_auth::username": "octavia", "octavia::service_auth::password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "octavia::service_auth::project_name": "service", "octavia::service_auth::project_domain_name": "Default", "octavia::service_auth::user_domain_name": "Default", "octavia::service_auth::region_name": "regionOne", "octavia::nova::endpoint_type": "internalURL", "octavia::neutron::endpoint_type": "internalURL", "octavia::glance::endpoint_type": "internalURL", "octavia::cinder::endpoint_type": "internalURL", "octavia::certificates::endpoint_type": "internalURL", "octavia::certificates::ca_certificate": "/etc/octavia/certs/ca_01.pem", "octavia::certificates::ca_private_key": "/etc/octavia/certs/private/cakey.pem", "octavia::certificates::client_cert": "/etc/octavia/certs/client.pem", "octavia::certificates::server_certs_key_passphrase": "MImlNSPGC7DYHSSZMapBACiP79svIAmm", "octavia::certificates::ca_private_key_passphrase": "CpqTe0gLs68jBEgpNZd1ehsv4", "octavia::worker::manage_nova_flavor": false, "octavia::controller::amp_boot_network_list": [], "octavia::controller::amp_flavor_id": "65", "octavia::controller::amp_image_tag": "amphora-image", "octavia::controller::amp_ssh_key_name": "octavia-ssh-key", "octavia::controller::enable_ssh_access": true, "octavia::controller::timeout_client_data": 50000, "octavia::controller::timeout_member_connect": 5000, "octavia::controller::timeout_member_data": 50000, "octavia::controller::timeout_tcp_inspect": 0, "octavia::controller::connection_max_retries": 120, "octavia::controller::connection_logging": true, "octavia::controller::build_active_retries": 120, "octavia::controller::port_detach_timeout": 300, "octavia::controller::administrative_log_facility": 1, "octavia::controller::forward_all_logs": true, "octavia::controller::user_log_facility": 0, "octavia::controller::disable_local_log_storage": false, "octavia::nova::enable_anti_affinity": true, "octavia::rabbit_heartbeat_in_pthread": false}, "tuple:('role_data', 'upgrade_tasks')": [{"name": "make sure that post-deploy.conf exists before restarting containers on update or upgrade", "when": "step|int == 5", "block": [{"name": "check for octavia post-deploy.conf file", "stat": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf"}, "register": "octavia_post_deploy_stat"}, {"name": "create an empty post-deploy.conf file if it does not exist", "file": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf", "state": "touch", "setype": "container_file_t", "mode": "0755"}, "when": ["octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists"]}]}, {"name": "pre-check to ensure redis is removed if the service is disabled", "when": ["step|int == 0", "\"redis\" not in enabled_services|list", "\"pacemaker\" in enabled_services|list"], "become": true, "shell": "export CIB_file=/var/lib/pacemaker/cib/cib.xml\nif crm_resource -r redis-bundle -q &>/dev/null; then\n  echo \"Redis resource present in pacemaker but disabled by default in TripleO\" >&2\n  echo \"Delete the resource in pacemaker or enable the redis service before upgrading\" >&2\n  exit 1\nfi"}], "tuple:('role_data', 'update_tasks')": [{"name": "make sure that post-deploy.conf exists before restarting containers on update or upgrade", "when": "step|int == 5", "block": [{"name": "check for octavia post-deploy.conf file", "stat": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf"}, "register": "octavia_post_deploy_stat"}, {"name": "create an empty post-deploy.conf file if it does not exist", "file": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf", "state": "touch", "setype": "container_file_t", "mode": "0755"}, "when": ["octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists"]}]}], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-62-p2fhguvvljrl-OctaviaBase-6xwqdmnrox5n/cce75992-364e-4bce-b306-0027d772f76f"}


created_at: 2026-01-27 08:25:27.416524
data:
  {"value": {"ContainerOctaviaHousekeepingImage": "registry.redhat.io/rhosp-rhel9/openstack-octavia-housekeeping:17.1", "ContainerOctaviaConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1"}}


created_at: 2026-01-27 08:25:27.428036
data:
  {"tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'service_name')": "octavia_housekeeping", "tuple:('role_data', 'docker_config')": {"step_2": {"octavia_housekeeping_init_dirs": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-housekeeping:17.1", "user": "root", "net": "none", "volumes": ["/var/lib/config-data/puppet-generated/octavia/etc/octavia:/etc/octavia:z"], "command": ["/bin/bash", "-c", "mkdir -p /etc/octavia/conf.d/octavia-housekeeping; chown -R octavia:octavia /etc/octavia/conf.d/octavia-housekeeping"]}}, "step_5": {"octavia_housekeeping": {"start_order": 2, "stop_grace_period": 630, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-housekeeping:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/octavia_housekeeping.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro", "/var/log/containers/octavia:/var/log/octavia:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "role_data": {"service_name": "octavia_housekeeping", "monitoring_subscription": "overcloud-octavia-housekeeping", "config_settings": {"octavia::logging::debug": true, "octavia::purge_config": false, "octavia::notification_driver": ["messagingv2"], "octavia::db::database_connection": "mysql+pymysql://octavia:9L5MLYf8jSxgOBZhJVNqF7RoH@172.17.0.2/octavia?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "octavia::service_auth::auth_url": "http://172.17.0.2:5000/v3", "octavia::service_auth::auth_type": "password", "octavia::service_auth::username": "octavia", "octavia::service_auth::password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "octavia::service_auth::project_name": "service", "octavia::service_auth::project_domain_name": "Default", "octavia::service_auth::user_domain_name": "Default", "octavia::service_auth::region_name": "regionOne", "octavia::nova::endpoint_type": "internalURL", "octavia::neutron::endpoint_type": "internalURL", "octavia::glance::endpoint_type": "internalURL", "octavia::cinder::endpoint_type": "internalURL", "octavia::certificates::endpoint_type": "internalURL", "octavia::certificates::ca_certificate": "/etc/octavia/certs/ca_01.pem", "octavia::certificates::ca_private_key": "/etc/octavia/certs/private/cakey.pem", "octavia::certificates::client_cert": "/etc/octavia/certs/client.pem", "octavia::certificates::server_certs_key_passphrase": "MImlNSPGC7DYHSSZMapBACiP79svIAmm", "octavia::certificates::ca_private_key_passphrase": "CpqTe0gLs68jBEgpNZd1ehsv4", "octavia::worker::manage_nova_flavor": false, "octavia::controller::amp_boot_network_list": [], "octavia::controller::amp_flavor_id": "65", "octavia::controller::amp_image_tag": "amphora-image", "octavia::controller::amp_ssh_key_name": "octavia-ssh-key", "octavia::controller::enable_ssh_access": true, "octavia::controller::timeout_client_data": 50000, "octavia::controller::timeout_member_connect": 5000, "octavia::controller::timeout_member_data": 50000, "octavia::controller::timeout_tcp_inspect": 0, "octavia::controller::connection_max_retries": 120, "octavia::controller::connection_logging": true, "octavia::controller::build_active_retries": 120, "octavia::controller::port_detach_timeout": 300, "octavia::controller::administrative_log_facility": 1, "octavia::controller::forward_all_logs": true, "octavia::controller::user_log_facility": 0, "octavia::controller::disable_local_log_storage": false, "octavia::nova::enable_anti_affinity": true, "octavia::rabbit_heartbeat_in_pthread": false}, "service_config_settings": {"rsyslog": {"tripleo_logging_sources_octavia_housekeeping": [{"tag": "openstack.octavia.housekeeping", "file": "/var/log/containers/octavia/housekeeping.log"}]}}, "puppet_config": {"config_volume": "octavia", "puppet_tags": "octavia_config", "step_config": "include tripleo::profile::base::octavia::housekeeping\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/octavia_housekeeping.json": {"command": "/usr/bin/octavia-housekeeping --config-file /usr/share/octavia/octavia-dist.conf --config-file /etc/octavia/octavia.conf --config-file /etc/octavia/post-deploy.conf --log-file /var/log/octavia/housekeeping.log --config-dir /etc/octavia/conf.d/octavia-housekeeping", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/octavia", "owner": "octavia:octavia", "recurse": true}]}}, "docker_config": {"step_2": {"octavia_housekeeping_init_dirs": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-housekeeping:17.1", "user": "root", "net": "none", "volumes": ["/var/lib/config-data/puppet-generated/octavia/etc/octavia:/etc/octavia:z"], "command": ["/bin/bash", "-c", "mkdir -p /etc/octavia/conf.d/octavia-housekeeping; chown -R octavia:octavia /etc/octavia/conf.d/octavia-housekeeping"]}}, "step_5": {"octavia_housekeeping": {"start_order": 2, "stop_grace_period": 630, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-housekeeping:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/octavia_housekeeping.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro", "/var/log/containers/octavia:/var/log/octavia:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "update_tasks": [{"name": "make sure that post-deploy.conf exists before restarting containers on update or upgrade", "when": "step|int == 5", "block": [{"name": "check for octavia post-deploy.conf file", "stat": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf"}, "register": "octavia_post_deploy_stat"}, {"name": "create an empty post-deploy.conf file if it does not exist", "file": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf", "state": "touch", "setype": "container_file_t", "mode": "0755"}, "when": ["octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists"]}]}], "upgrade_tasks": [{"name": "make sure that post-deploy.conf exists before restarting containers on update or upgrade", "when": "step|int == 5", "block": [{"name": "check for octavia post-deploy.conf file", "stat": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf"}, "register": "octavia_post_deploy_stat"}, {"name": "create an empty post-deploy.conf file if it does not exist", "file": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf", "state": "touch", "setype": "container_file_t", "mode": "0755"}, "when": ["octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists"]}]}, {"name": "pre-check to ensure redis is removed if the service is disabled", "when": ["step|int == 0", "\"redis\" not in enabled_services|list", "\"pacemaker\" in enabled_services|list"], "become": true, "shell": "export CIB_file=/var/lib/pacemaker/cib/cib.xml\nif crm_resource -r redis-bundle -q &>/dev/null; then\n  echo \"Redis resource present in pacemaker but disabled by default in TripleO\" >&2\n  echo \"Delete the resource in pacemaker or enable the redis service before upgrading\" >&2\n  exit 1\nfi"}], "host_prep_tasks": [{"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/octavia", "setype": "container_file_t", "mode": "0750"}]}], "external_upgrade_tasks": [{"when": ["step|int == 1"], "tags": ["never", "system_upgrade_transfer_data", "system_upgrade_stop_services"], "block": [{"name": "Stop octavia housekeeping container", "import_role": {"name": "tripleo_container_stop"}, "vars": {"tripleo_containers_to_stop": ["octavia_housekeeping"], "tripleo_delegate_to": "{{ groups['octavia_housekeeping'] | difference(groups['excluded_overcloud']) }}"}}]}]}, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'config_settings')": {"octavia::logging::debug": true, "octavia::purge_config": false, "octavia::notification_driver": ["messagingv2"], "octavia::db::database_connection": "mysql+pymysql://octavia:9L5MLYf8jSxgOBZhJVNqF7RoH@172.17.0.2/octavia?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "octavia::service_auth::auth_url": "http://172.17.0.2:5000/v3", "octavia::service_auth::auth_type": "password", "octavia::service_auth::username": "octavia", "octavia::service_auth::password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "octavia::service_auth::project_name": "service", "octavia::service_auth::project_domain_name": "Default", "octavia::service_auth::user_domain_name": "Default", "octavia::service_auth::region_name": "regionOne", "octavia::nova::endpoint_type": "internalURL", "octavia::neutron::endpoint_type": "internalURL", "octavia::glance::endpoint_type": "internalURL", "octavia::cinder::endpoint_type": "internalURL", "octavia::certificates::endpoint_type": "internalURL", "octavia::certificates::ca_certificate": "/etc/octavia/certs/ca_01.pem", "octavia::certificates::ca_private_key": "/etc/octavia/certs/private/cakey.pem", "octavia::certificates::client_cert": "/etc/octavia/certs/client.pem", "octavia::certificates::server_certs_key_passphrase": "MImlNSPGC7DYHSSZMapBACiP79svIAmm", "octavia::certificates::ca_private_key_passphrase": "CpqTe0gLs68jBEgpNZd1ehsv4", "octavia::worker::manage_nova_flavor": false, "octavia::controller::amp_boot_network_list": [], "octavia::controller::amp_flavor_id": "65", "octavia::controller::amp_image_tag": "amphora-image", "octavia::controller::amp_ssh_key_name": "octavia-ssh-key", "octavia::controller::enable_ssh_access": true, "octavia::controller::timeout_client_data": 50000, "octavia::controller::timeout_member_connect": 5000, "octavia::controller::timeout_member_data": 50000, "octavia::controller::timeout_tcp_inspect": 0, "octavia::controller::connection_max_retries": 120, "octavia::controller::connection_logging": true, "octavia::controller::build_active_retries": 120, "octavia::controller::port_detach_timeout": 300, "octavia::controller::administrative_log_facility": 1, "octavia::controller::forward_all_logs": true, "octavia::controller::user_log_facility": 0, "octavia::controller::disable_local_log_storage": false, "octavia::nova::enable_anti_affinity": true, "octavia::rabbit_heartbeat_in_pthread": false}, "tuple:('role_data', 'step_config')": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-62-p2fhguvvljrl/fa642998-6984-42c1-8e93-815638d20964"}


created_at: 2026-01-27 08:25:32.901869
data:
  {"tuple:('role_data', 'step_config')": "include tripleo::profile::base::database::mysql::client", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-63-yaecfn2b5fb2-MySQLClient-ivlcpez4vkp5/b54088aa-be34-4955-867b-a64a993214d5"}


created_at: 2026-01-27 08:25:32.960098
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "healthcheck_rpc_port": {"test": "/openstack/healthcheck 5672"}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-63-yaecfn2b5fb2-ContainersCommon-f2cslru3jmrs/ed2c7ee9-a69f-4e20-813d-4c8a8bcd1d1a"}


created_at: 2026-01-27 08:25:33.007618
data:
  {"tuple:('role_data', 'config_settings')": {"octavia::logging::debug": true, "octavia::purge_config": false, "octavia::notification_driver": ["messagingv2"], "octavia::db::database_connection": "mysql+pymysql://octavia:9L5MLYf8jSxgOBZhJVNqF7RoH@172.17.0.2/octavia?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "octavia::service_auth::auth_url": "http://172.17.0.2:5000/v3", "octavia::service_auth::auth_type": "password", "octavia::service_auth::username": "octavia", "octavia::service_auth::password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "octavia::service_auth::project_name": "service", "octavia::service_auth::project_domain_name": "Default", "octavia::service_auth::user_domain_name": "Default", "octavia::service_auth::region_name": "regionOne", "octavia::nova::endpoint_type": "internalURL", "octavia::neutron::endpoint_type": "internalURL", "octavia::glance::endpoint_type": "internalURL", "octavia::cinder::endpoint_type": "internalURL", "octavia::certificates::endpoint_type": "internalURL", "octavia::certificates::ca_certificate": "/etc/octavia/certs/ca_01.pem", "octavia::certificates::ca_private_key": "/etc/octavia/certs/private/cakey.pem", "octavia::certificates::client_cert": "/etc/octavia/certs/client.pem", "octavia::certificates::server_certs_key_passphrase": "MImlNSPGC7DYHSSZMapBACiP79svIAmm", "octavia::certificates::ca_private_key_passphrase": "CpqTe0gLs68jBEgpNZd1ehsv4", "octavia::worker::manage_nova_flavor": false, "octavia::controller::amp_boot_network_list": [], "octavia::controller::amp_flavor_id": "65", "octavia::controller::amp_image_tag": "amphora-image", "octavia::controller::amp_ssh_key_name": "octavia-ssh-key", "octavia::controller::enable_ssh_access": true, "octavia::controller::timeout_client_data": 50000, "octavia::controller::timeout_member_connect": 5000, "octavia::controller::timeout_member_data": 50000, "octavia::controller::timeout_tcp_inspect": 0, "octavia::controller::connection_max_retries": 120, "octavia::controller::connection_logging": true, "octavia::controller::build_active_retries": 120, "octavia::controller::port_detach_timeout": 300, "octavia::controller::administrative_log_facility": 1, "octavia::controller::forward_all_logs": true, "octavia::controller::user_log_facility": 0, "octavia::controller::disable_local_log_storage": false, "octavia::nova::enable_anti_affinity": true, "octavia::rabbit_heartbeat_in_pthread": false}, "tuple:('role_data', 'upgrade_tasks')": [{"name": "make sure that post-deploy.conf exists before restarting containers on update or upgrade", "when": "step|int == 5", "block": [{"name": "check for octavia post-deploy.conf file", "stat": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf"}, "register": "octavia_post_deploy_stat"}, {"name": "create an empty post-deploy.conf file if it does not exist", "file": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf", "state": "touch", "setype": "container_file_t", "mode": "0755"}, "when": ["octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists"]}]}, {"name": "pre-check to ensure redis is removed if the service is disabled", "when": ["step|int == 0", "\"redis\" not in enabled_services|list", "\"pacemaker\" in enabled_services|list"], "become": true, "shell": "export CIB_file=/var/lib/pacemaker/cib/cib.xml\nif crm_resource -r redis-bundle -q &>/dev/null; then\n  echo \"Redis resource present in pacemaker but disabled by default in TripleO\" >&2\n  echo \"Delete the resource in pacemaker or enable the redis service before upgrading\" >&2\n  exit 1\nfi"}], "tuple:('role_data', 'update_tasks')": [{"name": "make sure that post-deploy.conf exists before restarting containers on update or upgrade", "when": "step|int == 5", "block": [{"name": "check for octavia post-deploy.conf file", "stat": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf"}, "register": "octavia_post_deploy_stat"}, {"name": "create an empty post-deploy.conf file if it does not exist", "file": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf", "state": "touch", "setype": "container_file_t", "mode": "0755"}, "when": ["octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists"]}]}], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-63-yaecfn2b5fb2-OctaviaBase-zvqs7ncjmrf2/ccdb6821-7a11-4de9-a084-f16e0e43372a"}


created_at: 2026-01-27 08:25:33.022976
data:
  {"tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'service_name')": "octavia_worker", "tuple:('role_data', 'docker_config')": {"step_2": {"octavia_worker_init_dirs": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-worker:17.1", "user": "root", "net": "none", "volumes": ["/var/lib/config-data/puppet-generated/octavia/etc/octavia:/etc/octavia:z"], "command": ["/bin/bash", "-c", "mkdir -p /etc/octavia/conf.d/octavia-worker; chown -R octavia:octavia /etc/octavia/conf.d/octavia-worker"]}}, "step_5": {"octavia_worker": {"start_order": 2, "stop_grace_period": 630, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-worker:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck 5672"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/octavia_worker.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro", "/var/log/containers/octavia:/var/log/octavia:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "role_data": {"service_name": "octavia_worker", "monitoring_subscription": "overcloud-octavia-worker", "config_settings": {"octavia::logging::debug": true, "octavia::purge_config": false, "octavia::notification_driver": ["messagingv2"], "octavia::db::database_connection": "mysql+pymysql://octavia:9L5MLYf8jSxgOBZhJVNqF7RoH@172.17.0.2/octavia?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "octavia::service_auth::auth_url": "http://172.17.0.2:5000/v3", "octavia::service_auth::auth_type": "password", "octavia::service_auth::username": "octavia", "octavia::service_auth::password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "octavia::service_auth::project_name": "service", "octavia::service_auth::project_domain_name": "Default", "octavia::service_auth::user_domain_name": "Default", "octavia::service_auth::region_name": "regionOne", "octavia::nova::endpoint_type": "internalURL", "octavia::neutron::endpoint_type": "internalURL", "octavia::glance::endpoint_type": "internalURL", "octavia::cinder::endpoint_type": "internalURL", "octavia::certificates::endpoint_type": "internalURL", "octavia::certificates::ca_certificate": "/etc/octavia/certs/ca_01.pem", "octavia::certificates::ca_private_key": "/etc/octavia/certs/private/cakey.pem", "octavia::certificates::client_cert": "/etc/octavia/certs/client.pem", "octavia::certificates::server_certs_key_passphrase": "MImlNSPGC7DYHSSZMapBACiP79svIAmm", "octavia::certificates::ca_private_key_passphrase": "CpqTe0gLs68jBEgpNZd1ehsv4", "octavia::worker::manage_nova_flavor": false, "octavia::controller::amp_boot_network_list": [], "octavia::controller::amp_flavor_id": "65", "octavia::controller::amp_image_tag": "amphora-image", "octavia::controller::amp_ssh_key_name": "octavia-ssh-key", "octavia::controller::enable_ssh_access": true, "octavia::controller::timeout_client_data": 50000, "octavia::controller::timeout_member_connect": 5000, "octavia::controller::timeout_member_data": 50000, "octavia::controller::timeout_tcp_inspect": 0, "octavia::controller::connection_max_retries": 120, "octavia::controller::connection_logging": true, "octavia::controller::build_active_retries": 120, "octavia::controller::port_detach_timeout": 300, "octavia::controller::administrative_log_facility": 1, "octavia::controller::forward_all_logs": true, "octavia::controller::user_log_facility": 0, "octavia::controller::disable_local_log_storage": false, "octavia::nova::enable_anti_affinity": true, "octavia::rabbit_heartbeat_in_pthread": false}, "service_config_settings": {"rsyslog": {"tripleo_logging_sources_octavia_worker": [{"tag": "openstack.octavia.worker", "file": "/var/log/containers/octavia/worker.log"}]}}, "puppet_config": {"config_volume": "octavia", "puppet_tags": "octavia_config", "step_config": "['nova_flavor'].each |String $val| { noop_resource($val) }\ninclude tripleo::profile::base::octavia::worker\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-api:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/octavia_worker.json": {"command": "/usr/bin/octavia-worker --config-file /usr/share/octavia/octavia-dist.conf --config-file /etc/octavia/octavia.conf --config-file /etc/octavia/post-deploy.conf --log-file /var/log/octavia/worker.log --config-dir /etc/octavia/conf.d/octavia-worker", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/octavia", "owner": "octavia:octavia", "recurse": true}]}}, "docker_config": {"step_2": {"octavia_worker_init_dirs": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-worker:17.1", "user": "root", "net": "none", "volumes": ["/var/lib/config-data/puppet-generated/octavia/etc/octavia:/etc/octavia:z"], "command": ["/bin/bash", "-c", "mkdir -p /etc/octavia/conf.d/octavia-worker; chown -R octavia:octavia /etc/octavia/conf.d/octavia-worker"]}}, "step_5": {"octavia_worker": {"start_order": 2, "stop_grace_period": 630, "image": "registry.redhat.io/rhosp-rhel9/openstack-octavia-worker:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck 5672"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/octavia_worker.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro", "/var/log/containers/octavia:/var/log/octavia:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "host_prep_tasks": [{"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/octavia", "setype": "container_file_t", "mode": "0750"}]}, {"block": [{"name": "Ensure packages required for configuring octavia are present", "package": {"name": ["python3-neutronclient", "python3-openstackclient", "python3-octaviaclient", "openssl"], "state": "present"}}], "when": true}, {"name": "enable virt_sandbox_use_netlink for healthcheck", "seboolean": {"name": "virt_sandbox_use_netlink", "persistent": true, "state": true}, "when": ["ansible_facts.selinux is defined", "ansible_facts.selinux.status == \"enabled\""]}], "update_tasks": [{"name": "make sure that post-deploy.conf exists before restarting containers on update or upgrade", "when": "step|int == 5", "block": [{"name": "check for octavia post-deploy.conf file", "stat": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf"}, "register": "octavia_post_deploy_stat"}, {"name": "create an empty post-deploy.conf file if it does not exist", "file": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf", "state": "touch", "setype": "container_file_t", "mode": "0755"}, "when": ["octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists"]}]}], "upgrade_tasks": [{"name": "make sure that post-deploy.conf exists before restarting containers on update or upgrade", "when": "step|int == 5", "block": [{"name": "check for octavia post-deploy.conf file", "stat": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf"}, "register": "octavia_post_deploy_stat"}, {"name": "create an empty post-deploy.conf file if it does not exist", "file": {"path": "/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf", "state": "touch", "setype": "container_file_t", "mode": "0755"}, "when": ["octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists"]}]}, {"name": "pre-check to ensure redis is removed if the service is disabled", "when": ["step|int == 0", "\"redis\" not in enabled_services|list", "\"pacemaker\" in enabled_services|list"], "become": true, "shell": "export CIB_file=/var/lib/pacemaker/cib/cib.xml\nif crm_resource -r redis-bundle -q &>/dev/null; then\n  echo \"Redis resource present in pacemaker but disabled by default in TripleO\" >&2\n  echo \"Delete the resource in pacemaker or enable the redis service before upgrading\" >&2\n  exit 1\nfi"}], "external_upgrade_tasks": [{"when": ["step|int == 1"], "tags": ["never", "system_upgrade_transfer_data", "system_upgrade_stop_services"], "block": [{"name": "Stop octavia api container", "import_role": {"name": "tripleo_container_stop"}, "vars": {"tripleo_containers_to_stop": ["octavia_worker"], "tripleo_delegate_to": "{{ groups['octavia_worker'] | difference(groups['excluded_overcloud']) }}"}}]}]}, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'config_settings')": {"octavia::logging::debug": true, "octavia::purge_config": false, "octavia::notification_driver": ["messagingv2"], "octavia::db::database_connection": "mysql+pymysql://octavia:9L5MLYf8jSxgOBZhJVNqF7RoH@172.17.0.2/octavia?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "octavia::service_auth::auth_url": "http://172.17.0.2:5000/v3", "octavia::service_auth::auth_type": "password", "octavia::service_auth::username": "octavia", "octavia::service_auth::password": "9L5MLYf8jSxgOBZhJVNqF7RoH", "octavia::service_auth::project_name": "service", "octavia::service_auth::project_domain_name": "Default", "octavia::service_auth::user_domain_name": "Default", "octavia::service_auth::region_name": "regionOne", "octavia::nova::endpoint_type": "internalURL", "octavia::neutron::endpoint_type": "internalURL", "octavia::glance::endpoint_type": "internalURL", "octavia::cinder::endpoint_type": "internalURL", "octavia::certificates::endpoint_type": "internalURL", "octavia::certificates::ca_certificate": "/etc/octavia/certs/ca_01.pem", "octavia::certificates::ca_private_key": "/etc/octavia/certs/private/cakey.pem", "octavia::certificates::client_cert": "/etc/octavia/certs/client.pem", "octavia::certificates::server_certs_key_passphrase": "MImlNSPGC7DYHSSZMapBACiP79svIAmm", "octavia::certificates::ca_private_key_passphrase": "CpqTe0gLs68jBEgpNZd1ehsv4", "octavia::worker::manage_nova_flavor": false, "octavia::controller::amp_boot_network_list": [], "octavia::controller::amp_flavor_id": "65", "octavia::controller::amp_image_tag": "amphora-image", "octavia::controller::amp_ssh_key_name": "octavia-ssh-key", "octavia::controller::enable_ssh_access": true, "octavia::controller::timeout_client_data": 50000, "octavia::controller::timeout_member_connect": 5000, "octavia::controller::timeout_member_data": 50000, "octavia::controller::timeout_tcp_inspect": 0, "octavia::controller::connection_max_retries": 120, "octavia::controller::connection_logging": true, "octavia::controller::build_active_retries": 120, "octavia::controller::port_detach_timeout": 300, "octavia::controller::administrative_log_facility": 1, "octavia::controller::forward_all_logs": true, "octavia::controller::user_log_facility": 0, "octavia::controller::disable_local_log_storage": false, "octavia::nova::enable_anti_affinity": true, "octavia::rabbit_heartbeat_in_pthread": false}, "tuple:('role_data', 'step_config')": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-63-yaecfn2b5fb2/bceef66b-719b-4673-98c4-71c5c9a5be94"}


created_at: 2026-01-27 08:25:34.444150
data:
  {"tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'service_name')": "openstack_clients", "tuple:('role_data', 'docker_config')": null, "role_data": {"service_name": "openstack_clients", "host_prep_tasks": [{"include_role": {"name": "tripleo_clients_install"}}]}, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'config_settings')": null, "tuple:('role_data', 'step_config')": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-64-mmwapv7wjzpx/ccf6ae71-b873-4c7a-80cc-d0ff69b9b70d"}


created_at: 2026-01-27 08:25:37.000660
data:
  {"OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-65-aaqjeoki53jt-ContainersCommon-7ssgaytepuj4/b37491d7-807e-4454-82b2-0e3b62a1c99d"}


created_at: 2026-01-27 08:25:37.027796
data:
  {"tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'service_name')": "oslo_messaging_notify", "tuple:('role_data', 'docker_config')": null, "role_data": {"service_name": "oslo_messaging_notify", "global_config_settings": {"oslo_messaging_notify_scheme": "rabbit", "oslo_messaging_notify_user_name": "guest", "oslo_messaging_notify_password": "rAEOjyWy2c6PARokWxktfn5mX", "oslo_messaging_notify_use_ssl": "False", "oslo_messaging_notify_port": 5672}}, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'config_settings')": null, "tuple:('role_data', 'step_config')": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-65-aaqjeoki53jt/8c3ea762-d8e7-45fb-8750-159c62b92968"}


created_at: 2026-01-27 08:25:37.435986
data:
  {"type": "json", "value": {"ContainerRabbitmqImage": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1", "ContainerRabbitmqConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1"}}


created_at: 2026-01-27 08:25:46.583719
data:
  {"container_puppet_apply_volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/var/lib/container-config-scripts/container_puppet_apply.sh:/container_puppet_apply.sh:ro", "/etc/puppet:/tmp/puppet-etc:ro", "/usr/share/openstack-puppet/modules:/usr/share/openstack-puppet/modules:ro"], "container_config_scripts": {"container_puppet_apply.sh": {"mode": "0700", "content": "#!/bin/bash\nset -eux\nSTEP=$1\nTAGS=$2\nCONFIG=$3\nEXTRA_ARGS=${4:-''}\nif [ -d /tmp/puppet-etc ]; then\n  # ignore copy failures as these may be the same file depending on docker mounts\n  cp -a /tmp/puppet-etc/* /etc/puppet || true\nfi\necho \"{\\\"step\\\": ${STEP}}\" > /etc/puppet/hieradata/docker_puppet.json\n# $::deployment_type in puppet-tripleo\nexport FACTER_deployment_type=containers\nset +e\npuppet apply $EXTRA_ARGS \\\n    --verbose \\\n    --detailed-exitcodes \\\n    --summarize \\\n    --color=false \\\n    --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \\\n    --tags $TAGS \\\n    -e \"noop_resource('package'); ${CONFIG}\"\nrc=$?\nset -e\nset +ux\nif [ $rc -eq 2 -o $rc -eq 0 ]; then\n    exit 0\nfi\nexit $rc\n"}, "pyshim.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n#\n# Usage: pyshim.sh <script and/or arguments>\n#\n# Unfortunately THT doesn't know which version of python might be in a\n# container so we need this script to be able to try python3 or python2\n# depending on availability.  Since this is a temporary shim until we've\n# fully cut over to python3, we check for the existence of python3 first\n# before falling back to python2. This will help in the transition from\n# python2 based containers to python3.\n\nshow_usage() {\n    echo \"Usage: pyshim.sh <script and/or arguments>\"\n}\n\nif [ $# -lt 1 ]\nthen\n    show_usage\n    exit 1\nfi\n\nset -x\nif command -v python3 >/dev/null; then\n    python3 \"$@\"\nelif command -v python2 >/dev/null; then\n    python2 \"$@\"\nelif command -v python >/dev/null; then\n    python \"$@\"\nelse\n    echo \"ERROR: python is not available!\"\n    exit 1\nfi\n"}, "pacemaker_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nset -u\n\n# ./pacemaker_restart_bundle.sh mysql galera galera-bundle Master _\n# ./pacemaker_restart_bundle.sh redis redis redis-bundle Slave Master\n# ./pacemaker_restart_bundle.sh ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\nRESTART_SCRIPTS_DIR=$(dirname $0)\nTRIPLEO_SERVICE=$1\nRESOURCE_NAME=$2\nBUNDLE_NAME=$3\nWAIT_TARGET_LOCAL=$4\nWAIT_TARGET_ANYWHERE=${5:-_}\nTRIPLEO_MINOR_UPDATE=\"${TRIPLEO_MINOR_UPDATE:-false}\"\nTRIPLEO_HA_WRAPPER_RESOURCE_EXISTS=\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS:-false}\"\n\nbundle_can_be_restarted() {\n    local bundle=$1\n    # As long as the resource bundle is managed by pacemaker and is\n    # not meant to stay stopped, no matter the state of any inner\n    # pcmk_remote or ocf resource, we should restart it to give it a\n    # chance to read the new config.\n    [ \"$(crm_resource --meta -r $1 -g is-managed 2>/dev/null)\" != \"false\" ] && \\\n    [ \"$(crm_resource --meta -r $1 -g target-role 2>/dev/null)\" != \"Stopped\" ]\n}\n\nlog() {\n    local msg=$1\n    logger -t pcmkrestart \"$1\"\n}\n\nHOSTNAME=$(/bin/hostname -s)\nif [ x\"${TRIPLEO_MINOR_UPDATE,,}\" != x\"true\" ]; then\n    if [ x\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS,,}\" = x\"false\" ]; then\n        # Do not restart during initial deployment, as the resource\n        # has just been created.\n        SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n        if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n            log \"Initial deployment, skipping the restart of ${BUNDLE_NAME}\"\n\tfi\n        exit 0\n    else\n        # During a stack update, this script is called in parallel on\n        # every node the resource runs on, after the service's configs\n        # have been updated on all nodes. So we need to run pcs only\n        # once (e.g. on the service's boostrap node).\n        if bundle_can_be_restarted ${BUNDLE_NAME}; then\n            SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n            if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n                replicas_running=$(crm_resource -Q -r $BUNDLE_NAME --locate 2>&1 | wc -l)\n                if [ \"$replicas_running\" != \"0\" ]; then\n                    log \"Restarting ${BUNDLE_NAME} globally. Stopping:\"\n                    /sbin/pcs resource disable --wait=600 $BUNDLE_NAME\n                    log \"Restarting ${BUNDLE_NAME} globally. Starting:\"\n                    /sbin/pcs resource enable --wait=600 $BUNDLE_NAME\n                else\n                    log \"${BUNDLE_NAME} is not running anywhere,\" \\\n                         \"cleaning up to restart it globally if necessary\"\n                    /sbin/pcs resource cleanup $BUNDLE_NAME\n                fi\n            else\n                log \"Skipping global restart of ${BUNDLE_NAME} on ${HOSTNAME} it will be restarted by node ${SERVICE_NODEID}\"\n            fi\n\n        else\n            log \"No global restart needed for ${BUNDLE_NAME}.\"\n        fi\n    fi\nelse\n    # During a minor update workflow however, a host gets fully\n    # updated before updating the next one. So unlike stack\n    # update, at the time this script is called, the service's\n    # configs aren't updated on all nodes yet. So only restart the\n    # resource locally, where it's guaranteed that the config is\n    # up to date.\n    HOST=$(facter hostname)\n\n    if bundle_can_be_restarted ${BUNDLE_NAME}; then\n\t# if the resource is running locally, restart it\n\tif crm_resource -r $BUNDLE_NAME --locate 2>&1 | grep -w -q \"${HOST}\"; then\n            log \"Restarting ${BUNDLE_NAME} locally on '${HOST}'\"\n            /sbin/pcs resource restart $BUNDLE_NAME \"${HOST}\"\n\n\telse\n\t    # At this point, if no resource is running locally, it's\n\t    # either because a) it has failed previously, or b) because\n\t    # it's an A/P resource running elsewhere.\n\t    # By cleaning up resource, we ensure that a) it will try to\n\t    # restart, or b) it won't do anything if the resource is\n\t    # already running elsewhere.\n            log \"${BUNDLE_NAME} is currently not running on '${HOST}',\" \\\n                 \"cleaning up its state to restart it if necessary\"\n            /sbin/pcs resource cleanup $BUNDLE_NAME node=\"${HOST}\"\n\tfi\n\n\t# Wait until the resource is in the expected target state\n\t$RESTART_SCRIPTS_DIR/pacemaker_wait_bundle.sh \\\n            $RESOURCE_NAME $BUNDLE_NAME \\\n            \"$WAIT_TARGET_LOCAL\" \"$WAIT_TARGET_ANYWHERE\" \\\n\t    \"${HOST}\" 600\n    else\n        log \"No restart needed for ${BUNDLE_NAME}.\"\n    fi\nfi\n"}, "pacemaker_wait_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# ----\n# Wait for an OCF resource or a bundle to be restarted\n# ----\n# e.g.:\n# M/S OCF:      $0 galera galera-bundle Master\n# clone OCF:    $0 rabbitmq rabbitmq-bundle Started\n# A/P M/S OCF:  $0 redis redis-bundle Slave Master\n# A/P bundle:   $0 openstack-cinder-volume openstack-cinder-volume _ Started\n# clone bundle: $0 haproxy-bundle haproxy-bundle Started\n\n# design note 1:\n#  - this script is called during a minor update; it is called\n#    once per node that hosts a service replica.\n#  - the purpose of this script is to ensure that restarting the\n#    service replica locally won't disrupt the service availability\n#    for the end user. To reach that goal, the script waits until the\n#    service is restarted locally or globallu and reaches a given\n#    target state (i.e. Started, Slave or Master).\n# design note 2:\n#   - we don't want to track restart error: our only job is to ensure\n#     service restart synchronization, not service health.\n#   - In particular, we don't want to error out in case the resource\n#     cannot be restarted locally, because that would make the minor\n#     update fail, even if potentially other replicas still provide\n#     the service.\n# design note 3:\n#   - we can bail out early if we determine that the resource can't\n#     be restarted automatically by pacemaker (e.g. its \"blocked\",\n#     unmanaged or disabled).\n\nlog() {\n    local msg=$1\n    echo \"$(date -u): $1\"\n}\n\nusage() {\n    echo 2>&1 \"Usage: $0 NAME BUNDLE_NAME ROLE_LOCAL [ROLE_ANYWHERE] [HOST] [TIMEOUT]\"\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\n#\n# Utility functions to detect stuck resources\n#\n\nbundle_failures_locally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local replica_name\n    for i in $(seq 0 $last); do\n\treplica_name=${BUNDLE_NAME}-${engine}-${i}\n\tcrm_failcount -q -G -r $replica_name -N $HOST\n    done\n}\n\nbundle_failures_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    for i in $(seq 0 $last); do\n\tcrm_failcount -q -G -r ${BUNDLE_NAME}-${engine}-${i}\n    done\n}\n\nbundle_running_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    # return the number of running bundles replica, i.e. the number of\n    # docker/podman resource replicas currently running in the cluster\n    crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:heartbeat:${engine}']/node)\" -\n}\n\nocf_failures_globally() {\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local bundle_node\n    for i in $(seq 0 $last); do\n\tbundle_node=${BUNDLE_NAME}-${i}\n\tcrm_failcount -q -G -r $NAME -N $bundle_node\n    done\n}\n\ndid_resource_failed_locally() {\n    local failures\n    local running\n    local remotehost\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# if we're dealing with an ocf resource, it is running on a\n\t# pacemaker_remote rather that on the real host, and the\n\t# failcounts are thus associated to the pcmk remote. Replace\n\t# the host's name with the pcmk remote's name.\n        remotehost=$(crm_mon --as-xml | xmllint --xpath \"string(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource/node[@name='${HOST}']/../../resource[@resource_agent='${OCF}:pacemaker:remote']/@id)\" -)\n\tif [ -n \"${remotehost}\" ]; then\n\t    crm_failcount -q -G -r $NAME -N $remotehost | grep -q -w INFINITY\n\t    return $?\n\tfi\n\t# If no pcmk remote is currently running, the failcount from\n\t# the ocf resource is useless, compute the failcount from the\n\t# bundle case instead (computed below).\n    fi\n\n    # for bundles, pacemaker can run any bundle replica locally\n    # (e.g. galera-bundle-docker-{0,1,2}), and a failure happens when\n    # there are no more replica to try.\n    # That is, when _at least_ one replica failed locally, and all the\n    # others either failed or are currently running elsewhere.\n    failures=$(bundle_failures_locally $HOST | grep -c -w INFINITY)\n    running=$(bundle_running_globally)\n    test $failures -gt 0 && \\\n    test $(( $failures + $running )) -ge $BUNDLE_REPLICAS\n}\n\ndid_resource_failed_globally() {\n    local remotecount\n    local failures\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# we check the state of an ocf resource only if the\n\t# pcmkremotes are started\n        remotecount=$(crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node)\" -)\n\tif [ \"${remotecount}\" = \"0\" ]; then\n\t    # no pcmkremote is running, so check the bundle state\n\t    # instead of checking the ocf resource\n\t    # bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\t    failures=$(bundle_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\telse\n\t    # ocf resource failed if it failed to start on\n\t    # all $BUNDLE_REPLICAS bundle nodes\n\t    failures=$(ocf_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\tfi\n    else\n\t# bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\tfailures=$(bundle_failures_globally | grep -c -w INFINITY)\n\ttest $failures -eq $BUNDLE_REPLICAS\n    fi\n}\n\n\n# Input validation\n#\n\nNAME=$1\nif [ -z \"${NAME}\" ]; then\n    echo 2>&1 \"Error: argument NAME must not be empty\"\n    exit 1\nfi\n\nBUNDLE_NAME=$2\nif [ -z \"${BUNDLE_NAME}\" ]; then\n    echo 2>&1 \"Error: argument BUNDLE_NAME must not be empty\"\n    exit 1\nfi\n\nROLE_LOCAL=$3\nif [ \"${ROLE_LOCAL}\" = \"_\" ]; then\n    ROLE_LOCAL=\"\"\nfi\n\nROLE_ANYWHERE=$4\nif [ \"${ROLE_ANYWHERE}\" = \"_\" ]; then\n    ROLE_ANYWHERE=\"\"\nfi\n\nif [ -z \"${ROLE_LOCAL}\" ]; then\n    if [ -z \"${ROLE_ANYWHERE}\" ]; then\n        echo 2>&1 \"Error: either ROLE_LOCAL or ROLE_ANYWHERE must be non empty\"\n        exit 1\n    fi\nelse\n    if !(echo \"${ROLE_LOCAL}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n        echo 2>&1 \"Error: argument ROLE_LOCAL must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n        exit 1\n    fi\nfi\n\nif [ -n \"${ROLE_ANYWHERE}\" ] && !(echo \"${ROLE_ANYWHERE}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n    echo 2>&1 \"Error: argument ROLE_ANYWHERE must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n    exit 1\nfi\n\n# Ensure compatibility with pacemaker 2.1\nif pacemaker_supports_promoted; then\n    ROLE_LOCAL=$(echo \"$ROLE_LOCAL\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    ROLE_ANYWHERE=$(echo \"$ROLE_ANYWHERE\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    OCF=\"ocf\"\nelse\n    OCF=\"ocf:\"\nfi\n\nHOST=${5:-$(facter hostname)}\nTIMEOUT=${6:-600}\n\n\n# Configure the search\n# ----\n# Note: we can't use crm_resource in all searches because we can't\n# easily extract the host the OCF resources run on (crm_resource\n# returns the pcmk-remote nodes rather than the hosts)\n# So instead, we implement various searches with XPath directly.\n\nif [ \"${BUNDLE_NAME}\" != \"${NAME}\" ]; then\n# ocf resource\nlocal_resource_xpath=\"//bundle/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node[@name='${HOST}']/../../resource[@id='${NAME}']\"\nany_resource_xpath=\"//bundle//resource[@id='${NAME}']\"\nreplicas_xpath=\"//bundle/primitive[@id='${BUNDLE_NAME}']/../*[boolean(@image) and boolean(@replicas)]\"\nelse\n# bundle resource\nlocal_resource_xpath=\"//bundle[@id='${NAME}']/replica/resource/node[@name='${HOST}']/../../resource\"\nany_resource_xpath=\"//bundle[@id='${NAME}']//resource\"\nreplicas_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nfi\n\nbundle_def_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nBUNDLE_CONTAINER_ENGINE=$(cibadmin -Q | xmllint --xpath \"name(${bundle_def_xpath})\" -)\nBUNDLE_REPLICAS=$(cibadmin -Q | xmllint --xpath \"string(${bundle_def_xpath}/@replicas)\" -)\n\n\n# The wait algorithm follows a two-stage approach\n#  1. Depending on how the script is called, we first check whether\n#     the resource is restarted locally. An A/P resource may be\n#     restarted elsewhere in the cluster.\n#  2. If needed, check whether the A/P resource has restarted\n#     elsewhere. For A/P M/S resources, in case the resource is\n#     restarted as Slave locally, ensure a Master is available.\n\nsuccess=1\nbailout=1\ntimeout=$TIMEOUT\nrole=\"\"\n\n# Stage 1: local check\nif [ -n \"$ROLE_LOCAL\" ]; then\n    log \"Waiting until ${NAME} has restarted on ${HOST} and is in state ${ROLE_LOCAL}\"\n    log \"Will probe resource state with the following XPath pattern: ${local_resource_xpath}\"\n\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resource=$(crm_mon -r --as-xml | xmllint --xpath \"${local_resource_xpath}\" - 2>/dev/null)\n        role=$(echo \"${resource}\" | sed -ne 's/.*\\Wrole=\"\\([^\"]*\\)\".*/\\1/p')\n\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resource}\" | grep -q -w \"\\Wblocked=\\\"true\\\"\"; then\n            log \"${NAME} is blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_locally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif [ \"$role\" = \"$ROLE_LOCAL\" ]; then\n            success=0\n            continue\n        elif [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" = \"$ROLE_ANYWHERE\" ]; then\n            # A/P: we are restarted in the expected state\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_LOCAL} on ${HOST}\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\n# Stage 2: global check\nif [ $timeout -gt 0 ] && [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" != \"$ROLE_ANYWHERE\" ]; then\n    log \"Wait until ${NAME} is restarted anywhere in the cluster in state ${ROLE_ANYWHERE}\"\n    log \"Will probe resource state with the following XPath pattern: ${any_resource_xpath}\"\n\n    success=1\n    bailout=1\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resources=$(crm_mon -r --as-xml | xmllint --xpath \"${any_resource_xpath}\" - 2>/dev/null)\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif ! (echo \"${resources}\" | grep -q -w \"\\Wblocked=\\\"false\\\"\"); then\n            log \"${NAME} blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_globally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resources}\" | grep -q -w \"\\Wrole=\\\"${ROLE_ANYWHERE}\\\"\"; then\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_ANYWHERE} anywhere in the cluster\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\nif [ $timeout -le 0 ]; then\n    log \"Timeout reached after ${TIMEOUT}s while waiting for ${NAME} to be restarted\"\nelif [ $bailout -le 0 ]; then\n    log \"Restart monitoring for ${NAME} cancelled\"\nfi\n\nif [ $success -eq 0 ]; then\n    log \"${NAME} successfully restarted\"\nelse\n    log \"${NAME} was not restarted properly\"\nfi\n\n# Don't block minor update or stack update if the wait was unsuccessful\nexit 0\n"}, "wait-port-and-run.sh": {"mode": "0755", "content": "#!/usr/bin/bash\nset -eu\n\nHOST=$1\nPORT=$2\n\necho \"$(date -u): Checking whether we can bind to ${HOST}:${PORT}\"\nwhile (ss -Htnl src \"${HOST}\" \"sport = :${PORT}\" | grep -wq \"${PORT}\"); do\n    echo \"$(date -u): ${HOST}:${PORT} still in use, waiting...\";\n    sleep 10;\ndone\n\nshift 2\nCOMMAND=\"$*\"\nif [ -z \"${COMMAND}\" ]; then\n    COMMAND=\"true\"\nfi\nexec $COMMAND\n"}, "pacemaker_resource_lock.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nMAX_RETRIES=10\nCIB_ENOTFOUND=105\n\nusage() {\n   echo \"Set a global property in the cluster with a validity timestamp.\"\n   echo \"Usage:\"\n   echo \"   $0 --acquire <lock_name> <lock_owner> <lock_ttl_in_seconds>\"\n   echo \"   $0 --release <lock_name> <lock_owner>\"\n   echo\n}\n\nlog() {\n    echo \"$(date -u): $1\" 1>&2\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\nlock_create() {\n    local name=$1\n    local data=$2\n    # cibadmin won't overwrite a key if someone else succeeded to create it concurrently\n    cibadmin --sync-call --scope crm_config --create --xml-text \"<cluster_property_set id='${name}'><nvpair id='${name}-pair' name='${name}' value='${data}'/></cluster_property_set>\" &>/dev/null\n    return $?\n}\n\nlock_update() {\n    local name=$1\n    local expected_data=$2\n    local new_data=$3\n    # we only update the lock we expect to see, so we can't update someone else's lock\n    cibadmin --sync-call --scope crm_config --modify --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" --xml-text \"<nvpair id='${name}-pair' name='${name}' value='${new_data}'/>\" &>/dev/null\n    return $?\n}\n\nlock_delete() {\n    local name=$1\n    local expected_data=$2\n    # we only delete the lock we expect to see, so we can't delete someone else's lock\n    cibadmin --sync-call --scope crm_config --delete --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" &>/dev/null\n    return $?\n}\n\nlock_get() {\n    local lockname=$1\n    local res\n    local rc\n    res=$(cibadmin --query --scope crm_config --xpath \"//cluster_property_set/nvpair[@name='$lockname']\" 2>/dev/null)\n    rc=$?\n    if [ $rc -eq 0 ]; then\n        echo \"$res\" | sed -n 's/.*value=\"\\([^\"]*\\)\".*/\\1/p'\n    fi\n    return $rc\n}\n\nlock_owner() {\n    local lock=$1\n    echo \"$lock\" | cut -d':' -f1\n}\n\nlock_has_expired() {\n    local lock=$1\n    local expiry=$(echo \"$lock\" | cut -d':' -f2)\n    local now=$(date +%s)\n    test $now -ge $expiry\n}\n\n\n# Perform a lock action and restart if the CIB has been modified before\n# committing the lock action\ntry_action() {\n    local fun=$1\n    local lock=$2\n    local requester=$3\n    local args=${4:-}\n    local tries=$MAX_RETRIES\n    local rc=1\n    if [ \"$fun\" = \"lock_acquire\" ] || [ \"$fun\" = \"lock_release\" ]; then\n        log \"Try running $fun\"\n    else\n        return 2\n    fi\n    while [ $rc -ne 0 ]; do\n        $fun $lock $requester $args\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Operation $1 succeeded\"\n            return 0\n        elif [ $rc -eq 3 ]; then\n            # rc == 3 -> CIB changed before push\n            if [ $tries -eq 0 ]; then\n                log \"Failed to commit after $MAX_RETRIES retries. Bailing out.\"\n                return 2\n            else\n                log \"Failed to commit. Retrying operation.\"\n                tries=$(($tries - 1))\n            fi\n        elif [ $rc -eq 2 ]; then\n            # rc == 2 -> unrecoverable cib error (e.g. pacemaker down)\n            log \"Unexpected failure. Bailing out\"\n            return $rc\n        else\n            # rc == 1 -> lock error (not owner, lock doesn't exists)\n            return $rc\n        fi\n    done\n}\n\n# The lock mechanism uses cibadmin's atomic creation so cluster-wide\n# state coherency is guaranteed by pacemaker\nlock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc\n    local lock\n    local expiry\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -n \"$lock\" ]; then\n        lock_has_expired $lock\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Lock has expired, now available for being held\"\n        else\n            # lock is still held. check whether we're the owner\n            owner=$(lock_owner $lock)\n            if [ \"$owner\" = \"$requester\" ];then\n                log \"Requester already owns the lock, acquiring attempt will just reconfigure the TTL\"\n            else\n                log \"Lock is held by someone else ($owner)\"\n                return 1\n            fi\n        fi\n    else\n        log \"Lock is not held yet\"\n    fi\n\n    # prepare the lock info\n    expiry=$(($(date +%s) + $ttl))\n\n    if [ -n \"$lock\" ]; then\n        log \"Attempting to update the lock\"\n        lock_update $lockname \"$lock\" \"$requester:$expiry\"\n        rc=$?\n    else\n        log \"Attempting to acquire the lock\"\n        lock_create $lockname \"$requester:$expiry\"\n        rc=$?\n    fi\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' acquired by '$requester', valid until $(date -d @$expiry)\"\n        return 0\n    else\n        log \"CIB changed, lock cannot be acquired\"\n        return 3\n    fi\n}\n\n\n# The lock mechanism uses the CIB's num_updates tag to implement\n# a conditional store. Cluster-wide locking is guaranteed by pacemaker\nlock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n    local lock\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        log \"Lock doesn't exist. Nothing to release\"\n        return 0\n    else\n        log \"Lock exists, check whether we're the owner\"\n        owner=$(lock_owner $lock)\n        if [ \"$owner\" != \"$requester\" ];then\n            log \"Lock is held by someone else ($owner), will not unlock\"\n            return 1\n        fi\n    fi\n\n    lock_delete $lockname \"$lock\"\n    rc=$?\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' released by '$requester'\"\n        return 0\n    else\n        log \"CIB deletion error, lock cannot be released\"\n        return 3\n    fi\n}\n\n\n# Retrieve the owner of a lock from the CIB\n# this is a read-only operation, so no need to log debug info\nlock_get_owner() {\n    local lockname=$1\n    local rc\n    local lock\n    local owner\n\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        return 1\n    else\n        lock_owner $lock\n        return 0\n    fi\n}\n\n\nACTION=$1\nLOCKNAME=$2\nREQUESTER=$3\nTTL=${4:-60}\n\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nif [ $ACTION != \"--help\" ]; then\n    if [ -z \"$LOCKNAME\" ]; then\n        error \"You must specific a lock name\"\n    fi\n    if [ $ACTION != \"--owner\" ] && [ $ACTION != \"-o\" ]; then\n        if [ -z \"$REQUESTER\" ]; then\n            error \"You must specific a lock requester\"\n        fi\n    fi\nfi\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) try_action lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --release|-r) try_action lock_release $LOCKNAME $REQUESTER;;\n    --acquire-once|-A) lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --owner|-o) lock_get_owner $LOCKNAME;;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}, "pacemaker_mutex_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_restart_bundle.sh --lock mysql galera galera-bundle Master _\n# pacemaker_mutex_restart_bundle.sh --lock ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\n\nset -u\n\nusage() {\n    echo \"Restart a clustered resource in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --lock <tripleo-service> <pcmk-resource> <pcmk-bundle> <target-state-local> <target-state-cluster>\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\nACTION=$1\ncase $ACTION in\n    --help) usage; exit 0;;\n    --lock) ;;\n    *) error \"Unknown action '$ACTION'\";;\nesac\n\nTRIPLEO_SERVICE=$2\nLOCK_NAME=${TRIPLEO_SERVICE}-restart-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to restart resource $TRIPLEO_SERVICE\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\nRESOURCE_NAME=$3\nBUNDLE_NAME=$4\nWAIT_TARGET_LOCAL=$5\nWAIT_TARGET_ANYWHERE=${6:-_}\n\nif pacemaker_supports_promoted; then\n    WAIT_TARGET_LOCAL=$(echo \"$5\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    WAIT_TARGET_ANYWHERE=$(echo \"${6:-_}\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    promoted_role=\"Promoted\"\nelse\n    promoted_role=\"Master\"\nfi\n\n# The lock TTL should accomodate for the resource start/promote timeout\nif [ \"$RESOURCE_NAME\" != \"$BUNDLE_NAME\" ]; then\n    if [ \"$WAIT_TARGET_LOCAL\" = \"$promoted_role\" ] || [ \"$WAIT_TARGET_ANYWHERE\" = \"$promoted_role\" ]; then\n        rsc_op=\"promote\"\n    else\n        rsc_op=\"start\"\n    fi\n    # <op id=\"galera-promote-interval-0s\" interval=\"0s\" name=\"promote\" on-fail=\"block\" timeout=\"300s\"/>\n    PCMK_TTL=$(cibadmin -Q | xmllint -xpath \"string(//primitive[@id='${RESOURCE_NAME}']/operations/op[@name='${rsc_op}']/@timeout)\" - | sed 's/s$//')\n    LOCK_TTL=$((PCMK_TTL + 30))\nelse\n    # The podman RA's default start timeout\n    LOCK_TTL=90\nfi\n\nlog \"Acquire a ${LOCK_TTL}s restart lock for service $TRIPLEO_SERVICE before restarting it\"\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nrc=1\nwhile [ $rc -ne 0 ]; do\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire $LOCK_NAME $LOCK_OWNER $LOCK_TTL\n    rc=$?\n    if [ $rc != 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not acquire lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Could not acquire lock, retrying\"\n            sleep 10\n        fi\n    fi\ndone\n\nlog \"Restart the service $TRIPLEO_SERVICE locally\"\n# Reuse the local restart script in t-h-t (driven by env var TRIPLEO_MINOR_UPDATE)\nTRIPLEO_MINOR_UPDATE=true /var/lib/container-config-scripts/pacemaker_restart_bundle.sh $TRIPLEO_SERVICE $RESOURCE_NAME $BUNDLE_NAME $WAIT_TARGET_LOCAL $WAIT_TARGET_ANYWHERE\n\n# If we reached this point, always try to release the lock\nlog \"Release the restart lock for service $TRIPLEO_SERVICE\"\n/var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $LOCK_NAME $LOCK_OWNER\nrc=$?\nif [ $rc -ne 0 ] && [ $rc -ne 1 ]; then\n    error \"Could not release held lock (rc: $rc)\"\nfi\n"}, "pacemaker_mutex_shutdown.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_shutdown.sh --acquire\n# pacemaker_mutex_shutdown.sh --release\n\nset -u\n\nusage() {\n    echo \"Shutdown a cluster node in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --acquire # prevent other node from shutting down until we hold the lock\"\n    echo \"   $0 --release # release the lock, other node can compete for the shutdown lock\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nshutdown_lock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc=1\n    local current_owner\n    local owner_stopped\n    local owner_rc\n\n    log \"Acquiring the shutdown lock\"\n    while [ $rc -ne 0 ]; do\n        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire-once $lockname $requester $ttl\n        rc=$?\n        if [ $rc -ne 0 ]; then\n            if [ $rc -eq 2 ]; then\n                error \"Could not acquire the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n            else\n                # The lock is held by another node.\n                current_owner=$(/var/lib/container-config-scripts/pacemaker_resource_lock.sh --owner $lockname)\n                owner_rc=$?\n                if [ $owner_rc -eq 2 ]; then\n                    error \"Could not get the shutdown lock owner due to unrecoverable error (rc: $owner_rc), bailing out\"\n                fi\n                if [ $owner_rc -eq 0 ]; then\n                    # If the owner is marked as offline, that means it has shutdown and\n                    # we can clean the lock preemptively and try to acquire it.\n                    owner_stopped=$(crm_mon -1X | xmllint --xpath 'count(//nodes/node[@name=\"'${current_owner}'\" and @online=\"false\" and @unclean=\"false\"])' -)\n                    if [ \"${owner_stopped}\" = \"1\" ]; then\n                        log \"Shutdown lock held by stopped node '${current_owner}', lock can be released\"\n                        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $current_owner\n                        continue\n                    fi\n                fi\n                log \"Shutdown lock held by another node (rc: $rc), retrying\"\n                sleep 10\n            fi\n        fi\n    done\n    log \"Shutdown lock acquired\"\n    return 0\n}\n\n\n# Release the lock if we still own it. Not owning it anymore is not fatal\nshutdown_lock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n\n    log \"Releasing the shutdown lock\"\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $requester\n    rc=$?\n    if [ $rc -ne 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not release the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Shutdown lock no longer held, nothing to do\"\n        fi\n    else\n        log \"Shutdown lock released\"\n    fi\n    return 0\n}\n\n\nACTION=$1\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nLOCK_NAME=tripleo-shutdown-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to aquire the shutdown lock\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\n# We start with a very high TTL, that long enough to accomodate a cluster stop.\n# As soon as the node will get offline, the other competing node will be entitled\n# to steal the lock, so they should never wait that long in practice.\nLOCK_TTL=600\n\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) shutdown_lock_acquire ${LOCK_NAME} ${LOCK_OWNER} ${LOCK_TTL};;\n    --release|-r) shutdown_lock_release ${LOCK_NAME} ${LOCK_OWNER};;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-66-vpljypirliki-ContainersCommon-33m72jqqlet7/109ad1f8-d589-41ba-b8ff-d899cdfec006"}


created_at: 2026-01-27 08:25:46.681905
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-66-vpljypirliki-RabbitmqBase-rvluai75zixi-ContainersCommon-p337x4jzg43y/a63ebc43-d674-4237-a955-9df7553efb38"}


created_at: 2026-01-27 08:25:46.784182
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-66-vpljypirliki-RabbitmqBase-rvluai75zixi-RabbitMQServiceBase-gjc4ariy3jnx-ContainersCommon-cfrtu4kkfmmo/876df94f-e1bf-4b3c-bb7f-75f7a1486506"}


created_at: 2026-01-27 08:25:46.788599
data:
  {"value": {"ContainerRabbitmqImage": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1", "ContainerRabbitmqConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1"}}


created_at: 2026-01-27 08:25:46.796797
data:
  {"tuple:('role_data', 'global_config_settings')": null, "tuple:('role_data', 'monitoring_subscription')": "overcloud-rabbitmq", "tuple:('role_data', 'config_settings')": {"rabbitmq::file_limit": 65536, "rabbitmq::default_user": "guest", "rabbitmq::default_pass": "wbJikagtfTX41DG9FuRWPt53b", "rabbit_ipv6": false, "rabbitmq::delete_guest_user": false, "rabbitmq::wipe_db_on_cookie_change": true, "rabbitmq::port": 5672, "rabbitmq::loopback_users": [], "rabbitmq::tcp_backlog": 4096, "rabbitmq::repos_ensure": false, "rabbitmq::tcp_keepalive": true, "rabbitmq_environment": {"LANG": "en_US.UTF-8", "LC_ALL": "en_US.UTF-8", "NODE_PORT": "", "NODE_IP_ADDRESS": "", "RABBITMQ_NODENAME": "rabbit@%{hiera('fqdn_internal_api')}", "RABBITMQ_USE_LONGNAME": "true", "RABBITMQ_CTL_DIST_PORT_MIN": "25673", "RABBITMQ_CTL_DIST_PORT_MAX": "25683", "export ERL_EPMD_ADDRESS": "%{hiera('rabbitmq::interface')}"}, "tripleo::profile::base::rabbitmq::additional_erl_args": "'+sbwt none +sbwtdcpu none +sbwtdio none'", "rabbitmq_kernel_variables": {"inet_dist_listen_min": "25672", "inet_dist_listen_max": "25672", "net_ticktime": 15}, "rabbitmq_config_variables": {"cluster_partition_handling": "ignore", "queue_master_locator": "<<\"min-masters\">>"}, "rabbitmq::config_additional_variables": {"lager": "[{crash_log_count, 0}, { crash_log_date, \"\"}, { crash_log_size, 0 }]"}, "rabbitmq::erlang_cookie": "qyGFiwqiEVnsR5uI2hrs", "rabbitmq::interface": "%{hiera('internal_api')}", "rabbitmq::nr_ha_queues": 0, "rabbitmq::ssl": false, "rabbitmq::ssl_erl_dist": false, "rabbitmq::ssl_port": 5672, "rabbitmq::ssl_depth": 1, "rabbitmq::ssl_only": false, "rabbitmq::ssl_interface": "%{hiera('internal_api')}", "tripleo::profile::base::rabbitmq::enable_internal_tls": false, "tripleo::profile::base::rabbitmq::fips_mode": false, "rabbitmq::collect_statistics_interval": 30000, "rabbitmq::admin_enable": false, "rabbitmq::management_enable": true, "rabbitmq::use_config_file_for_plugins": true, "rabbitmq::management_ip_address": "127.0.0.1", "rabbitmq::management_port": 15672, "rabbitmq::config_management_variables": {"rates_mode": "none"}, "rabbitmq::ssl_cacert": "/etc/ipa/ca.crt", "rabbitmq::ssl_management_cacert": "/etc/ipa/ca.crt"}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-66-vpljypirliki-RabbitmqBase-rvluai75zixi-RabbitMQServiceBase-gjc4ariy3jnx/adaa77e7-df36-4c18-8a82-d8b53e680e13"}


created_at: 2026-01-27 08:25:46.809616
data:
  {"tuple:('role_data', 'service_name')": "oslo_messaging_rpc", "tuple:('role_data', 'metadata_settings')": null, "tuple:('role_data', 'global_config_settings')": {"oslo_messaging_rpc_scheme": "rabbit", "oslo_messaging_rpc_user_name": "guest", "oslo_messaging_rpc_password": "rAEOjyWy2c6PARokWxktfn5mX", "oslo_messaging_rpc_use_ssl": "False", "oslo_messaging_rpc_port": 5672}, "tuple:('role_data', 'deploy_steps_tasks')": [{"name": "Certificate generation", "when": ["step|int == 1", "enable_internal_tls"], "block": [{"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "rabbitmq", "dns": "{{fqdn_internal_api}}", "principal": "rabbitmq/{{fqdn_internal_api}}@{{idm_realm}}", "run_after": "container_name=$({{container_cli}} ps --format=\\{\\{.Names\\}\\} | grep -w -E 'rabbitmq(-bundle-.*-[0-9]+)?')\nservice_crt=\"/etc/pki/tls/certs/rabbitmq.crt\"\nservice_key=\"/etc/pki/tls/private/rabbitmq.key\"\nif echo \"$container_name\" | grep -q \"^rabbitmq-bundle\"; then\n  # lp#1917868: Do not use podman cp with HA containers as they get\n  # frozen temporarily and that can make pacemaker operation fail.\n  tar -c \"$service_crt\" \"$service_key\" | {{container_cli}} exec -i \"$container_name\" tar -C / -xv\n  # no need to update the mount point, because pacemaker\n  # recreates the container when it's restarted\nelse\n  # Refresh the cert at the mount-point\n  {{container_cli}} cp $service_crt \"$container_name:/var/lib/kolla/config_files/src-tls/$service_crt\"\n  # Refresh the key at the mount-point\n  {{container_cli}} cp $service_key \"$container_name:/var/lib/kolla/config_files/src-tls/$service_key\"\n  # Copy the new cert from the mount-point to the real path\n  {{container_cli}} exec -u root \"$container_name\" cp \"/var/lib/kolla/config_files/src-tls$service_crt\" \"$service_crt\"\n  # Copy the new key from the mount-point to the real path\n  {{container_cli}} exec -u root \"$container_name\" cp \"/var/lib/kolla/config_files/src-tls$service_key\" \"$service_key\"\nfi\n# Set appropriate permissions\n{{container_cli}} exec -u root \"$container_name\" chown rabbitmq:rabbitmq \"$service_crt\"\n{{container_cli}} exec -u root \"$container_name\" chown rabbitmq:rabbitmq \"$service_key\"\n# Trigger a pem cache clear in RabbitMQ to read the new certificates\n{{container_cli}} exec \"$container_name\" rabbitmqctl eval \"ssl:clear_pem_cache().\"\n", "key_size": "2048", "ca": "ipa"}]}}]}], "tuple:('role_data', 'config_settings')": {"rabbitmq::file_limit": 65536, "rabbitmq::default_user": "guest", "rabbitmq::default_pass": "rAEOjyWy2c6PARokWxktfn5mX", "rabbit_ipv6": false, "rabbitmq::delete_guest_user": false, "rabbitmq::wipe_db_on_cookie_change": true, "rabbitmq::port": 5672, "rabbitmq::loopback_users": [], "rabbitmq::tcp_backlog": 4096, "rabbitmq::repos_ensure": false, "rabbitmq::tcp_keepalive": true, "rabbitmq_environment": {"LANG": "en_US.UTF-8", "LC_ALL": "en_US.UTF-8", "NODE_PORT": "", "NODE_IP_ADDRESS": "", "RABBITMQ_NODENAME": "rabbit@%{hiera('fqdn_internal_api')}", "RABBITMQ_USE_LONGNAME": "true", "RABBITMQ_CTL_DIST_PORT_MIN": "25673", "RABBITMQ_CTL_DIST_PORT_MAX": "25683", "export ERL_EPMD_ADDRESS": "%{hiera('rabbitmq::interface')}"}, "tripleo::profile::base::rabbitmq::additional_erl_args": "'+sbwt none +sbwtdcpu none +sbwtdio none'", "rabbitmq_kernel_variables": {"inet_dist_listen_min": "25672", "inet_dist_listen_max": "25672", "net_ticktime": 15}, "rabbitmq_config_variables": {"cluster_partition_handling": "ignore", "queue_master_locator": "<<\"min-masters\">>"}, "rabbitmq::config_additional_variables": {"lager": "[{crash_log_count, 0}, { crash_log_date, \"\"}, { crash_log_size, 0 }]"}, "rabbitmq::erlang_cookie": "qyGFiwqiEVnsR5uI2hrs", "rabbitmq::interface": "%{hiera('internal_api')}", "rabbitmq::nr_ha_queues": 0, "rabbitmq::ssl": false, "rabbitmq::ssl_erl_dist": false, "rabbitmq::ssl_port": 5672, "rabbitmq::ssl_depth": 1, "rabbitmq::ssl_only": false, "rabbitmq::ssl_interface": "%{hiera('internal_api')}", "tripleo::profile::base::rabbitmq::enable_internal_tls": false, "tripleo::profile::base::rabbitmq::fips_mode": false, "rabbitmq::collect_statistics_interval": 30000, "rabbitmq::admin_enable": false, "rabbitmq::management_enable": true, "rabbitmq::use_config_file_for_plugins": true, "rabbitmq::management_ip_address": "127.0.0.1", "rabbitmq::management_port": 15672, "rabbitmq::config_management_variables": {"rates_mode": "none"}, "rabbitmq::ssl_cacert": "/etc/ipa/ca.crt", "rabbitmq::ssl_management_cacert": "/etc/ipa/ca.crt"}, "tuple:('role_data', 'service_config_settings')": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-66-vpljypirliki-RabbitmqBase-rvluai75zixi/5820c659-cae3-4667-ab4a-ca131ac6c325"}


created_at: 2026-01-27 08:25:46.846710
data:
  {"tuple:('role_data', 'container_config_scripts')": {"container_puppet_apply.sh": {"mode": "0700", "content": "#!/bin/bash\nset -eux\nSTEP=$1\nTAGS=$2\nCONFIG=$3\nEXTRA_ARGS=${4:-''}\nif [ -d /tmp/puppet-etc ]; then\n  # ignore copy failures as these may be the same file depending on docker mounts\n  cp -a /tmp/puppet-etc/* /etc/puppet || true\nfi\necho \"{\\\"step\\\": ${STEP}}\" > /etc/puppet/hieradata/docker_puppet.json\n# $::deployment_type in puppet-tripleo\nexport FACTER_deployment_type=containers\nset +e\npuppet apply $EXTRA_ARGS \\\n    --verbose \\\n    --detailed-exitcodes \\\n    --summarize \\\n    --color=false \\\n    --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \\\n    --tags $TAGS \\\n    -e \"noop_resource('package'); ${CONFIG}\"\nrc=$?\nset -e\nset +ux\nif [ $rc -eq 2 -o $rc -eq 0 ]; then\n    exit 0\nfi\nexit $rc\n"}, "pyshim.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n#\n# Usage: pyshim.sh <script and/or arguments>\n#\n# Unfortunately THT doesn't know which version of python might be in a\n# container so we need this script to be able to try python3 or python2\n# depending on availability.  Since this is a temporary shim until we've\n# fully cut over to python3, we check for the existence of python3 first\n# before falling back to python2. This will help in the transition from\n# python2 based containers to python3.\n\nshow_usage() {\n    echo \"Usage: pyshim.sh <script and/or arguments>\"\n}\n\nif [ $# -lt 1 ]\nthen\n    show_usage\n    exit 1\nfi\n\nset -x\nif command -v python3 >/dev/null; then\n    python3 \"$@\"\nelif command -v python2 >/dev/null; then\n    python2 \"$@\"\nelif command -v python >/dev/null; then\n    python \"$@\"\nelse\n    echo \"ERROR: python is not available!\"\n    exit 1\nfi\n"}, "pacemaker_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nset -u\n\n# ./pacemaker_restart_bundle.sh mysql galera galera-bundle Master _\n# ./pacemaker_restart_bundle.sh redis redis redis-bundle Slave Master\n# ./pacemaker_restart_bundle.sh ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\nRESTART_SCRIPTS_DIR=$(dirname $0)\nTRIPLEO_SERVICE=$1\nRESOURCE_NAME=$2\nBUNDLE_NAME=$3\nWAIT_TARGET_LOCAL=$4\nWAIT_TARGET_ANYWHERE=${5:-_}\nTRIPLEO_MINOR_UPDATE=\"${TRIPLEO_MINOR_UPDATE:-false}\"\nTRIPLEO_HA_WRAPPER_RESOURCE_EXISTS=\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS:-false}\"\n\nbundle_can_be_restarted() {\n    local bundle=$1\n    # As long as the resource bundle is managed by pacemaker and is\n    # not meant to stay stopped, no matter the state of any inner\n    # pcmk_remote or ocf resource, we should restart it to give it a\n    # chance to read the new config.\n    [ \"$(crm_resource --meta -r $1 -g is-managed 2>/dev/null)\" != \"false\" ] && \\\n    [ \"$(crm_resource --meta -r $1 -g target-role 2>/dev/null)\" != \"Stopped\" ]\n}\n\nlog() {\n    local msg=$1\n    logger -t pcmkrestart \"$1\"\n}\n\nHOSTNAME=$(/bin/hostname -s)\nif [ x\"${TRIPLEO_MINOR_UPDATE,,}\" != x\"true\" ]; then\n    if [ x\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS,,}\" = x\"false\" ]; then\n        # Do not restart during initial deployment, as the resource\n        # has just been created.\n        SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n        if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n            log \"Initial deployment, skipping the restart of ${BUNDLE_NAME}\"\n\tfi\n        exit 0\n    else\n        # During a stack update, this script is called in parallel on\n        # every node the resource runs on, after the service's configs\n        # have been updated on all nodes. So we need to run pcs only\n        # once (e.g. on the service's boostrap node).\n        if bundle_can_be_restarted ${BUNDLE_NAME}; then\n            SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n            if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n                replicas_running=$(crm_resource -Q -r $BUNDLE_NAME --locate 2>&1 | wc -l)\n                if [ \"$replicas_running\" != \"0\" ]; then\n                    log \"Restarting ${BUNDLE_NAME} globally. Stopping:\"\n                    /sbin/pcs resource disable --wait=600 $BUNDLE_NAME\n                    log \"Restarting ${BUNDLE_NAME} globally. Starting:\"\n                    /sbin/pcs resource enable --wait=600 $BUNDLE_NAME\n                else\n                    log \"${BUNDLE_NAME} is not running anywhere,\" \\\n                         \"cleaning up to restart it globally if necessary\"\n                    /sbin/pcs resource cleanup $BUNDLE_NAME\n                fi\n            else\n                log \"Skipping global restart of ${BUNDLE_NAME} on ${HOSTNAME} it will be restarted by node ${SERVICE_NODEID}\"\n            fi\n\n        else\n            log \"No global restart needed for ${BUNDLE_NAME}.\"\n        fi\n    fi\nelse\n    # During a minor update workflow however, a host gets fully\n    # updated before updating the next one. So unlike stack\n    # update, at the time this script is called, the service's\n    # configs aren't updated on all nodes yet. So only restart the\n    # resource locally, where it's guaranteed that the config is\n    # up to date.\n    HOST=$(facter hostname)\n\n    if bundle_can_be_restarted ${BUNDLE_NAME}; then\n\t# if the resource is running locally, restart it\n\tif crm_resource -r $BUNDLE_NAME --locate 2>&1 | grep -w -q \"${HOST}\"; then\n            log \"Restarting ${BUNDLE_NAME} locally on '${HOST}'\"\n            /sbin/pcs resource restart $BUNDLE_NAME \"${HOST}\"\n\n\telse\n\t    # At this point, if no resource is running locally, it's\n\t    # either because a) it has failed previously, or b) because\n\t    # it's an A/P resource running elsewhere.\n\t    # By cleaning up resource, we ensure that a) it will try to\n\t    # restart, or b) it won't do anything if the resource is\n\t    # already running elsewhere.\n            log \"${BUNDLE_NAME} is currently not running on '${HOST}',\" \\\n                 \"cleaning up its state to restart it if necessary\"\n            /sbin/pcs resource cleanup $BUNDLE_NAME node=\"${HOST}\"\n\tfi\n\n\t# Wait until the resource is in the expected target state\n\t$RESTART_SCRIPTS_DIR/pacemaker_wait_bundle.sh \\\n            $RESOURCE_NAME $BUNDLE_NAME \\\n            \"$WAIT_TARGET_LOCAL\" \"$WAIT_TARGET_ANYWHERE\" \\\n\t    \"${HOST}\" 600\n    else\n        log \"No restart needed for ${BUNDLE_NAME}.\"\n    fi\nfi\n"}, "pacemaker_wait_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# ----\n# Wait for an OCF resource or a bundle to be restarted\n# ----\n# e.g.:\n# M/S OCF:      $0 galera galera-bundle Master\n# clone OCF:    $0 rabbitmq rabbitmq-bundle Started\n# A/P M/S OCF:  $0 redis redis-bundle Slave Master\n# A/P bundle:   $0 openstack-cinder-volume openstack-cinder-volume _ Started\n# clone bundle: $0 haproxy-bundle haproxy-bundle Started\n\n# design note 1:\n#  - this script is called during a minor update; it is called\n#    once per node that hosts a service replica.\n#  - the purpose of this script is to ensure that restarting the\n#    service replica locally won't disrupt the service availability\n#    for the end user. To reach that goal, the script waits until the\n#    service is restarted locally or globallu and reaches a given\n#    target state (i.e. Started, Slave or Master).\n# design note 2:\n#   - we don't want to track restart error: our only job is to ensure\n#     service restart synchronization, not service health.\n#   - In particular, we don't want to error out in case the resource\n#     cannot be restarted locally, because that would make the minor\n#     update fail, even if potentially other replicas still provide\n#     the service.\n# design note 3:\n#   - we can bail out early if we determine that the resource can't\n#     be restarted automatically by pacemaker (e.g. its \"blocked\",\n#     unmanaged or disabled).\n\nlog() {\n    local msg=$1\n    echo \"$(date -u): $1\"\n}\n\nusage() {\n    echo 2>&1 \"Usage: $0 NAME BUNDLE_NAME ROLE_LOCAL [ROLE_ANYWHERE] [HOST] [TIMEOUT]\"\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\n#\n# Utility functions to detect stuck resources\n#\n\nbundle_failures_locally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local replica_name\n    for i in $(seq 0 $last); do\n\treplica_name=${BUNDLE_NAME}-${engine}-${i}\n\tcrm_failcount -q -G -r $replica_name -N $HOST\n    done\n}\n\nbundle_failures_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    for i in $(seq 0 $last); do\n\tcrm_failcount -q -G -r ${BUNDLE_NAME}-${engine}-${i}\n    done\n}\n\nbundle_running_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    # return the number of running bundles replica, i.e. the number of\n    # docker/podman resource replicas currently running in the cluster\n    crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:heartbeat:${engine}']/node)\" -\n}\n\nocf_failures_globally() {\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local bundle_node\n    for i in $(seq 0 $last); do\n\tbundle_node=${BUNDLE_NAME}-${i}\n\tcrm_failcount -q -G -r $NAME -N $bundle_node\n    done\n}\n\ndid_resource_failed_locally() {\n    local failures\n    local running\n    local remotehost\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# if we're dealing with an ocf resource, it is running on a\n\t# pacemaker_remote rather that on the real host, and the\n\t# failcounts are thus associated to the pcmk remote. Replace\n\t# the host's name with the pcmk remote's name.\n        remotehost=$(crm_mon --as-xml | xmllint --xpath \"string(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource/node[@name='${HOST}']/../../resource[@resource_agent='${OCF}:pacemaker:remote']/@id)\" -)\n\tif [ -n \"${remotehost}\" ]; then\n\t    crm_failcount -q -G -r $NAME -N $remotehost | grep -q -w INFINITY\n\t    return $?\n\tfi\n\t# If no pcmk remote is currently running, the failcount from\n\t# the ocf resource is useless, compute the failcount from the\n\t# bundle case instead (computed below).\n    fi\n\n    # for bundles, pacemaker can run any bundle replica locally\n    # (e.g. galera-bundle-docker-{0,1,2}), and a failure happens when\n    # there are no more replica to try.\n    # That is, when _at least_ one replica failed locally, and all the\n    # others either failed or are currently running elsewhere.\n    failures=$(bundle_failures_locally $HOST | grep -c -w INFINITY)\n    running=$(bundle_running_globally)\n    test $failures -gt 0 && \\\n    test $(( $failures + $running )) -ge $BUNDLE_REPLICAS\n}\n\ndid_resource_failed_globally() {\n    local remotecount\n    local failures\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# we check the state of an ocf resource only if the\n\t# pcmkremotes are started\n        remotecount=$(crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node)\" -)\n\tif [ \"${remotecount}\" = \"0\" ]; then\n\t    # no pcmkremote is running, so check the bundle state\n\t    # instead of checking the ocf resource\n\t    # bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\t    failures=$(bundle_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\telse\n\t    # ocf resource failed if it failed to start on\n\t    # all $BUNDLE_REPLICAS bundle nodes\n\t    failures=$(ocf_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\tfi\n    else\n\t# bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\tfailures=$(bundle_failures_globally | grep -c -w INFINITY)\n\ttest $failures -eq $BUNDLE_REPLICAS\n    fi\n}\n\n\n# Input validation\n#\n\nNAME=$1\nif [ -z \"${NAME}\" ]; then\n    echo 2>&1 \"Error: argument NAME must not be empty\"\n    exit 1\nfi\n\nBUNDLE_NAME=$2\nif [ -z \"${BUNDLE_NAME}\" ]; then\n    echo 2>&1 \"Error: argument BUNDLE_NAME must not be empty\"\n    exit 1\nfi\n\nROLE_LOCAL=$3\nif [ \"${ROLE_LOCAL}\" = \"_\" ]; then\n    ROLE_LOCAL=\"\"\nfi\n\nROLE_ANYWHERE=$4\nif [ \"${ROLE_ANYWHERE}\" = \"_\" ]; then\n    ROLE_ANYWHERE=\"\"\nfi\n\nif [ -z \"${ROLE_LOCAL}\" ]; then\n    if [ -z \"${ROLE_ANYWHERE}\" ]; then\n        echo 2>&1 \"Error: either ROLE_LOCAL or ROLE_ANYWHERE must be non empty\"\n        exit 1\n    fi\nelse\n    if !(echo \"${ROLE_LOCAL}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n        echo 2>&1 \"Error: argument ROLE_LOCAL must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n        exit 1\n    fi\nfi\n\nif [ -n \"${ROLE_ANYWHERE}\" ] && !(echo \"${ROLE_ANYWHERE}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n    echo 2>&1 \"Error: argument ROLE_ANYWHERE must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n    exit 1\nfi\n\n# Ensure compatibility with pacemaker 2.1\nif pacemaker_supports_promoted; then\n    ROLE_LOCAL=$(echo \"$ROLE_LOCAL\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    ROLE_ANYWHERE=$(echo \"$ROLE_ANYWHERE\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    OCF=\"ocf\"\nelse\n    OCF=\"ocf:\"\nfi\n\nHOST=${5:-$(facter hostname)}\nTIMEOUT=${6:-600}\n\n\n# Configure the search\n# ----\n# Note: we can't use crm_resource in all searches because we can't\n# easily extract the host the OCF resources run on (crm_resource\n# returns the pcmk-remote nodes rather than the hosts)\n# So instead, we implement various searches with XPath directly.\n\nif [ \"${BUNDLE_NAME}\" != \"${NAME}\" ]; then\n# ocf resource\nlocal_resource_xpath=\"//bundle/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node[@name='${HOST}']/../../resource[@id='${NAME}']\"\nany_resource_xpath=\"//bundle//resource[@id='${NAME}']\"\nreplicas_xpath=\"//bundle/primitive[@id='${BUNDLE_NAME}']/../*[boolean(@image) and boolean(@replicas)]\"\nelse\n# bundle resource\nlocal_resource_xpath=\"//bundle[@id='${NAME}']/replica/resource/node[@name='${HOST}']/../../resource\"\nany_resource_xpath=\"//bundle[@id='${NAME}']//resource\"\nreplicas_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nfi\n\nbundle_def_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nBUNDLE_CONTAINER_ENGINE=$(cibadmin -Q | xmllint --xpath \"name(${bundle_def_xpath})\" -)\nBUNDLE_REPLICAS=$(cibadmin -Q | xmllint --xpath \"string(${bundle_def_xpath}/@replicas)\" -)\n\n\n# The wait algorithm follows a two-stage approach\n#  1. Depending on how the script is called, we first check whether\n#     the resource is restarted locally. An A/P resource may be\n#     restarted elsewhere in the cluster.\n#  2. If needed, check whether the A/P resource has restarted\n#     elsewhere. For A/P M/S resources, in case the resource is\n#     restarted as Slave locally, ensure a Master is available.\n\nsuccess=1\nbailout=1\ntimeout=$TIMEOUT\nrole=\"\"\n\n# Stage 1: local check\nif [ -n \"$ROLE_LOCAL\" ]; then\n    log \"Waiting until ${NAME} has restarted on ${HOST} and is in state ${ROLE_LOCAL}\"\n    log \"Will probe resource state with the following XPath pattern: ${local_resource_xpath}\"\n\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resource=$(crm_mon -r --as-xml | xmllint --xpath \"${local_resource_xpath}\" - 2>/dev/null)\n        role=$(echo \"${resource}\" | sed -ne 's/.*\\Wrole=\"\\([^\"]*\\)\".*/\\1/p')\n\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resource}\" | grep -q -w \"\\Wblocked=\\\"true\\\"\"; then\n            log \"${NAME} is blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_locally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif [ \"$role\" = \"$ROLE_LOCAL\" ]; then\n            success=0\n            continue\n        elif [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" = \"$ROLE_ANYWHERE\" ]; then\n            # A/P: we are restarted in the expected state\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_LOCAL} on ${HOST}\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\n# Stage 2: global check\nif [ $timeout -gt 0 ] && [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" != \"$ROLE_ANYWHERE\" ]; then\n    log \"Wait until ${NAME} is restarted anywhere in the cluster in state ${ROLE_ANYWHERE}\"\n    log \"Will probe resource state with the following XPath pattern: ${any_resource_xpath}\"\n\n    success=1\n    bailout=1\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resources=$(crm_mon -r --as-xml | xmllint --xpath \"${any_resource_xpath}\" - 2>/dev/null)\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif ! (echo \"${resources}\" | grep -q -w \"\\Wblocked=\\\"false\\\"\"); then\n            log \"${NAME} blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_globally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resources}\" | grep -q -w \"\\Wrole=\\\"${ROLE_ANYWHERE}\\\"\"; then\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_ANYWHERE} anywhere in the cluster\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\nif [ $timeout -le 0 ]; then\n    log \"Timeout reached after ${TIMEOUT}s while waiting for ${NAME} to be restarted\"\nelif [ $bailout -le 0 ]; then\n    log \"Restart monitoring for ${NAME} cancelled\"\nfi\n\nif [ $success -eq 0 ]; then\n    log \"${NAME} successfully restarted\"\nelse\n    log \"${NAME} was not restarted properly\"\nfi\n\n# Don't block minor update or stack update if the wait was unsuccessful\nexit 0\n"}, "wait-port-and-run.sh": {"mode": "0755", "content": "#!/usr/bin/bash\nset -eu\n\nHOST=$1\nPORT=$2\n\necho \"$(date -u): Checking whether we can bind to ${HOST}:${PORT}\"\nwhile (ss -Htnl src \"${HOST}\" \"sport = :${PORT}\" | grep -wq \"${PORT}\"); do\n    echo \"$(date -u): ${HOST}:${PORT} still in use, waiting...\";\n    sleep 10;\ndone\n\nshift 2\nCOMMAND=\"$*\"\nif [ -z \"${COMMAND}\" ]; then\n    COMMAND=\"true\"\nfi\nexec $COMMAND\n"}, "pacemaker_resource_lock.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nMAX_RETRIES=10\nCIB_ENOTFOUND=105\n\nusage() {\n   echo \"Set a global property in the cluster with a validity timestamp.\"\n   echo \"Usage:\"\n   echo \"   $0 --acquire <lock_name> <lock_owner> <lock_ttl_in_seconds>\"\n   echo \"   $0 --release <lock_name> <lock_owner>\"\n   echo\n}\n\nlog() {\n    echo \"$(date -u): $1\" 1>&2\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\nlock_create() {\n    local name=$1\n    local data=$2\n    # cibadmin won't overwrite a key if someone else succeeded to create it concurrently\n    cibadmin --sync-call --scope crm_config --create --xml-text \"<cluster_property_set id='${name}'><nvpair id='${name}-pair' name='${name}' value='${data}'/></cluster_property_set>\" &>/dev/null\n    return $?\n}\n\nlock_update() {\n    local name=$1\n    local expected_data=$2\n    local new_data=$3\n    # we only update the lock we expect to see, so we can't update someone else's lock\n    cibadmin --sync-call --scope crm_config --modify --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" --xml-text \"<nvpair id='${name}-pair' name='${name}' value='${new_data}'/>\" &>/dev/null\n    return $?\n}\n\nlock_delete() {\n    local name=$1\n    local expected_data=$2\n    # we only delete the lock we expect to see, so we can't delete someone else's lock\n    cibadmin --sync-call --scope crm_config --delete --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" &>/dev/null\n    return $?\n}\n\nlock_get() {\n    local lockname=$1\n    local res\n    local rc\n    res=$(cibadmin --query --scope crm_config --xpath \"//cluster_property_set/nvpair[@name='$lockname']\" 2>/dev/null)\n    rc=$?\n    if [ $rc -eq 0 ]; then\n        echo \"$res\" | sed -n 's/.*value=\"\\([^\"]*\\)\".*/\\1/p'\n    fi\n    return $rc\n}\n\nlock_owner() {\n    local lock=$1\n    echo \"$lock\" | cut -d':' -f1\n}\n\nlock_has_expired() {\n    local lock=$1\n    local expiry=$(echo \"$lock\" | cut -d':' -f2)\n    local now=$(date +%s)\n    test $now -ge $expiry\n}\n\n\n# Perform a lock action and restart if the CIB has been modified before\n# committing the lock action\ntry_action() {\n    local fun=$1\n    local lock=$2\n    local requester=$3\n    local args=${4:-}\n    local tries=$MAX_RETRIES\n    local rc=1\n    if [ \"$fun\" = \"lock_acquire\" ] || [ \"$fun\" = \"lock_release\" ]; then\n        log \"Try running $fun\"\n    else\n        return 2\n    fi\n    while [ $rc -ne 0 ]; do\n        $fun $lock $requester $args\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Operation $1 succeeded\"\n            return 0\n        elif [ $rc -eq 3 ]; then\n            # rc == 3 -> CIB changed before push\n            if [ $tries -eq 0 ]; then\n                log \"Failed to commit after $MAX_RETRIES retries. Bailing out.\"\n                return 2\n            else\n                log \"Failed to commit. Retrying operation.\"\n                tries=$(($tries - 1))\n            fi\n        elif [ $rc -eq 2 ]; then\n            # rc == 2 -> unrecoverable cib error (e.g. pacemaker down)\n            log \"Unexpected failure. Bailing out\"\n            return $rc\n        else\n            # rc == 1 -> lock error (not owner, lock doesn't exists)\n            return $rc\n        fi\n    done\n}\n\n# The lock mechanism uses cibadmin's atomic creation so cluster-wide\n# state coherency is guaranteed by pacemaker\nlock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc\n    local lock\n    local expiry\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -n \"$lock\" ]; then\n        lock_has_expired $lock\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Lock has expired, now available for being held\"\n        else\n            # lock is still held. check whether we're the owner\n            owner=$(lock_owner $lock)\n            if [ \"$owner\" = \"$requester\" ];then\n                log \"Requester already owns the lock, acquiring attempt will just reconfigure the TTL\"\n            else\n                log \"Lock is held by someone else ($owner)\"\n                return 1\n            fi\n        fi\n    else\n        log \"Lock is not held yet\"\n    fi\n\n    # prepare the lock info\n    expiry=$(($(date +%s) + $ttl))\n\n    if [ -n \"$lock\" ]; then\n        log \"Attempting to update the lock\"\n        lock_update $lockname \"$lock\" \"$requester:$expiry\"\n        rc=$?\n    else\n        log \"Attempting to acquire the lock\"\n        lock_create $lockname \"$requester:$expiry\"\n        rc=$?\n    fi\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' acquired by '$requester', valid until $(date -d @$expiry)\"\n        return 0\n    else\n        log \"CIB changed, lock cannot be acquired\"\n        return 3\n    fi\n}\n\n\n# The lock mechanism uses the CIB's num_updates tag to implement\n# a conditional store. Cluster-wide locking is guaranteed by pacemaker\nlock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n    local lock\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        log \"Lock doesn't exist. Nothing to release\"\n        return 0\n    else\n        log \"Lock exists, check whether we're the owner\"\n        owner=$(lock_owner $lock)\n        if [ \"$owner\" != \"$requester\" ];then\n            log \"Lock is held by someone else ($owner), will not unlock\"\n            return 1\n        fi\n    fi\n\n    lock_delete $lockname \"$lock\"\n    rc=$?\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' released by '$requester'\"\n        return 0\n    else\n        log \"CIB deletion error, lock cannot be released\"\n        return 3\n    fi\n}\n\n\n# Retrieve the owner of a lock from the CIB\n# this is a read-only operation, so no need to log debug info\nlock_get_owner() {\n    local lockname=$1\n    local rc\n    local lock\n    local owner\n\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        return 1\n    else\n        lock_owner $lock\n        return 0\n    fi\n}\n\n\nACTION=$1\nLOCKNAME=$2\nREQUESTER=$3\nTTL=${4:-60}\n\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nif [ $ACTION != \"--help\" ]; then\n    if [ -z \"$LOCKNAME\" ]; then\n        error \"You must specific a lock name\"\n    fi\n    if [ $ACTION != \"--owner\" ] && [ $ACTION != \"-o\" ]; then\n        if [ -z \"$REQUESTER\" ]; then\n            error \"You must specific a lock requester\"\n        fi\n    fi\nfi\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) try_action lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --release|-r) try_action lock_release $LOCKNAME $REQUESTER;;\n    --acquire-once|-A) lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --owner|-o) lock_get_owner $LOCKNAME;;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}, "pacemaker_mutex_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_restart_bundle.sh --lock mysql galera galera-bundle Master _\n# pacemaker_mutex_restart_bundle.sh --lock ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\n\nset -u\n\nusage() {\n    echo \"Restart a clustered resource in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --lock <tripleo-service> <pcmk-resource> <pcmk-bundle> <target-state-local> <target-state-cluster>\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\nACTION=$1\ncase $ACTION in\n    --help) usage; exit 0;;\n    --lock) ;;\n    *) error \"Unknown action '$ACTION'\";;\nesac\n\nTRIPLEO_SERVICE=$2\nLOCK_NAME=${TRIPLEO_SERVICE}-restart-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to restart resource $TRIPLEO_SERVICE\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\nRESOURCE_NAME=$3\nBUNDLE_NAME=$4\nWAIT_TARGET_LOCAL=$5\nWAIT_TARGET_ANYWHERE=${6:-_}\n\nif pacemaker_supports_promoted; then\n    WAIT_TARGET_LOCAL=$(echo \"$5\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    WAIT_TARGET_ANYWHERE=$(echo \"${6:-_}\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    promoted_role=\"Promoted\"\nelse\n    promoted_role=\"Master\"\nfi\n\n# The lock TTL should accomodate for the resource start/promote timeout\nif [ \"$RESOURCE_NAME\" != \"$BUNDLE_NAME\" ]; then\n    if [ \"$WAIT_TARGET_LOCAL\" = \"$promoted_role\" ] || [ \"$WAIT_TARGET_ANYWHERE\" = \"$promoted_role\" ]; then\n        rsc_op=\"promote\"\n    else\n        rsc_op=\"start\"\n    fi\n    # <op id=\"galera-promote-interval-0s\" interval=\"0s\" name=\"promote\" on-fail=\"block\" timeout=\"300s\"/>\n    PCMK_TTL=$(cibadmin -Q | xmllint -xpath \"string(//primitive[@id='${RESOURCE_NAME}']/operations/op[@name='${rsc_op}']/@timeout)\" - | sed 's/s$//')\n    LOCK_TTL=$((PCMK_TTL + 30))\nelse\n    # The podman RA's default start timeout\n    LOCK_TTL=90\nfi\n\nlog \"Acquire a ${LOCK_TTL}s restart lock for service $TRIPLEO_SERVICE before restarting it\"\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nrc=1\nwhile [ $rc -ne 0 ]; do\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire $LOCK_NAME $LOCK_OWNER $LOCK_TTL\n    rc=$?\n    if [ $rc != 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not acquire lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Could not acquire lock, retrying\"\n            sleep 10\n        fi\n    fi\ndone\n\nlog \"Restart the service $TRIPLEO_SERVICE locally\"\n# Reuse the local restart script in t-h-t (driven by env var TRIPLEO_MINOR_UPDATE)\nTRIPLEO_MINOR_UPDATE=true /var/lib/container-config-scripts/pacemaker_restart_bundle.sh $TRIPLEO_SERVICE $RESOURCE_NAME $BUNDLE_NAME $WAIT_TARGET_LOCAL $WAIT_TARGET_ANYWHERE\n\n# If we reached this point, always try to release the lock\nlog \"Release the restart lock for service $TRIPLEO_SERVICE\"\n/var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $LOCK_NAME $LOCK_OWNER\nrc=$?\nif [ $rc -ne 0 ] && [ $rc -ne 1 ]; then\n    error \"Could not release held lock (rc: $rc)\"\nfi\n"}, "pacemaker_mutex_shutdown.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_shutdown.sh --acquire\n# pacemaker_mutex_shutdown.sh --release\n\nset -u\n\nusage() {\n    echo \"Shutdown a cluster node in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --acquire # prevent other node from shutting down until we hold the lock\"\n    echo \"   $0 --release # release the lock, other node can compete for the shutdown lock\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nshutdown_lock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc=1\n    local current_owner\n    local owner_stopped\n    local owner_rc\n\n    log \"Acquiring the shutdown lock\"\n    while [ $rc -ne 0 ]; do\n        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire-once $lockname $requester $ttl\n        rc=$?\n        if [ $rc -ne 0 ]; then\n            if [ $rc -eq 2 ]; then\n                error \"Could not acquire the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n            else\n                # The lock is held by another node.\n                current_owner=$(/var/lib/container-config-scripts/pacemaker_resource_lock.sh --owner $lockname)\n                owner_rc=$?\n                if [ $owner_rc -eq 2 ]; then\n                    error \"Could not get the shutdown lock owner due to unrecoverable error (rc: $owner_rc), bailing out\"\n                fi\n                if [ $owner_rc -eq 0 ]; then\n                    # If the owner is marked as offline, that means it has shutdown and\n                    # we can clean the lock preemptively and try to acquire it.\n                    owner_stopped=$(crm_mon -1X | xmllint --xpath 'count(//nodes/node[@name=\"'${current_owner}'\" and @online=\"false\" and @unclean=\"false\"])' -)\n                    if [ \"${owner_stopped}\" = \"1\" ]; then\n                        log \"Shutdown lock held by stopped node '${current_owner}', lock can be released\"\n                        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $current_owner\n                        continue\n                    fi\n                fi\n                log \"Shutdown lock held by another node (rc: $rc), retrying\"\n                sleep 10\n            fi\n        fi\n    done\n    log \"Shutdown lock acquired\"\n    return 0\n}\n\n\n# Release the lock if we still own it. Not owning it anymore is not fatal\nshutdown_lock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n\n    log \"Releasing the shutdown lock\"\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $requester\n    rc=$?\n    if [ $rc -ne 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not release the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Shutdown lock no longer held, nothing to do\"\n        fi\n    else\n        log \"Shutdown lock released\"\n    fi\n    return 0\n}\n\n\nACTION=$1\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nLOCK_NAME=tripleo-shutdown-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to aquire the shutdown lock\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\n# We start with a very high TTL, that long enough to accomodate a cluster stop.\n# As soon as the node will get offline, the other competing node will be entitled\n# to steal the lock, so they should never wait that long in practice.\nLOCK_TTL=600\n\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) shutdown_lock_acquire ${LOCK_NAME} ${LOCK_OWNER} ${LOCK_TTL};;\n    --release|-r) shutdown_lock_release ${LOCK_NAME} ${LOCK_OWNER};;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}}, "tuple:('role_data', 'service_name')": "oslo_messaging_rpc", "tuple:('role_data', 'docker_config')": {"step_1": {"rabbitmq_bootstrap": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1", "net": "host", "privileged": false, "user": "root", "command": ["bash", "-ec", "kolla_set_configs\nif [[ -e \"/var/lib/rabbitmq/.erlang.cookie\" ]]; then rm -f /var/lib/rabbitmq/.erlang.cookie; fi\nhiera 'rabbitmq::erlang_cookie' > /var/lib/rabbitmq/.erlang.cookie\nchown rabbitmq:rabbitmq /var/lib/rabbitmq/.erlang.cookie\nchmod 400 /var/lib/rabbitmq/.erlang.cookie"], "volumes": ["/var/lib/kolla/config_files/rabbitmq.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/rabbitmq:/var/lib/kolla/config_files/src:ro", "/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/var/lib/rabbitmq:/var/lib/rabbitmq:z", "/etc/puppet:/etc/puppet:ro,z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1769501968"}}}, "step_2": {"rabbitmq_wait_bundle": {"start_order": 0, "detach": false, "net": "host", "ipc": "host", "user": "root", "command": ["/container_puppet_apply.sh", "2", "file,file_line,concat,augeas,rabbitmq_policy,rabbitmq_user,rabbitmq_ready", "include tripleo::profile::pacemaker::rabbitmq_bundle", ""], "image": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/var/lib/container-config-scripts/container_puppet_apply.sh:/container_puppet_apply.sh:ro", "/etc/puppet:/tmp/puppet-etc:ro", "/usr/share/openstack-puppet/modules:/usr/share/openstack-puppet/modules:ro", "/bin/true:/bin/epmd"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "KOLLA_BOOTSTRAP": true, "TRIPLEO_DEPLOY_IDENTIFIER": "1769501968"}}}}, "role_data": {"service_name": "oslo_messaging_rpc", "firewall_rules": {"109 rabbitmq-bundle": {"dport": [3122, 4369, 5672, 25672, "25673-25683"]}}, "global_config_settings": {"oslo_messaging_rpc_scheme": "rabbit", "oslo_messaging_rpc_user_name": "guest", "oslo_messaging_rpc_password": "rAEOjyWy2c6PARokWxktfn5mX", "oslo_messaging_rpc_use_ssl": "False", "oslo_messaging_rpc_port": 5672}, "config_settings": {"rabbitmq::file_limit": 65536, "rabbitmq::default_user": "guest", "rabbitmq::default_pass": "rAEOjyWy2c6PARokWxktfn5mX", "rabbit_ipv6": false, "rabbitmq::delete_guest_user": false, "rabbitmq::wipe_db_on_cookie_change": true, "rabbitmq::port": 5672, "rabbitmq::loopback_users": [], "rabbitmq::tcp_backlog": 4096, "rabbitmq::repos_ensure": false, "rabbitmq::tcp_keepalive": true, "rabbitmq_environment": {"LANG": "en_US.UTF-8", "LC_ALL": "en_US.UTF-8", "NODE_PORT": "", "NODE_IP_ADDRESS": "", "RABBITMQ_NODENAME": "rabbit@%{hiera('fqdn_internal_api')}", "RABBITMQ_USE_LONGNAME": "true", "RABBITMQ_CTL_DIST_PORT_MIN": "25673", "RABBITMQ_CTL_DIST_PORT_MAX": "25683", "export ERL_EPMD_ADDRESS": "%{hiera('rabbitmq::interface')}"}, "tripleo::profile::base::rabbitmq::additional_erl_args": "'+sbwt none +sbwtdcpu none +sbwtdio none'", "rabbitmq_kernel_variables": {"inet_dist_listen_min": "25672", "inet_dist_listen_max": "25672", "net_ticktime": 15}, "rabbitmq_config_variables": {"cluster_partition_handling": "ignore", "queue_master_locator": "<<\"min-masters\">>"}, "rabbitmq::config_additional_variables": {"lager": "[{crash_log_count, 0}, { crash_log_date, \"\"}, { crash_log_size, 0 }]"}, "rabbitmq::erlang_cookie": "qyGFiwqiEVnsR5uI2hrs", "rabbitmq::interface": "%{hiera('internal_api')}", "rabbitmq::nr_ha_queues": 0, "rabbitmq::ssl": false, "rabbitmq::ssl_erl_dist": false, "rabbitmq::ssl_port": 5672, "rabbitmq::ssl_depth": 1, "rabbitmq::ssl_only": false, "rabbitmq::ssl_interface": "%{hiera('internal_api')}", "tripleo::profile::base::rabbitmq::enable_internal_tls": false, "tripleo::profile::base::rabbitmq::fips_mode": false, "rabbitmq::collect_statistics_interval": 30000, "rabbitmq::admin_enable": false, "rabbitmq::management_enable": true, "rabbitmq::use_config_file_for_plugins": true, "rabbitmq::management_ip_address": "127.0.0.1", "rabbitmq::management_port": 15672, "rabbitmq::config_management_variables": {"rates_mode": "none"}, "rabbitmq::ssl_cacert": "/etc/ipa/ca.crt", "rabbitmq::ssl_management_cacert": "/etc/ipa/ca.crt", "rabbitmq::service_manage": false, "tripleo::profile::pacemaker::rabbitmq_bundle::rabbitmq_docker_image": "cluster.common.tag/rabbitmq:pcmklatest", "tripleo::profile::pacemaker::rabbitmq_bundle::control_port": 3122, "tripleo::profile::pacemaker::rabbitmq_bundle::container_backend": "podman", "tripleo::profile::pacemaker::rabbitmq_bundle::force_ocf": true}, "service_config_settings": null, "puppet_config": {"config_volume": "rabbitmq", "puppet_tags": "file,file_line", "step_config": "['Rabbitmq_policy', 'Rabbitmq_user'].each |String $val| { noop_resource($val) }\ninclude tripleo::profile::pacemaker::rabbitmq_bundle", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/rabbitmq.json": {"command": "/usr/sbin/pacemaker_remoted", "config_files": [{"dest": "/etc/libqb/force-filesystem-sockets", "source": "/dev/null", "owner": "root", "perm": "0644"}, {"dest": "/var/log/btmp", "source": "/dev/null", "owner": "root:utmp", "perm": "0600"}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "optional": true, "preserve_properties": true}], "permissions": [{"path": "/var/lib/rabbitmq", "owner": "rabbitmq:rabbitmq", "recurse": true}, {"path": "/var/log/rabbitmq", "owner": "rabbitmq:rabbitmq", "recurse": true}, {"path": "/etc/pki/tls/certs/rabbitmq.crt", "owner": "rabbitmq:rabbitmq", "perm": "0600", "optional": true}, {"path": "/etc/pki/tls/private/rabbitmq.key", "owner": "rabbitmq:rabbitmq", "perm": "0600", "optional": true}]}}, "container_config_scripts": {"container_puppet_apply.sh": {"mode": "0700", "content": "#!/bin/bash\nset -eux\nSTEP=$1\nTAGS=$2\nCONFIG=$3\nEXTRA_ARGS=${4:-''}\nif [ -d /tmp/puppet-etc ]; then\n  # ignore copy failures as these may be the same file depending on docker mounts\n  cp -a /tmp/puppet-etc/* /etc/puppet || true\nfi\necho \"{\\\"step\\\": ${STEP}}\" > /etc/puppet/hieradata/docker_puppet.json\n# $::deployment_type in puppet-tripleo\nexport FACTER_deployment_type=containers\nset +e\npuppet apply $EXTRA_ARGS \\\n    --verbose \\\n    --detailed-exitcodes \\\n    --summarize \\\n    --color=false \\\n    --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \\\n    --tags $TAGS \\\n    -e \"noop_resource('package'); ${CONFIG}\"\nrc=$?\nset -e\nset +ux\nif [ $rc -eq 2 -o $rc -eq 0 ]; then\n    exit 0\nfi\nexit $rc\n"}, "pyshim.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n#\n# Usage: pyshim.sh <script and/or arguments>\n#\n# Unfortunately THT doesn't know which version of python might be in a\n# container so we need this script to be able to try python3 or python2\n# depending on availability.  Since this is a temporary shim until we've\n# fully cut over to python3, we check for the existence of python3 first\n# before falling back to python2. This will help in the transition from\n# python2 based containers to python3.\n\nshow_usage() {\n    echo \"Usage: pyshim.sh <script and/or arguments>\"\n}\n\nif [ $# -lt 1 ]\nthen\n    show_usage\n    exit 1\nfi\n\nset -x\nif command -v python3 >/dev/null; then\n    python3 \"$@\"\nelif command -v python2 >/dev/null; then\n    python2 \"$@\"\nelif command -v python >/dev/null; then\n    python \"$@\"\nelse\n    echo \"ERROR: python is not available!\"\n    exit 1\nfi\n"}, "pacemaker_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nset -u\n\n# ./pacemaker_restart_bundle.sh mysql galera galera-bundle Master _\n# ./pacemaker_restart_bundle.sh redis redis redis-bundle Slave Master\n# ./pacemaker_restart_bundle.sh ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\nRESTART_SCRIPTS_DIR=$(dirname $0)\nTRIPLEO_SERVICE=$1\nRESOURCE_NAME=$2\nBUNDLE_NAME=$3\nWAIT_TARGET_LOCAL=$4\nWAIT_TARGET_ANYWHERE=${5:-_}\nTRIPLEO_MINOR_UPDATE=\"${TRIPLEO_MINOR_UPDATE:-false}\"\nTRIPLEO_HA_WRAPPER_RESOURCE_EXISTS=\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS:-false}\"\n\nbundle_can_be_restarted() {\n    local bundle=$1\n    # As long as the resource bundle is managed by pacemaker and is\n    # not meant to stay stopped, no matter the state of any inner\n    # pcmk_remote or ocf resource, we should restart it to give it a\n    # chance to read the new config.\n    [ \"$(crm_resource --meta -r $1 -g is-managed 2>/dev/null)\" != \"false\" ] && \\\n    [ \"$(crm_resource --meta -r $1 -g target-role 2>/dev/null)\" != \"Stopped\" ]\n}\n\nlog() {\n    local msg=$1\n    logger -t pcmkrestart \"$1\"\n}\n\nHOSTNAME=$(/bin/hostname -s)\nif [ x\"${TRIPLEO_MINOR_UPDATE,,}\" != x\"true\" ]; then\n    if [ x\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS,,}\" = x\"false\" ]; then\n        # Do not restart during initial deployment, as the resource\n        # has just been created.\n        SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n        if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n            log \"Initial deployment, skipping the restart of ${BUNDLE_NAME}\"\n\tfi\n        exit 0\n    else\n        # During a stack update, this script is called in parallel on\n        # every node the resource runs on, after the service's configs\n        # have been updated on all nodes. So we need to run pcs only\n        # once (e.g. on the service's boostrap node).\n        if bundle_can_be_restarted ${BUNDLE_NAME}; then\n            SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n            if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n                replicas_running=$(crm_resource -Q -r $BUNDLE_NAME --locate 2>&1 | wc -l)\n                if [ \"$replicas_running\" != \"0\" ]; then\n                    log \"Restarting ${BUNDLE_NAME} globally. Stopping:\"\n                    /sbin/pcs resource disable --wait=600 $BUNDLE_NAME\n                    log \"Restarting ${BUNDLE_NAME} globally. Starting:\"\n                    /sbin/pcs resource enable --wait=600 $BUNDLE_NAME\n                else\n                    log \"${BUNDLE_NAME} is not running anywhere,\" \\\n                         \"cleaning up to restart it globally if necessary\"\n                    /sbin/pcs resource cleanup $BUNDLE_NAME\n                fi\n            else\n                log \"Skipping global restart of ${BUNDLE_NAME} on ${HOSTNAME} it will be restarted by node ${SERVICE_NODEID}\"\n            fi\n\n        else\n            log \"No global restart needed for ${BUNDLE_NAME}.\"\n        fi\n    fi\nelse\n    # During a minor update workflow however, a host gets fully\n    # updated before updating the next one. So unlike stack\n    # update, at the time this script is called, the service's\n    # configs aren't updated on all nodes yet. So only restart the\n    # resource locally, where it's guaranteed that the config is\n    # up to date.\n    HOST=$(facter hostname)\n\n    if bundle_can_be_restarted ${BUNDLE_NAME}; then\n\t# if the resource is running locally, restart it\n\tif crm_resource -r $BUNDLE_NAME --locate 2>&1 | grep -w -q \"${HOST}\"; then\n            log \"Restarting ${BUNDLE_NAME} locally on '${HOST}'\"\n            /sbin/pcs resource restart $BUNDLE_NAME \"${HOST}\"\n\n\telse\n\t    # At this point, if no resource is running locally, it's\n\t    # either because a) it has failed previously, or b) because\n\t    # it's an A/P resource running elsewhere.\n\t    # By cleaning up resource, we ensure that a) it will try to\n\t    # restart, or b) it won't do anything if the resource is\n\t    # already running elsewhere.\n            log \"${BUNDLE_NAME} is currently not running on '${HOST}',\" \\\n                 \"cleaning up its state to restart it if necessary\"\n            /sbin/pcs resource cleanup $BUNDLE_NAME node=\"${HOST}\"\n\tfi\n\n\t# Wait until the resource is in the expected target state\n\t$RESTART_SCRIPTS_DIR/pacemaker_wait_bundle.sh \\\n            $RESOURCE_NAME $BUNDLE_NAME \\\n            \"$WAIT_TARGET_LOCAL\" \"$WAIT_TARGET_ANYWHERE\" \\\n\t    \"${HOST}\" 600\n    else\n        log \"No restart needed for ${BUNDLE_NAME}.\"\n    fi\nfi\n"}, "pacemaker_wait_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# ----\n# Wait for an OCF resource or a bundle to be restarted\n# ----\n# e.g.:\n# M/S OCF:      $0 galera galera-bundle Master\n# clone OCF:    $0 rabbitmq rabbitmq-bundle Started\n# A/P M/S OCF:  $0 redis redis-bundle Slave Master\n# A/P bundle:   $0 openstack-cinder-volume openstack-cinder-volume _ Started\n# clone bundle: $0 haproxy-bundle haproxy-bundle Started\n\n# design note 1:\n#  - this script is called during a minor update; it is called\n#    once per node that hosts a service replica.\n#  - the purpose of this script is to ensure that restarting the\n#    service replica locally won't disrupt the service availability\n#    for the end user. To reach that goal, the script waits until the\n#    service is restarted locally or globallu and reaches a given\n#    target state (i.e. Started, Slave or Master).\n# design note 2:\n#   - we don't want to track restart error: our only job is to ensure\n#     service restart synchronization, not service health.\n#   - In particular, we don't want to error out in case the resource\n#     cannot be restarted locally, because that would make the minor\n#     update fail, even if potentially other replicas still provide\n#     the service.\n# design note 3:\n#   - we can bail out early if we determine that the resource can't\n#     be restarted automatically by pacemaker (e.g. its \"blocked\",\n#     unmanaged or disabled).\n\nlog() {\n    local msg=$1\n    echo \"$(date -u): $1\"\n}\n\nusage() {\n    echo 2>&1 \"Usage: $0 NAME BUNDLE_NAME ROLE_LOCAL [ROLE_ANYWHERE] [HOST] [TIMEOUT]\"\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\n#\n# Utility functions to detect stuck resources\n#\n\nbundle_failures_locally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local replica_name\n    for i in $(seq 0 $last); do\n\treplica_name=${BUNDLE_NAME}-${engine}-${i}\n\tcrm_failcount -q -G -r $replica_name -N $HOST\n    done\n}\n\nbundle_failures_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    for i in $(seq 0 $last); do\n\tcrm_failcount -q -G -r ${BUNDLE_NAME}-${engine}-${i}\n    done\n}\n\nbundle_running_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    # return the number of running bundles replica, i.e. the number of\n    # docker/podman resource replicas currently running in the cluster\n    crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:heartbeat:${engine}']/node)\" -\n}\n\nocf_failures_globally() {\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local bundle_node\n    for i in $(seq 0 $last); do\n\tbundle_node=${BUNDLE_NAME}-${i}\n\tcrm_failcount -q -G -r $NAME -N $bundle_node\n    done\n}\n\ndid_resource_failed_locally() {\n    local failures\n    local running\n    local remotehost\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# if we're dealing with an ocf resource, it is running on a\n\t# pacemaker_remote rather that on the real host, and the\n\t# failcounts are thus associated to the pcmk remote. Replace\n\t# the host's name with the pcmk remote's name.\n        remotehost=$(crm_mon --as-xml | xmllint --xpath \"string(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource/node[@name='${HOST}']/../../resource[@resource_agent='${OCF}:pacemaker:remote']/@id)\" -)\n\tif [ -n \"${remotehost}\" ]; then\n\t    crm_failcount -q -G -r $NAME -N $remotehost | grep -q -w INFINITY\n\t    return $?\n\tfi\n\t# If no pcmk remote is currently running, the failcount from\n\t# the ocf resource is useless, compute the failcount from the\n\t# bundle case instead (computed below).\n    fi\n\n    # for bundles, pacemaker can run any bundle replica locally\n    # (e.g. galera-bundle-docker-{0,1,2}), and a failure happens when\n    # there are no more replica to try.\n    # That is, when _at least_ one replica failed locally, and all the\n    # others either failed or are currently running elsewhere.\n    failures=$(bundle_failures_locally $HOST | grep -c -w INFINITY)\n    running=$(bundle_running_globally)\n    test $failures -gt 0 && \\\n    test $(( $failures + $running )) -ge $BUNDLE_REPLICAS\n}\n\ndid_resource_failed_globally() {\n    local remotecount\n    local failures\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# we check the state of an ocf resource only if the\n\t# pcmkremotes are started\n        remotecount=$(crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node)\" -)\n\tif [ \"${remotecount}\" = \"0\" ]; then\n\t    # no pcmkremote is running, so check the bundle state\n\t    # instead of checking the ocf resource\n\t    # bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\t    failures=$(bundle_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\telse\n\t    # ocf resource failed if it failed to start on\n\t    # all $BUNDLE_REPLICAS bundle nodes\n\t    failures=$(ocf_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\tfi\n    else\n\t# bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\tfailures=$(bundle_failures_globally | grep -c -w INFINITY)\n\ttest $failures -eq $BUNDLE_REPLICAS\n    fi\n}\n\n\n# Input validation\n#\n\nNAME=$1\nif [ -z \"${NAME}\" ]; then\n    echo 2>&1 \"Error: argument NAME must not be empty\"\n    exit 1\nfi\n\nBUNDLE_NAME=$2\nif [ -z \"${BUNDLE_NAME}\" ]; then\n    echo 2>&1 \"Error: argument BUNDLE_NAME must not be empty\"\n    exit 1\nfi\n\nROLE_LOCAL=$3\nif [ \"${ROLE_LOCAL}\" = \"_\" ]; then\n    ROLE_LOCAL=\"\"\nfi\n\nROLE_ANYWHERE=$4\nif [ \"${ROLE_ANYWHERE}\" = \"_\" ]; then\n    ROLE_ANYWHERE=\"\"\nfi\n\nif [ -z \"${ROLE_LOCAL}\" ]; then\n    if [ -z \"${ROLE_ANYWHERE}\" ]; then\n        echo 2>&1 \"Error: either ROLE_LOCAL or ROLE_ANYWHERE must be non empty\"\n        exit 1\n    fi\nelse\n    if !(echo \"${ROLE_LOCAL}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n        echo 2>&1 \"Error: argument ROLE_LOCAL must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n        exit 1\n    fi\nfi\n\nif [ -n \"${ROLE_ANYWHERE}\" ] && !(echo \"${ROLE_ANYWHERE}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n    echo 2>&1 \"Error: argument ROLE_ANYWHERE must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n    exit 1\nfi\n\n# Ensure compatibility with pacemaker 2.1\nif pacemaker_supports_promoted; then\n    ROLE_LOCAL=$(echo \"$ROLE_LOCAL\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    ROLE_ANYWHERE=$(echo \"$ROLE_ANYWHERE\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    OCF=\"ocf\"\nelse\n    OCF=\"ocf:\"\nfi\n\nHOST=${5:-$(facter hostname)}\nTIMEOUT=${6:-600}\n\n\n# Configure the search\n# ----\n# Note: we can't use crm_resource in all searches because we can't\n# easily extract the host the OCF resources run on (crm_resource\n# returns the pcmk-remote nodes rather than the hosts)\n# So instead, we implement various searches with XPath directly.\n\nif [ \"${BUNDLE_NAME}\" != \"${NAME}\" ]; then\n# ocf resource\nlocal_resource_xpath=\"//bundle/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node[@name='${HOST}']/../../resource[@id='${NAME}']\"\nany_resource_xpath=\"//bundle//resource[@id='${NAME}']\"\nreplicas_xpath=\"//bundle/primitive[@id='${BUNDLE_NAME}']/../*[boolean(@image) and boolean(@replicas)]\"\nelse\n# bundle resource\nlocal_resource_xpath=\"//bundle[@id='${NAME}']/replica/resource/node[@name='${HOST}']/../../resource\"\nany_resource_xpath=\"//bundle[@id='${NAME}']//resource\"\nreplicas_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nfi\n\nbundle_def_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nBUNDLE_CONTAINER_ENGINE=$(cibadmin -Q | xmllint --xpath \"name(${bundle_def_xpath})\" -)\nBUNDLE_REPLICAS=$(cibadmin -Q | xmllint --xpath \"string(${bundle_def_xpath}/@replicas)\" -)\n\n\n# The wait algorithm follows a two-stage approach\n#  1. Depending on how the script is called, we first check whether\n#     the resource is restarted locally. An A/P resource may be\n#     restarted elsewhere in the cluster.\n#  2. If needed, check whether the A/P resource has restarted\n#     elsewhere. For A/P M/S resources, in case the resource is\n#     restarted as Slave locally, ensure a Master is available.\n\nsuccess=1\nbailout=1\ntimeout=$TIMEOUT\nrole=\"\"\n\n# Stage 1: local check\nif [ -n \"$ROLE_LOCAL\" ]; then\n    log \"Waiting until ${NAME} has restarted on ${HOST} and is in state ${ROLE_LOCAL}\"\n    log \"Will probe resource state with the following XPath pattern: ${local_resource_xpath}\"\n\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resource=$(crm_mon -r --as-xml | xmllint --xpath \"${local_resource_xpath}\" - 2>/dev/null)\n        role=$(echo \"${resource}\" | sed -ne 's/.*\\Wrole=\"\\([^\"]*\\)\".*/\\1/p')\n\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resource}\" | grep -q -w \"\\Wblocked=\\\"true\\\"\"; then\n            log \"${NAME} is blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_locally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif [ \"$role\" = \"$ROLE_LOCAL\" ]; then\n            success=0\n            continue\n        elif [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" = \"$ROLE_ANYWHERE\" ]; then\n            # A/P: we are restarted in the expected state\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_LOCAL} on ${HOST}\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\n# Stage 2: global check\nif [ $timeout -gt 0 ] && [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" != \"$ROLE_ANYWHERE\" ]; then\n    log \"Wait until ${NAME} is restarted anywhere in the cluster in state ${ROLE_ANYWHERE}\"\n    log \"Will probe resource state with the following XPath pattern: ${any_resource_xpath}\"\n\n    success=1\n    bailout=1\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resources=$(crm_mon -r --as-xml | xmllint --xpath \"${any_resource_xpath}\" - 2>/dev/null)\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif ! (echo \"${resources}\" | grep -q -w \"\\Wblocked=\\\"false\\\"\"); then\n            log \"${NAME} blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_globally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resources}\" | grep -q -w \"\\Wrole=\\\"${ROLE_ANYWHERE}\\\"\"; then\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_ANYWHERE} anywhere in the cluster\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\nif [ $timeout -le 0 ]; then\n    log \"Timeout reached after ${TIMEOUT}s while waiting for ${NAME} to be restarted\"\nelif [ $bailout -le 0 ]; then\n    log \"Restart monitoring for ${NAME} cancelled\"\nfi\n\nif [ $success -eq 0 ]; then\n    log \"${NAME} successfully restarted\"\nelse\n    log \"${NAME} was not restarted properly\"\nfi\n\n# Don't block minor update or stack update if the wait was unsuccessful\nexit 0\n"}, "wait-port-and-run.sh": {"mode": "0755", "content": "#!/usr/bin/bash\nset -eu\n\nHOST=$1\nPORT=$2\n\necho \"$(date -u): Checking whether we can bind to ${HOST}:${PORT}\"\nwhile (ss -Htnl src \"${HOST}\" \"sport = :${PORT}\" | grep -wq \"${PORT}\"); do\n    echo \"$(date -u): ${HOST}:${PORT} still in use, waiting...\";\n    sleep 10;\ndone\n\nshift 2\nCOMMAND=\"$*\"\nif [ -z \"${COMMAND}\" ]; then\n    COMMAND=\"true\"\nfi\nexec $COMMAND\n"}, "pacemaker_resource_lock.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nMAX_RETRIES=10\nCIB_ENOTFOUND=105\n\nusage() {\n   echo \"Set a global property in the cluster with a validity timestamp.\"\n   echo \"Usage:\"\n   echo \"   $0 --acquire <lock_name> <lock_owner> <lock_ttl_in_seconds>\"\n   echo \"   $0 --release <lock_name> <lock_owner>\"\n   echo\n}\n\nlog() {\n    echo \"$(date -u): $1\" 1>&2\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\nlock_create() {\n    local name=$1\n    local data=$2\n    # cibadmin won't overwrite a key if someone else succeeded to create it concurrently\n    cibadmin --sync-call --scope crm_config --create --xml-text \"<cluster_property_set id='${name}'><nvpair id='${name}-pair' name='${name}' value='${data}'/></cluster_property_set>\" &>/dev/null\n    return $?\n}\n\nlock_update() {\n    local name=$1\n    local expected_data=$2\n    local new_data=$3\n    # we only update the lock we expect to see, so we can't update someone else's lock\n    cibadmin --sync-call --scope crm_config --modify --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" --xml-text \"<nvpair id='${name}-pair' name='${name}' value='${new_data}'/>\" &>/dev/null\n    return $?\n}\n\nlock_delete() {\n    local name=$1\n    local expected_data=$2\n    # we only delete the lock we expect to see, so we can't delete someone else's lock\n    cibadmin --sync-call --scope crm_config --delete --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" &>/dev/null\n    return $?\n}\n\nlock_get() {\n    local lockname=$1\n    local res\n    local rc\n    res=$(cibadmin --query --scope crm_config --xpath \"//cluster_property_set/nvpair[@name='$lockname']\" 2>/dev/null)\n    rc=$?\n    if [ $rc -eq 0 ]; then\n        echo \"$res\" | sed -n 's/.*value=\"\\([^\"]*\\)\".*/\\1/p'\n    fi\n    return $rc\n}\n\nlock_owner() {\n    local lock=$1\n    echo \"$lock\" | cut -d':' -f1\n}\n\nlock_has_expired() {\n    local lock=$1\n    local expiry=$(echo \"$lock\" | cut -d':' -f2)\n    local now=$(date +%s)\n    test $now -ge $expiry\n}\n\n\n# Perform a lock action and restart if the CIB has been modified before\n# committing the lock action\ntry_action() {\n    local fun=$1\n    local lock=$2\n    local requester=$3\n    local args=${4:-}\n    local tries=$MAX_RETRIES\n    local rc=1\n    if [ \"$fun\" = \"lock_acquire\" ] || [ \"$fun\" = \"lock_release\" ]; then\n        log \"Try running $fun\"\n    else\n        return 2\n    fi\n    while [ $rc -ne 0 ]; do\n        $fun $lock $requester $args\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Operation $1 succeeded\"\n            return 0\n        elif [ $rc -eq 3 ]; then\n            # rc == 3 -> CIB changed before push\n            if [ $tries -eq 0 ]; then\n                log \"Failed to commit after $MAX_RETRIES retries. Bailing out.\"\n                return 2\n            else\n                log \"Failed to commit. Retrying operation.\"\n                tries=$(($tries - 1))\n            fi\n        elif [ $rc -eq 2 ]; then\n            # rc == 2 -> unrecoverable cib error (e.g. pacemaker down)\n            log \"Unexpected failure. Bailing out\"\n            return $rc\n        else\n            # rc == 1 -> lock error (not owner, lock doesn't exists)\n            return $rc\n        fi\n    done\n}\n\n# The lock mechanism uses cibadmin's atomic creation so cluster-wide\n# state coherency is guaranteed by pacemaker\nlock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc\n    local lock\n    local expiry\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -n \"$lock\" ]; then\n        lock_has_expired $lock\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Lock has expired, now available for being held\"\n        else\n            # lock is still held. check whether we're the owner\n            owner=$(lock_owner $lock)\n            if [ \"$owner\" = \"$requester\" ];then\n                log \"Requester already owns the lock, acquiring attempt will just reconfigure the TTL\"\n            else\n                log \"Lock is held by someone else ($owner)\"\n                return 1\n            fi\n        fi\n    else\n        log \"Lock is not held yet\"\n    fi\n\n    # prepare the lock info\n    expiry=$(($(date +%s) + $ttl))\n\n    if [ -n \"$lock\" ]; then\n        log \"Attempting to update the lock\"\n        lock_update $lockname \"$lock\" \"$requester:$expiry\"\n        rc=$?\n    else\n        log \"Attempting to acquire the lock\"\n        lock_create $lockname \"$requester:$expiry\"\n        rc=$?\n    fi\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' acquired by '$requester', valid until $(date -d @$expiry)\"\n        return 0\n    else\n        log \"CIB changed, lock cannot be acquired\"\n        return 3\n    fi\n}\n\n\n# The lock mechanism uses the CIB's num_updates tag to implement\n# a conditional store. Cluster-wide locking is guaranteed by pacemaker\nlock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n    local lock\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        log \"Lock doesn't exist. Nothing to release\"\n        return 0\n    else\n        log \"Lock exists, check whether we're the owner\"\n        owner=$(lock_owner $lock)\n        if [ \"$owner\" != \"$requester\" ];then\n            log \"Lock is held by someone else ($owner), will not unlock\"\n            return 1\n        fi\n    fi\n\n    lock_delete $lockname \"$lock\"\n    rc=$?\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' released by '$requester'\"\n        return 0\n    else\n        log \"CIB deletion error, lock cannot be released\"\n        return 3\n    fi\n}\n\n\n# Retrieve the owner of a lock from the CIB\n# this is a read-only operation, so no need to log debug info\nlock_get_owner() {\n    local lockname=$1\n    local rc\n    local lock\n    local owner\n\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        return 1\n    else\n        lock_owner $lock\n        return 0\n    fi\n}\n\n\nACTION=$1\nLOCKNAME=$2\nREQUESTER=$3\nTTL=${4:-60}\n\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nif [ $ACTION != \"--help\" ]; then\n    if [ -z \"$LOCKNAME\" ]; then\n        error \"You must specific a lock name\"\n    fi\n    if [ $ACTION != \"--owner\" ] && [ $ACTION != \"-o\" ]; then\n        if [ -z \"$REQUESTER\" ]; then\n            error \"You must specific a lock requester\"\n        fi\n    fi\nfi\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) try_action lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --release|-r) try_action lock_release $LOCKNAME $REQUESTER;;\n    --acquire-once|-A) lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --owner|-o) lock_get_owner $LOCKNAME;;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}, "pacemaker_mutex_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_restart_bundle.sh --lock mysql galera galera-bundle Master _\n# pacemaker_mutex_restart_bundle.sh --lock ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\n\nset -u\n\nusage() {\n    echo \"Restart a clustered resource in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --lock <tripleo-service> <pcmk-resource> <pcmk-bundle> <target-state-local> <target-state-cluster>\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\nACTION=$1\ncase $ACTION in\n    --help) usage; exit 0;;\n    --lock) ;;\n    *) error \"Unknown action '$ACTION'\";;\nesac\n\nTRIPLEO_SERVICE=$2\nLOCK_NAME=${TRIPLEO_SERVICE}-restart-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to restart resource $TRIPLEO_SERVICE\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\nRESOURCE_NAME=$3\nBUNDLE_NAME=$4\nWAIT_TARGET_LOCAL=$5\nWAIT_TARGET_ANYWHERE=${6:-_}\n\nif pacemaker_supports_promoted; then\n    WAIT_TARGET_LOCAL=$(echo \"$5\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    WAIT_TARGET_ANYWHERE=$(echo \"${6:-_}\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    promoted_role=\"Promoted\"\nelse\n    promoted_role=\"Master\"\nfi\n\n# The lock TTL should accomodate for the resource start/promote timeout\nif [ \"$RESOURCE_NAME\" != \"$BUNDLE_NAME\" ]; then\n    if [ \"$WAIT_TARGET_LOCAL\" = \"$promoted_role\" ] || [ \"$WAIT_TARGET_ANYWHERE\" = \"$promoted_role\" ]; then\n        rsc_op=\"promote\"\n    else\n        rsc_op=\"start\"\n    fi\n    # <op id=\"galera-promote-interval-0s\" interval=\"0s\" name=\"promote\" on-fail=\"block\" timeout=\"300s\"/>\n    PCMK_TTL=$(cibadmin -Q | xmllint -xpath \"string(//primitive[@id='${RESOURCE_NAME}']/operations/op[@name='${rsc_op}']/@timeout)\" - | sed 's/s$//')\n    LOCK_TTL=$((PCMK_TTL + 30))\nelse\n    # The podman RA's default start timeout\n    LOCK_TTL=90\nfi\n\nlog \"Acquire a ${LOCK_TTL}s restart lock for service $TRIPLEO_SERVICE before restarting it\"\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nrc=1\nwhile [ $rc -ne 0 ]; do\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire $LOCK_NAME $LOCK_OWNER $LOCK_TTL\n    rc=$?\n    if [ $rc != 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not acquire lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Could not acquire lock, retrying\"\n            sleep 10\n        fi\n    fi\ndone\n\nlog \"Restart the service $TRIPLEO_SERVICE locally\"\n# Reuse the local restart script in t-h-t (driven by env var TRIPLEO_MINOR_UPDATE)\nTRIPLEO_MINOR_UPDATE=true /var/lib/container-config-scripts/pacemaker_restart_bundle.sh $TRIPLEO_SERVICE $RESOURCE_NAME $BUNDLE_NAME $WAIT_TARGET_LOCAL $WAIT_TARGET_ANYWHERE\n\n# If we reached this point, always try to release the lock\nlog \"Release the restart lock for service $TRIPLEO_SERVICE\"\n/var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $LOCK_NAME $LOCK_OWNER\nrc=$?\nif [ $rc -ne 0 ] && [ $rc -ne 1 ]; then\n    error \"Could not release held lock (rc: $rc)\"\nfi\n"}, "pacemaker_mutex_shutdown.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_shutdown.sh --acquire\n# pacemaker_mutex_shutdown.sh --release\n\nset -u\n\nusage() {\n    echo \"Shutdown a cluster node in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --acquire # prevent other node from shutting down until we hold the lock\"\n    echo \"   $0 --release # release the lock, other node can compete for the shutdown lock\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nshutdown_lock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc=1\n    local current_owner\n    local owner_stopped\n    local owner_rc\n\n    log \"Acquiring the shutdown lock\"\n    while [ $rc -ne 0 ]; do\n        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire-once $lockname $requester $ttl\n        rc=$?\n        if [ $rc -ne 0 ]; then\n            if [ $rc -eq 2 ]; then\n                error \"Could not acquire the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n            else\n                # The lock is held by another node.\n                current_owner=$(/var/lib/container-config-scripts/pacemaker_resource_lock.sh --owner $lockname)\n                owner_rc=$?\n                if [ $owner_rc -eq 2 ]; then\n                    error \"Could not get the shutdown lock owner due to unrecoverable error (rc: $owner_rc), bailing out\"\n                fi\n                if [ $owner_rc -eq 0 ]; then\n                    # If the owner is marked as offline, that means it has shutdown and\n                    # we can clean the lock preemptively and try to acquire it.\n                    owner_stopped=$(crm_mon -1X | xmllint --xpath 'count(//nodes/node[@name=\"'${current_owner}'\" and @online=\"false\" and @unclean=\"false\"])' -)\n                    if [ \"${owner_stopped}\" = \"1\" ]; then\n                        log \"Shutdown lock held by stopped node '${current_owner}', lock can be released\"\n                        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $current_owner\n                        continue\n                    fi\n                fi\n                log \"Shutdown lock held by another node (rc: $rc), retrying\"\n                sleep 10\n            fi\n        fi\n    done\n    log \"Shutdown lock acquired\"\n    return 0\n}\n\n\n# Release the lock if we still own it. Not owning it anymore is not fatal\nshutdown_lock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n\n    log \"Releasing the shutdown lock\"\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $requester\n    rc=$?\n    if [ $rc -ne 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not release the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Shutdown lock no longer held, nothing to do\"\n        fi\n    else\n        log \"Shutdown lock released\"\n    fi\n    return 0\n}\n\n\nACTION=$1\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nLOCK_NAME=tripleo-shutdown-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to aquire the shutdown lock\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\n# We start with a very high TTL, that long enough to accomodate a cluster stop.\n# As soon as the node will get offline, the other competing node will be entitled\n# to steal the lock, so they should never wait that long in practice.\nLOCK_TTL=600\n\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) shutdown_lock_acquire ${LOCK_NAME} ${LOCK_OWNER} ${LOCK_TTL};;\n    --release|-r) shutdown_lock_release ${LOCK_NAME} ${LOCK_OWNER};;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}}, "docker_config": {"step_1": {"rabbitmq_bootstrap": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1", "net": "host", "privileged": false, "user": "root", "command": ["bash", "-ec", "kolla_set_configs\nif [[ -e \"/var/lib/rabbitmq/.erlang.cookie\" ]]; then rm -f /var/lib/rabbitmq/.erlang.cookie; fi\nhiera 'rabbitmq::erlang_cookie' > /var/lib/rabbitmq/.erlang.cookie\nchown rabbitmq:rabbitmq /var/lib/rabbitmq/.erlang.cookie\nchmod 400 /var/lib/rabbitmq/.erlang.cookie"], "volumes": ["/var/lib/kolla/config_files/rabbitmq.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/rabbitmq:/var/lib/kolla/config_files/src:ro", "/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/var/lib/rabbitmq:/var/lib/rabbitmq:z", "/etc/puppet:/etc/puppet:ro,z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1769501968"}}}, "step_2": {"rabbitmq_wait_bundle": {"start_order": 0, "detach": false, "net": "host", "ipc": "host", "user": "root", "command": ["/container_puppet_apply.sh", "2", "file,file_line,concat,augeas,rabbitmq_policy,rabbitmq_user,rabbitmq_ready", "include tripleo::profile::pacemaker::rabbitmq_bundle", ""], "image": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/var/lib/container-config-scripts/container_puppet_apply.sh:/container_puppet_apply.sh:ro", "/etc/puppet:/tmp/puppet-etc:ro", "/usr/share/openstack-puppet/modules:/usr/share/openstack-puppet/modules:ro", "/bin/true:/bin/epmd"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "KOLLA_BOOTSTRAP": true, "TRIPLEO_DEPLOY_IDENTIFIER": "1769501968"}}}}, "metadata_settings": null, "host_prep_tasks": [{"name": "create fcontext for rabbitmq data", "community.general.sefcontext": {"target": "/var/lib/rabbitmq(/.*)?", "setype": "container_file_t", "state": "present"}}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/lib/rabbitmq", "setype": "container_file_t"}, {"path": "/var/log/containers/rabbitmq", "setype": "container_file_t", "mode": "0750"}]}, {"name": "stop the Erlang port mapper on the host and make sure it cannot bind to the port used by container", "shell": "echo 'export ERL_EPMD_ADDRESS=127.0.0.1' > /etc/rabbitmq/rabbitmq-env.conf\necho 'export ERL_EPMD_PORT=4370' >> /etc/rabbitmq/rabbitmq-env.conf\nfor pid in $(pgrep epmd --ns 1 --nslist pid); do kill $pid; done\n"}], "deploy_steps_tasks": [{"name": "Certificate generation", "when": ["step|int == 1", "enable_internal_tls"], "block": [{"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "rabbitmq", "dns": "{{fqdn_internal_api}}", "principal": "rabbitmq/{{fqdn_internal_api}}@{{idm_realm}}", "run_after": "container_name=$({{container_cli}} ps --format=\\{\\{.Names\\}\\} | grep -w -E 'rabbitmq(-bundle-.*-[0-9]+)?')\nservice_crt=\"/etc/pki/tls/certs/rabbitmq.crt\"\nservice_key=\"/etc/pki/tls/private/rabbitmq.key\"\nif echo \"$container_name\" | grep -q \"^rabbitmq-bundle\"; then\n  # lp#1917868: Do not use podman cp with HA containers as they get\n  # frozen temporarily and that can make pacemaker operation fail.\n  tar -c \"$service_crt\" \"$service_key\" | {{container_cli}} exec -i \"$container_name\" tar -C / -xv\n  # no need to update the mount point, because pacemaker\n  # recreates the container when it's restarted\nelse\n  # Refresh the cert at the mount-point\n  {{container_cli}} cp $service_crt \"$container_name:/var/lib/kolla/config_files/src-tls/$service_crt\"\n  # Refresh the key at the mount-point\n  {{container_cli}} cp $service_key \"$container_name:/var/lib/kolla/config_files/src-tls/$service_key\"\n  # Copy the new cert from the mount-point to the real path\n  {{container_cli}} exec -u root \"$container_name\" cp \"/var/lib/kolla/config_files/src-tls$service_crt\" \"$service_crt\"\n  # Copy the new key from the mount-point to the real path\n  {{container_cli}} exec -u root \"$container_name\" cp \"/var/lib/kolla/config_files/src-tls$service_key\" \"$service_key\"\nfi\n# Set appropriate permissions\n{{container_cli}} exec -u root \"$container_name\" chown rabbitmq:rabbitmq \"$service_crt\"\n{{container_cli}} exec -u root \"$container_name\" chown rabbitmq:rabbitmq \"$service_key\"\n# Trigger a pem cache clear in RabbitMQ to read the new certificates\n{{container_cli}} exec \"$container_name\" rabbitmqctl eval \"ssl:clear_pem_cache().\"\n", "key_size": "2048", "ca": "ipa"}]}}]}, {"name": "RabbitMQ tag container image for pacemaker", "when": "step|int == 1", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1", "container_image_latest": "cluster.common.tag/rabbitmq:pcmklatest"}}, {"name": "RabbitMQ RPC HA Wrappers Step", "when": "step|int == 2", "block": [{"name": "Rabbitmq rpc puppet bundle", "import_role": {"name": "tripleo_ha_wrapper"}, "vars": {"tripleo_ha_wrapper_service_name": "oslo_messaging_rpc", "tripleo_ha_wrapper_resource_name": "rabbitmq", "tripleo_ha_wrapper_bundle_name": "rabbitmq-bundle", "tripleo_ha_wrapper_resource_state": "Started", "tripleo_ha_wrapper_puppet_config_volume": "rabbitmq", "tripleo_ha_wrapper_puppet_execute": "[\"Rabbitmq_policy\", \"Rabbitmq_user\"].each |String $val| { noop_resource($val) }; include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::rabbitmq_bundle", "tripleo_ha_wrapper_puppet_tags": "pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation", "tripleo_ha_wrapper_puppet_debug": false, "tripleo_ha_wrapper_config_suffix": ".previous_run"}}]}], "external_update_tasks": [{"when": "step|int == 1", "tags": "ha_image_update", "block": [{"block": [{"name": "Get rabbitmq image from pacemaker", "become": true, "register": "xmllint_pcmk_rabbitmq_rpc_image", "shell": "xmllint --xpath \"string(//bundle[@id='rabbitmq-bundle']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container rabbitmq image", "set_fact": {"rabbitmq_rpc_image": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1", "rabbitmq_rpc_image_latest": "cluster.common.tag/rabbitmq:pcmklatest", "pcmk_rabbitmq_rpc_image": "{{xmllint_pcmk_rabbitmq_rpc_image.stdout}}"}}], "delegate_to": "{{ (groups[\"oslo_messaging_rpc\"] | difference(groups[\"excluded_overcloud\"]))[0] }}"}, {"name": "rabbitmq temporary pacemaker container tag in case of image switch", "become": true, "import_role": {"name": "tripleo_ha_image_update"}, "vars": {"tripleo_ha_image_update_node_names": "{{ groups[\"oslo_messaging_rpc\"] | difference(groups[\"excluded_overcloud\"]) }}", "tripleo_ha_image_update_bundle": "rabbitmq-bundle", "tripleo_ha_image_update_new_image": "{{rabbitmq_rpc_image_latest}}", "tripleo_ha_image_update_old_image": "{{pcmk_rabbitmq_rpc_image}}"}, "when": ["(pcmk_rabbitmq_rpc_image != \"\")", "(pcmk_rabbitmq_rpc_image != rabbitmq_rpc_image_latest)"]}]}], "update_tasks": [{"block": [{"name": "Get rabbitmq image from pacemaker", "become": true, "register": "xmllint_pcmk_rabbitmq_rpc_image", "shell": "xmllint --xpath \"string(//bundle[@id='rabbitmq-bundle']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container rabbitmq image", "set_fact": {"rabbitmq_rpc_image": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1", "rabbitmq_rpc_image_latest": "cluster.common.tag/rabbitmq:pcmklatest", "pcmk_rabbitmq_rpc_image": "{{xmllint_pcmk_rabbitmq_rpc_image.stdout}}"}}], "when": "(step|int == 0 or step|int == 2)"}, {"name": "Check for update of rabbitmq container image name", "when": "step|int == 0", "assert": {"that": "pcmk_rabbitmq_rpc_image == rabbitmq_rpc_image_latest", "fail_msg": "rabbitmq image change detected, run overcloud external-update --tags ha_image_update first"}}, {"name": "Tear-down non-HA rabbitmq container", "when": ["step|int == 1"], "block": [{"name": "Remove non-HA rabbitmq container", "include_role": {"name": "tripleo_container_rm"}, "vars": {"tripleo_container_cli": "{{ container_cli }}", "tripleo_containers_to_rm": ["rabbitmq"]}}]}, {"name": "Rabbitmq fetch and retag container image for pacemaker", "when": "step|int == 2", "block": [{"name": "Retag pcmklatest to latest rabbitmq image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{rabbitmq_rpc_image}}", "container_image_latest": "{{rabbitmq_rpc_image_latest}}"}}]}], "post_update_tasks": [{"name": "Rabbitmq rpc bundle post update", "when": "step|int == 1", "block": [{"name": "Rabbitmq rpc puppet bundle", "import_role": {"name": "tripleo_ha_wrapper"}, "vars": {"tripleo_ha_wrapper_service_name": "oslo_messaging_rpc", "tripleo_ha_wrapper_resource_name": "rabbitmq", "tripleo_ha_wrapper_bundle_name": "rabbitmq-bundle", "tripleo_ha_wrapper_resource_state": "Started", "tripleo_ha_wrapper_puppet_config_volume": "rabbitmq", "tripleo_ha_wrapper_puppet_execute": "[\"Rabbitmq_policy\", \"Rabbitmq_user\"].each |String $val| { noop_resource($val) }; include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::rabbitmq_bundle", "tripleo_ha_wrapper_puppet_tags": "pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation", "tripleo_ha_wrapper_puppet_debug": false, "tripleo_ha_wrapper_config_suffix": ".previous_run"}}], "vars": {"tripleo_ha_wrapper_minor_update": true}}], "upgrade_tasks": [{"name": "Tear-down non-HA rabbitmq container", "when": ["step|int == 0"], "block": [{"name": "Remove non-HA rabbitmq container", "include_role": {"name": "tripleo_container_rm"}, "vars": {"tripleo_container_cli": "{{ container_cli }}", "tripleo_containers_to_rm": ["rabbitmq"]}}]}, {"name": "Prepare switch of rabbitmq image name", "when": ["step|int == 0"], "block": [{"name": "Get rabbitmq image id currently used by pacemaker", "shell": "pcs resource config rabbitmq-bundle | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'", "register": "rabbitmq_rpc_image_current_res", "failed_when": false}, {"name": "Image facts for rabbitmq", "set_fact": {"rabbitmq_rpc_image_latest": "cluster.common.tag/rabbitmq:pcmklatest", "rabbitmq_rpc_image_current": "{{rabbitmq_rpc_image_current_res.stdout}}"}}, {"name": "Temporarily tag the current rabbitmq image id with the upgraded image name", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{rabbitmq_rpc_image_current}}", "container_image_latest": "{{rabbitmq_rpc_image_latest}}", "pull_image": false}, "when": ["rabbitmq_rpc_image_current != ''", "rabbitmq_rpc_image_current != rabbitmq_rpc_image_latest"]}, {"name": "Create rabbitmq_rpc retag statefile", "file": {"path": "/var/lib/tripleo/rabbitmq_rpc_needs_retag", "state": "touch"}, "when": ["rabbitmq_rpc_image_current != ''", "rabbitmq_rpc_image_current != rabbitmq_rpc_image_latest"]}]}, {"name": "Update rabbitmq-bundle pcs resource bundle for new container image", "when": ["step|int == 1"], "block": [{"name": "set is_rpc_rabbitmq_bootstrap_node fact", "set_fact": "is_rpc_rabbitmq_bootstrap_node={{oslo_messaging_rpc_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}"}, {"name": "Check for rabbitmq_rpc retag statefile", "stat": {"path": "/var/lib/tripleo/rabbitmq_rpc_needs_retag"}, "register": "rabbitmq_rpc_retag_state_file"}]}, {"name": "Update rabbitmq-bundle pcs resource bundle for new container image", "when": ["step|int == 1", "is_rpc_rabbitmq_bootstrap_node|bool", "rabbitmq_rpc_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the rabbitmq cluster resource before container upgrade", "pacemaker_resource": {"resource": "rabbitmq-bundle", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Check rabbitmq logging configuration in pacemaker", "command": "cibadmin --query --xpath \"//storage-mapping[@id='rabbitmq-log']\"", "failed_when": false, "register": "rabbitmq_logs_moved"}, {"name": "Add a bind mount for logging in the rabbitmq bundle", "when": "rabbitmq_logs_moved.rc == 6", "command": "pcs resource bundle update rabbitmq-bundle storage-map add id=rabbitmq-log source-dir=/var/log/containers/rabbitmq target-dir=/var/log/rabbitmq options=rw"}, {"name": "Update the rabbitmq bundle to use the new container image name", "command": "pcs resource bundle update rabbitmq-bundle container image={{rabbitmq_rpc_image_latest}}"}, {"name": "Enable the rabbitmq cluster resource", "pacemaker_resource": {"resource": "rabbitmq-bundle", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}]}, {"name": "Check for rabbitmq_rpc retag statefile", "when": ["step|int == 3"], "stat": {"path": "/var/lib/tripleo/rabbitmq_rpc_needs_retag"}, "register": "rabbitmq_rpc_retag_state_file"}, {"name": "Retag rabbitmq-bundle container image", "when": ["step|int == 3", "rabbitmq_rpc_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the rabbitmq cluster resource before container upgrade", "pacemaker_resource": {"resource": "rabbitmq-bundle", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Retag the pacemaker image if containerized", "block": [{"block": [{"name": "Get rabbitmq image from pacemaker", "become": true, "register": "xmllint_pcmk_rabbitmq_rpc_image", "shell": "xmllint --xpath \"string(//bundle[@id='rabbitmq-bundle']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container rabbitmq image", "set_fact": {"rabbitmq_rpc_image": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1", "rabbitmq_rpc_image_latest": "cluster.common.tag/rabbitmq:pcmklatest", "pcmk_rabbitmq_rpc_image": "{{xmllint_pcmk_rabbitmq_rpc_image.stdout}}"}}]}, {"block": [{"name": "Retag pcmklatest to latest rabbitmq image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{rabbitmq_rpc_image}}", "container_image_latest": "{{rabbitmq_rpc_image_latest}}"}}]}]}, {"name": "Enable the rabbitmq cluster resource", "pacemaker_resource": {"resource": "rabbitmq-bundle", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Remove rabbitmq_rpc retag statefile", "file": {"path": "/var/lib/tripleo/rabbitmq_rpc_needs_retag", "state": "absent"}}]}]}, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'config_settings')": {"rabbitmq::file_limit": 65536, "rabbitmq::default_user": "guest", "rabbitmq::default_pass": "rAEOjyWy2c6PARokWxktfn5mX", "rabbit_ipv6": false, "rabbitmq::delete_guest_user": false, "rabbitmq::wipe_db_on_cookie_change": true, "rabbitmq::port": 5672, "rabbitmq::loopback_users": [], "rabbitmq::tcp_backlog": 4096, "rabbitmq::repos_ensure": false, "rabbitmq::tcp_keepalive": true, "rabbitmq_environment": {"LANG": "en_US.UTF-8", "LC_ALL": "en_US.UTF-8", "NODE_PORT": "", "NODE_IP_ADDRESS": "", "RABBITMQ_NODENAME": "rabbit@%{hiera('fqdn_internal_api')}", "RABBITMQ_USE_LONGNAME": "true", "RABBITMQ_CTL_DIST_PORT_MIN": "25673", "RABBITMQ_CTL_DIST_PORT_MAX": "25683", "export ERL_EPMD_ADDRESS": "%{hiera('rabbitmq::interface')}"}, "tripleo::profile::base::rabbitmq::additional_erl_args": "'+sbwt none +sbwtdcpu none +sbwtdio none'", "rabbitmq_kernel_variables": {"inet_dist_listen_min": "25672", "inet_dist_listen_max": "25672", "net_ticktime": 15}, "rabbitmq_config_variables": {"cluster_partition_handling": "ignore", "queue_master_locator": "<<\"min-masters\">>"}, "rabbitmq::config_additional_variables": {"lager": "[{crash_log_count, 0}, { crash_log_date, \"\"}, { crash_log_size, 0 }]"}, "rabbitmq::erlang_cookie": "qyGFiwqiEVnsR5uI2hrs", "rabbitmq::interface": "%{hiera('internal_api')}", "rabbitmq::nr_ha_queues": 0, "rabbitmq::ssl": false, "rabbitmq::ssl_erl_dist": false, "rabbitmq::ssl_port": 5672, "rabbitmq::ssl_depth": 1, "rabbitmq::ssl_only": false, "rabbitmq::ssl_interface": "%{hiera('internal_api')}", "tripleo::profile::base::rabbitmq::enable_internal_tls": false, "tripleo::profile::base::rabbitmq::fips_mode": false, "rabbitmq::collect_statistics_interval": 30000, "rabbitmq::admin_enable": false, "rabbitmq::management_enable": true, "rabbitmq::use_config_file_for_plugins": true, "rabbitmq::management_ip_address": "127.0.0.1", "rabbitmq::management_port": 15672, "rabbitmq::config_management_variables": {"rates_mode": "none"}, "rabbitmq::ssl_cacert": "/etc/ipa/ca.crt", "rabbitmq::ssl_management_cacert": "/etc/ipa/ca.crt", "rabbitmq::service_manage": false, "tripleo::profile::pacemaker::rabbitmq_bundle::rabbitmq_docker_image": "cluster.common.tag/rabbitmq:pcmklatest", "tripleo::profile::pacemaker::rabbitmq_bundle::control_port": 3122, "tripleo::profile::pacemaker::rabbitmq_bundle::container_backend": "podman", "tripleo::profile::pacemaker::rabbitmq_bundle::force_ocf": true}, "tuple:('role_data', 'step_config')": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-66-vpljypirliki/9fee6dc9-f24c-4684-860d-c83bf9270157"}


created_at: 2026-01-27 08:25:48.308960
data:
  {"tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'service_name')": "pacemaker", "tuple:('role_data', 'docker_config')": null, "role_data": {"service_name": "pacemaker", "monitoring_subscription": "overcloud-pacemaker", "firewall_rules": {"130 pacemaker tcp": {"proto": "tcp", "dport": [2224, 3121, 21064]}, "131 pacemaker udp": {"proto": "udp", "dport": 5405}}, "config_settings": {"pacemaker::corosync::cluster_name": "tripleo_cluster", "pacemaker::corosync::manage_fw": false, "pacemaker::resource_defaults::defaults": {"resource-stickiness": {"value": "INFINITY"}}, "corosync_token_timeout": 10000, "pacemaker::corosync::settle_tries": 360, "pacemaker::resource::bundle::deep_compare": true, "pacemaker::resource::ip::deep_compare": true, "pacemaker::resource::ocf::deep_compare": true, "corosync_ipv6": false, "tripleo::fencing::config": {}, "tripleo::fencing::deep_compare": true, "enable_fencing": false, "hacluster_pwd": "cCkDs65SYyiN5XTq", "tripleo::profile::base::pacemaker::remote_authkey": "[encoded data, 4096 characters]", "tripleo::profile::base::pacemaker::pcsd_bind_addr": "%{hiera('internal_api')}", "tripleo::profile::base::pacemaker::resource_op_defaults": {"bundle": {"name": "timeout", "value": "120s"}}}, "service_config_settings": {"rsyslog": {"tripleo_logging_sources_pacemaker": [{"tag": "system.pacemaker", "file": "/var/log/host/pacemaker/pacemaker.log", "startmsg.regex": "^[a-zA-Z]{3} [0-9]{2} [:0-9]{8}"}]}}, "step_config": "include tripleo::profile::base::pacemaker\n", "host_prep_tasks": [{"name": "Make sure python3-novaclient is installed when IHA is enabled", "package": {"name": "python3-novaclient", "state": "present"}, "when": false}, {"name": "Remove existing entries from logind conf", "ansible.builtin.lineinfile": {"path": "/etc/systemd/logind.conf", "regexp": "^\\s*#?\\s*HandlePowerKey\\s*=.*", "state": "absent"}}, {"name": "Make sure systemd-logind ignores power off", "ansible.builtin.lineinfile": {"path": "/etc/systemd/logind.conf", "regexp": "^#?HandlePowerKey", "line": "HandlePowerKey=ignore"}}, {"name": "Restart systemd-logind", "ansible.builtin.service": {"name": "systemd-logind", "state": "restarted"}}, {"name": "Gather service_facts on pacemaker_bootstrap_node", "ansible.builtin.service_facts": null, "when": ["{{(pacemaker_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower)|bool}}", false]}, {"name": "Check and eventually delete duplicate constraints (bootstrap node)", "become": true, "shell": "COUNT=$(cibadmin --query | xmllint --xpath '//rsc_location[@rsc=\"stonith-fence_compute-fence-nova\"]/@id' - |grep -oP '(?<=[\"])[^\"]*' -c)\nif [[ $COUNT > 1 ]]; then\n    echo \"Detected $COUNT duplicate constraints, deleting them\"\n    # assemble string with current list of computes\n    GOOD=$(echo location-stonith-fence_compute-fence-nova-$(hiera pacemaker_remote_short_node_names |grep -oP '\".*?\"' |tr -d '\"'|tr -d '\\n' )--10000)\n    # delete old constraints\n    for i in $(cibadmin --query | xmllint --xpath '//rsc_location[@rsc=\"stonith-fence_compute-fence-nova\"]/@id' - |grep -oP '(?<=[\"])[^\"]*' |grep -v $GOOD ); do pcs constraint delete $i ; done\nelse\n    echo \"No duplicate constraint found\"\nfi\n", "when": ["{{(pacemaker_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower)|bool}}", false, "ansible_facts['services']['pacemaker.service']['state'] == 'running'"]}], "scale_tasks": [{"when": ["step|int == 1", "container_cli == 'podman'", "\"pacemaker_remote\" in enabled_services|list", "inventory_hostname_short in compute_instanceha_short_node_names"], "tags": "down", "become": true, "block": [{"name": "Getting Nova compute hostname", "command": "crm_node -n", "register": "nova_compute_hostname"}, {"name": "Check if pacemaker_short_bootstrap_node_name is a defined variable", "when": "pacemaker_short_bootstrap_node_name is not defined", "fail": {"msg": "Cannot delegate pacemaker cleanup to the bootstrap node. Please delete the resources manually."}, "ignore_errors": true}, {"name": "Clean up Pacemaker remote and STONITH resources for Compute node", "when": ["nova_compute_hostname.stdout in compute_instanceha_short_node_names", "pacemaker_short_bootstrap_node_name is defined"], "block": [{"name": "List STONITH resource for the Compute node", "command": "stonith_admin -l {{ nova_compute_hostname.stdout }}", "register": "stonith_service_results", "delegate_to": "{{ pacemaker_short_bootstrap_node_name }}"}, {"name": "Disable the STONITH resources for the Compute node", "command": "pcs stonith disable \"{{ item }}\"", "loop": "{{ stonith_service_results.stdout | regex_findall('^(stonith-fence(?!_compute-fence-nova).*)', multiline=True)}}", "delegate_to": "{{ pacemaker_short_bootstrap_node_name }}", "register": "disable_output", "failed_when": "disable_output.rc != 0", "retries": 3, "delay": 5, "until": "disable_output.rc == 0"}, {"name": "Delete the STONITH resources for the Compute node", "command": "pcs stonith delete \"{{ item }}\"", "loop": "{{ stonith_service_results.stdout | regex_findall('^(stonith-fence(?!_compute-fence-nova).*)', multiline=True)}}", "delegate_to": "{{ pacemaker_short_bootstrap_node_name }}", "register": "delete_output", "failed_when": "delete_output.rc != 0", "retries": 3, "delay": 5, "until": "delete_output.rc == 0"}, {"name": "Clear the stonith level hierarchy for the Compute node target", "command": "pcs stonith level clear target {{ nova_compute_hostname.stdout }}", "delegate_to": "{{ pacemaker_short_bootstrap_node_name }}"}, {"name": "Delete Compute node from cluster", "command": "pcs cluster node remove-remote {{ nova_compute_hostname.stdout }}", "delegate_to": "{{ pacemaker_short_bootstrap_node_name }}"}, {"name": "Remove compute node in pcmk_host_list parameter from stonith-fence_compute-fence-nova", "command": "crm_resource --set-parameter=pcmk_host_list -r stonith-fence_compute-fence-nova -v \"{{ pacemaker_remote_short_node_names | reject('search', nova_compute_hostname.stdout) | join(',') }}\"", "delegate_to": "{{ pacemaker_short_bootstrap_node_name }}"}]}]}], "upgrade_tasks": [{"name": "Ensure redis is removed", "when": ["step|int == 5", "\"redis\" not in enabled_services|list", "{{ (pacemaker_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower)|bool}}"], "become": true, "shell": "if crm_resource -r redis-bundle -q &>/dev/null; then\n   pcs resource delete redis-bundle || true\n   pcs resource delete ip-$(hiera redis_vip) || true\nfi\n"}, {"name": "Clean up cluster node cache", "when": ["step|int == 5", "\"redis\" not in enabled_services|list", "{{ (pacemaker_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower)|bool}}"], "become": true, "shell": "pcs cluster node clear redis-bundle-0\npcs cluster node clear redis-bundle-1\npcs cluster node clear redis-bundle-2\ncrm_attribute --name redis_REPL_INFO --delete\n"}, {"name": "Clean up redis attribute", "when": ["step|int == 5", "\"redis\" not in enabled_services|list", "{{ (pacemaker_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower)|bool}}"], "become": true, "shell": "pcs node attribute \"{{ item }}\" redis-role= || true\n", "loop": "{{ pacemaker_short_node_names }}"}], "external_upgrade_tasks": [{"when": ["step|int == 1"], "tags": ["never", "system_upgrade_stop_services", "system_upgrade_transfer_data"], "block": [{"name": "Stop cluster", "become": true, "shell": "set -eu\nFILE=/usr/sbin/pcs\nif test -f \"$FILE\"; then\n  /usr/sbin/pcs cluster stop --force\nfi\n", "delegate_to": "{{ item }}", "with_items": "{{ groups['pacemaker'] | difference(groups['excluded_overcloud']) }}"}]}], "update_tasks": [{"name": "Check pacemaker cluster running before the minor update", "when": "step|int == 0", "pacemaker_cluster": "state=online check_and_fail=true", "async": 30, "poll": 4}, {"name": "Acquire the cluster shutdown lock to stop pacemaker cluster", "when": "step|int == 1", "command": "systemd-cat -t ha-shutdown /var/lib/container-config-scripts/pacemaker_mutex_shutdown.sh --acquire"}, {"name": "Stop pacemaker cluster", "when": "step|int == 1", "pacemaker_cluster": "state=offline"}, {"name": "Start pacemaker cluster", "when": "step|int == 4", "pacemaker_cluster": "state=online"}, {"name": "Release the cluster shutdown lock", "when": "step|int == 4", "command": "systemd-cat -t ha-shutdown /var/lib/container-config-scripts/pacemaker_mutex_shutdown.sh --release"}]}, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'config_settings')": {"pacemaker::corosync::cluster_name": "tripleo_cluster", "pacemaker::corosync::manage_fw": false, "pacemaker::resource_defaults::defaults": {"resource-stickiness": {"value": "INFINITY"}}, "corosync_token_timeout": 10000, "pacemaker::corosync::settle_tries": 360, "pacemaker::resource::bundle::deep_compare": true, "pacemaker::resource::ip::deep_compare": true, "pacemaker::resource::ocf::deep_compare": true, "corosync_ipv6": false, "tripleo::fencing::config": {}, "tripleo::fencing::deep_compare": true, "enable_fencing": false, "hacluster_pwd": "cCkDs65SYyiN5XTq", "tripleo::profile::base::pacemaker::remote_authkey": "[encoded data, 4096 characters]", "tripleo::profile::base::pacemaker::pcsd_bind_addr": "%{hiera('internal_api')}", "tripleo::profile::base::pacemaker::resource_op_defaults": {"bundle": {"name": "timeout", "value": "120s"}}}, "tuple:('role_data', 'step_config')": "include tripleo::profile::base::pacemaker\n", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-67-y7jq5a2l3z7t/b0bae7ca-174b-448e-bbdd-5c6ddc2fd503"}


created_at: 2026-01-27 08:25:51.865268
data:
  {"type": "json", "value": {"ContainerPlacementImage": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1"}}


created_at: 2026-01-27 08:25:52.727694
data:
  {"type": "json", "value": {"ContainerPlacementImage": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1", "ContainerPlacementConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1"}}


created_at: 2026-01-27 08:25:53.825052
data:
  {"tuple:('role_data', 'step_config')": "include tripleo::profile::base::database::mysql::client", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-68-pwnm2lum3vrr-MySQLClient-5jjsgl5he57p/68a77f10-961c-4aab-8ecc-6f3fdf7c17c7"}


created_at: 2026-01-27 08:25:53.899577
data:
  {"tuple:('role_data', 'deploy_steps_tasks')": [{"name": "Certificate generation", "when": ["step|int == 1", "enable_internal_tls"], "block": [{"name": "Create dirs for certificates and keys", "file": {"path": "{{ item }}", "state": "directory", "serole": "object_r", "setype": "cert_t", "seuser": "system_u"}, "with_items": ["/etc/pki/tls/certs/httpd", "/etc/pki/tls/private/httpd"]}, {"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "httpd-ctlplane", "dns": "{{ fqdn_ctlplane }}", "principal": "HTTP/{{ fqdn_ctlplane }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-ctlplane.crt /etc/pki/tls/certs/httpd/httpd-ctlplane.crt\ncp /etc/pki/tls/private/httpd-ctlplane.key /etc/pki/tls/private/httpd/httpd-ctlplane.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage", "dns": "{{ fqdn_storage }}", "principal": "HTTP/{{ fqdn_storage }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage.crt /etc/pki/tls/certs/httpd/httpd-storage.crt\ncp /etc/pki/tls/private/httpd-storage.key /etc/pki/tls/private/httpd/httpd-storage.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage_mgmt", "dns": "{{ fqdn_storage_mgmt }}", "principal": "HTTP/{{ fqdn_storage_mgmt }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage_mgmt.crt /etc/pki/tls/certs/httpd/httpd-storage_mgmt.crt\ncp /etc/pki/tls/private/httpd-storage_mgmt.key /etc/pki/tls/private/httpd/httpd-storage_mgmt.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-internal_api", "dns": "{{ fqdn_internal_api }}", "principal": "HTTP/{{ fqdn_internal_api }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-internal_api.crt /etc/pki/tls/certs/httpd/httpd-internal_api.crt\ncp /etc/pki/tls/private/httpd-internal_api.key /etc/pki/tls/private/httpd/httpd-internal_api.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-external", "dns": "{{ fqdn_external }}", "principal": "HTTP/{{ fqdn_external }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-external.crt /etc/pki/tls/certs/httpd/httpd-external.crt\ncp /etc/pki/tls/private/httpd-external.key /etc/pki/tls/private/httpd/httpd-external.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}]}}]}], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-68-pwnm2lum3vrr-ApacheServiceBase-e2b5bqsmhpoo/85b10a97-cc98-4a6b-a584-4da2b40abcdf"}


created_at: 2026-01-27 08:25:53.926478
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "container_config_scripts": {"container_puppet_apply.sh": {"mode": "0700", "content": "#!/bin/bash\nset -eux\nSTEP=$1\nTAGS=$2\nCONFIG=$3\nEXTRA_ARGS=${4:-''}\nif [ -d /tmp/puppet-etc ]; then\n  # ignore copy failures as these may be the same file depending on docker mounts\n  cp -a /tmp/puppet-etc/* /etc/puppet || true\nfi\necho \"{\\\"step\\\": ${STEP}}\" > /etc/puppet/hieradata/docker_puppet.json\n# $::deployment_type in puppet-tripleo\nexport FACTER_deployment_type=containers\nset +e\npuppet apply $EXTRA_ARGS \\\n    --verbose \\\n    --detailed-exitcodes \\\n    --summarize \\\n    --color=false \\\n    --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \\\n    --tags $TAGS \\\n    -e \"noop_resource('package'); ${CONFIG}\"\nrc=$?\nset -e\nset +ux\nif [ $rc -eq 2 -o $rc -eq 0 ]; then\n    exit 0\nfi\nexit $rc\n"}, "pyshim.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n#\n# Usage: pyshim.sh <script and/or arguments>\n#\n# Unfortunately THT doesn't know which version of python might be in a\n# container so we need this script to be able to try python3 or python2\n# depending on availability.  Since this is a temporary shim until we've\n# fully cut over to python3, we check for the existence of python3 first\n# before falling back to python2. This will help in the transition from\n# python2 based containers to python3.\n\nshow_usage() {\n    echo \"Usage: pyshim.sh <script and/or arguments>\"\n}\n\nif [ $# -lt 1 ]\nthen\n    show_usage\n    exit 1\nfi\n\nset -x\nif command -v python3 >/dev/null; then\n    python3 \"$@\"\nelif command -v python2 >/dev/null; then\n    python2 \"$@\"\nelif command -v python >/dev/null; then\n    python \"$@\"\nelse\n    echo \"ERROR: python is not available!\"\n    exit 1\nfi\n"}, "pacemaker_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nset -u\n\n# ./pacemaker_restart_bundle.sh mysql galera galera-bundle Master _\n# ./pacemaker_restart_bundle.sh redis redis redis-bundle Slave Master\n# ./pacemaker_restart_bundle.sh ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\nRESTART_SCRIPTS_DIR=$(dirname $0)\nTRIPLEO_SERVICE=$1\nRESOURCE_NAME=$2\nBUNDLE_NAME=$3\nWAIT_TARGET_LOCAL=$4\nWAIT_TARGET_ANYWHERE=${5:-_}\nTRIPLEO_MINOR_UPDATE=\"${TRIPLEO_MINOR_UPDATE:-false}\"\nTRIPLEO_HA_WRAPPER_RESOURCE_EXISTS=\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS:-false}\"\n\nbundle_can_be_restarted() {\n    local bundle=$1\n    # As long as the resource bundle is managed by pacemaker and is\n    # not meant to stay stopped, no matter the state of any inner\n    # pcmk_remote or ocf resource, we should restart it to give it a\n    # chance to read the new config.\n    [ \"$(crm_resource --meta -r $1 -g is-managed 2>/dev/null)\" != \"false\" ] && \\\n    [ \"$(crm_resource --meta -r $1 -g target-role 2>/dev/null)\" != \"Stopped\" ]\n}\n\nlog() {\n    local msg=$1\n    logger -t pcmkrestart \"$1\"\n}\n\nHOSTNAME=$(/bin/hostname -s)\nif [ x\"${TRIPLEO_MINOR_UPDATE,,}\" != x\"true\" ]; then\n    if [ x\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS,,}\" = x\"false\" ]; then\n        # Do not restart during initial deployment, as the resource\n        # has just been created.\n        SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n        if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n            log \"Initial deployment, skipping the restart of ${BUNDLE_NAME}\"\n\tfi\n        exit 0\n    else\n        # During a stack update, this script is called in parallel on\n        # every node the resource runs on, after the service's configs\n        # have been updated on all nodes. So we need to run pcs only\n        # once (e.g. on the service's boostrap node).\n        if bundle_can_be_restarted ${BUNDLE_NAME}; then\n            SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n            if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n                replicas_running=$(crm_resource -Q -r $BUNDLE_NAME --locate 2>&1 | wc -l)\n                if [ \"$replicas_running\" != \"0\" ]; then\n                    log \"Restarting ${BUNDLE_NAME} globally. Stopping:\"\n                    /sbin/pcs resource disable --wait=600 $BUNDLE_NAME\n                    log \"Restarting ${BUNDLE_NAME} globally. Starting:\"\n                    /sbin/pcs resource enable --wait=600 $BUNDLE_NAME\n                else\n                    log \"${BUNDLE_NAME} is not running anywhere,\" \\\n                         \"cleaning up to restart it globally if necessary\"\n                    /sbin/pcs resource cleanup $BUNDLE_NAME\n                fi\n            else\n                log \"Skipping global restart of ${BUNDLE_NAME} on ${HOSTNAME} it will be restarted by node ${SERVICE_NODEID}\"\n            fi\n\n        else\n            log \"No global restart needed for ${BUNDLE_NAME}.\"\n        fi\n    fi\nelse\n    # During a minor update workflow however, a host gets fully\n    # updated before updating the next one. So unlike stack\n    # update, at the time this script is called, the service's\n    # configs aren't updated on all nodes yet. So only restart the\n    # resource locally, where it's guaranteed that the config is\n    # up to date.\n    HOST=$(facter hostname)\n\n    if bundle_can_be_restarted ${BUNDLE_NAME}; then\n\t# if the resource is running locally, restart it\n\tif crm_resource -r $BUNDLE_NAME --locate 2>&1 | grep -w -q \"${HOST}\"; then\n            log \"Restarting ${BUNDLE_NAME} locally on '${HOST}'\"\n            /sbin/pcs resource restart $BUNDLE_NAME \"${HOST}\"\n\n\telse\n\t    # At this point, if no resource is running locally, it's\n\t    # either because a) it has failed previously, or b) because\n\t    # it's an A/P resource running elsewhere.\n\t    # By cleaning up resource, we ensure that a) it will try to\n\t    # restart, or b) it won't do anything if the resource is\n\t    # already running elsewhere.\n            log \"${BUNDLE_NAME} is currently not running on '${HOST}',\" \\\n                 \"cleaning up its state to restart it if necessary\"\n            /sbin/pcs resource cleanup $BUNDLE_NAME node=\"${HOST}\"\n\tfi\n\n\t# Wait until the resource is in the expected target state\n\t$RESTART_SCRIPTS_DIR/pacemaker_wait_bundle.sh \\\n            $RESOURCE_NAME $BUNDLE_NAME \\\n            \"$WAIT_TARGET_LOCAL\" \"$WAIT_TARGET_ANYWHERE\" \\\n\t    \"${HOST}\" 600\n    else\n        log \"No restart needed for ${BUNDLE_NAME}.\"\n    fi\nfi\n"}, "pacemaker_wait_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# ----\n# Wait for an OCF resource or a bundle to be restarted\n# ----\n# e.g.:\n# M/S OCF:      $0 galera galera-bundle Master\n# clone OCF:    $0 rabbitmq rabbitmq-bundle Started\n# A/P M/S OCF:  $0 redis redis-bundle Slave Master\n# A/P bundle:   $0 openstack-cinder-volume openstack-cinder-volume _ Started\n# clone bundle: $0 haproxy-bundle haproxy-bundle Started\n\n# design note 1:\n#  - this script is called during a minor update; it is called\n#    once per node that hosts a service replica.\n#  - the purpose of this script is to ensure that restarting the\n#    service replica locally won't disrupt the service availability\n#    for the end user. To reach that goal, the script waits until the\n#    service is restarted locally or globallu and reaches a given\n#    target state (i.e. Started, Slave or Master).\n# design note 2:\n#   - we don't want to track restart error: our only job is to ensure\n#     service restart synchronization, not service health.\n#   - In particular, we don't want to error out in case the resource\n#     cannot be restarted locally, because that would make the minor\n#     update fail, even if potentially other replicas still provide\n#     the service.\n# design note 3:\n#   - we can bail out early if we determine that the resource can't\n#     be restarted automatically by pacemaker (e.g. its \"blocked\",\n#     unmanaged or disabled).\n\nlog() {\n    local msg=$1\n    echo \"$(date -u): $1\"\n}\n\nusage() {\n    echo 2>&1 \"Usage: $0 NAME BUNDLE_NAME ROLE_LOCAL [ROLE_ANYWHERE] [HOST] [TIMEOUT]\"\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\n#\n# Utility functions to detect stuck resources\n#\n\nbundle_failures_locally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local replica_name\n    for i in $(seq 0 $last); do\n\treplica_name=${BUNDLE_NAME}-${engine}-${i}\n\tcrm_failcount -q -G -r $replica_name -N $HOST\n    done\n}\n\nbundle_failures_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    for i in $(seq 0 $last); do\n\tcrm_failcount -q -G -r ${BUNDLE_NAME}-${engine}-${i}\n    done\n}\n\nbundle_running_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    # return the number of running bundles replica, i.e. the number of\n    # docker/podman resource replicas currently running in the cluster\n    crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:heartbeat:${engine}']/node)\" -\n}\n\nocf_failures_globally() {\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local bundle_node\n    for i in $(seq 0 $last); do\n\tbundle_node=${BUNDLE_NAME}-${i}\n\tcrm_failcount -q -G -r $NAME -N $bundle_node\n    done\n}\n\ndid_resource_failed_locally() {\n    local failures\n    local running\n    local remotehost\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# if we're dealing with an ocf resource, it is running on a\n\t# pacemaker_remote rather that on the real host, and the\n\t# failcounts are thus associated to the pcmk remote. Replace\n\t# the host's name with the pcmk remote's name.\n        remotehost=$(crm_mon --as-xml | xmllint --xpath \"string(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource/node[@name='${HOST}']/../../resource[@resource_agent='${OCF}:pacemaker:remote']/@id)\" -)\n\tif [ -n \"${remotehost}\" ]; then\n\t    crm_failcount -q -G -r $NAME -N $remotehost | grep -q -w INFINITY\n\t    return $?\n\tfi\n\t# If no pcmk remote is currently running, the failcount from\n\t# the ocf resource is useless, compute the failcount from the\n\t# bundle case instead (computed below).\n    fi\n\n    # for bundles, pacemaker can run any bundle replica locally\n    # (e.g. galera-bundle-docker-{0,1,2}), and a failure happens when\n    # there are no more replica to try.\n    # That is, when _at least_ one replica failed locally, and all the\n    # others either failed or are currently running elsewhere.\n    failures=$(bundle_failures_locally $HOST | grep -c -w INFINITY)\n    running=$(bundle_running_globally)\n    test $failures -gt 0 && \\\n    test $(( $failures + $running )) -ge $BUNDLE_REPLICAS\n}\n\ndid_resource_failed_globally() {\n    local remotecount\n    local failures\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# we check the state of an ocf resource only if the\n\t# pcmkremotes are started\n        remotecount=$(crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node)\" -)\n\tif [ \"${remotecount}\" = \"0\" ]; then\n\t    # no pcmkremote is running, so check the bundle state\n\t    # instead of checking the ocf resource\n\t    # bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\t    failures=$(bundle_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\telse\n\t    # ocf resource failed if it failed to start on\n\t    # all $BUNDLE_REPLICAS bundle nodes\n\t    failures=$(ocf_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\tfi\n    else\n\t# bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\tfailures=$(bundle_failures_globally | grep -c -w INFINITY)\n\ttest $failures -eq $BUNDLE_REPLICAS\n    fi\n}\n\n\n# Input validation\n#\n\nNAME=$1\nif [ -z \"${NAME}\" ]; then\n    echo 2>&1 \"Error: argument NAME must not be empty\"\n    exit 1\nfi\n\nBUNDLE_NAME=$2\nif [ -z \"${BUNDLE_NAME}\" ]; then\n    echo 2>&1 \"Error: argument BUNDLE_NAME must not be empty\"\n    exit 1\nfi\n\nROLE_LOCAL=$3\nif [ \"${ROLE_LOCAL}\" = \"_\" ]; then\n    ROLE_LOCAL=\"\"\nfi\n\nROLE_ANYWHERE=$4\nif [ \"${ROLE_ANYWHERE}\" = \"_\" ]; then\n    ROLE_ANYWHERE=\"\"\nfi\n\nif [ -z \"${ROLE_LOCAL}\" ]; then\n    if [ -z \"${ROLE_ANYWHERE}\" ]; then\n        echo 2>&1 \"Error: either ROLE_LOCAL or ROLE_ANYWHERE must be non empty\"\n        exit 1\n    fi\nelse\n    if !(echo \"${ROLE_LOCAL}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n        echo 2>&1 \"Error: argument ROLE_LOCAL must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n        exit 1\n    fi\nfi\n\nif [ -n \"${ROLE_ANYWHERE}\" ] && !(echo \"${ROLE_ANYWHERE}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n    echo 2>&1 \"Error: argument ROLE_ANYWHERE must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n    exit 1\nfi\n\n# Ensure compatibility with pacemaker 2.1\nif pacemaker_supports_promoted; then\n    ROLE_LOCAL=$(echo \"$ROLE_LOCAL\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    ROLE_ANYWHERE=$(echo \"$ROLE_ANYWHERE\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    OCF=\"ocf\"\nelse\n    OCF=\"ocf:\"\nfi\n\nHOST=${5:-$(facter hostname)}\nTIMEOUT=${6:-600}\n\n\n# Configure the search\n# ----\n# Note: we can't use crm_resource in all searches because we can't\n# easily extract the host the OCF resources run on (crm_resource\n# returns the pcmk-remote nodes rather than the hosts)\n# So instead, we implement various searches with XPath directly.\n\nif [ \"${BUNDLE_NAME}\" != \"${NAME}\" ]; then\n# ocf resource\nlocal_resource_xpath=\"//bundle/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node[@name='${HOST}']/../../resource[@id='${NAME}']\"\nany_resource_xpath=\"//bundle//resource[@id='${NAME}']\"\nreplicas_xpath=\"//bundle/primitive[@id='${BUNDLE_NAME}']/../*[boolean(@image) and boolean(@replicas)]\"\nelse\n# bundle resource\nlocal_resource_xpath=\"//bundle[@id='${NAME}']/replica/resource/node[@name='${HOST}']/../../resource\"\nany_resource_xpath=\"//bundle[@id='${NAME}']//resource\"\nreplicas_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nfi\n\nbundle_def_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nBUNDLE_CONTAINER_ENGINE=$(cibadmin -Q | xmllint --xpath \"name(${bundle_def_xpath})\" -)\nBUNDLE_REPLICAS=$(cibadmin -Q | xmllint --xpath \"string(${bundle_def_xpath}/@replicas)\" -)\n\n\n# The wait algorithm follows a two-stage approach\n#  1. Depending on how the script is called, we first check whether\n#     the resource is restarted locally. An A/P resource may be\n#     restarted elsewhere in the cluster.\n#  2. If needed, check whether the A/P resource has restarted\n#     elsewhere. For A/P M/S resources, in case the resource is\n#     restarted as Slave locally, ensure a Master is available.\n\nsuccess=1\nbailout=1\ntimeout=$TIMEOUT\nrole=\"\"\n\n# Stage 1: local check\nif [ -n \"$ROLE_LOCAL\" ]; then\n    log \"Waiting until ${NAME} has restarted on ${HOST} and is in state ${ROLE_LOCAL}\"\n    log \"Will probe resource state with the following XPath pattern: ${local_resource_xpath}\"\n\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resource=$(crm_mon -r --as-xml | xmllint --xpath \"${local_resource_xpath}\" - 2>/dev/null)\n        role=$(echo \"${resource}\" | sed -ne 's/.*\\Wrole=\"\\([^\"]*\\)\".*/\\1/p')\n\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resource}\" | grep -q -w \"\\Wblocked=\\\"true\\\"\"; then\n            log \"${NAME} is blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_locally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif [ \"$role\" = \"$ROLE_LOCAL\" ]; then\n            success=0\n            continue\n        elif [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" = \"$ROLE_ANYWHERE\" ]; then\n            # A/P: we are restarted in the expected state\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_LOCAL} on ${HOST}\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\n# Stage 2: global check\nif [ $timeout -gt 0 ] && [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" != \"$ROLE_ANYWHERE\" ]; then\n    log \"Wait until ${NAME} is restarted anywhere in the cluster in state ${ROLE_ANYWHERE}\"\n    log \"Will probe resource state with the following XPath pattern: ${any_resource_xpath}\"\n\n    success=1\n    bailout=1\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resources=$(crm_mon -r --as-xml | xmllint --xpath \"${any_resource_xpath}\" - 2>/dev/null)\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif ! (echo \"${resources}\" | grep -q -w \"\\Wblocked=\\\"false\\\"\"); then\n            log \"${NAME} blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_globally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resources}\" | grep -q -w \"\\Wrole=\\\"${ROLE_ANYWHERE}\\\"\"; then\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_ANYWHERE} anywhere in the cluster\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\nif [ $timeout -le 0 ]; then\n    log \"Timeout reached after ${TIMEOUT}s while waiting for ${NAME} to be restarted\"\nelif [ $bailout -le 0 ]; then\n    log \"Restart monitoring for ${NAME} cancelled\"\nfi\n\nif [ $success -eq 0 ]; then\n    log \"${NAME} successfully restarted\"\nelse\n    log \"${NAME} was not restarted properly\"\nfi\n\n# Don't block minor update or stack update if the wait was unsuccessful\nexit 0\n"}, "wait-port-and-run.sh": {"mode": "0755", "content": "#!/usr/bin/bash\nset -eu\n\nHOST=$1\nPORT=$2\n\necho \"$(date -u): Checking whether we can bind to ${HOST}:${PORT}\"\nwhile (ss -Htnl src \"${HOST}\" \"sport = :${PORT}\" | grep -wq \"${PORT}\"); do\n    echo \"$(date -u): ${HOST}:${PORT} still in use, waiting...\";\n    sleep 10;\ndone\n\nshift 2\nCOMMAND=\"$*\"\nif [ -z \"${COMMAND}\" ]; then\n    COMMAND=\"true\"\nfi\nexec $COMMAND\n"}, "pacemaker_resource_lock.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nMAX_RETRIES=10\nCIB_ENOTFOUND=105\n\nusage() {\n   echo \"Set a global property in the cluster with a validity timestamp.\"\n   echo \"Usage:\"\n   echo \"   $0 --acquire <lock_name> <lock_owner> <lock_ttl_in_seconds>\"\n   echo \"   $0 --release <lock_name> <lock_owner>\"\n   echo\n}\n\nlog() {\n    echo \"$(date -u): $1\" 1>&2\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\nlock_create() {\n    local name=$1\n    local data=$2\n    # cibadmin won't overwrite a key if someone else succeeded to create it concurrently\n    cibadmin --sync-call --scope crm_config --create --xml-text \"<cluster_property_set id='${name}'><nvpair id='${name}-pair' name='${name}' value='${data}'/></cluster_property_set>\" &>/dev/null\n    return $?\n}\n\nlock_update() {\n    local name=$1\n    local expected_data=$2\n    local new_data=$3\n    # we only update the lock we expect to see, so we can't update someone else's lock\n    cibadmin --sync-call --scope crm_config --modify --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" --xml-text \"<nvpair id='${name}-pair' name='${name}' value='${new_data}'/>\" &>/dev/null\n    return $?\n}\n\nlock_delete() {\n    local name=$1\n    local expected_data=$2\n    # we only delete the lock we expect to see, so we can't delete someone else's lock\n    cibadmin --sync-call --scope crm_config --delete --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" &>/dev/null\n    return $?\n}\n\nlock_get() {\n    local lockname=$1\n    local res\n    local rc\n    res=$(cibadmin --query --scope crm_config --xpath \"//cluster_property_set/nvpair[@name='$lockname']\" 2>/dev/null)\n    rc=$?\n    if [ $rc -eq 0 ]; then\n        echo \"$res\" | sed -n 's/.*value=\"\\([^\"]*\\)\".*/\\1/p'\n    fi\n    return $rc\n}\n\nlock_owner() {\n    local lock=$1\n    echo \"$lock\" | cut -d':' -f1\n}\n\nlock_has_expired() {\n    local lock=$1\n    local expiry=$(echo \"$lock\" | cut -d':' -f2)\n    local now=$(date +%s)\n    test $now -ge $expiry\n}\n\n\n# Perform a lock action and restart if the CIB has been modified before\n# committing the lock action\ntry_action() {\n    local fun=$1\n    local lock=$2\n    local requester=$3\n    local args=${4:-}\n    local tries=$MAX_RETRIES\n    local rc=1\n    if [ \"$fun\" = \"lock_acquire\" ] || [ \"$fun\" = \"lock_release\" ]; then\n        log \"Try running $fun\"\n    else\n        return 2\n    fi\n    while [ $rc -ne 0 ]; do\n        $fun $lock $requester $args\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Operation $1 succeeded\"\n            return 0\n        elif [ $rc -eq 3 ]; then\n            # rc == 3 -> CIB changed before push\n            if [ $tries -eq 0 ]; then\n                log \"Failed to commit after $MAX_RETRIES retries. Bailing out.\"\n                return 2\n            else\n                log \"Failed to commit. Retrying operation.\"\n                tries=$(($tries - 1))\n            fi\n        elif [ $rc -eq 2 ]; then\n            # rc == 2 -> unrecoverable cib error (e.g. pacemaker down)\n            log \"Unexpected failure. Bailing out\"\n            return $rc\n        else\n            # rc == 1 -> lock error (not owner, lock doesn't exists)\n            return $rc\n        fi\n    done\n}\n\n# The lock mechanism uses cibadmin's atomic creation so cluster-wide\n# state coherency is guaranteed by pacemaker\nlock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc\n    local lock\n    local expiry\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -n \"$lock\" ]; then\n        lock_has_expired $lock\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Lock has expired, now available for being held\"\n        else\n            # lock is still held. check whether we're the owner\n            owner=$(lock_owner $lock)\n            if [ \"$owner\" = \"$requester\" ];then\n                log \"Requester already owns the lock, acquiring attempt will just reconfigure the TTL\"\n            else\n                log \"Lock is held by someone else ($owner)\"\n                return 1\n            fi\n        fi\n    else\n        log \"Lock is not held yet\"\n    fi\n\n    # prepare the lock info\n    expiry=$(($(date +%s) + $ttl))\n\n    if [ -n \"$lock\" ]; then\n        log \"Attempting to update the lock\"\n        lock_update $lockname \"$lock\" \"$requester:$expiry\"\n        rc=$?\n    else\n        log \"Attempting to acquire the lock\"\n        lock_create $lockname \"$requester:$expiry\"\n        rc=$?\n    fi\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' acquired by '$requester', valid until $(date -d @$expiry)\"\n        return 0\n    else\n        log \"CIB changed, lock cannot be acquired\"\n        return 3\n    fi\n}\n\n\n# The lock mechanism uses the CIB's num_updates tag to implement\n# a conditional store. Cluster-wide locking is guaranteed by pacemaker\nlock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n    local lock\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        log \"Lock doesn't exist. Nothing to release\"\n        return 0\n    else\n        log \"Lock exists, check whether we're the owner\"\n        owner=$(lock_owner $lock)\n        if [ \"$owner\" != \"$requester\" ];then\n            log \"Lock is held by someone else ($owner), will not unlock\"\n            return 1\n        fi\n    fi\n\n    lock_delete $lockname \"$lock\"\n    rc=$?\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' released by '$requester'\"\n        return 0\n    else\n        log \"CIB deletion error, lock cannot be released\"\n        return 3\n    fi\n}\n\n\n# Retrieve the owner of a lock from the CIB\n# this is a read-only operation, so no need to log debug info\nlock_get_owner() {\n    local lockname=$1\n    local rc\n    local lock\n    local owner\n\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        return 1\n    else\n        lock_owner $lock\n        return 0\n    fi\n}\n\n\nACTION=$1\nLOCKNAME=$2\nREQUESTER=$3\nTTL=${4:-60}\n\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nif [ $ACTION != \"--help\" ]; then\n    if [ -z \"$LOCKNAME\" ]; then\n        error \"You must specific a lock name\"\n    fi\n    if [ $ACTION != \"--owner\" ] && [ $ACTION != \"-o\" ]; then\n        if [ -z \"$REQUESTER\" ]; then\n            error \"You must specific a lock requester\"\n        fi\n    fi\nfi\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) try_action lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --release|-r) try_action lock_release $LOCKNAME $REQUESTER;;\n    --acquire-once|-A) lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --owner|-o) lock_get_owner $LOCKNAME;;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}, "pacemaker_mutex_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_restart_bundle.sh --lock mysql galera galera-bundle Master _\n# pacemaker_mutex_restart_bundle.sh --lock ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\n\nset -u\n\nusage() {\n    echo \"Restart a clustered resource in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --lock <tripleo-service> <pcmk-resource> <pcmk-bundle> <target-state-local> <target-state-cluster>\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\nACTION=$1\ncase $ACTION in\n    --help) usage; exit 0;;\n    --lock) ;;\n    *) error \"Unknown action '$ACTION'\";;\nesac\n\nTRIPLEO_SERVICE=$2\nLOCK_NAME=${TRIPLEO_SERVICE}-restart-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to restart resource $TRIPLEO_SERVICE\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\nRESOURCE_NAME=$3\nBUNDLE_NAME=$4\nWAIT_TARGET_LOCAL=$5\nWAIT_TARGET_ANYWHERE=${6:-_}\n\nif pacemaker_supports_promoted; then\n    WAIT_TARGET_LOCAL=$(echo \"$5\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    WAIT_TARGET_ANYWHERE=$(echo \"${6:-_}\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    promoted_role=\"Promoted\"\nelse\n    promoted_role=\"Master\"\nfi\n\n# The lock TTL should accomodate for the resource start/promote timeout\nif [ \"$RESOURCE_NAME\" != \"$BUNDLE_NAME\" ]; then\n    if [ \"$WAIT_TARGET_LOCAL\" = \"$promoted_role\" ] || [ \"$WAIT_TARGET_ANYWHERE\" = \"$promoted_role\" ]; then\n        rsc_op=\"promote\"\n    else\n        rsc_op=\"start\"\n    fi\n    # <op id=\"galera-promote-interval-0s\" interval=\"0s\" name=\"promote\" on-fail=\"block\" timeout=\"300s\"/>\n    PCMK_TTL=$(cibadmin -Q | xmllint -xpath \"string(//primitive[@id='${RESOURCE_NAME}']/operations/op[@name='${rsc_op}']/@timeout)\" - | sed 's/s$//')\n    LOCK_TTL=$((PCMK_TTL + 30))\nelse\n    # The podman RA's default start timeout\n    LOCK_TTL=90\nfi\n\nlog \"Acquire a ${LOCK_TTL}s restart lock for service $TRIPLEO_SERVICE before restarting it\"\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nrc=1\nwhile [ $rc -ne 0 ]; do\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire $LOCK_NAME $LOCK_OWNER $LOCK_TTL\n    rc=$?\n    if [ $rc != 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not acquire lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Could not acquire lock, retrying\"\n            sleep 10\n        fi\n    fi\ndone\n\nlog \"Restart the service $TRIPLEO_SERVICE locally\"\n# Reuse the local restart script in t-h-t (driven by env var TRIPLEO_MINOR_UPDATE)\nTRIPLEO_MINOR_UPDATE=true /var/lib/container-config-scripts/pacemaker_restart_bundle.sh $TRIPLEO_SERVICE $RESOURCE_NAME $BUNDLE_NAME $WAIT_TARGET_LOCAL $WAIT_TARGET_ANYWHERE\n\n# If we reached this point, always try to release the lock\nlog \"Release the restart lock for service $TRIPLEO_SERVICE\"\n/var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $LOCK_NAME $LOCK_OWNER\nrc=$?\nif [ $rc -ne 0 ] && [ $rc -ne 1 ]; then\n    error \"Could not release held lock (rc: $rc)\"\nfi\n"}, "pacemaker_mutex_shutdown.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_shutdown.sh --acquire\n# pacemaker_mutex_shutdown.sh --release\n\nset -u\n\nusage() {\n    echo \"Shutdown a cluster node in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --acquire # prevent other node from shutting down until we hold the lock\"\n    echo \"   $0 --release # release the lock, other node can compete for the shutdown lock\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nshutdown_lock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc=1\n    local current_owner\n    local owner_stopped\n    local owner_rc\n\n    log \"Acquiring the shutdown lock\"\n    while [ $rc -ne 0 ]; do\n        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire-once $lockname $requester $ttl\n        rc=$?\n        if [ $rc -ne 0 ]; then\n            if [ $rc -eq 2 ]; then\n                error \"Could not acquire the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n            else\n                # The lock is held by another node.\n                current_owner=$(/var/lib/container-config-scripts/pacemaker_resource_lock.sh --owner $lockname)\n                owner_rc=$?\n                if [ $owner_rc -eq 2 ]; then\n                    error \"Could not get the shutdown lock owner due to unrecoverable error (rc: $owner_rc), bailing out\"\n                fi\n                if [ $owner_rc -eq 0 ]; then\n                    # If the owner is marked as offline, that means it has shutdown and\n                    # we can clean the lock preemptively and try to acquire it.\n                    owner_stopped=$(crm_mon -1X | xmllint --xpath 'count(//nodes/node[@name=\"'${current_owner}'\" and @online=\"false\" and @unclean=\"false\"])' -)\n                    if [ \"${owner_stopped}\" = \"1\" ]; then\n                        log \"Shutdown lock held by stopped node '${current_owner}', lock can be released\"\n                        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $current_owner\n                        continue\n                    fi\n                fi\n                log \"Shutdown lock held by another node (rc: $rc), retrying\"\n                sleep 10\n            fi\n        fi\n    done\n    log \"Shutdown lock acquired\"\n    return 0\n}\n\n\n# Release the lock if we still own it. Not owning it anymore is not fatal\nshutdown_lock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n\n    log \"Releasing the shutdown lock\"\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $requester\n    rc=$?\n    if [ $rc -ne 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not release the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Shutdown lock no longer held, nothing to do\"\n        fi\n    else\n        log \"Shutdown lock released\"\n    fi\n    return 0\n}\n\n\nACTION=$1\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nLOCK_NAME=tripleo-shutdown-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to aquire the shutdown lock\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\n# We start with a very high TTL, that long enough to accomodate a cluster stop.\n# As soon as the node will get offline, the other competing node will be entitled\n# to steal the lock, so they should never wait that long in practice.\nLOCK_TTL=600\n\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) shutdown_lock_acquire ${LOCK_NAME} ${LOCK_OWNER} ${LOCK_TTL};;\n    --release|-r) shutdown_lock_release ${LOCK_NAME} ${LOCK_OWNER};;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-68-pwnm2lum3vrr-ContainersCommon-jemcpryvyfnr/2b2e4a85-ce32-4d14-840a-c6d758227c4a"}


created_at: 2026-01-27 08:25:53.985739
data:
  {"value": {"ContainerPlacementImage": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1"}}


created_at: 2026-01-27 08:25:53.994625
data:
  {"config_settings": null, "tuple:('docker_config', 'step_2')": {"placement_init_log": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1", "net": "none", "user": "root", "command": ["/bin/bash", "-c", "chown -R placement:placement /var/log/placement"], "volumes": ["/var/log/containers/placement:/var/log/placement:z", "/var/log/containers/httpd/placement:/var/log/httpd:z"]}}, "volumes": ["/var/log/containers/placement:/var/log/placement:z", "/var/log/containers/httpd/placement:/var/log/httpd:z"], "host_prep_tasks": [{"name": "create persistent logs directory", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/placement", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/placement", "setype": "container_file_t", "mode": "0750"}]}], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-68-pwnm2lum3vrr-PlacementLogging-l6nis7heqlm4/188f5fbb-0d36-492c-9c34-955fd9d4ca1d"}


created_at: 2026-01-27 08:25:54.000748
data:
  {"value": {"ContainerPlacementImage": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1", "ContainerPlacementConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1"}}


created_at: 2026-01-27 08:25:54.013676
data:
  {"tuple:('role_data', 'container_config_scripts')": {"container_puppet_apply.sh": {"mode": "0700", "content": "#!/bin/bash\nset -eux\nSTEP=$1\nTAGS=$2\nCONFIG=$3\nEXTRA_ARGS=${4:-''}\nif [ -d /tmp/puppet-etc ]; then\n  # ignore copy failures as these may be the same file depending on docker mounts\n  cp -a /tmp/puppet-etc/* /etc/puppet || true\nfi\necho \"{\\\"step\\\": ${STEP}}\" > /etc/puppet/hieradata/docker_puppet.json\n# $::deployment_type in puppet-tripleo\nexport FACTER_deployment_type=containers\nset +e\npuppet apply $EXTRA_ARGS \\\n    --verbose \\\n    --detailed-exitcodes \\\n    --summarize \\\n    --color=false \\\n    --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \\\n    --tags $TAGS \\\n    -e \"noop_resource('package'); ${CONFIG}\"\nrc=$?\nset -e\nset +ux\nif [ $rc -eq 2 -o $rc -eq 0 ]; then\n    exit 0\nfi\nexit $rc\n"}, "pyshim.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n#\n# Usage: pyshim.sh <script and/or arguments>\n#\n# Unfortunately THT doesn't know which version of python might be in a\n# container so we need this script to be able to try python3 or python2\n# depending on availability.  Since this is a temporary shim until we've\n# fully cut over to python3, we check for the existence of python3 first\n# before falling back to python2. This will help in the transition from\n# python2 based containers to python3.\n\nshow_usage() {\n    echo \"Usage: pyshim.sh <script and/or arguments>\"\n}\n\nif [ $# -lt 1 ]\nthen\n    show_usage\n    exit 1\nfi\n\nset -x\nif command -v python3 >/dev/null; then\n    python3 \"$@\"\nelif command -v python2 >/dev/null; then\n    python2 \"$@\"\nelif command -v python >/dev/null; then\n    python \"$@\"\nelse\n    echo \"ERROR: python is not available!\"\n    exit 1\nfi\n"}, "pacemaker_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nset -u\n\n# ./pacemaker_restart_bundle.sh mysql galera galera-bundle Master _\n# ./pacemaker_restart_bundle.sh redis redis redis-bundle Slave Master\n# ./pacemaker_restart_bundle.sh ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\nRESTART_SCRIPTS_DIR=$(dirname $0)\nTRIPLEO_SERVICE=$1\nRESOURCE_NAME=$2\nBUNDLE_NAME=$3\nWAIT_TARGET_LOCAL=$4\nWAIT_TARGET_ANYWHERE=${5:-_}\nTRIPLEO_MINOR_UPDATE=\"${TRIPLEO_MINOR_UPDATE:-false}\"\nTRIPLEO_HA_WRAPPER_RESOURCE_EXISTS=\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS:-false}\"\n\nbundle_can_be_restarted() {\n    local bundle=$1\n    # As long as the resource bundle is managed by pacemaker and is\n    # not meant to stay stopped, no matter the state of any inner\n    # pcmk_remote or ocf resource, we should restart it to give it a\n    # chance to read the new config.\n    [ \"$(crm_resource --meta -r $1 -g is-managed 2>/dev/null)\" != \"false\" ] && \\\n    [ \"$(crm_resource --meta -r $1 -g target-role 2>/dev/null)\" != \"Stopped\" ]\n}\n\nlog() {\n    local msg=$1\n    logger -t pcmkrestart \"$1\"\n}\n\nHOSTNAME=$(/bin/hostname -s)\nif [ x\"${TRIPLEO_MINOR_UPDATE,,}\" != x\"true\" ]; then\n    if [ x\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS,,}\" = x\"false\" ]; then\n        # Do not restart during initial deployment, as the resource\n        # has just been created.\n        SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n        if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n            log \"Initial deployment, skipping the restart of ${BUNDLE_NAME}\"\n\tfi\n        exit 0\n    else\n        # During a stack update, this script is called in parallel on\n        # every node the resource runs on, after the service's configs\n        # have been updated on all nodes. So we need to run pcs only\n        # once (e.g. on the service's boostrap node).\n        if bundle_can_be_restarted ${BUNDLE_NAME}; then\n            SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n            if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n                replicas_running=$(crm_resource -Q -r $BUNDLE_NAME --locate 2>&1 | wc -l)\n                if [ \"$replicas_running\" != \"0\" ]; then\n                    log \"Restarting ${BUNDLE_NAME} globally. Stopping:\"\n                    /sbin/pcs resource disable --wait=600 $BUNDLE_NAME\n                    log \"Restarting ${BUNDLE_NAME} globally. Starting:\"\n                    /sbin/pcs resource enable --wait=600 $BUNDLE_NAME\n                else\n                    log \"${BUNDLE_NAME} is not running anywhere,\" \\\n                         \"cleaning up to restart it globally if necessary\"\n                    /sbin/pcs resource cleanup $BUNDLE_NAME\n                fi\n            else\n                log \"Skipping global restart of ${BUNDLE_NAME} on ${HOSTNAME} it will be restarted by node ${SERVICE_NODEID}\"\n            fi\n\n        else\n            log \"No global restart needed for ${BUNDLE_NAME}.\"\n        fi\n    fi\nelse\n    # During a minor update workflow however, a host gets fully\n    # updated before updating the next one. So unlike stack\n    # update, at the time this script is called, the service's\n    # configs aren't updated on all nodes yet. So only restart the\n    # resource locally, where it's guaranteed that the config is\n    # up to date.\n    HOST=$(facter hostname)\n\n    if bundle_can_be_restarted ${BUNDLE_NAME}; then\n\t# if the resource is running locally, restart it\n\tif crm_resource -r $BUNDLE_NAME --locate 2>&1 | grep -w -q \"${HOST}\"; then\n            log \"Restarting ${BUNDLE_NAME} locally on '${HOST}'\"\n            /sbin/pcs resource restart $BUNDLE_NAME \"${HOST}\"\n\n\telse\n\t    # At this point, if no resource is running locally, it's\n\t    # either because a) it has failed previously, or b) because\n\t    # it's an A/P resource running elsewhere.\n\t    # By cleaning up resource, we ensure that a) it will try to\n\t    # restart, or b) it won't do anything if the resource is\n\t    # already running elsewhere.\n            log \"${BUNDLE_NAME} is currently not running on '${HOST}',\" \\\n                 \"cleaning up its state to restart it if necessary\"\n            /sbin/pcs resource cleanup $BUNDLE_NAME node=\"${HOST}\"\n\tfi\n\n\t# Wait until the resource is in the expected target state\n\t$RESTART_SCRIPTS_DIR/pacemaker_wait_bundle.sh \\\n            $RESOURCE_NAME $BUNDLE_NAME \\\n            \"$WAIT_TARGET_LOCAL\" \"$WAIT_TARGET_ANYWHERE\" \\\n\t    \"${HOST}\" 600\n    else\n        log \"No restart needed for ${BUNDLE_NAME}.\"\n    fi\nfi\n"}, "pacemaker_wait_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# ----\n# Wait for an OCF resource or a bundle to be restarted\n# ----\n# e.g.:\n# M/S OCF:      $0 galera galera-bundle Master\n# clone OCF:    $0 rabbitmq rabbitmq-bundle Started\n# A/P M/S OCF:  $0 redis redis-bundle Slave Master\n# A/P bundle:   $0 openstack-cinder-volume openstack-cinder-volume _ Started\n# clone bundle: $0 haproxy-bundle haproxy-bundle Started\n\n# design note 1:\n#  - this script is called during a minor update; it is called\n#    once per node that hosts a service replica.\n#  - the purpose of this script is to ensure that restarting the\n#    service replica locally won't disrupt the service availability\n#    for the end user. To reach that goal, the script waits until the\n#    service is restarted locally or globallu and reaches a given\n#    target state (i.e. Started, Slave or Master).\n# design note 2:\n#   - we don't want to track restart error: our only job is to ensure\n#     service restart synchronization, not service health.\n#   - In particular, we don't want to error out in case the resource\n#     cannot be restarted locally, because that would make the minor\n#     update fail, even if potentially other replicas still provide\n#     the service.\n# design note 3:\n#   - we can bail out early if we determine that the resource can't\n#     be restarted automatically by pacemaker (e.g. its \"blocked\",\n#     unmanaged or disabled).\n\nlog() {\n    local msg=$1\n    echo \"$(date -u): $1\"\n}\n\nusage() {\n    echo 2>&1 \"Usage: $0 NAME BUNDLE_NAME ROLE_LOCAL [ROLE_ANYWHERE] [HOST] [TIMEOUT]\"\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\n#\n# Utility functions to detect stuck resources\n#\n\nbundle_failures_locally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local replica_name\n    for i in $(seq 0 $last); do\n\treplica_name=${BUNDLE_NAME}-${engine}-${i}\n\tcrm_failcount -q -G -r $replica_name -N $HOST\n    done\n}\n\nbundle_failures_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    for i in $(seq 0 $last); do\n\tcrm_failcount -q -G -r ${BUNDLE_NAME}-${engine}-${i}\n    done\n}\n\nbundle_running_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    # return the number of running bundles replica, i.e. the number of\n    # docker/podman resource replicas currently running in the cluster\n    crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:heartbeat:${engine}']/node)\" -\n}\n\nocf_failures_globally() {\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local bundle_node\n    for i in $(seq 0 $last); do\n\tbundle_node=${BUNDLE_NAME}-${i}\n\tcrm_failcount -q -G -r $NAME -N $bundle_node\n    done\n}\n\ndid_resource_failed_locally() {\n    local failures\n    local running\n    local remotehost\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# if we're dealing with an ocf resource, it is running on a\n\t# pacemaker_remote rather that on the real host, and the\n\t# failcounts are thus associated to the pcmk remote. Replace\n\t# the host's name with the pcmk remote's name.\n        remotehost=$(crm_mon --as-xml | xmllint --xpath \"string(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource/node[@name='${HOST}']/../../resource[@resource_agent='${OCF}:pacemaker:remote']/@id)\" -)\n\tif [ -n \"${remotehost}\" ]; then\n\t    crm_failcount -q -G -r $NAME -N $remotehost | grep -q -w INFINITY\n\t    return $?\n\tfi\n\t# If no pcmk remote is currently running, the failcount from\n\t# the ocf resource is useless, compute the failcount from the\n\t# bundle case instead (computed below).\n    fi\n\n    # for bundles, pacemaker can run any bundle replica locally\n    # (e.g. galera-bundle-docker-{0,1,2}), and a failure happens when\n    # there are no more replica to try.\n    # That is, when _at least_ one replica failed locally, and all the\n    # others either failed or are currently running elsewhere.\n    failures=$(bundle_failures_locally $HOST | grep -c -w INFINITY)\n    running=$(bundle_running_globally)\n    test $failures -gt 0 && \\\n    test $(( $failures + $running )) -ge $BUNDLE_REPLICAS\n}\n\ndid_resource_failed_globally() {\n    local remotecount\n    local failures\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# we check the state of an ocf resource only if the\n\t# pcmkremotes are started\n        remotecount=$(crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node)\" -)\n\tif [ \"${remotecount}\" = \"0\" ]; then\n\t    # no pcmkremote is running, so check the bundle state\n\t    # instead of checking the ocf resource\n\t    # bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\t    failures=$(bundle_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\telse\n\t    # ocf resource failed if it failed to start on\n\t    # all $BUNDLE_REPLICAS bundle nodes\n\t    failures=$(ocf_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\tfi\n    else\n\t# bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\tfailures=$(bundle_failures_globally | grep -c -w INFINITY)\n\ttest $failures -eq $BUNDLE_REPLICAS\n    fi\n}\n\n\n# Input validation\n#\n\nNAME=$1\nif [ -z \"${NAME}\" ]; then\n    echo 2>&1 \"Error: argument NAME must not be empty\"\n    exit 1\nfi\n\nBUNDLE_NAME=$2\nif [ -z \"${BUNDLE_NAME}\" ]; then\n    echo 2>&1 \"Error: argument BUNDLE_NAME must not be empty\"\n    exit 1\nfi\n\nROLE_LOCAL=$3\nif [ \"${ROLE_LOCAL}\" = \"_\" ]; then\n    ROLE_LOCAL=\"\"\nfi\n\nROLE_ANYWHERE=$4\nif [ \"${ROLE_ANYWHERE}\" = \"_\" ]; then\n    ROLE_ANYWHERE=\"\"\nfi\n\nif [ -z \"${ROLE_LOCAL}\" ]; then\n    if [ -z \"${ROLE_ANYWHERE}\" ]; then\n        echo 2>&1 \"Error: either ROLE_LOCAL or ROLE_ANYWHERE must be non empty\"\n        exit 1\n    fi\nelse\n    if !(echo \"${ROLE_LOCAL}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n        echo 2>&1 \"Error: argument ROLE_LOCAL must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n        exit 1\n    fi\nfi\n\nif [ -n \"${ROLE_ANYWHERE}\" ] && !(echo \"${ROLE_ANYWHERE}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n    echo 2>&1 \"Error: argument ROLE_ANYWHERE must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n    exit 1\nfi\n\n# Ensure compatibility with pacemaker 2.1\nif pacemaker_supports_promoted; then\n    ROLE_LOCAL=$(echo \"$ROLE_LOCAL\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    ROLE_ANYWHERE=$(echo \"$ROLE_ANYWHERE\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    OCF=\"ocf\"\nelse\n    OCF=\"ocf:\"\nfi\n\nHOST=${5:-$(facter hostname)}\nTIMEOUT=${6:-600}\n\n\n# Configure the search\n# ----\n# Note: we can't use crm_resource in all searches because we can't\n# easily extract the host the OCF resources run on (crm_resource\n# returns the pcmk-remote nodes rather than the hosts)\n# So instead, we implement various searches with XPath directly.\n\nif [ \"${BUNDLE_NAME}\" != \"${NAME}\" ]; then\n# ocf resource\nlocal_resource_xpath=\"//bundle/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node[@name='${HOST}']/../../resource[@id='${NAME}']\"\nany_resource_xpath=\"//bundle//resource[@id='${NAME}']\"\nreplicas_xpath=\"//bundle/primitive[@id='${BUNDLE_NAME}']/../*[boolean(@image) and boolean(@replicas)]\"\nelse\n# bundle resource\nlocal_resource_xpath=\"//bundle[@id='${NAME}']/replica/resource/node[@name='${HOST}']/../../resource\"\nany_resource_xpath=\"//bundle[@id='${NAME}']//resource\"\nreplicas_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nfi\n\nbundle_def_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nBUNDLE_CONTAINER_ENGINE=$(cibadmin -Q | xmllint --xpath \"name(${bundle_def_xpath})\" -)\nBUNDLE_REPLICAS=$(cibadmin -Q | xmllint --xpath \"string(${bundle_def_xpath}/@replicas)\" -)\n\n\n# The wait algorithm follows a two-stage approach\n#  1. Depending on how the script is called, we first check whether\n#     the resource is restarted locally. An A/P resource may be\n#     restarted elsewhere in the cluster.\n#  2. If needed, check whether the A/P resource has restarted\n#     elsewhere. For A/P M/S resources, in case the resource is\n#     restarted as Slave locally, ensure a Master is available.\n\nsuccess=1\nbailout=1\ntimeout=$TIMEOUT\nrole=\"\"\n\n# Stage 1: local check\nif [ -n \"$ROLE_LOCAL\" ]; then\n    log \"Waiting until ${NAME} has restarted on ${HOST} and is in state ${ROLE_LOCAL}\"\n    log \"Will probe resource state with the following XPath pattern: ${local_resource_xpath}\"\n\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resource=$(crm_mon -r --as-xml | xmllint --xpath \"${local_resource_xpath}\" - 2>/dev/null)\n        role=$(echo \"${resource}\" | sed -ne 's/.*\\Wrole=\"\\([^\"]*\\)\".*/\\1/p')\n\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resource}\" | grep -q -w \"\\Wblocked=\\\"true\\\"\"; then\n            log \"${NAME} is blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_locally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif [ \"$role\" = \"$ROLE_LOCAL\" ]; then\n            success=0\n            continue\n        elif [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" = \"$ROLE_ANYWHERE\" ]; then\n            # A/P: we are restarted in the expected state\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_LOCAL} on ${HOST}\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\n# Stage 2: global check\nif [ $timeout -gt 0 ] && [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" != \"$ROLE_ANYWHERE\" ]; then\n    log \"Wait until ${NAME} is restarted anywhere in the cluster in state ${ROLE_ANYWHERE}\"\n    log \"Will probe resource state with the following XPath pattern: ${any_resource_xpath}\"\n\n    success=1\n    bailout=1\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resources=$(crm_mon -r --as-xml | xmllint --xpath \"${any_resource_xpath}\" - 2>/dev/null)\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif ! (echo \"${resources}\" | grep -q -w \"\\Wblocked=\\\"false\\\"\"); then\n            log \"${NAME} blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_globally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resources}\" | grep -q -w \"\\Wrole=\\\"${ROLE_ANYWHERE}\\\"\"; then\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_ANYWHERE} anywhere in the cluster\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\nif [ $timeout -le 0 ]; then\n    log \"Timeout reached after ${TIMEOUT}s while waiting for ${NAME} to be restarted\"\nelif [ $bailout -le 0 ]; then\n    log \"Restart monitoring for ${NAME} cancelled\"\nfi\n\nif [ $success -eq 0 ]; then\n    log \"${NAME} successfully restarted\"\nelse\n    log \"${NAME} was not restarted properly\"\nfi\n\n# Don't block minor update or stack update if the wait was unsuccessful\nexit 0\n"}, "wait-port-and-run.sh": {"mode": "0755", "content": "#!/usr/bin/bash\nset -eu\n\nHOST=$1\nPORT=$2\n\necho \"$(date -u): Checking whether we can bind to ${HOST}:${PORT}\"\nwhile (ss -Htnl src \"${HOST}\" \"sport = :${PORT}\" | grep -wq \"${PORT}\"); do\n    echo \"$(date -u): ${HOST}:${PORT} still in use, waiting...\";\n    sleep 10;\ndone\n\nshift 2\nCOMMAND=\"$*\"\nif [ -z \"${COMMAND}\" ]; then\n    COMMAND=\"true\"\nfi\nexec $COMMAND\n"}, "pacemaker_resource_lock.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nMAX_RETRIES=10\nCIB_ENOTFOUND=105\n\nusage() {\n   echo \"Set a global property in the cluster with a validity timestamp.\"\n   echo \"Usage:\"\n   echo \"   $0 --acquire <lock_name> <lock_owner> <lock_ttl_in_seconds>\"\n   echo \"   $0 --release <lock_name> <lock_owner>\"\n   echo\n}\n\nlog() {\n    echo \"$(date -u): $1\" 1>&2\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\nlock_create() {\n    local name=$1\n    local data=$2\n    # cibadmin won't overwrite a key if someone else succeeded to create it concurrently\n    cibadmin --sync-call --scope crm_config --create --xml-text \"<cluster_property_set id='${name}'><nvpair id='${name}-pair' name='${name}' value='${data}'/></cluster_property_set>\" &>/dev/null\n    return $?\n}\n\nlock_update() {\n    local name=$1\n    local expected_data=$2\n    local new_data=$3\n    # we only update the lock we expect to see, so we can't update someone else's lock\n    cibadmin --sync-call --scope crm_config --modify --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" --xml-text \"<nvpair id='${name}-pair' name='${name}' value='${new_data}'/>\" &>/dev/null\n    return $?\n}\n\nlock_delete() {\n    local name=$1\n    local expected_data=$2\n    # we only delete the lock we expect to see, so we can't delete someone else's lock\n    cibadmin --sync-call --scope crm_config --delete --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" &>/dev/null\n    return $?\n}\n\nlock_get() {\n    local lockname=$1\n    local res\n    local rc\n    res=$(cibadmin --query --scope crm_config --xpath \"//cluster_property_set/nvpair[@name='$lockname']\" 2>/dev/null)\n    rc=$?\n    if [ $rc -eq 0 ]; then\n        echo \"$res\" | sed -n 's/.*value=\"\\([^\"]*\\)\".*/\\1/p'\n    fi\n    return $rc\n}\n\nlock_owner() {\n    local lock=$1\n    echo \"$lock\" | cut -d':' -f1\n}\n\nlock_has_expired() {\n    local lock=$1\n    local expiry=$(echo \"$lock\" | cut -d':' -f2)\n    local now=$(date +%s)\n    test $now -ge $expiry\n}\n\n\n# Perform a lock action and restart if the CIB has been modified before\n# committing the lock action\ntry_action() {\n    local fun=$1\n    local lock=$2\n    local requester=$3\n    local args=${4:-}\n    local tries=$MAX_RETRIES\n    local rc=1\n    if [ \"$fun\" = \"lock_acquire\" ] || [ \"$fun\" = \"lock_release\" ]; then\n        log \"Try running $fun\"\n    else\n        return 2\n    fi\n    while [ $rc -ne 0 ]; do\n        $fun $lock $requester $args\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Operation $1 succeeded\"\n            return 0\n        elif [ $rc -eq 3 ]; then\n            # rc == 3 -> CIB changed before push\n            if [ $tries -eq 0 ]; then\n                log \"Failed to commit after $MAX_RETRIES retries. Bailing out.\"\n                return 2\n            else\n                log \"Failed to commit. Retrying operation.\"\n                tries=$(($tries - 1))\n            fi\n        elif [ $rc -eq 2 ]; then\n            # rc == 2 -> unrecoverable cib error (e.g. pacemaker down)\n            log \"Unexpected failure. Bailing out\"\n            return $rc\n        else\n            # rc == 1 -> lock error (not owner, lock doesn't exists)\n            return $rc\n        fi\n    done\n}\n\n# The lock mechanism uses cibadmin's atomic creation so cluster-wide\n# state coherency is guaranteed by pacemaker\nlock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc\n    local lock\n    local expiry\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -n \"$lock\" ]; then\n        lock_has_expired $lock\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Lock has expired, now available for being held\"\n        else\n            # lock is still held. check whether we're the owner\n            owner=$(lock_owner $lock)\n            if [ \"$owner\" = \"$requester\" ];then\n                log \"Requester already owns the lock, acquiring attempt will just reconfigure the TTL\"\n            else\n                log \"Lock is held by someone else ($owner)\"\n                return 1\n            fi\n        fi\n    else\n        log \"Lock is not held yet\"\n    fi\n\n    # prepare the lock info\n    expiry=$(($(date +%s) + $ttl))\n\n    if [ -n \"$lock\" ]; then\n        log \"Attempting to update the lock\"\n        lock_update $lockname \"$lock\" \"$requester:$expiry\"\n        rc=$?\n    else\n        log \"Attempting to acquire the lock\"\n        lock_create $lockname \"$requester:$expiry\"\n        rc=$?\n    fi\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' acquired by '$requester', valid until $(date -d @$expiry)\"\n        return 0\n    else\n        log \"CIB changed, lock cannot be acquired\"\n        return 3\n    fi\n}\n\n\n# The lock mechanism uses the CIB's num_updates tag to implement\n# a conditional store. Cluster-wide locking is guaranteed by pacemaker\nlock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n    local lock\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        log \"Lock doesn't exist. Nothing to release\"\n        return 0\n    else\n        log \"Lock exists, check whether we're the owner\"\n        owner=$(lock_owner $lock)\n        if [ \"$owner\" != \"$requester\" ];then\n            log \"Lock is held by someone else ($owner), will not unlock\"\n            return 1\n        fi\n    fi\n\n    lock_delete $lockname \"$lock\"\n    rc=$?\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' released by '$requester'\"\n        return 0\n    else\n        log \"CIB deletion error, lock cannot be released\"\n        return 3\n    fi\n}\n\n\n# Retrieve the owner of a lock from the CIB\n# this is a read-only operation, so no need to log debug info\nlock_get_owner() {\n    local lockname=$1\n    local rc\n    local lock\n    local owner\n\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        return 1\n    else\n        lock_owner $lock\n        return 0\n    fi\n}\n\n\nACTION=$1\nLOCKNAME=$2\nREQUESTER=$3\nTTL=${4:-60}\n\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nif [ $ACTION != \"--help\" ]; then\n    if [ -z \"$LOCKNAME\" ]; then\n        error \"You must specific a lock name\"\n    fi\n    if [ $ACTION != \"--owner\" ] && [ $ACTION != \"-o\" ]; then\n        if [ -z \"$REQUESTER\" ]; then\n            error \"You must specific a lock requester\"\n        fi\n    fi\nfi\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) try_action lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --release|-r) try_action lock_release $LOCKNAME $REQUESTER;;\n    --acquire-once|-A) lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --owner|-o) lock_get_owner $LOCKNAME;;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}, "pacemaker_mutex_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_restart_bundle.sh --lock mysql galera galera-bundle Master _\n# pacemaker_mutex_restart_bundle.sh --lock ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\n\nset -u\n\nusage() {\n    echo \"Restart a clustered resource in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --lock <tripleo-service> <pcmk-resource> <pcmk-bundle> <target-state-local> <target-state-cluster>\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\nACTION=$1\ncase $ACTION in\n    --help) usage; exit 0;;\n    --lock) ;;\n    *) error \"Unknown action '$ACTION'\";;\nesac\n\nTRIPLEO_SERVICE=$2\nLOCK_NAME=${TRIPLEO_SERVICE}-restart-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to restart resource $TRIPLEO_SERVICE\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\nRESOURCE_NAME=$3\nBUNDLE_NAME=$4\nWAIT_TARGET_LOCAL=$5\nWAIT_TARGET_ANYWHERE=${6:-_}\n\nif pacemaker_supports_promoted; then\n    WAIT_TARGET_LOCAL=$(echo \"$5\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    WAIT_TARGET_ANYWHERE=$(echo \"${6:-_}\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    promoted_role=\"Promoted\"\nelse\n    promoted_role=\"Master\"\nfi\n\n# The lock TTL should accomodate for the resource start/promote timeout\nif [ \"$RESOURCE_NAME\" != \"$BUNDLE_NAME\" ]; then\n    if [ \"$WAIT_TARGET_LOCAL\" = \"$promoted_role\" ] || [ \"$WAIT_TARGET_ANYWHERE\" = \"$promoted_role\" ]; then\n        rsc_op=\"promote\"\n    else\n        rsc_op=\"start\"\n    fi\n    # <op id=\"galera-promote-interval-0s\" interval=\"0s\" name=\"promote\" on-fail=\"block\" timeout=\"300s\"/>\n    PCMK_TTL=$(cibadmin -Q | xmllint -xpath \"string(//primitive[@id='${RESOURCE_NAME}']/operations/op[@name='${rsc_op}']/@timeout)\" - | sed 's/s$//')\n    LOCK_TTL=$((PCMK_TTL + 30))\nelse\n    # The podman RA's default start timeout\n    LOCK_TTL=90\nfi\n\nlog \"Acquire a ${LOCK_TTL}s restart lock for service $TRIPLEO_SERVICE before restarting it\"\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nrc=1\nwhile [ $rc -ne 0 ]; do\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire $LOCK_NAME $LOCK_OWNER $LOCK_TTL\n    rc=$?\n    if [ $rc != 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not acquire lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Could not acquire lock, retrying\"\n            sleep 10\n        fi\n    fi\ndone\n\nlog \"Restart the service $TRIPLEO_SERVICE locally\"\n# Reuse the local restart script in t-h-t (driven by env var TRIPLEO_MINOR_UPDATE)\nTRIPLEO_MINOR_UPDATE=true /var/lib/container-config-scripts/pacemaker_restart_bundle.sh $TRIPLEO_SERVICE $RESOURCE_NAME $BUNDLE_NAME $WAIT_TARGET_LOCAL $WAIT_TARGET_ANYWHERE\n\n# If we reached this point, always try to release the lock\nlog \"Release the restart lock for service $TRIPLEO_SERVICE\"\n/var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $LOCK_NAME $LOCK_OWNER\nrc=$?\nif [ $rc -ne 0 ] && [ $rc -ne 1 ]; then\n    error \"Could not release held lock (rc: $rc)\"\nfi\n"}, "pacemaker_mutex_shutdown.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_shutdown.sh --acquire\n# pacemaker_mutex_shutdown.sh --release\n\nset -u\n\nusage() {\n    echo \"Shutdown a cluster node in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --acquire # prevent other node from shutting down until we hold the lock\"\n    echo \"   $0 --release # release the lock, other node can compete for the shutdown lock\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nshutdown_lock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc=1\n    local current_owner\n    local owner_stopped\n    local owner_rc\n\n    log \"Acquiring the shutdown lock\"\n    while [ $rc -ne 0 ]; do\n        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire-once $lockname $requester $ttl\n        rc=$?\n        if [ $rc -ne 0 ]; then\n            if [ $rc -eq 2 ]; then\n                error \"Could not acquire the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n            else\n                # The lock is held by another node.\n                current_owner=$(/var/lib/container-config-scripts/pacemaker_resource_lock.sh --owner $lockname)\n                owner_rc=$?\n                if [ $owner_rc -eq 2 ]; then\n                    error \"Could not get the shutdown lock owner due to unrecoverable error (rc: $owner_rc), bailing out\"\n                fi\n                if [ $owner_rc -eq 0 ]; then\n                    # If the owner is marked as offline, that means it has shutdown and\n                    # we can clean the lock preemptively and try to acquire it.\n                    owner_stopped=$(crm_mon -1X | xmllint --xpath 'count(//nodes/node[@name=\"'${current_owner}'\" and @online=\"false\" and @unclean=\"false\"])' -)\n                    if [ \"${owner_stopped}\" = \"1\" ]; then\n                        log \"Shutdown lock held by stopped node '${current_owner}', lock can be released\"\n                        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $current_owner\n                        continue\n                    fi\n                fi\n                log \"Shutdown lock held by another node (rc: $rc), retrying\"\n                sleep 10\n            fi\n        fi\n    done\n    log \"Shutdown lock acquired\"\n    return 0\n}\n\n\n# Release the lock if we still own it. Not owning it anymore is not fatal\nshutdown_lock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n\n    log \"Releasing the shutdown lock\"\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $requester\n    rc=$?\n    if [ $rc -ne 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not release the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Shutdown lock no longer held, nothing to do\"\n        fi\n    else\n        log \"Shutdown lock released\"\n    fi\n    return 0\n}\n\n\nACTION=$1\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nLOCK_NAME=tripleo-shutdown-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to aquire the shutdown lock\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\n# We start with a very high TTL, that long enough to accomodate a cluster stop.\n# As soon as the node will get offline, the other competing node will be entitled\n# to steal the lock, so they should never wait that long in practice.\nLOCK_TTL=600\n\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) shutdown_lock_acquire ${LOCK_NAME} ${LOCK_OWNER} ${LOCK_TTL};;\n    --release|-r) shutdown_lock_release ${LOCK_NAME} ${LOCK_OWNER};;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}, "placement_wait_for_service.py": {"mode": "0755", "content": "#!/usr/bin/python3\n#\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n\n# shell script to check if placement API is up after X attempts.\n# Default max is 60 iterations with 10s (default) timeout in between.\n\nimport logging\nimport os\nimport re\nimport six\nimport sys\nimport time\n\nfrom keystoneauth1.identity import v3\nfrom keystoneauth1 import session\nfrom keystoneclient.v3 import client\nimport requests\n\n# In python3 SafeConfigParser was renamed to ConfigParser and the default\n# for duplicate options default to true. In case of nova it is valid to\n# have duplicate option lines, e.g. passthrough_whitelist which leads to\n# issues reading the nova.conf\n# https://bugs.launchpad.net/tripleo/+bug/1827775\nif six.PY3:\n    from six.moves.configparser import ConfigParser\n    config = ConfigParser(strict=False)\nelse:\n    from six.moves.configparser import SafeConfigParser\n    config = SafeConfigParser()\n\n\ndebug = os.getenv('__OS_DEBUG', 'false')\n\nif debug.lower() == 'true':\n    loglevel = logging.DEBUG\nelse:\n    loglevel = logging.INFO\n\nlogging.basicConfig(stream=sys.stdout, level=loglevel)\nLOG = logging.getLogger('placement_wait_for_service')\n\niterations = 60\ntimeout = 10\nplacement_cfg = '/etc/placement/placement.conf'\n\nif __name__ == '__main__':\n    if os.path.isfile(placement_cfg):\n        try:\n            config.read(placement_cfg)\n        except Exception:\n            LOG.exception('Error while reading placement.conf:')\n    else:\n        LOG.error('Placement configuration file %s does not exist',\n                  placement_cfg)\n        sys.exit(1)\n\n    # get keystone client with details from [keystone_authtoken] section\n    auth = v3.Password(\n        user_domain_name=config.get('keystone_authtoken', 'user_domain_name'),\n        username=config.get('keystone_authtoken', 'username'),\n        password=config.get('keystone_authtoken', 'password'),\n        project_name=config.get('keystone_authtoken', 'project_name'),\n        project_domain_name=config.get('keystone_authtoken',\n                                       'project_domain_name'),\n        auth_url=config.get('keystone_authtoken', 'auth_url') + '/v3')\n    sess = session.Session(auth=auth, verify=False)\n    keystone = client.Client(session=sess, interface='internal')\n\n    iterations_endpoint = iterations\n    placement_endpoint_url = None\n    while iterations_endpoint > 1:\n        iterations_endpoint -= 1\n        try:\n            # get placement service id\n            placement_service_id = keystone.services.list(\n                name='placement')[0].id\n\n            # get placement endpoint\n            # Note: puppet-placement does not support setting the interface\n            #       until we have https://review.opendev.org/688862.\n            #       Lets hard code 'internal' for now.\n            placement_endpoint_url = keystone.endpoints.list(\n                service=placement_service_id,\n                region=config.get('keystone_authtoken', 'region_name'),\n                interface='internal')[0].url\n            if not placement_endpoint_url:\n                LOG.error('Failed to get placement service endpoint!')\n            else:\n                break\n        except Exception:\n            LOG.exception('Retry - Failed to get placement service endpoint:')\n        time.sleep(timeout)\n\n    if not placement_endpoint_url:\n        LOG.error('Failed to get placement service endpoint!')\n        sys.exit(1)\n\n    # we should have CURRENT in the request response from placement:\n    # {\"versions\": [{\"status\": \"CURRENT\", \"min_version\": \"1.0\", \"max_version\":\n    # \"1.29\", \"id\": \"v1.0\", \"links\": [{\"href\": \"\", \"rel\": \"self\"}]}]}\n    response_reg = re.compile('.*CURRENT,*')\n\n    while iterations > 1:\n        iterations -= 1\n        try:\n            r = requests.get(placement_endpoint_url + '/', verify=False)\n            if r.status_code == 200 and response_reg.match(r.text):\n                LOG.info('Placement service up! - %s', r.text)\n                sys.exit(0)\n                break\n            else:\n                LOG.info('response - %r', r)\n                LOG.info('Placement service not up - %s, %s',\n                         r.status_code,\n                         r.text)\n        except Exception:\n            LOG.exception('Error query the placement endpoint:')\n        time.sleep(timeout)\n\n    sys.exit(1)\n\n# vim: set et ts=4 sw=4 :\n"}}, "tuple:('role_data', 'service_name')": "placement", "tuple:('role_data', 'docker_config')": {"step_2": {"placement_init_log": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1", "net": "none", "user": "root", "command": ["/bin/bash", "-c", "chown -R placement:placement /var/log/placement"], "volumes": ["/var/log/containers/placement:/var/log/placement:z", "/var/log/containers/httpd/placement:/var/log/httpd:z"]}}, "step_3": {"placement_api_db_sync": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1", "cap_add": ["AUDIT_WRITE"], "net": "host", "detach": false, "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/placement:/var/log/placement:z", "/var/log/containers/httpd/placement:/var/log/httpd:z", "/var/lib/kolla/config_files/placement_api_db_sync.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/placement:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1769501968"}}}, "step_4": {"placement_api": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1", "net": "host", "user": "root", "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/placement:/var/log/placement:z", "/var/log/containers/httpd/placement:/var/log/httpd:z", "/var/lib/kolla/config_files/placement_api.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/placement:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "placement_wait_for_service": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1", "user": "root", "net": "host", "privileged": false, "detach": false, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/placement:/var/log/placement:z", "/var/log/containers/httpd/placement:/var/log/httpd:z", "/var/lib/kolla/config_files/placement_api_wait_for_service.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/placement:/var/lib/kolla/config_files/src:ro", "/var/lib/container-config-scripts:/container-config-scripts:z"], "environment": {"__OS_DEBUG": "true", "KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "role_data": {"service_name": "placement", "firewall_rules": {"138 placement": {"dport": [8778]}}, "firewall_frontend_rules": {"100 placement_haproxy_frontend": {"dport": [8778]}}, "firewall_ssl_frontend_rules": {"100 placement_haproxy_frontend_ssl": {"dport": [13778]}}, "keystone_resources": {"placement": {"endpoints": {"public": "http://172.21.0.2:8778/placement", "internal": "http://172.17.0.2:8778/placement", "admin": "http://172.17.0.2:8778/placement"}, "users": {"placement": {"password": "AURFXTTURToxU3GrlROirQhvS"}}, "region": "regionOne", "service": "placement"}}, "config_settings": {"apache::default_vhost": false, "placement::keystone::authtoken::project_name": "service", "placement::keystone::authtoken::password": "AURFXTTURToxU3GrlROirQhvS", "placement::keystone::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "placement::keystone::authtoken::auth_url": "http://172.17.0.2:5000", "placement::keystone::authtoken::region_name": "regionOne", "placement::keystone::authtoken::interface": "internal", "placement::keystone::authtoken::memcache_use_advanced_pool": true, "placement::logging::debug": true, "placement::policy::enforce_new_defaults": false, "placement::policy::enforce_scope": false, "placement::policy::policies": {}, "placement::wsgi::apache::api_port": "8778", "placement::wsgi::apache::ssl": false, "placement::wsgi::apache::bind_host": "%{hiera('internal_api')}", "placement::wsgi::apache::servername": "%{hiera('fqdn_internal_api')}", "placement::db::database_connection": "mysql+pymysql://placement:AURFXTTURToxU3GrlROirQhvS@172.17.0.2/placement?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "placement::wsgi::apache::workers": 1}, "service_config_settings": {"rsyslog": {"tripleo_logging_sources_placement": [{"tag": "openstack.placement", "file": "/var/log/containers/placement/placement.log"}]}, "mysql": {"placement::db::mysql::password": "AURFXTTURToxU3GrlROirQhvS", "placement::db::mysql::user": "placement", "placement::db::mysql::host": "%", "placement::db::mysql::dbname": "placement"}}, "puppet_config": {"config_volume": "placement", "puppet_tags": "placement_config", "step_config": "include tripleo::profile::base::database::mysql::client\ninclude tripleo::profile::base::placement::api", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/placement_api.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/placement", "owner": "placement:placement", "recurse": true}]}, "/var/lib/kolla/config_files/placement_api_db_sync.json": {"command": "/usr/bin/bootstrap_host_exec placement su placement -s /bin/bash -c '/usr/bin/placement-manage db sync'", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/placement", "owner": "placement:placement", "recurse": true}]}, "/var/lib/kolla/config_files/placement_api_wait_for_service.json": {"command": "/usr/bin/bootstrap_host_exec placement su placement -s /bin/bash -c '/container-config-scripts/pyshim.sh /container-config-scripts/placement_wait_for_service.py'", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/placement", "owner": "placement:placement", "recurse": true}]}}, "container_config_scripts": {"container_puppet_apply.sh": {"mode": "0700", "content": "#!/bin/bash\nset -eux\nSTEP=$1\nTAGS=$2\nCONFIG=$3\nEXTRA_ARGS=${4:-''}\nif [ -d /tmp/puppet-etc ]; then\n  # ignore copy failures as these may be the same file depending on docker mounts\n  cp -a /tmp/puppet-etc/* /etc/puppet || true\nfi\necho \"{\\\"step\\\": ${STEP}}\" > /etc/puppet/hieradata/docker_puppet.json\n# $::deployment_type in puppet-tripleo\nexport FACTER_deployment_type=containers\nset +e\npuppet apply $EXTRA_ARGS \\\n    --verbose \\\n    --detailed-exitcodes \\\n    --summarize \\\n    --color=false \\\n    --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \\\n    --tags $TAGS \\\n    -e \"noop_resource('package'); ${CONFIG}\"\nrc=$?\nset -e\nset +ux\nif [ $rc -eq 2 -o $rc -eq 0 ]; then\n    exit 0\nfi\nexit $rc\n"}, "pyshim.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n#\n# Usage: pyshim.sh <script and/or arguments>\n#\n# Unfortunately THT doesn't know which version of python might be in a\n# container so we need this script to be able to try python3 or python2\n# depending on availability.  Since this is a temporary shim until we've\n# fully cut over to python3, we check for the existence of python3 first\n# before falling back to python2. This will help in the transition from\n# python2 based containers to python3.\n\nshow_usage() {\n    echo \"Usage: pyshim.sh <script and/or arguments>\"\n}\n\nif [ $# -lt 1 ]\nthen\n    show_usage\n    exit 1\nfi\n\nset -x\nif command -v python3 >/dev/null; then\n    python3 \"$@\"\nelif command -v python2 >/dev/null; then\n    python2 \"$@\"\nelif command -v python >/dev/null; then\n    python \"$@\"\nelse\n    echo \"ERROR: python is not available!\"\n    exit 1\nfi\n"}, "pacemaker_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nset -u\n\n# ./pacemaker_restart_bundle.sh mysql galera galera-bundle Master _\n# ./pacemaker_restart_bundle.sh redis redis redis-bundle Slave Master\n# ./pacemaker_restart_bundle.sh ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\nRESTART_SCRIPTS_DIR=$(dirname $0)\nTRIPLEO_SERVICE=$1\nRESOURCE_NAME=$2\nBUNDLE_NAME=$3\nWAIT_TARGET_LOCAL=$4\nWAIT_TARGET_ANYWHERE=${5:-_}\nTRIPLEO_MINOR_UPDATE=\"${TRIPLEO_MINOR_UPDATE:-false}\"\nTRIPLEO_HA_WRAPPER_RESOURCE_EXISTS=\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS:-false}\"\n\nbundle_can_be_restarted() {\n    local bundle=$1\n    # As long as the resource bundle is managed by pacemaker and is\n    # not meant to stay stopped, no matter the state of any inner\n    # pcmk_remote or ocf resource, we should restart it to give it a\n    # chance to read the new config.\n    [ \"$(crm_resource --meta -r $1 -g is-managed 2>/dev/null)\" != \"false\" ] && \\\n    [ \"$(crm_resource --meta -r $1 -g target-role 2>/dev/null)\" != \"Stopped\" ]\n}\n\nlog() {\n    local msg=$1\n    logger -t pcmkrestart \"$1\"\n}\n\nHOSTNAME=$(/bin/hostname -s)\nif [ x\"${TRIPLEO_MINOR_UPDATE,,}\" != x\"true\" ]; then\n    if [ x\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS,,}\" = x\"false\" ]; then\n        # Do not restart during initial deployment, as the resource\n        # has just been created.\n        SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n        if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n            log \"Initial deployment, skipping the restart of ${BUNDLE_NAME}\"\n\tfi\n        exit 0\n    else\n        # During a stack update, this script is called in parallel on\n        # every node the resource runs on, after the service's configs\n        # have been updated on all nodes. So we need to run pcs only\n        # once (e.g. on the service's boostrap node).\n        if bundle_can_be_restarted ${BUNDLE_NAME}; then\n            SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n            if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n                replicas_running=$(crm_resource -Q -r $BUNDLE_NAME --locate 2>&1 | wc -l)\n                if [ \"$replicas_running\" != \"0\" ]; then\n                    log \"Restarting ${BUNDLE_NAME} globally. Stopping:\"\n                    /sbin/pcs resource disable --wait=600 $BUNDLE_NAME\n                    log \"Restarting ${BUNDLE_NAME} globally. Starting:\"\n                    /sbin/pcs resource enable --wait=600 $BUNDLE_NAME\n                else\n                    log \"${BUNDLE_NAME} is not running anywhere,\" \\\n                         \"cleaning up to restart it globally if necessary\"\n                    /sbin/pcs resource cleanup $BUNDLE_NAME\n                fi\n            else\n                log \"Skipping global restart of ${BUNDLE_NAME} on ${HOSTNAME} it will be restarted by node ${SERVICE_NODEID}\"\n            fi\n\n        else\n            log \"No global restart needed for ${BUNDLE_NAME}.\"\n        fi\n    fi\nelse\n    # During a minor update workflow however, a host gets fully\n    # updated before updating the next one. So unlike stack\n    # update, at the time this script is called, the service's\n    # configs aren't updated on all nodes yet. So only restart the\n    # resource locally, where it's guaranteed that the config is\n    # up to date.\n    HOST=$(facter hostname)\n\n    if bundle_can_be_restarted ${BUNDLE_NAME}; then\n\t# if the resource is running locally, restart it\n\tif crm_resource -r $BUNDLE_NAME --locate 2>&1 | grep -w -q \"${HOST}\"; then\n            log \"Restarting ${BUNDLE_NAME} locally on '${HOST}'\"\n            /sbin/pcs resource restart $BUNDLE_NAME \"${HOST}\"\n\n\telse\n\t    # At this point, if no resource is running locally, it's\n\t    # either because a) it has failed previously, or b) because\n\t    # it's an A/P resource running elsewhere.\n\t    # By cleaning up resource, we ensure that a) it will try to\n\t    # restart, or b) it won't do anything if the resource is\n\t    # already running elsewhere.\n            log \"${BUNDLE_NAME} is currently not running on '${HOST}',\" \\\n                 \"cleaning up its state to restart it if necessary\"\n            /sbin/pcs resource cleanup $BUNDLE_NAME node=\"${HOST}\"\n\tfi\n\n\t# Wait until the resource is in the expected target state\n\t$RESTART_SCRIPTS_DIR/pacemaker_wait_bundle.sh \\\n            $RESOURCE_NAME $BUNDLE_NAME \\\n            \"$WAIT_TARGET_LOCAL\" \"$WAIT_TARGET_ANYWHERE\" \\\n\t    \"${HOST}\" 600\n    else\n        log \"No restart needed for ${BUNDLE_NAME}.\"\n    fi\nfi\n"}, "pacemaker_wait_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# ----\n# Wait for an OCF resource or a bundle to be restarted\n# ----\n# e.g.:\n# M/S OCF:      $0 galera galera-bundle Master\n# clone OCF:    $0 rabbitmq rabbitmq-bundle Started\n# A/P M/S OCF:  $0 redis redis-bundle Slave Master\n# A/P bundle:   $0 openstack-cinder-volume openstack-cinder-volume _ Started\n# clone bundle: $0 haproxy-bundle haproxy-bundle Started\n\n# design note 1:\n#  - this script is called during a minor update; it is called\n#    once per node that hosts a service replica.\n#  - the purpose of this script is to ensure that restarting the\n#    service replica locally won't disrupt the service availability\n#    for the end user. To reach that goal, the script waits until the\n#    service is restarted locally or globallu and reaches a given\n#    target state (i.e. Started, Slave or Master).\n# design note 2:\n#   - we don't want to track restart error: our only job is to ensure\n#     service restart synchronization, not service health.\n#   - In particular, we don't want to error out in case the resource\n#     cannot be restarted locally, because that would make the minor\n#     update fail, even if potentially other replicas still provide\n#     the service.\n# design note 3:\n#   - we can bail out early if we determine that the resource can't\n#     be restarted automatically by pacemaker (e.g. its \"blocked\",\n#     unmanaged or disabled).\n\nlog() {\n    local msg=$1\n    echo \"$(date -u): $1\"\n}\n\nusage() {\n    echo 2>&1 \"Usage: $0 NAME BUNDLE_NAME ROLE_LOCAL [ROLE_ANYWHERE] [HOST] [TIMEOUT]\"\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\n#\n# Utility functions to detect stuck resources\n#\n\nbundle_failures_locally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local replica_name\n    for i in $(seq 0 $last); do\n\treplica_name=${BUNDLE_NAME}-${engine}-${i}\n\tcrm_failcount -q -G -r $replica_name -N $HOST\n    done\n}\n\nbundle_failures_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    for i in $(seq 0 $last); do\n\tcrm_failcount -q -G -r ${BUNDLE_NAME}-${engine}-${i}\n    done\n}\n\nbundle_running_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    # return the number of running bundles replica, i.e. the number of\n    # docker/podman resource replicas currently running in the cluster\n    crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:heartbeat:${engine}']/node)\" -\n}\n\nocf_failures_globally() {\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local bundle_node\n    for i in $(seq 0 $last); do\n\tbundle_node=${BUNDLE_NAME}-${i}\n\tcrm_failcount -q -G -r $NAME -N $bundle_node\n    done\n}\n\ndid_resource_failed_locally() {\n    local failures\n    local running\n    local remotehost\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# if we're dealing with an ocf resource, it is running on a\n\t# pacemaker_remote rather that on the real host, and the\n\t# failcounts are thus associated to the pcmk remote. Replace\n\t# the host's name with the pcmk remote's name.\n        remotehost=$(crm_mon --as-xml | xmllint --xpath \"string(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource/node[@name='${HOST}']/../../resource[@resource_agent='${OCF}:pacemaker:remote']/@id)\" -)\n\tif [ -n \"${remotehost}\" ]; then\n\t    crm_failcount -q -G -r $NAME -N $remotehost | grep -q -w INFINITY\n\t    return $?\n\tfi\n\t# If no pcmk remote is currently running, the failcount from\n\t# the ocf resource is useless, compute the failcount from the\n\t# bundle case instead (computed below).\n    fi\n\n    # for bundles, pacemaker can run any bundle replica locally\n    # (e.g. galera-bundle-docker-{0,1,2}), and a failure happens when\n    # there are no more replica to try.\n    # That is, when _at least_ one replica failed locally, and all the\n    # others either failed or are currently running elsewhere.\n    failures=$(bundle_failures_locally $HOST | grep -c -w INFINITY)\n    running=$(bundle_running_globally)\n    test $failures -gt 0 && \\\n    test $(( $failures + $running )) -ge $BUNDLE_REPLICAS\n}\n\ndid_resource_failed_globally() {\n    local remotecount\n    local failures\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# we check the state of an ocf resource only if the\n\t# pcmkremotes are started\n        remotecount=$(crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node)\" -)\n\tif [ \"${remotecount}\" = \"0\" ]; then\n\t    # no pcmkremote is running, so check the bundle state\n\t    # instead of checking the ocf resource\n\t    # bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\t    failures=$(bundle_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\telse\n\t    # ocf resource failed if it failed to start on\n\t    # all $BUNDLE_REPLICAS bundle nodes\n\t    failures=$(ocf_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\tfi\n    else\n\t# bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\tfailures=$(bundle_failures_globally | grep -c -w INFINITY)\n\ttest $failures -eq $BUNDLE_REPLICAS\n    fi\n}\n\n\n# Input validation\n#\n\nNAME=$1\nif [ -z \"${NAME}\" ]; then\n    echo 2>&1 \"Error: argument NAME must not be empty\"\n    exit 1\nfi\n\nBUNDLE_NAME=$2\nif [ -z \"${BUNDLE_NAME}\" ]; then\n    echo 2>&1 \"Error: argument BUNDLE_NAME must not be empty\"\n    exit 1\nfi\n\nROLE_LOCAL=$3\nif [ \"${ROLE_LOCAL}\" = \"_\" ]; then\n    ROLE_LOCAL=\"\"\nfi\n\nROLE_ANYWHERE=$4\nif [ \"${ROLE_ANYWHERE}\" = \"_\" ]; then\n    ROLE_ANYWHERE=\"\"\nfi\n\nif [ -z \"${ROLE_LOCAL}\" ]; then\n    if [ -z \"${ROLE_ANYWHERE}\" ]; then\n        echo 2>&1 \"Error: either ROLE_LOCAL or ROLE_ANYWHERE must be non empty\"\n        exit 1\n    fi\nelse\n    if !(echo \"${ROLE_LOCAL}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n        echo 2>&1 \"Error: argument ROLE_LOCAL must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n        exit 1\n    fi\nfi\n\nif [ -n \"${ROLE_ANYWHERE}\" ] && !(echo \"${ROLE_ANYWHERE}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n    echo 2>&1 \"Error: argument ROLE_ANYWHERE must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n    exit 1\nfi\n\n# Ensure compatibility with pacemaker 2.1\nif pacemaker_supports_promoted; then\n    ROLE_LOCAL=$(echo \"$ROLE_LOCAL\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    ROLE_ANYWHERE=$(echo \"$ROLE_ANYWHERE\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    OCF=\"ocf\"\nelse\n    OCF=\"ocf:\"\nfi\n\nHOST=${5:-$(facter hostname)}\nTIMEOUT=${6:-600}\n\n\n# Configure the search\n# ----\n# Note: we can't use crm_resource in all searches because we can't\n# easily extract the host the OCF resources run on (crm_resource\n# returns the pcmk-remote nodes rather than the hosts)\n# So instead, we implement various searches with XPath directly.\n\nif [ \"${BUNDLE_NAME}\" != \"${NAME}\" ]; then\n# ocf resource\nlocal_resource_xpath=\"//bundle/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node[@name='${HOST}']/../../resource[@id='${NAME}']\"\nany_resource_xpath=\"//bundle//resource[@id='${NAME}']\"\nreplicas_xpath=\"//bundle/primitive[@id='${BUNDLE_NAME}']/../*[boolean(@image) and boolean(@replicas)]\"\nelse\n# bundle resource\nlocal_resource_xpath=\"//bundle[@id='${NAME}']/replica/resource/node[@name='${HOST}']/../../resource\"\nany_resource_xpath=\"//bundle[@id='${NAME}']//resource\"\nreplicas_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nfi\n\nbundle_def_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nBUNDLE_CONTAINER_ENGINE=$(cibadmin -Q | xmllint --xpath \"name(${bundle_def_xpath})\" -)\nBUNDLE_REPLICAS=$(cibadmin -Q | xmllint --xpath \"string(${bundle_def_xpath}/@replicas)\" -)\n\n\n# The wait algorithm follows a two-stage approach\n#  1. Depending on how the script is called, we first check whether\n#     the resource is restarted locally. An A/P resource may be\n#     restarted elsewhere in the cluster.\n#  2. If needed, check whether the A/P resource has restarted\n#     elsewhere. For A/P M/S resources, in case the resource is\n#     restarted as Slave locally, ensure a Master is available.\n\nsuccess=1\nbailout=1\ntimeout=$TIMEOUT\nrole=\"\"\n\n# Stage 1: local check\nif [ -n \"$ROLE_LOCAL\" ]; then\n    log \"Waiting until ${NAME} has restarted on ${HOST} and is in state ${ROLE_LOCAL}\"\n    log \"Will probe resource state with the following XPath pattern: ${local_resource_xpath}\"\n\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resource=$(crm_mon -r --as-xml | xmllint --xpath \"${local_resource_xpath}\" - 2>/dev/null)\n        role=$(echo \"${resource}\" | sed -ne 's/.*\\Wrole=\"\\([^\"]*\\)\".*/\\1/p')\n\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resource}\" | grep -q -w \"\\Wblocked=\\\"true\\\"\"; then\n            log \"${NAME} is blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_locally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif [ \"$role\" = \"$ROLE_LOCAL\" ]; then\n            success=0\n            continue\n        elif [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" = \"$ROLE_ANYWHERE\" ]; then\n            # A/P: we are restarted in the expected state\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_LOCAL} on ${HOST}\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\n# Stage 2: global check\nif [ $timeout -gt 0 ] && [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" != \"$ROLE_ANYWHERE\" ]; then\n    log \"Wait until ${NAME} is restarted anywhere in the cluster in state ${ROLE_ANYWHERE}\"\n    log \"Will probe resource state with the following XPath pattern: ${any_resource_xpath}\"\n\n    success=1\n    bailout=1\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resources=$(crm_mon -r --as-xml | xmllint --xpath \"${any_resource_xpath}\" - 2>/dev/null)\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif ! (echo \"${resources}\" | grep -q -w \"\\Wblocked=\\\"false\\\"\"); then\n            log \"${NAME} blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_globally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resources}\" | grep -q -w \"\\Wrole=\\\"${ROLE_ANYWHERE}\\\"\"; then\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_ANYWHERE} anywhere in the cluster\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\nif [ $timeout -le 0 ]; then\n    log \"Timeout reached after ${TIMEOUT}s while waiting for ${NAME} to be restarted\"\nelif [ $bailout -le 0 ]; then\n    log \"Restart monitoring for ${NAME} cancelled\"\nfi\n\nif [ $success -eq 0 ]; then\n    log \"${NAME} successfully restarted\"\nelse\n    log \"${NAME} was not restarted properly\"\nfi\n\n# Don't block minor update or stack update if the wait was unsuccessful\nexit 0\n"}, "wait-port-and-run.sh": {"mode": "0755", "content": "#!/usr/bin/bash\nset -eu\n\nHOST=$1\nPORT=$2\n\necho \"$(date -u): Checking whether we can bind to ${HOST}:${PORT}\"\nwhile (ss -Htnl src \"${HOST}\" \"sport = :${PORT}\" | grep -wq \"${PORT}\"); do\n    echo \"$(date -u): ${HOST}:${PORT} still in use, waiting...\";\n    sleep 10;\ndone\n\nshift 2\nCOMMAND=\"$*\"\nif [ -z \"${COMMAND}\" ]; then\n    COMMAND=\"true\"\nfi\nexec $COMMAND\n"}, "pacemaker_resource_lock.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nMAX_RETRIES=10\nCIB_ENOTFOUND=105\n\nusage() {\n   echo \"Set a global property in the cluster with a validity timestamp.\"\n   echo \"Usage:\"\n   echo \"   $0 --acquire <lock_name> <lock_owner> <lock_ttl_in_seconds>\"\n   echo \"   $0 --release <lock_name> <lock_owner>\"\n   echo\n}\n\nlog() {\n    echo \"$(date -u): $1\" 1>&2\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\nlock_create() {\n    local name=$1\n    local data=$2\n    # cibadmin won't overwrite a key if someone else succeeded to create it concurrently\n    cibadmin --sync-call --scope crm_config --create --xml-text \"<cluster_property_set id='${name}'><nvpair id='${name}-pair' name='${name}' value='${data}'/></cluster_property_set>\" &>/dev/null\n    return $?\n}\n\nlock_update() {\n    local name=$1\n    local expected_data=$2\n    local new_data=$3\n    # we only update the lock we expect to see, so we can't update someone else's lock\n    cibadmin --sync-call --scope crm_config --modify --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" --xml-text \"<nvpair id='${name}-pair' name='${name}' value='${new_data}'/>\" &>/dev/null\n    return $?\n}\n\nlock_delete() {\n    local name=$1\n    local expected_data=$2\n    # we only delete the lock we expect to see, so we can't delete someone else's lock\n    cibadmin --sync-call --scope crm_config --delete --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" &>/dev/null\n    return $?\n}\n\nlock_get() {\n    local lockname=$1\n    local res\n    local rc\n    res=$(cibadmin --query --scope crm_config --xpath \"//cluster_property_set/nvpair[@name='$lockname']\" 2>/dev/null)\n    rc=$?\n    if [ $rc -eq 0 ]; then\n        echo \"$res\" | sed -n 's/.*value=\"\\([^\"]*\\)\".*/\\1/p'\n    fi\n    return $rc\n}\n\nlock_owner() {\n    local lock=$1\n    echo \"$lock\" | cut -d':' -f1\n}\n\nlock_has_expired() {\n    local lock=$1\n    local expiry=$(echo \"$lock\" | cut -d':' -f2)\n    local now=$(date +%s)\n    test $now -ge $expiry\n}\n\n\n# Perform a lock action and restart if the CIB has been modified before\n# committing the lock action\ntry_action() {\n    local fun=$1\n    local lock=$2\n    local requester=$3\n    local args=${4:-}\n    local tries=$MAX_RETRIES\n    local rc=1\n    if [ \"$fun\" = \"lock_acquire\" ] || [ \"$fun\" = \"lock_release\" ]; then\n        log \"Try running $fun\"\n    else\n        return 2\n    fi\n    while [ $rc -ne 0 ]; do\n        $fun $lock $requester $args\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Operation $1 succeeded\"\n            return 0\n        elif [ $rc -eq 3 ]; then\n            # rc == 3 -> CIB changed before push\n            if [ $tries -eq 0 ]; then\n                log \"Failed to commit after $MAX_RETRIES retries. Bailing out.\"\n                return 2\n            else\n                log \"Failed to commit. Retrying operation.\"\n                tries=$(($tries - 1))\n            fi\n        elif [ $rc -eq 2 ]; then\n            # rc == 2 -> unrecoverable cib error (e.g. pacemaker down)\n            log \"Unexpected failure. Bailing out\"\n            return $rc\n        else\n            # rc == 1 -> lock error (not owner, lock doesn't exists)\n            return $rc\n        fi\n    done\n}\n\n# The lock mechanism uses cibadmin's atomic creation so cluster-wide\n# state coherency is guaranteed by pacemaker\nlock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc\n    local lock\n    local expiry\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -n \"$lock\" ]; then\n        lock_has_expired $lock\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Lock has expired, now available for being held\"\n        else\n            # lock is still held. check whether we're the owner\n            owner=$(lock_owner $lock)\n            if [ \"$owner\" = \"$requester\" ];then\n                log \"Requester already owns the lock, acquiring attempt will just reconfigure the TTL\"\n            else\n                log \"Lock is held by someone else ($owner)\"\n                return 1\n            fi\n        fi\n    else\n        log \"Lock is not held yet\"\n    fi\n\n    # prepare the lock info\n    expiry=$(($(date +%s) + $ttl))\n\n    if [ -n \"$lock\" ]; then\n        log \"Attempting to update the lock\"\n        lock_update $lockname \"$lock\" \"$requester:$expiry\"\n        rc=$?\n    else\n        log \"Attempting to acquire the lock\"\n        lock_create $lockname \"$requester:$expiry\"\n        rc=$?\n    fi\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' acquired by '$requester', valid until $(date -d @$expiry)\"\n        return 0\n    else\n        log \"CIB changed, lock cannot be acquired\"\n        return 3\n    fi\n}\n\n\n# The lock mechanism uses the CIB's num_updates tag to implement\n# a conditional store. Cluster-wide locking is guaranteed by pacemaker\nlock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n    local lock\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        log \"Lock doesn't exist. Nothing to release\"\n        return 0\n    else\n        log \"Lock exists, check whether we're the owner\"\n        owner=$(lock_owner $lock)\n        if [ \"$owner\" != \"$requester\" ];then\n            log \"Lock is held by someone else ($owner), will not unlock\"\n            return 1\n        fi\n    fi\n\n    lock_delete $lockname \"$lock\"\n    rc=$?\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' released by '$requester'\"\n        return 0\n    else\n        log \"CIB deletion error, lock cannot be released\"\n        return 3\n    fi\n}\n\n\n# Retrieve the owner of a lock from the CIB\n# this is a read-only operation, so no need to log debug info\nlock_get_owner() {\n    local lockname=$1\n    local rc\n    local lock\n    local owner\n\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        return 1\n    else\n        lock_owner $lock\n        return 0\n    fi\n}\n\n\nACTION=$1\nLOCKNAME=$2\nREQUESTER=$3\nTTL=${4:-60}\n\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nif [ $ACTION != \"--help\" ]; then\n    if [ -z \"$LOCKNAME\" ]; then\n        error \"You must specific a lock name\"\n    fi\n    if [ $ACTION != \"--owner\" ] && [ $ACTION != \"-o\" ]; then\n        if [ -z \"$REQUESTER\" ]; then\n            error \"You must specific a lock requester\"\n        fi\n    fi\nfi\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) try_action lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --release|-r) try_action lock_release $LOCKNAME $REQUESTER;;\n    --acquire-once|-A) lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --owner|-o) lock_get_owner $LOCKNAME;;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}, "pacemaker_mutex_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_restart_bundle.sh --lock mysql galera galera-bundle Master _\n# pacemaker_mutex_restart_bundle.sh --lock ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\n\nset -u\n\nusage() {\n    echo \"Restart a clustered resource in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --lock <tripleo-service> <pcmk-resource> <pcmk-bundle> <target-state-local> <target-state-cluster>\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\nACTION=$1\ncase $ACTION in\n    --help) usage; exit 0;;\n    --lock) ;;\n    *) error \"Unknown action '$ACTION'\";;\nesac\n\nTRIPLEO_SERVICE=$2\nLOCK_NAME=${TRIPLEO_SERVICE}-restart-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to restart resource $TRIPLEO_SERVICE\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\nRESOURCE_NAME=$3\nBUNDLE_NAME=$4\nWAIT_TARGET_LOCAL=$5\nWAIT_TARGET_ANYWHERE=${6:-_}\n\nif pacemaker_supports_promoted; then\n    WAIT_TARGET_LOCAL=$(echo \"$5\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    WAIT_TARGET_ANYWHERE=$(echo \"${6:-_}\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    promoted_role=\"Promoted\"\nelse\n    promoted_role=\"Master\"\nfi\n\n# The lock TTL should accomodate for the resource start/promote timeout\nif [ \"$RESOURCE_NAME\" != \"$BUNDLE_NAME\" ]; then\n    if [ \"$WAIT_TARGET_LOCAL\" = \"$promoted_role\" ] || [ \"$WAIT_TARGET_ANYWHERE\" = \"$promoted_role\" ]; then\n        rsc_op=\"promote\"\n    else\n        rsc_op=\"start\"\n    fi\n    # <op id=\"galera-promote-interval-0s\" interval=\"0s\" name=\"promote\" on-fail=\"block\" timeout=\"300s\"/>\n    PCMK_TTL=$(cibadmin -Q | xmllint -xpath \"string(//primitive[@id='${RESOURCE_NAME}']/operations/op[@name='${rsc_op}']/@timeout)\" - | sed 's/s$//')\n    LOCK_TTL=$((PCMK_TTL + 30))\nelse\n    # The podman RA's default start timeout\n    LOCK_TTL=90\nfi\n\nlog \"Acquire a ${LOCK_TTL}s restart lock for service $TRIPLEO_SERVICE before restarting it\"\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nrc=1\nwhile [ $rc -ne 0 ]; do\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire $LOCK_NAME $LOCK_OWNER $LOCK_TTL\n    rc=$?\n    if [ $rc != 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not acquire lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Could not acquire lock, retrying\"\n            sleep 10\n        fi\n    fi\ndone\n\nlog \"Restart the service $TRIPLEO_SERVICE locally\"\n# Reuse the local restart script in t-h-t (driven by env var TRIPLEO_MINOR_UPDATE)\nTRIPLEO_MINOR_UPDATE=true /var/lib/container-config-scripts/pacemaker_restart_bundle.sh $TRIPLEO_SERVICE $RESOURCE_NAME $BUNDLE_NAME $WAIT_TARGET_LOCAL $WAIT_TARGET_ANYWHERE\n\n# If we reached this point, always try to release the lock\nlog \"Release the restart lock for service $TRIPLEO_SERVICE\"\n/var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $LOCK_NAME $LOCK_OWNER\nrc=$?\nif [ $rc -ne 0 ] && [ $rc -ne 1 ]; then\n    error \"Could not release held lock (rc: $rc)\"\nfi\n"}, "pacemaker_mutex_shutdown.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_shutdown.sh --acquire\n# pacemaker_mutex_shutdown.sh --release\n\nset -u\n\nusage() {\n    echo \"Shutdown a cluster node in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --acquire # prevent other node from shutting down until we hold the lock\"\n    echo \"   $0 --release # release the lock, other node can compete for the shutdown lock\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nshutdown_lock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc=1\n    local current_owner\n    local owner_stopped\n    local owner_rc\n\n    log \"Acquiring the shutdown lock\"\n    while [ $rc -ne 0 ]; do\n        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire-once $lockname $requester $ttl\n        rc=$?\n        if [ $rc -ne 0 ]; then\n            if [ $rc -eq 2 ]; then\n                error \"Could not acquire the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n            else\n                # The lock is held by another node.\n                current_owner=$(/var/lib/container-config-scripts/pacemaker_resource_lock.sh --owner $lockname)\n                owner_rc=$?\n                if [ $owner_rc -eq 2 ]; then\n                    error \"Could not get the shutdown lock owner due to unrecoverable error (rc: $owner_rc), bailing out\"\n                fi\n                if [ $owner_rc -eq 0 ]; then\n                    # If the owner is marked as offline, that means it has shutdown and\n                    # we can clean the lock preemptively and try to acquire it.\n                    owner_stopped=$(crm_mon -1X | xmllint --xpath 'count(//nodes/node[@name=\"'${current_owner}'\" and @online=\"false\" and @unclean=\"false\"])' -)\n                    if [ \"${owner_stopped}\" = \"1\" ]; then\n                        log \"Shutdown lock held by stopped node '${current_owner}', lock can be released\"\n                        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $current_owner\n                        continue\n                    fi\n                fi\n                log \"Shutdown lock held by another node (rc: $rc), retrying\"\n                sleep 10\n            fi\n        fi\n    done\n    log \"Shutdown lock acquired\"\n    return 0\n}\n\n\n# Release the lock if we still own it. Not owning it anymore is not fatal\nshutdown_lock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n\n    log \"Releasing the shutdown lock\"\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $requester\n    rc=$?\n    if [ $rc -ne 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not release the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Shutdown lock no longer held, nothing to do\"\n        fi\n    else\n        log \"Shutdown lock released\"\n    fi\n    return 0\n}\n\n\nACTION=$1\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nLOCK_NAME=tripleo-shutdown-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to aquire the shutdown lock\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\n# We start with a very high TTL, that long enough to accomodate a cluster stop.\n# As soon as the node will get offline, the other competing node will be entitled\n# to steal the lock, so they should never wait that long in practice.\nLOCK_TTL=600\n\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) shutdown_lock_acquire ${LOCK_NAME} ${LOCK_OWNER} ${LOCK_TTL};;\n    --release|-r) shutdown_lock_release ${LOCK_NAME} ${LOCK_OWNER};;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}, "placement_wait_for_service.py": {"mode": "0755", "content": "#!/usr/bin/python3\n#\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n\n# shell script to check if placement API is up after X attempts.\n# Default max is 60 iterations with 10s (default) timeout in between.\n\nimport logging\nimport os\nimport re\nimport six\nimport sys\nimport time\n\nfrom keystoneauth1.identity import v3\nfrom keystoneauth1 import session\nfrom keystoneclient.v3 import client\nimport requests\n\n# In python3 SafeConfigParser was renamed to ConfigParser and the default\n# for duplicate options default to true. In case of nova it is valid to\n# have duplicate option lines, e.g. passthrough_whitelist which leads to\n# issues reading the nova.conf\n# https://bugs.launchpad.net/tripleo/+bug/1827775\nif six.PY3:\n    from six.moves.configparser import ConfigParser\n    config = ConfigParser(strict=False)\nelse:\n    from six.moves.configparser import SafeConfigParser\n    config = SafeConfigParser()\n\n\ndebug = os.getenv('__OS_DEBUG', 'false')\n\nif debug.lower() == 'true':\n    loglevel = logging.DEBUG\nelse:\n    loglevel = logging.INFO\n\nlogging.basicConfig(stream=sys.stdout, level=loglevel)\nLOG = logging.getLogger('placement_wait_for_service')\n\niterations = 60\ntimeout = 10\nplacement_cfg = '/etc/placement/placement.conf'\n\nif __name__ == '__main__':\n    if os.path.isfile(placement_cfg):\n        try:\n            config.read(placement_cfg)\n        except Exception:\n            LOG.exception('Error while reading placement.conf:')\n    else:\n        LOG.error('Placement configuration file %s does not exist',\n                  placement_cfg)\n        sys.exit(1)\n\n    # get keystone client with details from [keystone_authtoken] section\n    auth = v3.Password(\n        user_domain_name=config.get('keystone_authtoken', 'user_domain_name'),\n        username=config.get('keystone_authtoken', 'username'),\n        password=config.get('keystone_authtoken', 'password'),\n        project_name=config.get('keystone_authtoken', 'project_name'),\n        project_domain_name=config.get('keystone_authtoken',\n                                       'project_domain_name'),\n        auth_url=config.get('keystone_authtoken', 'auth_url') + '/v3')\n    sess = session.Session(auth=auth, verify=False)\n    keystone = client.Client(session=sess, interface='internal')\n\n    iterations_endpoint = iterations\n    placement_endpoint_url = None\n    while iterations_endpoint > 1:\n        iterations_endpoint -= 1\n        try:\n            # get placement service id\n            placement_service_id = keystone.services.list(\n                name='placement')[0].id\n\n            # get placement endpoint\n            # Note: puppet-placement does not support setting the interface\n            #       until we have https://review.opendev.org/688862.\n            #       Lets hard code 'internal' for now.\n            placement_endpoint_url = keystone.endpoints.list(\n                service=placement_service_id,\n                region=config.get('keystone_authtoken', 'region_name'),\n                interface='internal')[0].url\n            if not placement_endpoint_url:\n                LOG.error('Failed to get placement service endpoint!')\n            else:\n                break\n        except Exception:\n            LOG.exception('Retry - Failed to get placement service endpoint:')\n        time.sleep(timeout)\n\n    if not placement_endpoint_url:\n        LOG.error('Failed to get placement service endpoint!')\n        sys.exit(1)\n\n    # we should have CURRENT in the request response from placement:\n    # {\"versions\": [{\"status\": \"CURRENT\", \"min_version\": \"1.0\", \"max_version\":\n    # \"1.29\", \"id\": \"v1.0\", \"links\": [{\"href\": \"\", \"rel\": \"self\"}]}]}\n    response_reg = re.compile('.*CURRENT,*')\n\n    while iterations > 1:\n        iterations -= 1\n        try:\n            r = requests.get(placement_endpoint_url + '/', verify=False)\n            if r.status_code == 200 and response_reg.match(r.text):\n                LOG.info('Placement service up! - %s', r.text)\n                sys.exit(0)\n                break\n            else:\n                LOG.info('response - %r', r)\n                LOG.info('Placement service not up - %s, %s',\n                         r.status_code,\n                         r.text)\n        except Exception:\n            LOG.exception('Error query the placement endpoint:')\n        time.sleep(timeout)\n\n    sys.exit(1)\n\n# vim: set et ts=4 sw=4 :\n"}}, "docker_config": {"step_2": {"placement_init_log": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1", "net": "none", "user": "root", "command": ["/bin/bash", "-c", "chown -R placement:placement /var/log/placement"], "volumes": ["/var/log/containers/placement:/var/log/placement:z", "/var/log/containers/httpd/placement:/var/log/httpd:z"]}}, "step_3": {"placement_api_db_sync": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1", "cap_add": ["AUDIT_WRITE"], "net": "host", "detach": false, "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/placement:/var/log/placement:z", "/var/log/containers/httpd/placement:/var/log/httpd:z", "/var/lib/kolla/config_files/placement_api_db_sync.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/placement:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1769501968"}}}, "step_4": {"placement_api": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1", "net": "host", "user": "root", "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/placement:/var/log/placement:z", "/var/log/containers/httpd/placement:/var/log/httpd:z", "/var/lib/kolla/config_files/placement_api.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/placement:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "placement_wait_for_service": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1", "user": "root", "net": "host", "privileged": false, "detach": false, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/placement:/var/log/placement:z", "/var/log/containers/httpd/placement:/var/log/httpd:z", "/var/lib/kolla/config_files/placement_api_wait_for_service.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/placement:/var/lib/kolla/config_files/src:ro", "/var/lib/container-config-scripts:/container-config-scripts:z"], "environment": {"__OS_DEBUG": "true", "KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "host_prep_tasks": [{"name": "create persistent logs directory", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/placement", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/placement", "setype": "container_file_t", "mode": "0750"}]}], "deploy_steps_tasks": [{"name": "Certificate generation", "when": ["step|int == 1", "enable_internal_tls"], "block": [{"name": "Create dirs for certificates and keys", "file": {"path": "{{ item }}", "state": "directory", "serole": "object_r", "setype": "cert_t", "seuser": "system_u"}, "with_items": ["/etc/pki/tls/certs/httpd", "/etc/pki/tls/private/httpd"]}, {"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "httpd-ctlplane", "dns": "{{ fqdn_ctlplane }}", "principal": "HTTP/{{ fqdn_ctlplane }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-ctlplane.crt /etc/pki/tls/certs/httpd/httpd-ctlplane.crt\ncp /etc/pki/tls/private/httpd-ctlplane.key /etc/pki/tls/private/httpd/httpd-ctlplane.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage", "dns": "{{ fqdn_storage }}", "principal": "HTTP/{{ fqdn_storage }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage.crt /etc/pki/tls/certs/httpd/httpd-storage.crt\ncp /etc/pki/tls/private/httpd-storage.key /etc/pki/tls/private/httpd/httpd-storage.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage_mgmt", "dns": "{{ fqdn_storage_mgmt }}", "principal": "HTTP/{{ fqdn_storage_mgmt }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage_mgmt.crt /etc/pki/tls/certs/httpd/httpd-storage_mgmt.crt\ncp /etc/pki/tls/private/httpd-storage_mgmt.key /etc/pki/tls/private/httpd/httpd-storage_mgmt.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-internal_api", "dns": "{{ fqdn_internal_api }}", "principal": "HTTP/{{ fqdn_internal_api }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-internal_api.crt /etc/pki/tls/certs/httpd/httpd-internal_api.crt\ncp /etc/pki/tls/private/httpd-internal_api.key /etc/pki/tls/private/httpd/httpd-internal_api.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-external", "dns": "{{ fqdn_external }}", "principal": "HTTP/{{ fqdn_external }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-external.crt /etc/pki/tls/certs/httpd/httpd-external.crt\ncp /etc/pki/tls/private/httpd-external.key /etc/pki/tls/private/httpd/httpd-external.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}]}}]}], "upgrade_tasks": []}, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'config_settings')": {"apache::default_vhost": false, "placement::keystone::authtoken::project_name": "service", "placement::keystone::authtoken::password": "AURFXTTURToxU3GrlROirQhvS", "placement::keystone::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "placement::keystone::authtoken::auth_url": "http://172.17.0.2:5000", "placement::keystone::authtoken::region_name": "regionOne", "placement::keystone::authtoken::interface": "internal", "placement::keystone::authtoken::memcache_use_advanced_pool": true, "placement::logging::debug": true, "placement::policy::enforce_new_defaults": false, "placement::policy::enforce_scope": false, "placement::policy::policies": {}, "placement::wsgi::apache::api_port": "8778", "placement::wsgi::apache::ssl": false, "placement::wsgi::apache::bind_host": "%{hiera('internal_api')}", "placement::wsgi::apache::servername": "%{hiera('fqdn_internal_api')}", "placement::db::database_connection": "mysql+pymysql://placement:AURFXTTURToxU3GrlROirQhvS@172.17.0.2/placement?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "placement::wsgi::apache::workers": 1}, "tuple:('role_data', 'step_config')": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-4gbl6pobuy5z-ServiceChain-gkdevub5wy5r-68-pwnm2lum3vrr/05cbdd17-a887-4f60-bc73-c838073486e6"}


