# resource_properties_data

created_at: 2026-01-21 15:58:31.727282
data:
  {"EndpointMap": {"AodhAdmin": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8042", "protocol": "http", "uri": "http://172.17.0.2:8042", "uri_no_suffix": "http://172.17.0.2:8042"}, "AodhInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8042", "protocol": "http", "uri": "http://172.17.0.2:8042", "uri_no_suffix": "http://172.17.0.2:8042"}, "AodhPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "8042", "protocol": "http", "uri": "http://172.21.0.2:8042", "uri_no_suffix": "http://172.21.0.2:8042"}, "BarbicanAdmin": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "9311", "protocol": "http", "uri": "http://172.17.0.2:9311", "uri_no_suffix": "http://172.17.0.2:9311"}, "BarbicanInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "9311", "protocol": "http", "uri": "http://172.17.0.2:9311", "uri_no_suffix": "http://172.17.0.2:9311"}, "BarbicanPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "9311", "protocol": "http", "uri": "http://172.21.0.2:9311", "uri_no_suffix": "http://172.21.0.2:9311"}, "CephDashboardInternal": {"host": "192.168.122.99", "host_nobrackets": "192.168.122.99", "port": "8444", "protocol": "http", "uri": "http://192.168.122.99:8444", "uri_no_suffix": "http://192.168.122.99:8444"}, "CephGrafanaInternal": {"host": "172.18.0.2", "host_nobrackets": "172.18.0.2", "port": "3100", "protocol": "http", "uri": "http://172.18.0.2:3100", "uri_no_suffix": "http://172.18.0.2:3100"}, "CephRgwAdmin": {"host": "172.18.0.2", "host_nobrackets": "172.18.0.2", "port": "8080", "protocol": "http", "uri": "http://172.18.0.2:8080/swift/v1/AUTH_%(project_id)s", "uri_no_suffix": "http://172.18.0.2:8080"}, "CephRgwInternal": {"host": "172.18.0.2", "host_nobrackets": "172.18.0.2", "port": "8080", "protocol": "http", "uri": "http://172.18.0.2:8080/swift/v1/AUTH_%(project_id)s", "uri_no_suffix": "http://172.18.0.2:8080"}, "CephRgwPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "8080", "protocol": "http", "uri": "http://172.21.0.2:8080/swift/v1/AUTH_%(project_id)s", "uri_no_suffix": "http://172.21.0.2:8080"}, "CinderAdmin": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8776", "protocol": "http", "uri": "http://172.17.0.2:8776/v1/%(tenant_id)s", "uri_no_suffix": "http://172.17.0.2:8776"}, "CinderInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8776", "protocol": "http", "uri": "http://172.17.0.2:8776/v1/%(tenant_id)s", "uri_no_suffix": "http://172.17.0.2:8776"}, "CinderPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "8776", "protocol": "http", "uri": "http://172.21.0.2:8776/v1/%(tenant_id)s", "uri_no_suffix": "http://172.21.0.2:8776"}, "CinderV2Admin": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8776", "protocol": "http", "uri": "http://172.17.0.2:8776/v2/%(tenant_id)s", "uri_no_suffix": "http://172.17.0.2:8776"}, "CinderV2Internal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8776", "protocol": "http", "uri": "http://172.17.0.2:8776/v2/%(tenant_id)s", "uri_no_suffix": "http://172.17.0.2:8776"}, "CinderV2Public": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "8776", "protocol": "http", "uri": "http://172.21.0.2:8776/v2/%(tenant_id)s", "uri_no_suffix": "http://172.21.0.2:8776"}, "CinderV3Admin": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8776", "protocol": "http", "uri": "http://172.17.0.2:8776/v3/%(tenant_id)s", "uri_no_suffix": "http://172.17.0.2:8776"}, "CinderV3Internal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8776", "protocol": "http", "uri": "http://172.17.0.2:8776/v3/%(tenant_id)s", "uri_no_suffix": "http://172.17.0.2:8776"}, "CinderV3Public": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "8776", "protocol": "http", "uri": "http://172.21.0.2:8776/v3/%(tenant_id)s", "uri_no_suffix": "http://172.21.0.2:8776"}, "DesignateAdmin": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "9001", "protocol": "http", "uri": "http://172.17.0.2:9001/v2", "uri_no_suffix": "http://172.17.0.2:9001"}, "DesignateInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "9001", "protocol": "http", "uri": "http://172.17.0.2:9001/v2", "uri_no_suffix": "http://172.17.0.2:9001"}, "DesignatePublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "9001", "protocol": "http", "uri": "http://172.21.0.2:9001/v2", "uri_no_suffix": "http://172.21.0.2:9001"}, "DockerRegistryInternal": {"host": "192.168.122.99", "host_nobrackets": "192.168.122.99", "port": "8787", "protocol": "http", "uri": "http://192.168.122.99:8787", "uri_no_suffix": "http://192.168.122.99:8787"}, "GaneshaInternal": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "2049", "protocol": "nfs", "uri": "nfs://172.21.0.2:2049", "uri_no_suffix": "nfs://172.21.0.2:2049"}, "GlanceAdmin": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "9293", "protocol": "http", "uri": "http://172.17.0.2:9293", "uri_no_suffix": "http://172.17.0.2:9293"}, "GlanceInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "9293", "protocol": "http", "uri": "http://172.17.0.2:9293", "uri_no_suffix": "http://172.17.0.2:9293"}, "GlancePublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "9292", "protocol": "http", "uri": "http://172.21.0.2:9292", "uri_no_suffix": "http://172.21.0.2:9292"}, "GnocchiAdmin": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8041", "protocol": "http", "uri": "http://172.17.0.2:8041", "uri_no_suffix": "http://172.17.0.2:8041"}, "GnocchiInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8041", "protocol": "http", "uri": "http://172.17.0.2:8041", "uri_no_suffix": "http://172.17.0.2:8041"}, "GnocchiPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "8041", "protocol": "http", "uri": "http://172.21.0.2:8041", "uri_no_suffix": "http://172.21.0.2:8041"}, "HeatAdmin": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8004", "protocol": "http", "uri": "http://172.17.0.2:8004/v1/%(tenant_id)s", "uri_no_suffix": "http://172.17.0.2:8004"}, "HeatInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8004", "protocol": "http", "uri": "http://172.17.0.2:8004/v1/%(tenant_id)s", "uri_no_suffix": "http://172.17.0.2:8004"}, "HeatPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "8004", "protocol": "http", "uri": "http://172.21.0.2:8004/v1/%(tenant_id)s", "uri_no_suffix": "http://172.21.0.2:8004"}, "HeatCfnAdmin": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8000", "protocol": "http", "uri": "http://172.17.0.2:8000/v1", "uri_no_suffix": "http://172.17.0.2:8000"}, "HeatCfnInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8000", "protocol": "http", "uri": "http://172.17.0.2:8000/v1", "uri_no_suffix": "http://172.17.0.2:8000"}, "HeatCfnPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "8000", "protocol": "http", "uri": "http://172.21.0.2:8000/v1", "uri_no_suffix": "http://172.21.0.2:8000"}, "HorizonPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "80", "protocol": "http", "uri": "http://172.21.0.2:80/dashboard", "uri_no_suffix": "http://172.21.0.2:80"}, "IronicAdmin": {"host": "192.168.122.99", "host_nobrackets": "192.168.122.99", "port": "6385", "protocol": "http", "uri": "http://192.168.122.99:6385/v1", "uri_no_suffix": "http://192.168.122.99:6385"}, "IronicInternal": {"host": "192.168.122.99", "host_nobrackets": "192.168.122.99", "port": "6385", "protocol": "http", "uri": "http://192.168.122.99:6385/v1", "uri_no_suffix": "http://192.168.122.99:6385"}, "IronicPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "6385", "protocol": "http", "uri": "http://172.21.0.2:6385/v1", "uri_no_suffix": "http://172.21.0.2:6385"}, "IronicInspectorAdmin": {"host": "", "host_nobrackets": "", "port": "5050", "protocol": "http", "uri": "http://:5050", "uri_no_suffix": "http://:5050"}, "IronicInspectorInternal": {"host": "", "host_nobrackets": "", "port": "5050", "protocol": "http", "uri": "http://:5050", "uri_no_suffix": "http://:5050"}, "IronicInspectorPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "5050", "protocol": "http", "uri": "http://172.21.0.2:5050", "uri_no_suffix": "http://172.21.0.2:5050"}, "KeystoneAdmin": {"host": "192.168.122.99", "host_nobrackets": "192.168.122.99", "port": "35357", "protocol": "http", "uri": "http://192.168.122.99:35357/", "uri_no_suffix": "http://192.168.122.99:35357"}, "KeystoneInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "5000", "protocol": "http", "uri": "http://172.17.0.2:5000/", "uri_no_suffix": "http://172.17.0.2:5000"}, "KeystonePublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "5000", "protocol": "http", "uri": "http://172.21.0.2:5000/", "uri_no_suffix": "http://172.21.0.2:5000"}, "KeystoneV3Admin": {"host": "192.168.122.99", "host_nobrackets": "192.168.122.99", "port": "35357", "protocol": "http", "uri": "http://192.168.122.99:35357/v3", "uri_no_suffix": "http://192.168.122.99:35357"}, "KeystoneV3Internal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "5000", "protocol": "http", "uri": "http://172.17.0.2:5000/v3", "uri_no_suffix": "http://172.17.0.2:5000"}, "KeystoneV3Public": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "5000", "protocol": "http", "uri": "http://172.21.0.2:5000/v3", "uri_no_suffix": "http://172.21.0.2:5000"}, "ManilaAdmin": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8786", "protocol": "http", "uri": "http://172.17.0.2:8786/v2", "uri_no_suffix": "http://172.17.0.2:8786"}, "ManilaInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8786", "protocol": "http", "uri": "http://172.17.0.2:8786/v2", "uri_no_suffix": "http://172.17.0.2:8786"}, "ManilaPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "8786", "protocol": "http", "uri": "http://172.21.0.2:8786/v2", "uri_no_suffix": "http://172.21.0.2:8786"}, "ManilaV1Admin": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8786", "protocol": "http", "uri": "http://172.17.0.2:8786/v1/%(tenant_id)s", "uri_no_suffix": "http://172.17.0.2:8786"}, "ManilaV1Internal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8786", "protocol": "http", "uri": "http://172.17.0.2:8786/v1/%(tenant_id)s", "uri_no_suffix": "http://172.17.0.2:8786"}, "ManilaV1Public": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "8786", "protocol": "http", "uri": "http://172.21.0.2:8786/v1/%(tenant_id)s", "uri_no_suffix": "http://172.21.0.2:8786"}, "MetricsQdrPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "5666", "protocol": "amqp", "uri": "amqp://172.21.0.2:5666", "uri_no_suffix": "amqp://172.21.0.2:5666"}, "MysqlInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "3306", "protocol": "mysql+pymysql", "uri": "mysql+pymysql://172.17.0.2:3306", "uri_no_suffix": "mysql+pymysql://172.17.0.2:3306"}, "NeutronAdmin": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "9696", "protocol": "http", "uri": "http://172.17.0.2:9696", "uri_no_suffix": "http://172.17.0.2:9696"}, "NeutronInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "9696", "protocol": "http", "uri": "http://172.17.0.2:9696", "uri_no_suffix": "http://172.17.0.2:9696"}, "NeutronPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "9696", "protocol": "http", "uri": "http://172.21.0.2:9696", "uri_no_suffix": "http://172.21.0.2:9696"}, "NovaAdmin": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8774", "protocol": "http", "uri": "http://172.17.0.2:8774/v2.1", "uri_no_suffix": "http://172.17.0.2:8774"}, "NovaInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8774", "protocol": "http", "uri": "http://172.17.0.2:8774/v2.1", "uri_no_suffix": "http://172.17.0.2:8774"}, "NovaPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "8774", "protocol": "http", "uri": "http://172.21.0.2:8774/v2.1", "uri_no_suffix": "http://172.21.0.2:8774"}, "NovaMetadataInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8775", "protocol": "http", "uri": "http://172.17.0.2:8775", "uri_no_suffix": "http://172.17.0.2:8775"}, "NovaVNCProxyAdmin": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "6080", "protocol": "http", "uri": "http://172.17.0.2:6080", "uri_no_suffix": "http://172.17.0.2:6080"}, "NovaVNCProxyInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "6080", "protocol": "http", "uri": "http://172.17.0.2:6080", "uri_no_suffix": "http://172.17.0.2:6080"}, "NovaVNCProxyPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "6080", "protocol": "http", "uri": "http://172.21.0.2:6080", "uri_no_suffix": "http://172.21.0.2:6080"}, "NovajoinAdmin": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "9090", "protocol": "http", "uri": "http://172.17.0.2:9090/v1", "uri_no_suffix": "http://172.17.0.2:9090"}, "NovajoinInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "9090", "protocol": "http", "uri": "http://172.17.0.2:9090/v1", "uri_no_suffix": "http://172.17.0.2:9090"}, "NovajoinPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "9090", "protocol": "http", "uri": "http://172.21.0.2:9090/v1", "uri_no_suffix": "http://172.21.0.2:9090"}, "OctaviaAdmin": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "9876", "protocol": "http", "uri": "http://172.17.0.2:9876", "uri_no_suffix": "http://172.17.0.2:9876"}, "OctaviaInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "9876", "protocol": "http", "uri": "http://172.17.0.2:9876", "uri_no_suffix": "http://172.17.0.2:9876"}, "OctaviaPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "9876", "protocol": "http", "uri": "http://172.21.0.2:9876", "uri_no_suffix": "http://172.21.0.2:9876"}, "PlacementAdmin": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8778", "protocol": "http", "uri": "http://172.17.0.2:8778/placement", "uri_no_suffix": "http://172.17.0.2:8778"}, "PlacementInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8778", "protocol": "http", "uri": "http://172.17.0.2:8778/placement", "uri_no_suffix": "http://172.17.0.2:8778"}, "PlacementPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "8778", "protocol": "http", "uri": "http://172.21.0.2:8778/placement", "uri_no_suffix": "http://172.21.0.2:8778"}, "SwiftAdmin": {"host": "172.18.0.2", "host_nobrackets": "172.18.0.2", "port": "8080", "protocol": "http", "uri": "http://172.18.0.2:8080", "uri_no_suffix": "http://172.18.0.2:8080"}, "SwiftInternal": {"host": "172.18.0.2", "host_nobrackets": "172.18.0.2", "port": "8080", "protocol": "http", "uri": "http://172.18.0.2:8080/v1/AUTH_%(tenant_id)s", "uri_no_suffix": "http://172.18.0.2:8080"}, "SwiftPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "8080", "protocol": "http", "uri": "http://172.21.0.2:8080/v1/AUTH_%(tenant_id)s", "uri_no_suffix": "http://172.21.0.2:8080"}, "SwiftS3Admin": {"host": "172.18.0.2", "host_nobrackets": "172.18.0.2", "port": "8080", "protocol": "http", "uri": "http://172.18.0.2:8080", "uri_no_suffix": "http://172.18.0.2:8080"}, "SwiftS3Internal": {"host": "172.18.0.2", "host_nobrackets": "172.18.0.2", "port": "8080", "protocol": "http", "uri": "http://172.18.0.2:8080", "uri_no_suffix": "http://172.18.0.2:8080"}, "SwiftS3Public": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "8080", "protocol": "http", "uri": "http://172.21.0.2:8080", "uri_no_suffix": "http://172.21.0.2:8080"}, "MysqlCellInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "3306", "protocol": "mysql+pymysql", "uri": "mysql+pymysql://172.17.0.2:3306", "uri_no_suffix": "mysql+pymysql://172.17.0.2:3306"}, "NovaVNCProxyCellPublic": {"host": "172.21.0.2", "host_nobrackets": "172.21.0.2", "port": "6080", "protocol": "http", "uri": "http://172.21.0.2:6080", "uri_no_suffix": "http://172.21.0.2:6080"}, "NovaMetadataCellInternal": {"host": "172.17.0.2", "host_nobrackets": "172.17.0.2", "port": "8775", "protocol": "http", "uri": "http://172.17.0.2:8775", "uri_no_suffix": "http://172.17.0.2:8775"}}, "ServiceData": {"net_cidr_map": {"ctlplane": ["192.168.122.0/24"], "storage": ["172.18.0.0/24"], "storage_mgmt": ["172.20.0.0/24"], "internal_api": ["172.17.0.0/24"], "tenant": ["172.19.0.0/24"], "external": ["172.21.0.0/24"]}, "net_vip_map": {"ctlplane": "192.168.122.99", "ctlplane_subnet": "192.168.122.99/24", "ctlplane_uri": "192.168.122.99", "storage": "172.18.0.2", "storage_subnet": "", "storage_uri": "172.18.0.2", "storage_mgmt": "172.20.0.2", "storage_mgmt_subnet": "", "storage_mgmt_uri": "172.20.0.2", "internal_api": "172.17.0.2", "internal_api_subnet": "", "internal_api_uri": "172.17.0.2", "tenant": "", "tenant_subnet": "", "tenant_uri": "", "external": "172.21.0.2", "external_subnet": "", "external_uri": "172.21.0.2"}, "net_ip_version_map": {"ctlplane": 4, "storage": 4, "storage_mgmt": 4, "internal_api": 4, "tenant": 4, "external": 4}, "vip_subnet_map": {"ctlplane": "ctlplane-subnet", "Storage": "storage_subnet", "StorageMgmt": "storage_mgmt_subnet", "InternalApi": "internal_api_subnet", "External": "external_subnet", "redis": "internal_api_subnet", "ovn_dbs": "internal_api_subnet"}}, "ServiceNetMap": {"ApacheNetwork": "internal_api", "NeutronTenantNetwork": "tenant", "AodhApiNetwork": "internal_api", "BarbicanApiNetwork": "internal_api", "GnocchiApiNetwork": "internal_api", "MongodbNetwork": "internal_api", "CinderApiNetwork": "internal_api", "CinderIscsiNetwork": "storage", "GlanceApiNetwork": "internal_api", "GlanceApiEdgeNetwork": "internal_api", "GlanceApiInternalNetwork": "internal_api", "IronicApiNetwork": "ctlplane", "IronicNetwork": "baremetal", "IronicInspectorNetwork": "baremetal", "KeystoneAdminApiNetwork": "ctlplane", "KeystonePublicApiNetwork": "internal_api", "ManilaApiNetwork": "internal_api", "NeutronApiNetwork": "internal_api", "OctaviaApiNetwork": "internal_api", "HeatApiNetwork": "internal_api", "HeatApiCfnNetwork": "internal_api", "HeatApiCloudwatchNetwork": "internal_api", "NovaApiNetwork": "internal_api", "PlacementNetwork": "internal_api", "NovaMetadataNetwork": "internal_api", "NovaLibvirtNetwork": "internal_api", "NovajoinNetwork": "internal_api", "SwiftStorageNetwork": "storage_mgmt", "SwiftProxyNetwork": "storage", "HorizonNetwork": "internal_api", "MemcachedNetwork": "internal_api", "OsloMessagingRpcNetwork": "internal_api", "OsloMessagingNotifyNetwork": "internal_api", "RabbitmqNetwork": "internal_api", "RabbitmqManagementNetwork": "internal_api", "QdrNetwork": "internal_api", "RedisNetwork": "internal_api", "GaneshaNetwork": "external", "MysqlNetwork": "internal_api", "SnmpdNetwork": "ctlplane", "CephClusterNetwork": "storage_mgmt", "CephDashboardNetwork": "ctlplane", "CephGrafanaNetwork": "storage", "CephMonNetwork": "storage", "CephRgwNetwork": "storage", "PublicNetwork": "external", "InternalApiNetwork": "internal_api", "OpendaylightApiNetwork": "internal_api", "OvnDbsNetwork": "internal_api", "DockerRegistryNetwork": "ctlplane", "PacemakerNetwork": "internal_api", "PacemakerRemoteNetwork": "internal_api", "DesignateApiNetwork": "internal_api", "DesignateMdnsNetwork": "internal_api", "DesignateWorkerNetwork": "external", "DesignateBindNetwork": "external", "BINDNetwork": "external", "EtcdNetwork": "internal_api", "HaproxyNetwork": "ctlplane", "UnboundNetwork": "external", "StandaloneHostnameResolveNetwork": "internal_api", "StandaloneMetricsQdrNetwork": "internal_api", "NovaVncProxyNetwork": "internal_api"}, "RoleName": "Standalone", "RoleParameters": {"OVNCMSOptions": "enable-chassis-as-gw"}, "CinderBackupBackend": "ceph", "CinderBackupRbdPoolName": "backups", "CephClientUserName": "openstack"}


created_at: 2026-01-21 15:58:31.918829
data:
  {"type": "json", "value": {"ContainerCinderBackupImage": "registry.redhat.io/rhosp-rhel9/openstack-cinder-backup:17.1", "ContainerCinderConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-cinder-api:17.1"}}


created_at: 2026-01-21 15:58:38.792540
data:
  {"value": {"ContainerCinderBackupImage": "registry.redhat.io/rhosp-rhel9/openstack-cinder-backup:17.1", "ContainerCinderConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-cinder-api:17.1"}}


created_at: 2026-01-21 15:58:38.837619
data:
  {"container_config_scripts": {"container_puppet_apply.sh": {"mode": "0700", "content": "#!/bin/bash\nset -eux\nSTEP=$1\nTAGS=$2\nCONFIG=$3\nEXTRA_ARGS=${4:-''}\nif [ -d /tmp/puppet-etc ]; then\n  # ignore copy failures as these may be the same file depending on docker mounts\n  cp -a /tmp/puppet-etc/* /etc/puppet || true\nfi\necho \"{\\\"step\\\": ${STEP}}\" > /etc/puppet/hieradata/docker_puppet.json\n# $::deployment_type in puppet-tripleo\nexport FACTER_deployment_type=containers\nset +e\npuppet apply $EXTRA_ARGS \\\n    --verbose \\\n    --detailed-exitcodes \\\n    --summarize \\\n    --color=false \\\n    --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \\\n    --tags $TAGS \\\n    -e \"noop_resource('package'); ${CONFIG}\"\nrc=$?\nset -e\nset +ux\nif [ $rc -eq 2 -o $rc -eq 0 ]; then\n    exit 0\nfi\nexit $rc\n"}, "pyshim.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n#\n# Usage: pyshim.sh <script and/or arguments>\n#\n# Unfortunately THT doesn't know which version of python might be in a\n# container so we need this script to be able to try python3 or python2\n# depending on availability.  Since this is a temporary shim until we've\n# fully cut over to python3, we check for the existence of python3 first\n# before falling back to python2. This will help in the transition from\n# python2 based containers to python3.\n\nshow_usage() {\n    echo \"Usage: pyshim.sh <script and/or arguments>\"\n}\n\nif [ $# -lt 1 ]\nthen\n    show_usage\n    exit 1\nfi\n\nset -x\nif command -v python3 >/dev/null; then\n    python3 \"$@\"\nelif command -v python2 >/dev/null; then\n    python2 \"$@\"\nelif command -v python >/dev/null; then\n    python \"$@\"\nelse\n    echo \"ERROR: python is not available!\"\n    exit 1\nfi\n"}, "pacemaker_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nset -u\n\n# ./pacemaker_restart_bundle.sh mysql galera galera-bundle Master _\n# ./pacemaker_restart_bundle.sh redis redis redis-bundle Slave Master\n# ./pacemaker_restart_bundle.sh ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\nRESTART_SCRIPTS_DIR=$(dirname $0)\nTRIPLEO_SERVICE=$1\nRESOURCE_NAME=$2\nBUNDLE_NAME=$3\nWAIT_TARGET_LOCAL=$4\nWAIT_TARGET_ANYWHERE=${5:-_}\nTRIPLEO_MINOR_UPDATE=\"${TRIPLEO_MINOR_UPDATE:-false}\"\nTRIPLEO_HA_WRAPPER_RESOURCE_EXISTS=\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS:-false}\"\n\nbundle_can_be_restarted() {\n    local bundle=$1\n    # As long as the resource bundle is managed by pacemaker and is\n    # not meant to stay stopped, no matter the state of any inner\n    # pcmk_remote or ocf resource, we should restart it to give it a\n    # chance to read the new config.\n    [ \"$(crm_resource --meta -r $1 -g is-managed 2>/dev/null)\" != \"false\" ] && \\\n    [ \"$(crm_resource --meta -r $1 -g target-role 2>/dev/null)\" != \"Stopped\" ]\n}\n\nlog() {\n    local msg=$1\n    logger -t pcmkrestart \"$1\"\n}\n\nHOSTNAME=$(/bin/hostname -s)\nif [ x\"${TRIPLEO_MINOR_UPDATE,,}\" != x\"true\" ]; then\n    if [ x\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS,,}\" = x\"false\" ]; then\n        # Do not restart during initial deployment, as the resource\n        # has just been created.\n        SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n        if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n            log \"Initial deployment, skipping the restart of ${BUNDLE_NAME}\"\n\tfi\n        exit 0\n    else\n        # During a stack update, this script is called in parallel on\n        # every node the resource runs on, after the service's configs\n        # have been updated on all nodes. So we need to run pcs only\n        # once (e.g. on the service's boostrap node).\n        if bundle_can_be_restarted ${BUNDLE_NAME}; then\n            SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n            if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n                replicas_running=$(crm_resource -Q -r $BUNDLE_NAME --locate 2>&1 | wc -l)\n                if [ \"$replicas_running\" != \"0\" ]; then\n                    log \"Restarting ${BUNDLE_NAME} globally. Stopping:\"\n                    /sbin/pcs resource disable --wait=600 $BUNDLE_NAME\n                    log \"Restarting ${BUNDLE_NAME} globally. Starting:\"\n                    /sbin/pcs resource enable --wait=600 $BUNDLE_NAME\n                else\n                    log \"${BUNDLE_NAME} is not running anywhere,\" \\\n                         \"cleaning up to restart it globally if necessary\"\n                    /sbin/pcs resource cleanup $BUNDLE_NAME\n                fi\n            else\n                log \"Skipping global restart of ${BUNDLE_NAME} on ${HOSTNAME} it will be restarted by node ${SERVICE_NODEID}\"\n            fi\n\n        else\n            log \"No global restart needed for ${BUNDLE_NAME}.\"\n        fi\n    fi\nelse\n    # During a minor update workflow however, a host gets fully\n    # updated before updating the next one. So unlike stack\n    # update, at the time this script is called, the service's\n    # configs aren't updated on all nodes yet. So only restart the\n    # resource locally, where it's guaranteed that the config is\n    # up to date.\n    HOST=$(facter hostname)\n\n    if bundle_can_be_restarted ${BUNDLE_NAME}; then\n\t# if the resource is running locally, restart it\n\tif crm_resource -r $BUNDLE_NAME --locate 2>&1 | grep -w -q \"${HOST}\"; then\n            log \"Restarting ${BUNDLE_NAME} locally on '${HOST}'\"\n            /sbin/pcs resource restart $BUNDLE_NAME \"${HOST}\"\n\n\telse\n\t    # At this point, if no resource is running locally, it's\n\t    # either because a) it has failed previously, or b) because\n\t    # it's an A/P resource running elsewhere.\n\t    # By cleaning up resource, we ensure that a) it will try to\n\t    # restart, or b) it won't do anything if the resource is\n\t    # already running elsewhere.\n            log \"${BUNDLE_NAME} is currently not running on '${HOST}',\" \\\n                 \"cleaning up its state to restart it if necessary\"\n            /sbin/pcs resource cleanup $BUNDLE_NAME node=\"${HOST}\"\n\tfi\n\n\t# Wait until the resource is in the expected target state\n\t$RESTART_SCRIPTS_DIR/pacemaker_wait_bundle.sh \\\n            $RESOURCE_NAME $BUNDLE_NAME \\\n            \"$WAIT_TARGET_LOCAL\" \"$WAIT_TARGET_ANYWHERE\" \\\n\t    \"${HOST}\" 600\n    else\n        log \"No restart needed for ${BUNDLE_NAME}.\"\n    fi\nfi\n"}, "pacemaker_wait_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# ----\n# Wait for an OCF resource or a bundle to be restarted\n# ----\n# e.g.:\n# M/S OCF:      $0 galera galera-bundle Master\n# clone OCF:    $0 rabbitmq rabbitmq-bundle Started\n# A/P M/S OCF:  $0 redis redis-bundle Slave Master\n# A/P bundle:   $0 openstack-cinder-volume openstack-cinder-volume _ Started\n# clone bundle: $0 haproxy-bundle haproxy-bundle Started\n\n# design note 1:\n#  - this script is called during a minor update; it is called\n#    once per node that hosts a service replica.\n#  - the purpose of this script is to ensure that restarting the\n#    service replica locally won't disrupt the service availability\n#    for the end user. To reach that goal, the script waits until the\n#    service is restarted locally or globallu and reaches a given\n#    target state (i.e. Started, Slave or Master).\n# design note 2:\n#   - we don't want to track restart error: our only job is to ensure\n#     service restart synchronization, not service health.\n#   - In particular, we don't want to error out in case the resource\n#     cannot be restarted locally, because that would make the minor\n#     update fail, even if potentially other replicas still provide\n#     the service.\n# design note 3:\n#   - we can bail out early if we determine that the resource can't\n#     be restarted automatically by pacemaker (e.g. its \"blocked\",\n#     unmanaged or disabled).\n\nlog() {\n    local msg=$1\n    echo \"$(date -u): $1\"\n}\n\nusage() {\n    echo 2>&1 \"Usage: $0 NAME BUNDLE_NAME ROLE_LOCAL [ROLE_ANYWHERE] [HOST] [TIMEOUT]\"\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\n#\n# Utility functions to detect stuck resources\n#\n\nbundle_failures_locally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local replica_name\n    for i in $(seq 0 $last); do\n\treplica_name=${BUNDLE_NAME}-${engine}-${i}\n\tcrm_failcount -q -G -r $replica_name -N $HOST\n    done\n}\n\nbundle_failures_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    for i in $(seq 0 $last); do\n\tcrm_failcount -q -G -r ${BUNDLE_NAME}-${engine}-${i}\n    done\n}\n\nbundle_running_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    # return the number of running bundles replica, i.e. the number of\n    # docker/podman resource replicas currently running in the cluster\n    crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:heartbeat:${engine}']/node)\" -\n}\n\nocf_failures_globally() {\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local bundle_node\n    for i in $(seq 0 $last); do\n\tbundle_node=${BUNDLE_NAME}-${i}\n\tcrm_failcount -q -G -r $NAME -N $bundle_node\n    done\n}\n\ndid_resource_failed_locally() {\n    local failures\n    local running\n    local remotehost\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# if we're dealing with an ocf resource, it is running on a\n\t# pacemaker_remote rather that on the real host, and the\n\t# failcounts are thus associated to the pcmk remote. Replace\n\t# the host's name with the pcmk remote's name.\n        remotehost=$(crm_mon --as-xml | xmllint --xpath \"string(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource/node[@name='${HOST}']/../../resource[@resource_agent='${OCF}:pacemaker:remote']/@id)\" -)\n\tif [ -n \"${remotehost}\" ]; then\n\t    crm_failcount -q -G -r $NAME -N $remotehost | grep -q -w INFINITY\n\t    return $?\n\tfi\n\t# If no pcmk remote is currently running, the failcount from\n\t# the ocf resource is useless, compute the failcount from the\n\t# bundle case instead (computed below).\n    fi\n\n    # for bundles, pacemaker can run any bundle replica locally\n    # (e.g. galera-bundle-docker-{0,1,2}), and a failure happens when\n    # there are no more replica to try.\n    # That is, when _at least_ one replica failed locally, and all the\n    # others either failed or are currently running elsewhere.\n    failures=$(bundle_failures_locally $HOST | grep -c -w INFINITY)\n    running=$(bundle_running_globally)\n    test $failures -gt 0 && \\\n    test $(( $failures + $running )) -ge $BUNDLE_REPLICAS\n}\n\ndid_resource_failed_globally() {\n    local remotecount\n    local failures\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# we check the state of an ocf resource only if the\n\t# pcmkremotes are started\n        remotecount=$(crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node)\" -)\n\tif [ \"${remotecount}\" = \"0\" ]; then\n\t    # no pcmkremote is running, so check the bundle state\n\t    # instead of checking the ocf resource\n\t    # bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\t    failures=$(bundle_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\telse\n\t    # ocf resource failed if it failed to start on\n\t    # all $BUNDLE_REPLICAS bundle nodes\n\t    failures=$(ocf_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\tfi\n    else\n\t# bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\tfailures=$(bundle_failures_globally | grep -c -w INFINITY)\n\ttest $failures -eq $BUNDLE_REPLICAS\n    fi\n}\n\n\n# Input validation\n#\n\nNAME=$1\nif [ -z \"${NAME}\" ]; then\n    echo 2>&1 \"Error: argument NAME must not be empty\"\n    exit 1\nfi\n\nBUNDLE_NAME=$2\nif [ -z \"${BUNDLE_NAME}\" ]; then\n    echo 2>&1 \"Error: argument BUNDLE_NAME must not be empty\"\n    exit 1\nfi\n\nROLE_LOCAL=$3\nif [ \"${ROLE_LOCAL}\" = \"_\" ]; then\n    ROLE_LOCAL=\"\"\nfi\n\nROLE_ANYWHERE=$4\nif [ \"${ROLE_ANYWHERE}\" = \"_\" ]; then\n    ROLE_ANYWHERE=\"\"\nfi\n\nif [ -z \"${ROLE_LOCAL}\" ]; then\n    if [ -z \"${ROLE_ANYWHERE}\" ]; then\n        echo 2>&1 \"Error: either ROLE_LOCAL or ROLE_ANYWHERE must be non empty\"\n        exit 1\n    fi\nelse\n    if !(echo \"${ROLE_LOCAL}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n        echo 2>&1 \"Error: argument ROLE_LOCAL must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n        exit 1\n    fi\nfi\n\nif [ -n \"${ROLE_ANYWHERE}\" ] && !(echo \"${ROLE_ANYWHERE}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n    echo 2>&1 \"Error: argument ROLE_ANYWHERE must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n    exit 1\nfi\n\n# Ensure compatibility with pacemaker 2.1\nif pacemaker_supports_promoted; then\n    ROLE_LOCAL=$(echo \"$ROLE_LOCAL\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    ROLE_ANYWHERE=$(echo \"$ROLE_ANYWHERE\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    OCF=\"ocf\"\nelse\n    OCF=\"ocf:\"\nfi\n\nHOST=${5:-$(facter hostname)}\nTIMEOUT=${6:-600}\n\n\n# Configure the search\n# ----\n# Note: we can't use crm_resource in all searches because we can't\n# easily extract the host the OCF resources run on (crm_resource\n# returns the pcmk-remote nodes rather than the hosts)\n# So instead, we implement various searches with XPath directly.\n\nif [ \"${BUNDLE_NAME}\" != \"${NAME}\" ]; then\n# ocf resource\nlocal_resource_xpath=\"//bundle/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node[@name='${HOST}']/../../resource[@id='${NAME}']\"\nany_resource_xpath=\"//bundle//resource[@id='${NAME}']\"\nreplicas_xpath=\"//bundle/primitive[@id='${BUNDLE_NAME}']/../*[boolean(@image) and boolean(@replicas)]\"\nelse\n# bundle resource\nlocal_resource_xpath=\"//bundle[@id='${NAME}']/replica/resource/node[@name='${HOST}']/../../resource\"\nany_resource_xpath=\"//bundle[@id='${NAME}']//resource\"\nreplicas_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nfi\n\nbundle_def_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nBUNDLE_CONTAINER_ENGINE=$(cibadmin -Q | xmllint --xpath \"name(${bundle_def_xpath})\" -)\nBUNDLE_REPLICAS=$(cibadmin -Q | xmllint --xpath \"string(${bundle_def_xpath}/@replicas)\" -)\n\n\n# The wait algorithm follows a two-stage approach\n#  1. Depending on how the script is called, we first check whether\n#     the resource is restarted locally. An A/P resource may be\n#     restarted elsewhere in the cluster.\n#  2. If needed, check whether the A/P resource has restarted\n#     elsewhere. For A/P M/S resources, in case the resource is\n#     restarted as Slave locally, ensure a Master is available.\n\nsuccess=1\nbailout=1\ntimeout=$TIMEOUT\nrole=\"\"\n\n# Stage 1: local check\nif [ -n \"$ROLE_LOCAL\" ]; then\n    log \"Waiting until ${NAME} has restarted on ${HOST} and is in state ${ROLE_LOCAL}\"\n    log \"Will probe resource state with the following XPath pattern: ${local_resource_xpath}\"\n\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resource=$(crm_mon -r --as-xml | xmllint --xpath \"${local_resource_xpath}\" - 2>/dev/null)\n        role=$(echo \"${resource}\" | sed -ne 's/.*\\Wrole=\"\\([^\"]*\\)\".*/\\1/p')\n\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resource}\" | grep -q -w \"\\Wblocked=\\\"true\\\"\"; then\n            log \"${NAME} is blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_locally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif [ \"$role\" = \"$ROLE_LOCAL\" ]; then\n            success=0\n            continue\n        elif [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" = \"$ROLE_ANYWHERE\" ]; then\n            # A/P: we are restarted in the expected state\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_LOCAL} on ${HOST}\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\n# Stage 2: global check\nif [ $timeout -gt 0 ] && [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" != \"$ROLE_ANYWHERE\" ]; then\n    log \"Wait until ${NAME} is restarted anywhere in the cluster in state ${ROLE_ANYWHERE}\"\n    log \"Will probe resource state with the following XPath pattern: ${any_resource_xpath}\"\n\n    success=1\n    bailout=1\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resources=$(crm_mon -r --as-xml | xmllint --xpath \"${any_resource_xpath}\" - 2>/dev/null)\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif ! (echo \"${resources}\" | grep -q -w \"\\Wblocked=\\\"false\\\"\"); then\n            log \"${NAME} blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_globally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resources}\" | grep -q -w \"\\Wrole=\\\"${ROLE_ANYWHERE}\\\"\"; then\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_ANYWHERE} anywhere in the cluster\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\nif [ $timeout -le 0 ]; then\n    log \"Timeout reached after ${TIMEOUT}s while waiting for ${NAME} to be restarted\"\nelif [ $bailout -le 0 ]; then\n    log \"Restart monitoring for ${NAME} cancelled\"\nfi\n\nif [ $success -eq 0 ]; then\n    log \"${NAME} successfully restarted\"\nelse\n    log \"${NAME} was not restarted properly\"\nfi\n\n# Don't block minor update or stack update if the wait was unsuccessful\nexit 0\n"}, "wait-port-and-run.sh": {"mode": "0755", "content": "#!/usr/bin/bash\nset -eu\n\nHOST=$1\nPORT=$2\n\necho \"$(date -u): Checking whether we can bind to ${HOST}:${PORT}\"\nwhile (ss -Htnl src \"${HOST}\" \"sport = :${PORT}\" | grep -wq \"${PORT}\"); do\n    echo \"$(date -u): ${HOST}:${PORT} still in use, waiting...\";\n    sleep 10;\ndone\n\nshift 2\nCOMMAND=\"$*\"\nif [ -z \"${COMMAND}\" ]; then\n    COMMAND=\"true\"\nfi\nexec $COMMAND\n"}, "pacemaker_resource_lock.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nMAX_RETRIES=10\nCIB_ENOTFOUND=105\n\nusage() {\n   echo \"Set a global property in the cluster with a validity timestamp.\"\n   echo \"Usage:\"\n   echo \"   $0 --acquire <lock_name> <lock_owner> <lock_ttl_in_seconds>\"\n   echo \"   $0 --release <lock_name> <lock_owner>\"\n   echo\n}\n\nlog() {\n    echo \"$(date -u): $1\" 1>&2\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\nlock_create() {\n    local name=$1\n    local data=$2\n    # cibadmin won't overwrite a key if someone else succeeded to create it concurrently\n    cibadmin --sync-call --scope crm_config --create --xml-text \"<cluster_property_set id='${name}'><nvpair id='${name}-pair' name='${name}' value='${data}'/></cluster_property_set>\" &>/dev/null\n    return $?\n}\n\nlock_update() {\n    local name=$1\n    local expected_data=$2\n    local new_data=$3\n    # we only update the lock we expect to see, so we can't update someone else's lock\n    cibadmin --sync-call --scope crm_config --modify --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" --xml-text \"<nvpair id='${name}-pair' name='${name}' value='${new_data}'/>\" &>/dev/null\n    return $?\n}\n\nlock_delete() {\n    local name=$1\n    local expected_data=$2\n    # we only delete the lock we expect to see, so we can't delete someone else's lock\n    cibadmin --sync-call --scope crm_config --delete --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" &>/dev/null\n    return $?\n}\n\nlock_get() {\n    local lockname=$1\n    local res\n    local rc\n    res=$(cibadmin --query --scope crm_config --xpath \"//cluster_property_set/nvpair[@name='$lockname']\" 2>/dev/null)\n    rc=$?\n    if [ $rc -eq 0 ]; then\n        echo \"$res\" | sed -n 's/.*value=\"\\([^\"]*\\)\".*/\\1/p'\n    fi\n    return $rc\n}\n\nlock_owner() {\n    local lock=$1\n    echo \"$lock\" | cut -d':' -f1\n}\n\nlock_has_expired() {\n    local lock=$1\n    local expiry=$(echo \"$lock\" | cut -d':' -f2)\n    local now=$(date +%s)\n    test $now -ge $expiry\n}\n\n\n# Perform a lock action and restart if the CIB has been modified before\n# committing the lock action\ntry_action() {\n    local fun=$1\n    local lock=$2\n    local requester=$3\n    local args=${4:-}\n    local tries=$MAX_RETRIES\n    local rc=1\n    if [ \"$fun\" = \"lock_acquire\" ] || [ \"$fun\" = \"lock_release\" ]; then\n        log \"Try running $fun\"\n    else\n        return 2\n    fi\n    while [ $rc -ne 0 ]; do\n        $fun $lock $requester $args\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Operation $1 succeeded\"\n            return 0\n        elif [ $rc -eq 3 ]; then\n            # rc == 3 -> CIB changed before push\n            if [ $tries -eq 0 ]; then\n                log \"Failed to commit after $MAX_RETRIES retries. Bailing out.\"\n                return 2\n            else\n                log \"Failed to commit. Retrying operation.\"\n                tries=$(($tries - 1))\n            fi\n        elif [ $rc -eq 2 ]; then\n            # rc == 2 -> unrecoverable cib error (e.g. pacemaker down)\n            log \"Unexpected failure. Bailing out\"\n            return $rc\n        else\n            # rc == 1 -> lock error (not owner, lock doesn't exists)\n            return $rc\n        fi\n    done\n}\n\n# The lock mechanism uses cibadmin's atomic creation so cluster-wide\n# state coherency is guaranteed by pacemaker\nlock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc\n    local lock\n    local expiry\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -n \"$lock\" ]; then\n        lock_has_expired $lock\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Lock has expired, now available for being held\"\n        else\n            # lock is still held. check whether we're the owner\n            owner=$(lock_owner $lock)\n            if [ \"$owner\" = \"$requester\" ];then\n                log \"Requester already owns the lock, acquiring attempt will just reconfigure the TTL\"\n            else\n                log \"Lock is held by someone else ($owner)\"\n                return 1\n            fi\n        fi\n    else\n        log \"Lock is not held yet\"\n    fi\n\n    # prepare the lock info\n    expiry=$(($(date +%s) + $ttl))\n\n    if [ -n \"$lock\" ]; then\n        log \"Attempting to update the lock\"\n        lock_update $lockname \"$lock\" \"$requester:$expiry\"\n        rc=$?\n    else\n        log \"Attempting to acquire the lock\"\n        lock_create $lockname \"$requester:$expiry\"\n        rc=$?\n    fi\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' acquired by '$requester', valid until $(date -d @$expiry)\"\n        return 0\n    else\n        log \"CIB changed, lock cannot be acquired\"\n        return 3\n    fi\n}\n\n\n# The lock mechanism uses the CIB's num_updates tag to implement\n# a conditional store. Cluster-wide locking is guaranteed by pacemaker\nlock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n    local lock\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        log \"Lock doesn't exist. Nothing to release\"\n        return 0\n    else\n        log \"Lock exists, check whether we're the owner\"\n        owner=$(lock_owner $lock)\n        if [ \"$owner\" != \"$requester\" ];then\n            log \"Lock is held by someone else ($owner), will not unlock\"\n            return 1\n        fi\n    fi\n\n    lock_delete $lockname \"$lock\"\n    rc=$?\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' released by '$requester'\"\n        return 0\n    else\n        log \"CIB deletion error, lock cannot be released\"\n        return 3\n    fi\n}\n\n\n# Retrieve the owner of a lock from the CIB\n# this is a read-only operation, so no need to log debug info\nlock_get_owner() {\n    local lockname=$1\n    local rc\n    local lock\n    local owner\n\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        return 1\n    else\n        lock_owner $lock\n        return 0\n    fi\n}\n\n\nACTION=$1\nLOCKNAME=$2\nREQUESTER=$3\nTTL=${4:-60}\n\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nif [ $ACTION != \"--help\" ]; then\n    if [ -z \"$LOCKNAME\" ]; then\n        error \"You must specific a lock name\"\n    fi\n    if [ $ACTION != \"--owner\" ] && [ $ACTION != \"-o\" ]; then\n        if [ -z \"$REQUESTER\" ]; then\n            error \"You must specific a lock requester\"\n        fi\n    fi\nfi\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) try_action lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --release|-r) try_action lock_release $LOCKNAME $REQUESTER;;\n    --acquire-once|-A) lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --owner|-o) lock_get_owner $LOCKNAME;;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}, "pacemaker_mutex_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_restart_bundle.sh --lock mysql galera galera-bundle Master _\n# pacemaker_mutex_restart_bundle.sh --lock ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\n\nset -u\n\nusage() {\n    echo \"Restart a clustered resource in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --lock <tripleo-service> <pcmk-resource> <pcmk-bundle> <target-state-local> <target-state-cluster>\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\nACTION=$1\ncase $ACTION in\n    --help) usage; exit 0;;\n    --lock) ;;\n    *) error \"Unknown action '$ACTION'\";;\nesac\n\nTRIPLEO_SERVICE=$2\nLOCK_NAME=${TRIPLEO_SERVICE}-restart-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to restart resource $TRIPLEO_SERVICE\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\nRESOURCE_NAME=$3\nBUNDLE_NAME=$4\nWAIT_TARGET_LOCAL=$5\nWAIT_TARGET_ANYWHERE=${6:-_}\n\nif pacemaker_supports_promoted; then\n    WAIT_TARGET_LOCAL=$(echo \"$5\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    WAIT_TARGET_ANYWHERE=$(echo \"${6:-_}\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    promoted_role=\"Promoted\"\nelse\n    promoted_role=\"Master\"\nfi\n\n# The lock TTL should accomodate for the resource start/promote timeout\nif [ \"$RESOURCE_NAME\" != \"$BUNDLE_NAME\" ]; then\n    if [ \"$WAIT_TARGET_LOCAL\" = \"$promoted_role\" ] || [ \"$WAIT_TARGET_ANYWHERE\" = \"$promoted_role\" ]; then\n        rsc_op=\"promote\"\n    else\n        rsc_op=\"start\"\n    fi\n    # <op id=\"galera-promote-interval-0s\" interval=\"0s\" name=\"promote\" on-fail=\"block\" timeout=\"300s\"/>\n    PCMK_TTL=$(cibadmin -Q | xmllint -xpath \"string(//primitive[@id='${RESOURCE_NAME}']/operations/op[@name='${rsc_op}']/@timeout)\" - | sed 's/s$//')\n    LOCK_TTL=$((PCMK_TTL + 30))\nelse\n    # The podman RA's default start timeout\n    LOCK_TTL=90\nfi\n\nlog \"Acquire a ${LOCK_TTL}s restart lock for service $TRIPLEO_SERVICE before restarting it\"\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nrc=1\nwhile [ $rc -ne 0 ]; do\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire $LOCK_NAME $LOCK_OWNER $LOCK_TTL\n    rc=$?\n    if [ $rc != 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not acquire lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Could not acquire lock, retrying\"\n            sleep 10\n        fi\n    fi\ndone\n\nlog \"Restart the service $TRIPLEO_SERVICE locally\"\n# Reuse the local restart script in t-h-t (driven by env var TRIPLEO_MINOR_UPDATE)\nTRIPLEO_MINOR_UPDATE=true /var/lib/container-config-scripts/pacemaker_restart_bundle.sh $TRIPLEO_SERVICE $RESOURCE_NAME $BUNDLE_NAME $WAIT_TARGET_LOCAL $WAIT_TARGET_ANYWHERE\n\n# If we reached this point, always try to release the lock\nlog \"Release the restart lock for service $TRIPLEO_SERVICE\"\n/var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $LOCK_NAME $LOCK_OWNER\nrc=$?\nif [ $rc -ne 0 ] && [ $rc -ne 1 ]; then\n    error \"Could not release held lock (rc: $rc)\"\nfi\n"}, "pacemaker_mutex_shutdown.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_shutdown.sh --acquire\n# pacemaker_mutex_shutdown.sh --release\n\nset -u\n\nusage() {\n    echo \"Shutdown a cluster node in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --acquire # prevent other node from shutting down until we hold the lock\"\n    echo \"   $0 --release # release the lock, other node can compete for the shutdown lock\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nshutdown_lock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc=1\n    local current_owner\n    local owner_stopped\n    local owner_rc\n\n    log \"Acquiring the shutdown lock\"\n    while [ $rc -ne 0 ]; do\n        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire-once $lockname $requester $ttl\n        rc=$?\n        if [ $rc -ne 0 ]; then\n            if [ $rc -eq 2 ]; then\n                error \"Could not acquire the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n            else\n                # The lock is held by another node.\n                current_owner=$(/var/lib/container-config-scripts/pacemaker_resource_lock.sh --owner $lockname)\n                owner_rc=$?\n                if [ $owner_rc -eq 2 ]; then\n                    error \"Could not get the shutdown lock owner due to unrecoverable error (rc: $owner_rc), bailing out\"\n                fi\n                if [ $owner_rc -eq 0 ]; then\n                    # If the owner is marked as offline, that means it has shutdown and\n                    # we can clean the lock preemptively and try to acquire it.\n                    owner_stopped=$(crm_mon -1X | xmllint --xpath 'count(//nodes/node[@name=\"'${current_owner}'\" and @online=\"false\" and @unclean=\"false\"])' -)\n                    if [ \"${owner_stopped}\" = \"1\" ]; then\n                        log \"Shutdown lock held by stopped node '${current_owner}', lock can be released\"\n                        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $current_owner\n                        continue\n                    fi\n                fi\n                log \"Shutdown lock held by another node (rc: $rc), retrying\"\n                sleep 10\n            fi\n        fi\n    done\n    log \"Shutdown lock acquired\"\n    return 0\n}\n\n\n# Release the lock if we still own it. Not owning it anymore is not fatal\nshutdown_lock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n\n    log \"Releasing the shutdown lock\"\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $requester\n    rc=$?\n    if [ $rc -ne 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not release the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Shutdown lock no longer held, nothing to do\"\n        fi\n    else\n        log \"Shutdown lock released\"\n    fi\n    return 0\n}\n\n\nACTION=$1\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nLOCK_NAME=tripleo-shutdown-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to aquire the shutdown lock\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\n# We start with a very high TTL, that long enough to accomodate a cluster stop.\n# As soon as the node will get offline, the other competing node will be entitled\n# to steal the lock, so they should never wait that long in practice.\nLOCK_TTL=600\n\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) shutdown_lock_acquire ${LOCK_NAME} ${LOCK_OWNER} ${LOCK_TTL};;\n    --release|-r) shutdown_lock_release ${LOCK_NAME} ${LOCK_OWNER};;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-16-mm7wr6xribeg-ContainersCommon-p5hhfln2loy5/251f4be6-bcc8-4b41-9814-c31269cee9d9"}


created_at: 2026-01-21 15:58:38.990638
data:
  {"cinder_nvmeof_volumes": null, "cinder_nvmeof_host_prep_tasks": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-16-mm7wr6xribeg-CinderCommon-hde7powvjoyv-CinderNVMeOF-ik4rg6cqx42c/36684a88-2b15-4b40-97a9-12be8d7e1654"}


created_at: 2026-01-21 15:58:39.041145
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-16-mm7wr6xribeg-CinderCommon-hde7powvjoyv-ContainersCommon-qazrwujzawg3/e16047f7-d36a-4490-ad1d-76e45121f04f"}


created_at: 2026-01-21 15:58:39.050762
data:
  {"cinder_common_kolla_config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-iscsid/*", "dest": "/etc/iscsi/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}], "cinder_backup_host_prep_tasks": [{"name": "create fcontext entry for cinder data", "community.general.sefcontext": {"target": "/var/lib/cinder(/.*)?", "setype": "container_file_t", "state": "present"}}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/log/containers/cinder", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/lib/cinder", "setype": "container_file_t"}]}, {"name": "ensure ceph configurations exist", "file": {"path": "/var/lib/tripleo-config/ceph", "state": "directory"}}], "cinder_backup_environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}, "cinder_common_kolla_permissions": [{"path": "/var/log/cinder", "owner": "cinder:cinder", "recurse": true}, {"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "cinder:cinder", "perm": "0600"}, {"path": "/etc/pki/tls/certs/etcd.crt", "owner": "cinder:cinder"}, {"path": "/etc/pki/tls/private/etcd.key", "owner": "cinder:cinder"}], "cinder_backup_volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro", "/var/log/containers/cinder:/var/log/cinder:z", "/var/lib/kolla/config_files/cinder_backup.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/dev:/dev", "/run:/run", "/sys:/sys", "/lib/modules:/lib/modules:ro", "/var/lib/cinder:/var/lib/cinder:z", "/var/lib/iscsi:/var/lib/iscsi:z"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-16-mm7wr6xribeg-CinderCommon-hde7powvjoyv/87ae7ed1-4e23-4cda-8dcb-1a6d4de9f20d"}


created_at: 2026-01-21 15:58:39.054959
data:
  {"OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-16-mm7wr6xribeg-MySQLClient-cvyz2h6kx66m/282a6855-da17-4d39-a452-7a045de37556"}


created_at: 2026-01-21 15:58:39.142386
data:
  {"healthcheck_rpc_port": {"test": "/openstack/healthcheck 5672"}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-16-mm7wr6xribeg-CinderBackupBase-6su3m5rrertm-ContainersCommon-kiprzqxz3bfb/21bd2e9d-7a54-49ce-9e7f-b78800abc4c6"}


created_at: 2026-01-21 15:58:39.301701
data:
  {"cinder_nvmeof_volumes": null, "cinder_nvmeof_host_prep_tasks": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-16-mm7wr6xribeg-CinderBackupBase-6su3m5rrertm-CinderCommon-hbcpmfyhxz4c-CinderNVMeOF-ahqdkesa4upu/8a8255a7-9ba4-4cc7-8926-f80fd870fddf"}


created_at: 2026-01-21 15:58:39.457657
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-16-mm7wr6xribeg-CinderBackupBase-6su3m5rrertm-CinderCommon-hbcpmfyhxz4c-ContainersCommon-6fbkokjuxhiu/f8dd6da6-3e7e-44ff-a1b0-ca41e773f5f3"}


created_at: 2026-01-21 15:58:39.465054
data:
  {"cinder_common_kolla_config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-iscsid/*", "dest": "/etc/iscsi/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}], "cinder_backup_host_prep_tasks": [{"name": "create fcontext entry for cinder data", "community.general.sefcontext": {"target": "/var/lib/cinder(/.*)?", "setype": "container_file_t", "state": "present"}}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/log/containers/cinder", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/lib/cinder", "setype": "container_file_t"}]}, {"name": "ensure ceph configurations exist", "file": {"path": "/var/lib/tripleo-config/ceph", "state": "directory"}}], "cinder_backup_environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}, "cinder_common_kolla_permissions": [{"path": "/var/log/cinder", "owner": "cinder:cinder", "recurse": true}, {"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "cinder:cinder", "perm": "0600"}, {"path": "/etc/pki/tls/certs/etcd.crt", "owner": "cinder:cinder"}, {"path": "/etc/pki/tls/private/etcd.key", "owner": "cinder:cinder"}], "cinder_backup_volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro", "/var/log/containers/cinder:/var/log/cinder:z", "/var/lib/kolla/config_files/cinder_backup.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/dev:/dev", "/run:/run", "/sys:/sys", "/lib/modules:/lib/modules:ro", "/var/lib/cinder:/var/lib/cinder:z", "/var/lib/iscsi:/var/lib/iscsi:z"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-16-mm7wr6xribeg-CinderBackupBase-6su3m5rrertm-CinderCommon-hbcpmfyhxz4c/c0938c3f-6e05-4cbb-ac8a-1e660309cb4a"}


created_at: 2026-01-21 15:58:39.518118
data:
  {"tuple:('role_data', 'step_config')": "include tripleo::profile::base::database::mysql::client", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-16-mm7wr6xribeg-CinderBackupBase-6su3m5rrertm-MySQLClient-rz62c2c64off/fb5b463e-d2c0-493e-a716-daef6efb8211"}


created_at: 2026-01-21 15:58:39.578552
data:
  {"tuple:('role_data', 'step_config')": null, "tuple:('role_data', 'config_settings')": {"cinder::database_connection": "mysql+pymysql://cinder:q4G6h4a5N51huVgDb7vMEqcRq@172.17.0.2/cinder?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "cinder::logging::debug": true, "cinder::storage_availability_zone": "nova", "cinder::rabbit_heartbeat_timeout_threshold": 60, "cinder::rpc_response_timeout": 60, "cinder::rabbit_heartbeat_in_pthread": false, "cinder::db::database_db_max_retries": -1, "cinder::db::database_max_retries": -1, "cinder::cron::db_purge::minute": "1", "cinder::cron::db_purge::hour": "0", "cinder::cron::db_purge::monthday": "*", "cinder::cron::db_purge::month": "*", "cinder::cron::db_purge::weekday": "*", "cinder::cron::db_purge::user": "cinder", "cinder::cron::db_purge::age": "30", "cinder::cron::db_purge::destination": "/var/log/cinder/cinder-rowsflush.log", "cinder::cron::db_purge::maxdelay": "3600", "cinder::glance::glance_api_servers": "http://172.17.0.2:9293", "cinder::keystone::service_user::send_service_user_token": true, "cinder::keystone::service_user::project_name": "service", "cinder::keystone::service_user::auth_type": "password", "cinder::keystone::service_user::auth_url": "http://172.17.0.2:5000/", "cinder::keystone::service_user::password": "q4G6h4a5N51huVgDb7vMEqcRq", "cinder::keystone::service_user::region_name": "regionOne", "cinder::nova::interface": "admin", "cinder::nova::project_name": "service", "cinder::nova::auth_type": "password", "cinder::nova::auth_url": "http://172.17.0.2:5000/", "cinder::nova::password": "LS8Q05rmlMlHeKHPO1GdkVzQT", "cinder::nova::region_name": "regionOne"}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-16-mm7wr6xribeg-CinderBackupBase-6su3m5rrertm-CinderBase-6ahd6c7f2voz/037f72ec-c3e1-4feb-9fda-16cefa3d0ed5"}


created_at: 2026-01-21 15:58:39.590818
data:
  {"tuple:('role_data', 'puppet_config', 'step_config')": "\ninclude tripleo::profile::base::cinder::backup::ceph\ninclude tripleo::profile::base::database::mysql::client", "tuple:('role_data', 'service_config_settings')": {"rsyslog": {"tripleo_logging_sources_cinder_backup": [{"tag": "openstack.cinder.backup", "file": "/var/log/containers/cinder/cinder-backup.log"}]}}, "tuple:('role_data', 'config_settings')": {"cinder::database_connection": "mysql+pymysql://cinder:q4G6h4a5N51huVgDb7vMEqcRq@172.17.0.2/cinder?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "cinder::logging::debug": true, "cinder::storage_availability_zone": "nova", "cinder::rabbit_heartbeat_timeout_threshold": 60, "cinder::rpc_response_timeout": 60, "cinder::rabbit_heartbeat_in_pthread": false, "cinder::db::database_db_max_retries": -1, "cinder::db::database_max_retries": -1, "cinder::cron::db_purge::minute": "1", "cinder::cron::db_purge::hour": "0", "cinder::cron::db_purge::monthday": "*", "cinder::cron::db_purge::month": "*", "cinder::cron::db_purge::weekday": "*", "cinder::cron::db_purge::user": "cinder", "cinder::cron::db_purge::age": "30", "cinder::cron::db_purge::destination": "/var/log/cinder/cinder-rowsflush.log", "cinder::cron::db_purge::maxdelay": "3600", "cinder::glance::glance_api_servers": "http://172.17.0.2:9293", "cinder::keystone::service_user::send_service_user_token": true, "cinder::keystone::service_user::project_name": "service", "cinder::keystone::service_user::auth_type": "password", "cinder::keystone::service_user::auth_url": "http://172.17.0.2:5000/", "cinder::keystone::service_user::password": "q4G6h4a5N51huVgDb7vMEqcRq", "cinder::keystone::service_user::region_name": "regionOne", "cinder::nova::interface": "admin", "cinder::nova::project_name": "service", "cinder::nova::auth_type": "password", "cinder::nova::auth_url": "http://172.17.0.2:5000/", "cinder::nova::password": "LS8Q05rmlMlHeKHPO1GdkVzQT", "cinder::nova::region_name": "regionOne", "cinder::backup::backup_workers": 1, "cinder::backup::backup_max_operations": 15, "cinder::backup::ceph::backup_ceph_user": "openstack", "cinder::backup::ceph::backup_ceph_pool": "backups", "cinder::backup::ceph::backup_ceph_conf": "/etc/ceph/ceph.conf"}, "tuple:('role_data', 'monitoring_subscription')": "overcloud-cinder-backup", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-16-mm7wr6xribeg-CinderBackupBase-6su3m5rrertm/8dbff82c-d73d-466a-9c0e-8679bc87d3e1"}


created_at: 2026-01-21 15:58:39.605485
data:
  {"tuple:('role_data', 'step_config')": null, "role_data": {"service_name": "cinder_backup", "monitoring_subscription": "overcloud-cinder-backup", "config_settings": {"cinder::database_connection": "mysql+pymysql://cinder:q4G6h4a5N51huVgDb7vMEqcRq@172.17.0.2/cinder?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "cinder::logging::debug": true, "cinder::storage_availability_zone": "nova", "cinder::rabbit_heartbeat_timeout_threshold": 60, "cinder::rpc_response_timeout": 60, "cinder::rabbit_heartbeat_in_pthread": false, "cinder::db::database_db_max_retries": -1, "cinder::db::database_max_retries": -1, "cinder::cron::db_purge::minute": "1", "cinder::cron::db_purge::hour": "0", "cinder::cron::db_purge::monthday": "*", "cinder::cron::db_purge::month": "*", "cinder::cron::db_purge::weekday": "*", "cinder::cron::db_purge::user": "cinder", "cinder::cron::db_purge::age": "30", "cinder::cron::db_purge::destination": "/var/log/cinder/cinder-rowsflush.log", "cinder::cron::db_purge::maxdelay": "3600", "cinder::glance::glance_api_servers": "http://172.17.0.2:9293", "cinder::keystone::service_user::send_service_user_token": true, "cinder::keystone::service_user::project_name": "service", "cinder::keystone::service_user::auth_type": "password", "cinder::keystone::service_user::auth_url": "http://172.17.0.2:5000/", "cinder::keystone::service_user::password": "q4G6h4a5N51huVgDb7vMEqcRq", "cinder::keystone::service_user::region_name": "regionOne", "cinder::nova::interface": "admin", "cinder::nova::project_name": "service", "cinder::nova::auth_type": "password", "cinder::nova::auth_url": "http://172.17.0.2:5000/", "cinder::nova::password": "LS8Q05rmlMlHeKHPO1GdkVzQT", "cinder::nova::region_name": "regionOne", "cinder::backup::backup_workers": 1, "cinder::backup::backup_max_operations": 15, "cinder::backup::ceph::backup_ceph_user": "openstack", "cinder::backup::ceph::backup_ceph_pool": "backups", "cinder::backup::ceph::backup_ceph_conf": "/etc/ceph/ceph.conf", "tripleo::profile::pacemaker::cinder::backup_bundle::cinder_backup_docker_image": "cluster.common.tag/cinder-backup:pcmklatest", "tripleo::profile::pacemaker::cinder::backup_bundle::docker_volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro", "/var/log/containers/cinder:/var/log/cinder:z", "/var/lib/kolla/config_files/cinder_backup.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/dev:/dev", "/run:/run", "/sys:/sys", "/lib/modules:/lib/modules:ro", "/var/lib/cinder:/var/lib/cinder:z", "/var/lib/iscsi:/var/lib/iscsi:z"], "tripleo::profile::pacemaker::cinder::backup_bundle::docker_environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}, "tripleo::profile::pacemaker::cinder::backup_bundle::container_backend": "podman", "tripleo::profile::pacemaker::cinder::backup_bundle::ceph_conf_path": "/var/lib/tripleo-config/ceph", "cinder::backup::manage_service": false, "cinder::backup::enabled": false}, "service_config_settings": {"rsyslog": {"tripleo_logging_sources_cinder_backup": [{"tag": "openstack.cinder.backup", "file": "/var/log/containers/cinder/cinder-backup.log"}]}}, "puppet_config": {"config_volume": "cinder", "puppet_tags": "cinder_config,file,concat,file_line", "step_config": "\ninclude tripleo::profile::base::cinder::backup::ceph\ninclude tripleo::profile::base::database::mysql::client\ninclude tripleo::profile::pacemaker::cinder::backup_bundle", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-api:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/cinder_backup.json": {"command": "/usr/bin/cinder-backup --config-file /usr/share/cinder/cinder-dist.conf --config-file /etc/cinder/cinder.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-iscsid/*", "dest": "/etc/iscsi/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}], "permissions": [{"path": "/var/log/cinder", "owner": "cinder:cinder", "recurse": true}, {"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "cinder:cinder", "perm": "0600"}, {"path": "/etc/pki/tls/certs/etcd.crt", "owner": "cinder:cinder"}, {"path": "/etc/pki/tls/private/etcd.key", "owner": "cinder:cinder"}]}}, "container_config_scripts": {"container_puppet_apply.sh": {"mode": "0700", "content": "#!/bin/bash\nset -eux\nSTEP=$1\nTAGS=$2\nCONFIG=$3\nEXTRA_ARGS=${4:-''}\nif [ -d /tmp/puppet-etc ]; then\n  # ignore copy failures as these may be the same file depending on docker mounts\n  cp -a /tmp/puppet-etc/* /etc/puppet || true\nfi\necho \"{\\\"step\\\": ${STEP}}\" > /etc/puppet/hieradata/docker_puppet.json\n# $::deployment_type in puppet-tripleo\nexport FACTER_deployment_type=containers\nset +e\npuppet apply $EXTRA_ARGS \\\n    --verbose \\\n    --detailed-exitcodes \\\n    --summarize \\\n    --color=false \\\n    --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \\\n    --tags $TAGS \\\n    -e \"noop_resource('package'); ${CONFIG}\"\nrc=$?\nset -e\nset +ux\nif [ $rc -eq 2 -o $rc -eq 0 ]; then\n    exit 0\nfi\nexit $rc\n"}, "pyshim.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n#\n# Usage: pyshim.sh <script and/or arguments>\n#\n# Unfortunately THT doesn't know which version of python might be in a\n# container so we need this script to be able to try python3 or python2\n# depending on availability.  Since this is a temporary shim until we've\n# fully cut over to python3, we check for the existence of python3 first\n# before falling back to python2. This will help in the transition from\n# python2 based containers to python3.\n\nshow_usage() {\n    echo \"Usage: pyshim.sh <script and/or arguments>\"\n}\n\nif [ $# -lt 1 ]\nthen\n    show_usage\n    exit 1\nfi\n\nset -x\nif command -v python3 >/dev/null; then\n    python3 \"$@\"\nelif command -v python2 >/dev/null; then\n    python2 \"$@\"\nelif command -v python >/dev/null; then\n    python \"$@\"\nelse\n    echo \"ERROR: python is not available!\"\n    exit 1\nfi\n"}, "pacemaker_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nset -u\n\n# ./pacemaker_restart_bundle.sh mysql galera galera-bundle Master _\n# ./pacemaker_restart_bundle.sh redis redis redis-bundle Slave Master\n# ./pacemaker_restart_bundle.sh ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\nRESTART_SCRIPTS_DIR=$(dirname $0)\nTRIPLEO_SERVICE=$1\nRESOURCE_NAME=$2\nBUNDLE_NAME=$3\nWAIT_TARGET_LOCAL=$4\nWAIT_TARGET_ANYWHERE=${5:-_}\nTRIPLEO_MINOR_UPDATE=\"${TRIPLEO_MINOR_UPDATE:-false}\"\nTRIPLEO_HA_WRAPPER_RESOURCE_EXISTS=\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS:-false}\"\n\nbundle_can_be_restarted() {\n    local bundle=$1\n    # As long as the resource bundle is managed by pacemaker and is\n    # not meant to stay stopped, no matter the state of any inner\n    # pcmk_remote or ocf resource, we should restart it to give it a\n    # chance to read the new config.\n    [ \"$(crm_resource --meta -r $1 -g is-managed 2>/dev/null)\" != \"false\" ] && \\\n    [ \"$(crm_resource --meta -r $1 -g target-role 2>/dev/null)\" != \"Stopped\" ]\n}\n\nlog() {\n    local msg=$1\n    logger -t pcmkrestart \"$1\"\n}\n\nHOSTNAME=$(/bin/hostname -s)\nif [ x\"${TRIPLEO_MINOR_UPDATE,,}\" != x\"true\" ]; then\n    if [ x\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS,,}\" = x\"false\" ]; then\n        # Do not restart during initial deployment, as the resource\n        # has just been created.\n        SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n        if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n            log \"Initial deployment, skipping the restart of ${BUNDLE_NAME}\"\n\tfi\n        exit 0\n    else\n        # During a stack update, this script is called in parallel on\n        # every node the resource runs on, after the service's configs\n        # have been updated on all nodes. So we need to run pcs only\n        # once (e.g. on the service's boostrap node).\n        if bundle_can_be_restarted ${BUNDLE_NAME}; then\n            SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n            if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n                replicas_running=$(crm_resource -Q -r $BUNDLE_NAME --locate 2>&1 | wc -l)\n                if [ \"$replicas_running\" != \"0\" ]; then\n                    log \"Restarting ${BUNDLE_NAME} globally. Stopping:\"\n                    /sbin/pcs resource disable --wait=600 $BUNDLE_NAME\n                    log \"Restarting ${BUNDLE_NAME} globally. Starting:\"\n                    /sbin/pcs resource enable --wait=600 $BUNDLE_NAME\n                else\n                    log \"${BUNDLE_NAME} is not running anywhere,\" \\\n                         \"cleaning up to restart it globally if necessary\"\n                    /sbin/pcs resource cleanup $BUNDLE_NAME\n                fi\n            else\n                log \"Skipping global restart of ${BUNDLE_NAME} on ${HOSTNAME} it will be restarted by node ${SERVICE_NODEID}\"\n            fi\n\n        else\n            log \"No global restart needed for ${BUNDLE_NAME}.\"\n        fi\n    fi\nelse\n    # During a minor update workflow however, a host gets fully\n    # updated before updating the next one. So unlike stack\n    # update, at the time this script is called, the service's\n    # configs aren't updated on all nodes yet. So only restart the\n    # resource locally, where it's guaranteed that the config is\n    # up to date.\n    HOST=$(facter hostname)\n\n    if bundle_can_be_restarted ${BUNDLE_NAME}; then\n\t# if the resource is running locally, restart it\n\tif crm_resource -r $BUNDLE_NAME --locate 2>&1 | grep -w -q \"${HOST}\"; then\n            log \"Restarting ${BUNDLE_NAME} locally on '${HOST}'\"\n            /sbin/pcs resource restart $BUNDLE_NAME \"${HOST}\"\n\n\telse\n\t    # At this point, if no resource is running locally, it's\n\t    # either because a) it has failed previously, or b) because\n\t    # it's an A/P resource running elsewhere.\n\t    # By cleaning up resource, we ensure that a) it will try to\n\t    # restart, or b) it won't do anything if the resource is\n\t    # already running elsewhere.\n            log \"${BUNDLE_NAME} is currently not running on '${HOST}',\" \\\n                 \"cleaning up its state to restart it if necessary\"\n            /sbin/pcs resource cleanup $BUNDLE_NAME node=\"${HOST}\"\n\tfi\n\n\t# Wait until the resource is in the expected target state\n\t$RESTART_SCRIPTS_DIR/pacemaker_wait_bundle.sh \\\n            $RESOURCE_NAME $BUNDLE_NAME \\\n            \"$WAIT_TARGET_LOCAL\" \"$WAIT_TARGET_ANYWHERE\" \\\n\t    \"${HOST}\" 600\n    else\n        log \"No restart needed for ${BUNDLE_NAME}.\"\n    fi\nfi\n"}, "pacemaker_wait_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# ----\n# Wait for an OCF resource or a bundle to be restarted\n# ----\n# e.g.:\n# M/S OCF:      $0 galera galera-bundle Master\n# clone OCF:    $0 rabbitmq rabbitmq-bundle Started\n# A/P M/S OCF:  $0 redis redis-bundle Slave Master\n# A/P bundle:   $0 openstack-cinder-volume openstack-cinder-volume _ Started\n# clone bundle: $0 haproxy-bundle haproxy-bundle Started\n\n# design note 1:\n#  - this script is called during a minor update; it is called\n#    once per node that hosts a service replica.\n#  - the purpose of this script is to ensure that restarting the\n#    service replica locally won't disrupt the service availability\n#    for the end user. To reach that goal, the script waits until the\n#    service is restarted locally or globallu and reaches a given\n#    target state (i.e. Started, Slave or Master).\n# design note 2:\n#   - we don't want to track restart error: our only job is to ensure\n#     service restart synchronization, not service health.\n#   - In particular, we don't want to error out in case the resource\n#     cannot be restarted locally, because that would make the minor\n#     update fail, even if potentially other replicas still provide\n#     the service.\n# design note 3:\n#   - we can bail out early if we determine that the resource can't\n#     be restarted automatically by pacemaker (e.g. its \"blocked\",\n#     unmanaged or disabled).\n\nlog() {\n    local msg=$1\n    echo \"$(date -u): $1\"\n}\n\nusage() {\n    echo 2>&1 \"Usage: $0 NAME BUNDLE_NAME ROLE_LOCAL [ROLE_ANYWHERE] [HOST] [TIMEOUT]\"\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\n#\n# Utility functions to detect stuck resources\n#\n\nbundle_failures_locally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local replica_name\n    for i in $(seq 0 $last); do\n\treplica_name=${BUNDLE_NAME}-${engine}-${i}\n\tcrm_failcount -q -G -r $replica_name -N $HOST\n    done\n}\n\nbundle_failures_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    for i in $(seq 0 $last); do\n\tcrm_failcount -q -G -r ${BUNDLE_NAME}-${engine}-${i}\n    done\n}\n\nbundle_running_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    # return the number of running bundles replica, i.e. the number of\n    # docker/podman resource replicas currently running in the cluster\n    crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:heartbeat:${engine}']/node)\" -\n}\n\nocf_failures_globally() {\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local bundle_node\n    for i in $(seq 0 $last); do\n\tbundle_node=${BUNDLE_NAME}-${i}\n\tcrm_failcount -q -G -r $NAME -N $bundle_node\n    done\n}\n\ndid_resource_failed_locally() {\n    local failures\n    local running\n    local remotehost\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# if we're dealing with an ocf resource, it is running on a\n\t# pacemaker_remote rather that on the real host, and the\n\t# failcounts are thus associated to the pcmk remote. Replace\n\t# the host's name with the pcmk remote's name.\n        remotehost=$(crm_mon --as-xml | xmllint --xpath \"string(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource/node[@name='${HOST}']/../../resource[@resource_agent='${OCF}:pacemaker:remote']/@id)\" -)\n\tif [ -n \"${remotehost}\" ]; then\n\t    crm_failcount -q -G -r $NAME -N $remotehost | grep -q -w INFINITY\n\t    return $?\n\tfi\n\t# If no pcmk remote is currently running, the failcount from\n\t# the ocf resource is useless, compute the failcount from the\n\t# bundle case instead (computed below).\n    fi\n\n    # for bundles, pacemaker can run any bundle replica locally\n    # (e.g. galera-bundle-docker-{0,1,2}), and a failure happens when\n    # there are no more replica to try.\n    # That is, when _at least_ one replica failed locally, and all the\n    # others either failed or are currently running elsewhere.\n    failures=$(bundle_failures_locally $HOST | grep -c -w INFINITY)\n    running=$(bundle_running_globally)\n    test $failures -gt 0 && \\\n    test $(( $failures + $running )) -ge $BUNDLE_REPLICAS\n}\n\ndid_resource_failed_globally() {\n    local remotecount\n    local failures\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# we check the state of an ocf resource only if the\n\t# pcmkremotes are started\n        remotecount=$(crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node)\" -)\n\tif [ \"${remotecount}\" = \"0\" ]; then\n\t    # no pcmkremote is running, so check the bundle state\n\t    # instead of checking the ocf resource\n\t    # bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\t    failures=$(bundle_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\telse\n\t    # ocf resource failed if it failed to start on\n\t    # all $BUNDLE_REPLICAS bundle nodes\n\t    failures=$(ocf_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\tfi\n    else\n\t# bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\tfailures=$(bundle_failures_globally | grep -c -w INFINITY)\n\ttest $failures -eq $BUNDLE_REPLICAS\n    fi\n}\n\n\n# Input validation\n#\n\nNAME=$1\nif [ -z \"${NAME}\" ]; then\n    echo 2>&1 \"Error: argument NAME must not be empty\"\n    exit 1\nfi\n\nBUNDLE_NAME=$2\nif [ -z \"${BUNDLE_NAME}\" ]; then\n    echo 2>&1 \"Error: argument BUNDLE_NAME must not be empty\"\n    exit 1\nfi\n\nROLE_LOCAL=$3\nif [ \"${ROLE_LOCAL}\" = \"_\" ]; then\n    ROLE_LOCAL=\"\"\nfi\n\nROLE_ANYWHERE=$4\nif [ \"${ROLE_ANYWHERE}\" = \"_\" ]; then\n    ROLE_ANYWHERE=\"\"\nfi\n\nif [ -z \"${ROLE_LOCAL}\" ]; then\n    if [ -z \"${ROLE_ANYWHERE}\" ]; then\n        echo 2>&1 \"Error: either ROLE_LOCAL or ROLE_ANYWHERE must be non empty\"\n        exit 1\n    fi\nelse\n    if !(echo \"${ROLE_LOCAL}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n        echo 2>&1 \"Error: argument ROLE_LOCAL must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n        exit 1\n    fi\nfi\n\nif [ -n \"${ROLE_ANYWHERE}\" ] && !(echo \"${ROLE_ANYWHERE}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n    echo 2>&1 \"Error: argument ROLE_ANYWHERE must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n    exit 1\nfi\n\n# Ensure compatibility with pacemaker 2.1\nif pacemaker_supports_promoted; then\n    ROLE_LOCAL=$(echo \"$ROLE_LOCAL\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    ROLE_ANYWHERE=$(echo \"$ROLE_ANYWHERE\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    OCF=\"ocf\"\nelse\n    OCF=\"ocf:\"\nfi\n\nHOST=${5:-$(facter hostname)}\nTIMEOUT=${6:-600}\n\n\n# Configure the search\n# ----\n# Note: we can't use crm_resource in all searches because we can't\n# easily extract the host the OCF resources run on (crm_resource\n# returns the pcmk-remote nodes rather than the hosts)\n# So instead, we implement various searches with XPath directly.\n\nif [ \"${BUNDLE_NAME}\" != \"${NAME}\" ]; then\n# ocf resource\nlocal_resource_xpath=\"//bundle/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node[@name='${HOST}']/../../resource[@id='${NAME}']\"\nany_resource_xpath=\"//bundle//resource[@id='${NAME}']\"\nreplicas_xpath=\"//bundle/primitive[@id='${BUNDLE_NAME}']/../*[boolean(@image) and boolean(@replicas)]\"\nelse\n# bundle resource\nlocal_resource_xpath=\"//bundle[@id='${NAME}']/replica/resource/node[@name='${HOST}']/../../resource\"\nany_resource_xpath=\"//bundle[@id='${NAME}']//resource\"\nreplicas_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nfi\n\nbundle_def_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nBUNDLE_CONTAINER_ENGINE=$(cibadmin -Q | xmllint --xpath \"name(${bundle_def_xpath})\" -)\nBUNDLE_REPLICAS=$(cibadmin -Q | xmllint --xpath \"string(${bundle_def_xpath}/@replicas)\" -)\n\n\n# The wait algorithm follows a two-stage approach\n#  1. Depending on how the script is called, we first check whether\n#     the resource is restarted locally. An A/P resource may be\n#     restarted elsewhere in the cluster.\n#  2. If needed, check whether the A/P resource has restarted\n#     elsewhere. For A/P M/S resources, in case the resource is\n#     restarted as Slave locally, ensure a Master is available.\n\nsuccess=1\nbailout=1\ntimeout=$TIMEOUT\nrole=\"\"\n\n# Stage 1: local check\nif [ -n \"$ROLE_LOCAL\" ]; then\n    log \"Waiting until ${NAME} has restarted on ${HOST} and is in state ${ROLE_LOCAL}\"\n    log \"Will probe resource state with the following XPath pattern: ${local_resource_xpath}\"\n\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resource=$(crm_mon -r --as-xml | xmllint --xpath \"${local_resource_xpath}\" - 2>/dev/null)\n        role=$(echo \"${resource}\" | sed -ne 's/.*\\Wrole=\"\\([^\"]*\\)\".*/\\1/p')\n\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resource}\" | grep -q -w \"\\Wblocked=\\\"true\\\"\"; then\n            log \"${NAME} is blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_locally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif [ \"$role\" = \"$ROLE_LOCAL\" ]; then\n            success=0\n            continue\n        elif [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" = \"$ROLE_ANYWHERE\" ]; then\n            # A/P: we are restarted in the expected state\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_LOCAL} on ${HOST}\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\n# Stage 2: global check\nif [ $timeout -gt 0 ] && [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" != \"$ROLE_ANYWHERE\" ]; then\n    log \"Wait until ${NAME} is restarted anywhere in the cluster in state ${ROLE_ANYWHERE}\"\n    log \"Will probe resource state with the following XPath pattern: ${any_resource_xpath}\"\n\n    success=1\n    bailout=1\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resources=$(crm_mon -r --as-xml | xmllint --xpath \"${any_resource_xpath}\" - 2>/dev/null)\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif ! (echo \"${resources}\" | grep -q -w \"\\Wblocked=\\\"false\\\"\"); then\n            log \"${NAME} blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_globally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resources}\" | grep -q -w \"\\Wrole=\\\"${ROLE_ANYWHERE}\\\"\"; then\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_ANYWHERE} anywhere in the cluster\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\nif [ $timeout -le 0 ]; then\n    log \"Timeout reached after ${TIMEOUT}s while waiting for ${NAME} to be restarted\"\nelif [ $bailout -le 0 ]; then\n    log \"Restart monitoring for ${NAME} cancelled\"\nfi\n\nif [ $success -eq 0 ]; then\n    log \"${NAME} successfully restarted\"\nelse\n    log \"${NAME} was not restarted properly\"\nfi\n\n# Don't block minor update or stack update if the wait was unsuccessful\nexit 0\n"}, "wait-port-and-run.sh": {"mode": "0755", "content": "#!/usr/bin/bash\nset -eu\n\nHOST=$1\nPORT=$2\n\necho \"$(date -u): Checking whether we can bind to ${HOST}:${PORT}\"\nwhile (ss -Htnl src \"${HOST}\" \"sport = :${PORT}\" | grep -wq \"${PORT}\"); do\n    echo \"$(date -u): ${HOST}:${PORT} still in use, waiting...\";\n    sleep 10;\ndone\n\nshift 2\nCOMMAND=\"$*\"\nif [ -z \"${COMMAND}\" ]; then\n    COMMAND=\"true\"\nfi\nexec $COMMAND\n"}, "pacemaker_resource_lock.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nMAX_RETRIES=10\nCIB_ENOTFOUND=105\n\nusage() {\n   echo \"Set a global property in the cluster with a validity timestamp.\"\n   echo \"Usage:\"\n   echo \"   $0 --acquire <lock_name> <lock_owner> <lock_ttl_in_seconds>\"\n   echo \"   $0 --release <lock_name> <lock_owner>\"\n   echo\n}\n\nlog() {\n    echo \"$(date -u): $1\" 1>&2\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\nlock_create() {\n    local name=$1\n    local data=$2\n    # cibadmin won't overwrite a key if someone else succeeded to create it concurrently\n    cibadmin --sync-call --scope crm_config --create --xml-text \"<cluster_property_set id='${name}'><nvpair id='${name}-pair' name='${name}' value='${data}'/></cluster_property_set>\" &>/dev/null\n    return $?\n}\n\nlock_update() {\n    local name=$1\n    local expected_data=$2\n    local new_data=$3\n    # we only update the lock we expect to see, so we can't update someone else's lock\n    cibadmin --sync-call --scope crm_config --modify --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" --xml-text \"<nvpair id='${name}-pair' name='${name}' value='${new_data}'/>\" &>/dev/null\n    return $?\n}\n\nlock_delete() {\n    local name=$1\n    local expected_data=$2\n    # we only delete the lock we expect to see, so we can't delete someone else's lock\n    cibadmin --sync-call --scope crm_config --delete --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" &>/dev/null\n    return $?\n}\n\nlock_get() {\n    local lockname=$1\n    local res\n    local rc\n    res=$(cibadmin --query --scope crm_config --xpath \"//cluster_property_set/nvpair[@name='$lockname']\" 2>/dev/null)\n    rc=$?\n    if [ $rc -eq 0 ]; then\n        echo \"$res\" | sed -n 's/.*value=\"\\([^\"]*\\)\".*/\\1/p'\n    fi\n    return $rc\n}\n\nlock_owner() {\n    local lock=$1\n    echo \"$lock\" | cut -d':' -f1\n}\n\nlock_has_expired() {\n    local lock=$1\n    local expiry=$(echo \"$lock\" | cut -d':' -f2)\n    local now=$(date +%s)\n    test $now -ge $expiry\n}\n\n\n# Perform a lock action and restart if the CIB has been modified before\n# committing the lock action\ntry_action() {\n    local fun=$1\n    local lock=$2\n    local requester=$3\n    local args=${4:-}\n    local tries=$MAX_RETRIES\n    local rc=1\n    if [ \"$fun\" = \"lock_acquire\" ] || [ \"$fun\" = \"lock_release\" ]; then\n        log \"Try running $fun\"\n    else\n        return 2\n    fi\n    while [ $rc -ne 0 ]; do\n        $fun $lock $requester $args\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Operation $1 succeeded\"\n            return 0\n        elif [ $rc -eq 3 ]; then\n            # rc == 3 -> CIB changed before push\n            if [ $tries -eq 0 ]; then\n                log \"Failed to commit after $MAX_RETRIES retries. Bailing out.\"\n                return 2\n            else\n                log \"Failed to commit. Retrying operation.\"\n                tries=$(($tries - 1))\n            fi\n        elif [ $rc -eq 2 ]; then\n            # rc == 2 -> unrecoverable cib error (e.g. pacemaker down)\n            log \"Unexpected failure. Bailing out\"\n            return $rc\n        else\n            # rc == 1 -> lock error (not owner, lock doesn't exists)\n            return $rc\n        fi\n    done\n}\n\n# The lock mechanism uses cibadmin's atomic creation so cluster-wide\n# state coherency is guaranteed by pacemaker\nlock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc\n    local lock\n    local expiry\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -n \"$lock\" ]; then\n        lock_has_expired $lock\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Lock has expired, now available for being held\"\n        else\n            # lock is still held. check whether we're the owner\n            owner=$(lock_owner $lock)\n            if [ \"$owner\" = \"$requester\" ];then\n                log \"Requester already owns the lock, acquiring attempt will just reconfigure the TTL\"\n            else\n                log \"Lock is held by someone else ($owner)\"\n                return 1\n            fi\n        fi\n    else\n        log \"Lock is not held yet\"\n    fi\n\n    # prepare the lock info\n    expiry=$(($(date +%s) + $ttl))\n\n    if [ -n \"$lock\" ]; then\n        log \"Attempting to update the lock\"\n        lock_update $lockname \"$lock\" \"$requester:$expiry\"\n        rc=$?\n    else\n        log \"Attempting to acquire the lock\"\n        lock_create $lockname \"$requester:$expiry\"\n        rc=$?\n    fi\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' acquired by '$requester', valid until $(date -d @$expiry)\"\n        return 0\n    else\n        log \"CIB changed, lock cannot be acquired\"\n        return 3\n    fi\n}\n\n\n# The lock mechanism uses the CIB's num_updates tag to implement\n# a conditional store. Cluster-wide locking is guaranteed by pacemaker\nlock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n    local lock\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        log \"Lock doesn't exist. Nothing to release\"\n        return 0\n    else\n        log \"Lock exists, check whether we're the owner\"\n        owner=$(lock_owner $lock)\n        if [ \"$owner\" != \"$requester\" ];then\n            log \"Lock is held by someone else ($owner), will not unlock\"\n            return 1\n        fi\n    fi\n\n    lock_delete $lockname \"$lock\"\n    rc=$?\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' released by '$requester'\"\n        return 0\n    else\n        log \"CIB deletion error, lock cannot be released\"\n        return 3\n    fi\n}\n\n\n# Retrieve the owner of a lock from the CIB\n# this is a read-only operation, so no need to log debug info\nlock_get_owner() {\n    local lockname=$1\n    local rc\n    local lock\n    local owner\n\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        return 1\n    else\n        lock_owner $lock\n        return 0\n    fi\n}\n\n\nACTION=$1\nLOCKNAME=$2\nREQUESTER=$3\nTTL=${4:-60}\n\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nif [ $ACTION != \"--help\" ]; then\n    if [ -z \"$LOCKNAME\" ]; then\n        error \"You must specific a lock name\"\n    fi\n    if [ $ACTION != \"--owner\" ] && [ $ACTION != \"-o\" ]; then\n        if [ -z \"$REQUESTER\" ]; then\n            error \"You must specific a lock requester\"\n        fi\n    fi\nfi\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) try_action lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --release|-r) try_action lock_release $LOCKNAME $REQUESTER;;\n    --acquire-once|-A) lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --owner|-o) lock_get_owner $LOCKNAME;;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}, "pacemaker_mutex_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_restart_bundle.sh --lock mysql galera galera-bundle Master _\n# pacemaker_mutex_restart_bundle.sh --lock ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\n\nset -u\n\nusage() {\n    echo \"Restart a clustered resource in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --lock <tripleo-service> <pcmk-resource> <pcmk-bundle> <target-state-local> <target-state-cluster>\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\nACTION=$1\ncase $ACTION in\n    --help) usage; exit 0;;\n    --lock) ;;\n    *) error \"Unknown action '$ACTION'\";;\nesac\n\nTRIPLEO_SERVICE=$2\nLOCK_NAME=${TRIPLEO_SERVICE}-restart-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to restart resource $TRIPLEO_SERVICE\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\nRESOURCE_NAME=$3\nBUNDLE_NAME=$4\nWAIT_TARGET_LOCAL=$5\nWAIT_TARGET_ANYWHERE=${6:-_}\n\nif pacemaker_supports_promoted; then\n    WAIT_TARGET_LOCAL=$(echo \"$5\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    WAIT_TARGET_ANYWHERE=$(echo \"${6:-_}\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    promoted_role=\"Promoted\"\nelse\n    promoted_role=\"Master\"\nfi\n\n# The lock TTL should accomodate for the resource start/promote timeout\nif [ \"$RESOURCE_NAME\" != \"$BUNDLE_NAME\" ]; then\n    if [ \"$WAIT_TARGET_LOCAL\" = \"$promoted_role\" ] || [ \"$WAIT_TARGET_ANYWHERE\" = \"$promoted_role\" ]; then\n        rsc_op=\"promote\"\n    else\n        rsc_op=\"start\"\n    fi\n    # <op id=\"galera-promote-interval-0s\" interval=\"0s\" name=\"promote\" on-fail=\"block\" timeout=\"300s\"/>\n    PCMK_TTL=$(cibadmin -Q | xmllint -xpath \"string(//primitive[@id='${RESOURCE_NAME}']/operations/op[@name='${rsc_op}']/@timeout)\" - | sed 's/s$//')\n    LOCK_TTL=$((PCMK_TTL + 30))\nelse\n    # The podman RA's default start timeout\n    LOCK_TTL=90\nfi\n\nlog \"Acquire a ${LOCK_TTL}s restart lock for service $TRIPLEO_SERVICE before restarting it\"\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nrc=1\nwhile [ $rc -ne 0 ]; do\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire $LOCK_NAME $LOCK_OWNER $LOCK_TTL\n    rc=$?\n    if [ $rc != 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not acquire lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Could not acquire lock, retrying\"\n            sleep 10\n        fi\n    fi\ndone\n\nlog \"Restart the service $TRIPLEO_SERVICE locally\"\n# Reuse the local restart script in t-h-t (driven by env var TRIPLEO_MINOR_UPDATE)\nTRIPLEO_MINOR_UPDATE=true /var/lib/container-config-scripts/pacemaker_restart_bundle.sh $TRIPLEO_SERVICE $RESOURCE_NAME $BUNDLE_NAME $WAIT_TARGET_LOCAL $WAIT_TARGET_ANYWHERE\n\n# If we reached this point, always try to release the lock\nlog \"Release the restart lock for service $TRIPLEO_SERVICE\"\n/var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $LOCK_NAME $LOCK_OWNER\nrc=$?\nif [ $rc -ne 0 ] && [ $rc -ne 1 ]; then\n    error \"Could not release held lock (rc: $rc)\"\nfi\n"}, "pacemaker_mutex_shutdown.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_shutdown.sh --acquire\n# pacemaker_mutex_shutdown.sh --release\n\nset -u\n\nusage() {\n    echo \"Shutdown a cluster node in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --acquire # prevent other node from shutting down until we hold the lock\"\n    echo \"   $0 --release # release the lock, other node can compete for the shutdown lock\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nshutdown_lock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc=1\n    local current_owner\n    local owner_stopped\n    local owner_rc\n\n    log \"Acquiring the shutdown lock\"\n    while [ $rc -ne 0 ]; do\n        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire-once $lockname $requester $ttl\n        rc=$?\n        if [ $rc -ne 0 ]; then\n            if [ $rc -eq 2 ]; then\n                error \"Could not acquire the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n            else\n                # The lock is held by another node.\n                current_owner=$(/var/lib/container-config-scripts/pacemaker_resource_lock.sh --owner $lockname)\n                owner_rc=$?\n                if [ $owner_rc -eq 2 ]; then\n                    error \"Could not get the shutdown lock owner due to unrecoverable error (rc: $owner_rc), bailing out\"\n                fi\n                if [ $owner_rc -eq 0 ]; then\n                    # If the owner is marked as offline, that means it has shutdown and\n                    # we can clean the lock preemptively and try to acquire it.\n                    owner_stopped=$(crm_mon -1X | xmllint --xpath 'count(//nodes/node[@name=\"'${current_owner}'\" and @online=\"false\" and @unclean=\"false\"])' -)\n                    if [ \"${owner_stopped}\" = \"1\" ]; then\n                        log \"Shutdown lock held by stopped node '${current_owner}', lock can be released\"\n                        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $current_owner\n                        continue\n                    fi\n                fi\n                log \"Shutdown lock held by another node (rc: $rc), retrying\"\n                sleep 10\n            fi\n        fi\n    done\n    log \"Shutdown lock acquired\"\n    return 0\n}\n\n\n# Release the lock if we still own it. Not owning it anymore is not fatal\nshutdown_lock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n\n    log \"Releasing the shutdown lock\"\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $requester\n    rc=$?\n    if [ $rc -ne 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not release the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Shutdown lock no longer held, nothing to do\"\n        fi\n    else\n        log \"Shutdown lock released\"\n    fi\n    return 0\n}\n\n\nACTION=$1\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nLOCK_NAME=tripleo-shutdown-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to aquire the shutdown lock\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\n# We start with a very high TTL, that long enough to accomodate a cluster stop.\n# As soon as the node will get offline, the other competing node will be entitled\n# to steal the lock, so they should never wait that long in practice.\nLOCK_TTL=600\n\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) shutdown_lock_acquire ${LOCK_NAME} ${LOCK_OWNER} ${LOCK_TTL};;\n    --release|-r) shutdown_lock_release ${LOCK_NAME} ${LOCK_OWNER};;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}}, "docker_config": {"step_3": {"cinder_backup_init_logs": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-backup:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/cinder:/var/log/cinder:z"], "command": ["/bin/bash", "-c", "chown -R cinder:cinder /var/log/cinder"]}}}, "host_prep_tasks": [{"name": "create fcontext entry for cinder data", "community.general.sefcontext": {"target": "/var/lib/cinder(/.*)?", "setype": "container_file_t", "state": "present"}}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/log/containers/cinder", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/lib/cinder", "setype": "container_file_t"}]}, {"name": "ensure ceph configurations exist", "file": {"path": "/var/lib/tripleo-config/ceph", "state": "directory"}}], "deploy_steps_tasks": [{"name": "Cinder Backup tag container image for pacemaker", "when": "step|int == 1", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-backup:17.1", "container_image_latest": "cluster.common.tag/cinder-backup:pcmklatest"}}, {"name": "Cinder Backup HA Wrappers Step", "when": "step|int == 5", "block": [{"name": "Cinder backup puppet bundle", "import_role": {"name": "tripleo_ha_wrapper"}, "vars": {"tripleo_ha_wrapper_service_name": "cinder_backup", "tripleo_ha_wrapper_resource_name": "openstack-cinder-backup", "tripleo_ha_wrapper_bundle_name": "openstack-cinder-backup", "tripleo_ha_wrapper_resource_state": "_ Started", "tripleo_ha_wrapper_puppet_config_volume": "cinder", "tripleo_ha_wrapper_puppet_execute": "include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::cinder::backup_bundle", "tripleo_ha_wrapper_puppet_tags": "pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation", "tripleo_ha_wrapper_puppet_debug": false, "tripleo_ha_wrapper_config_suffix": ".cinder_backup_previous_run"}}]}], "external_update_tasks": [{"when": "step|int == 1", "tags": "ha_image_update", "block": [{"block": [{"name": "Get cinder_backup image from pacemaker", "become": true, "register": "xmllint_pcmk_cinder_backup_image", "shell": "xmllint --xpath \"string(//bundle[@id='openstack-cinder-backup']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container cinder_backup image", "set_fact": {"cinder_backup_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-backup:17.1", "cinder_backup_image_latest": "cluster.common.tag/cinder-backup:pcmklatest", "pcmk_cinder_backup_image": "{{xmllint_pcmk_cinder_backup_image.stdout}}"}}], "delegate_to": "{{ (groups[\"cinder_backup\"] | difference(groups[\"excluded_overcloud\"]))[0] }}"}, {"name": "cinder-backup temporary pacemaker container tag in case of image switch", "become": true, "import_role": {"name": "tripleo_ha_image_update"}, "vars": {"tripleo_ha_image_update_node_names": "{{ groups[\"cinder_backup\"] | difference(groups[\"excluded_overcloud\"]) }}", "tripleo_ha_image_update_bundle": "openstack-cinder-backup", "tripleo_ha_image_update_new_image": "{{cinder_backup_image_latest}}", "tripleo_ha_image_update_old_image": "{{pcmk_cinder_backup_image}}"}, "when": ["(pcmk_cinder_backup_image != \"\")", "(pcmk_cinder_backup_image != cinder_backup_image_latest)"]}]}], "update_tasks": [{"block": [{"name": "Get cinder_backup image from pacemaker", "become": true, "register": "xmllint_pcmk_cinder_backup_image", "shell": "xmllint --xpath \"string(//bundle[@id='openstack-cinder-backup']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container cinder_backup image", "set_fact": {"cinder_backup_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-backup:17.1", "cinder_backup_image_latest": "cluster.common.tag/cinder-backup:pcmklatest", "pcmk_cinder_backup_image": "{{xmllint_pcmk_cinder_backup_image.stdout}}"}}], "when": "(step|int == 0 or step|int == 2)"}, {"name": "Check for update of cinder-backup container image name", "when": "step|int == 0", "assert": {"that": "pcmk_cinder_backup_image == cinder_backup_image_latest", "fail_msg": "cinder-backup image change detected, run overcloud external-update --tags ha_image_update first"}}, {"name": "Tear-down non-HA cinder-backup container", "when": ["step|int == 1"], "block": [{"name": "Remove non-HA cinder-backup container", "include_role": {"name": "tripleo_container_rm"}, "vars": {"tripleo_container_cli": "{{ container_cli }}", "tripleo_containers_to_rm": ["cinder_backup"]}}]}, {"name": "cinder_backup fetch and retag container image for pacemaker", "when": "step|int == 2", "block": [{"name": "Retag pcmklatest to latest cinder_backup image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{cinder_backup_image}}", "container_image_latest": "{{cinder_backup_image_latest}}"}}]}], "post_update_tasks": [{"name": "Cinder backup bundle post update", "when": "step|int == 1", "block": [{"name": "Cinder backup puppet bundle", "import_role": {"name": "tripleo_ha_wrapper"}, "vars": {"tripleo_ha_wrapper_service_name": "cinder_backup", "tripleo_ha_wrapper_resource_name": "openstack-cinder-backup", "tripleo_ha_wrapper_bundle_name": "openstack-cinder-backup", "tripleo_ha_wrapper_resource_state": "_ Started", "tripleo_ha_wrapper_puppet_config_volume": "cinder", "tripleo_ha_wrapper_puppet_execute": "include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::cinder::backup_bundle", "tripleo_ha_wrapper_puppet_tags": "pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation", "tripleo_ha_wrapper_puppet_debug": false, "tripleo_ha_wrapper_config_suffix": ".cinder_backup_previous_run"}}], "vars": {"tripleo_ha_wrapper_minor_update": true}}], "upgrade_tasks": [{"name": "Tear-down non-HA cinder_backup container", "when": ["step|int == 0"], "block": [{"name": "Remove non-HA cinder-backup container", "include_role": {"name": "tripleo_container_rm"}, "vars": {"tripleo_container_cli": "{{ container_cli }}", "tripleo_containers_to_rm": ["cinder_backup"]}}]}, {"name": "Prepare switch of cinder_backup image name", "when": ["step|int == 0"], "block": [{"name": "Get cinder_backup image id currently used by pacemaker", "shell": "pcs resource config openstack-cinder-backup | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'", "register": "cinder_backup_image_current_res", "failed_when": false}, {"name": "cinder_backup image facts", "set_fact": {"cinder_backup_image_latest": "cluster.common.tag/cinder-backup:pcmklatest", "cinder_backup_image_current": "{{cinder_backup_image_current_res.stdout}}"}}, {"name": "Temporarily tag the current cinder_backup image id with the upgraded image name", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{cinder_backup_image_current}}", "container_image_latest": "{{cinder_backup_image_latest}}", "pull_image": false}, "when": ["cinder_backup_image_current != ''", "cinder_backup_image_current != cinder_backup_image_latest"]}, {"name": "Create cinder_backup retag statefile", "file": {"path": "/var/lib/tripleo/cinder_backup_needs_retag", "state": "touch"}, "when": ["cinder_backup_image_current != ''", "cinder_backup_image_current != cinder_backup_image_latest"]}]}, {"name": "Update cinder_backup pcs resource bundle for new container image - check", "when": ["step|int == 1"], "block": [{"name": "set is_cinder_backup_bootstrap_node fact", "tags": "common", "set_fact": "is_cinder_backup_bootstrap_node={{cinder_backup_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}"}, {"name": "Check for cinder_backup retag statefile", "stat": {"path": "/var/lib/tripleo/cinder_backup_needs_retag"}, "register": "cinder_backup_retag_state_file"}]}, {"name": "Update cinder_backup pcs resource bundle for new container image", "when": ["step|int == 1", "is_cinder_backup_bootstrap_node", "cinder_backup_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the cinder_backup cluster resource before container upgrade step1", "pacemaker_resource": {"resource": "openstack-cinder-backup", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Update the cinder_backup bundle to use the new container image name", "command": "pcs resource bundle update openstack-cinder-backup container image={{cinder_backup_image_latest}}"}, {"name": "Enable the cinder_backup cluster resource", "pacemaker_resource": {"resource": "openstack-cinder-backup", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}]}, {"name": "Check for cinder_backup retag statefile", "when": ["step|int == 3"], "stat": {"path": "/var/lib/tripleo/cinder_backup_needs_retag"}, "register": "cinder_backup_retag_state_file"}, {"name": "Retag the pacemaker image for cinder_backup", "when": ["step|int == 3", "cinder_backup_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the cinder_backup cluster resource before container upgrade step3", "pacemaker_resource": {"resource": "openstack-cinder-backup", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Retag the pacemaker image if containerized", "block": [{"block": [{"name": "Get cinder_backup image from pacemaker", "become": true, "register": "xmllint_pcmk_cinder_backup_image", "shell": "xmllint --xpath \"string(//bundle[@id='openstack-cinder-backup']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container cinder_backup image", "set_fact": {"cinder_backup_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-backup:17.1", "cinder_backup_image_latest": "cluster.common.tag/cinder-backup:pcmklatest", "pcmk_cinder_backup_image": "{{xmllint_pcmk_cinder_backup_image.stdout}}"}}]}, {"block": [{"name": "Retag pcmklatest to latest cinder_backup image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{cinder_backup_image}}", "container_image_latest": "{{cinder_backup_image_latest}}"}}]}]}, {"name": "Enable the cinder_backup cluster resource", "pacemaker_resource": {"resource": "openstack-cinder-backup", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Remove cinder_backup retag statefile", "file": {"path": "/var/lib/tripleo/cinder_backup_needs_retag", "state": "absent"}}]}]}, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "cinder_backup", "tuple:('role_data', 'container_config_scripts')": {"container_puppet_apply.sh": {"mode": "0700", "content": "#!/bin/bash\nset -eux\nSTEP=$1\nTAGS=$2\nCONFIG=$3\nEXTRA_ARGS=${4:-''}\nif [ -d /tmp/puppet-etc ]; then\n  # ignore copy failures as these may be the same file depending on docker mounts\n  cp -a /tmp/puppet-etc/* /etc/puppet || true\nfi\necho \"{\\\"step\\\": ${STEP}}\" > /etc/puppet/hieradata/docker_puppet.json\n# $::deployment_type in puppet-tripleo\nexport FACTER_deployment_type=containers\nset +e\npuppet apply $EXTRA_ARGS \\\n    --verbose \\\n    --detailed-exitcodes \\\n    --summarize \\\n    --color=false \\\n    --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \\\n    --tags $TAGS \\\n    -e \"noop_resource('package'); ${CONFIG}\"\nrc=$?\nset -e\nset +ux\nif [ $rc -eq 2 -o $rc -eq 0 ]; then\n    exit 0\nfi\nexit $rc\n"}, "pyshim.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n#\n# Usage: pyshim.sh <script and/or arguments>\n#\n# Unfortunately THT doesn't know which version of python might be in a\n# container so we need this script to be able to try python3 or python2\n# depending on availability.  Since this is a temporary shim until we've\n# fully cut over to python3, we check for the existence of python3 first\n# before falling back to python2. This will help in the transition from\n# python2 based containers to python3.\n\nshow_usage() {\n    echo \"Usage: pyshim.sh <script and/or arguments>\"\n}\n\nif [ $# -lt 1 ]\nthen\n    show_usage\n    exit 1\nfi\n\nset -x\nif command -v python3 >/dev/null; then\n    python3 \"$@\"\nelif command -v python2 >/dev/null; then\n    python2 \"$@\"\nelif command -v python >/dev/null; then\n    python \"$@\"\nelse\n    echo \"ERROR: python is not available!\"\n    exit 1\nfi\n"}, "pacemaker_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nset -u\n\n# ./pacemaker_restart_bundle.sh mysql galera galera-bundle Master _\n# ./pacemaker_restart_bundle.sh redis redis redis-bundle Slave Master\n# ./pacemaker_restart_bundle.sh ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\nRESTART_SCRIPTS_DIR=$(dirname $0)\nTRIPLEO_SERVICE=$1\nRESOURCE_NAME=$2\nBUNDLE_NAME=$3\nWAIT_TARGET_LOCAL=$4\nWAIT_TARGET_ANYWHERE=${5:-_}\nTRIPLEO_MINOR_UPDATE=\"${TRIPLEO_MINOR_UPDATE:-false}\"\nTRIPLEO_HA_WRAPPER_RESOURCE_EXISTS=\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS:-false}\"\n\nbundle_can_be_restarted() {\n    local bundle=$1\n    # As long as the resource bundle is managed by pacemaker and is\n    # not meant to stay stopped, no matter the state of any inner\n    # pcmk_remote or ocf resource, we should restart it to give it a\n    # chance to read the new config.\n    [ \"$(crm_resource --meta -r $1 -g is-managed 2>/dev/null)\" != \"false\" ] && \\\n    [ \"$(crm_resource --meta -r $1 -g target-role 2>/dev/null)\" != \"Stopped\" ]\n}\n\nlog() {\n    local msg=$1\n    logger -t pcmkrestart \"$1\"\n}\n\nHOSTNAME=$(/bin/hostname -s)\nif [ x\"${TRIPLEO_MINOR_UPDATE,,}\" != x\"true\" ]; then\n    if [ x\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS,,}\" = x\"false\" ]; then\n        # Do not restart during initial deployment, as the resource\n        # has just been created.\n        SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n        if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n            log \"Initial deployment, skipping the restart of ${BUNDLE_NAME}\"\n\tfi\n        exit 0\n    else\n        # During a stack update, this script is called in parallel on\n        # every node the resource runs on, after the service's configs\n        # have been updated on all nodes. So we need to run pcs only\n        # once (e.g. on the service's boostrap node).\n        if bundle_can_be_restarted ${BUNDLE_NAME}; then\n            SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n            if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n                replicas_running=$(crm_resource -Q -r $BUNDLE_NAME --locate 2>&1 | wc -l)\n                if [ \"$replicas_running\" != \"0\" ]; then\n                    log \"Restarting ${BUNDLE_NAME} globally. Stopping:\"\n                    /sbin/pcs resource disable --wait=600 $BUNDLE_NAME\n                    log \"Restarting ${BUNDLE_NAME} globally. Starting:\"\n                    /sbin/pcs resource enable --wait=600 $BUNDLE_NAME\n                else\n                    log \"${BUNDLE_NAME} is not running anywhere,\" \\\n                         \"cleaning up to restart it globally if necessary\"\n                    /sbin/pcs resource cleanup $BUNDLE_NAME\n                fi\n            else\n                log \"Skipping global restart of ${BUNDLE_NAME} on ${HOSTNAME} it will be restarted by node ${SERVICE_NODEID}\"\n            fi\n\n        else\n            log \"No global restart needed for ${BUNDLE_NAME}.\"\n        fi\n    fi\nelse\n    # During a minor update workflow however, a host gets fully\n    # updated before updating the next one. So unlike stack\n    # update, at the time this script is called, the service's\n    # configs aren't updated on all nodes yet. So only restart the\n    # resource locally, where it's guaranteed that the config is\n    # up to date.\n    HOST=$(facter hostname)\n\n    if bundle_can_be_restarted ${BUNDLE_NAME}; then\n\t# if the resource is running locally, restart it\n\tif crm_resource -r $BUNDLE_NAME --locate 2>&1 | grep -w -q \"${HOST}\"; then\n            log \"Restarting ${BUNDLE_NAME} locally on '${HOST}'\"\n            /sbin/pcs resource restart $BUNDLE_NAME \"${HOST}\"\n\n\telse\n\t    # At this point, if no resource is running locally, it's\n\t    # either because a) it has failed previously, or b) because\n\t    # it's an A/P resource running elsewhere.\n\t    # By cleaning up resource, we ensure that a) it will try to\n\t    # restart, or b) it won't do anything if the resource is\n\t    # already running elsewhere.\n            log \"${BUNDLE_NAME} is currently not running on '${HOST}',\" \\\n                 \"cleaning up its state to restart it if necessary\"\n            /sbin/pcs resource cleanup $BUNDLE_NAME node=\"${HOST}\"\n\tfi\n\n\t# Wait until the resource is in the expected target state\n\t$RESTART_SCRIPTS_DIR/pacemaker_wait_bundle.sh \\\n            $RESOURCE_NAME $BUNDLE_NAME \\\n            \"$WAIT_TARGET_LOCAL\" \"$WAIT_TARGET_ANYWHERE\" \\\n\t    \"${HOST}\" 600\n    else\n        log \"No restart needed for ${BUNDLE_NAME}.\"\n    fi\nfi\n"}, "pacemaker_wait_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# ----\n# Wait for an OCF resource or a bundle to be restarted\n# ----\n# e.g.:\n# M/S OCF:      $0 galera galera-bundle Master\n# clone OCF:    $0 rabbitmq rabbitmq-bundle Started\n# A/P M/S OCF:  $0 redis redis-bundle Slave Master\n# A/P bundle:   $0 openstack-cinder-volume openstack-cinder-volume _ Started\n# clone bundle: $0 haproxy-bundle haproxy-bundle Started\n\n# design note 1:\n#  - this script is called during a minor update; it is called\n#    once per node that hosts a service replica.\n#  - the purpose of this script is to ensure that restarting the\n#    service replica locally won't disrupt the service availability\n#    for the end user. To reach that goal, the script waits until the\n#    service is restarted locally or globallu and reaches a given\n#    target state (i.e. Started, Slave or Master).\n# design note 2:\n#   - we don't want to track restart error: our only job is to ensure\n#     service restart synchronization, not service health.\n#   - In particular, we don't want to error out in case the resource\n#     cannot be restarted locally, because that would make the minor\n#     update fail, even if potentially other replicas still provide\n#     the service.\n# design note 3:\n#   - we can bail out early if we determine that the resource can't\n#     be restarted automatically by pacemaker (e.g. its \"blocked\",\n#     unmanaged or disabled).\n\nlog() {\n    local msg=$1\n    echo \"$(date -u): $1\"\n}\n\nusage() {\n    echo 2>&1 \"Usage: $0 NAME BUNDLE_NAME ROLE_LOCAL [ROLE_ANYWHERE] [HOST] [TIMEOUT]\"\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\n#\n# Utility functions to detect stuck resources\n#\n\nbundle_failures_locally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local replica_name\n    for i in $(seq 0 $last); do\n\treplica_name=${BUNDLE_NAME}-${engine}-${i}\n\tcrm_failcount -q -G -r $replica_name -N $HOST\n    done\n}\n\nbundle_failures_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    for i in $(seq 0 $last); do\n\tcrm_failcount -q -G -r ${BUNDLE_NAME}-${engine}-${i}\n    done\n}\n\nbundle_running_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    # return the number of running bundles replica, i.e. the number of\n    # docker/podman resource replicas currently running in the cluster\n    crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:heartbeat:${engine}']/node)\" -\n}\n\nocf_failures_globally() {\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local bundle_node\n    for i in $(seq 0 $last); do\n\tbundle_node=${BUNDLE_NAME}-${i}\n\tcrm_failcount -q -G -r $NAME -N $bundle_node\n    done\n}\n\ndid_resource_failed_locally() {\n    local failures\n    local running\n    local remotehost\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# if we're dealing with an ocf resource, it is running on a\n\t# pacemaker_remote rather that on the real host, and the\n\t# failcounts are thus associated to the pcmk remote. Replace\n\t# the host's name with the pcmk remote's name.\n        remotehost=$(crm_mon --as-xml | xmllint --xpath \"string(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource/node[@name='${HOST}']/../../resource[@resource_agent='${OCF}:pacemaker:remote']/@id)\" -)\n\tif [ -n \"${remotehost}\" ]; then\n\t    crm_failcount -q -G -r $NAME -N $remotehost | grep -q -w INFINITY\n\t    return $?\n\tfi\n\t# If no pcmk remote is currently running, the failcount from\n\t# the ocf resource is useless, compute the failcount from the\n\t# bundle case instead (computed below).\n    fi\n\n    # for bundles, pacemaker can run any bundle replica locally\n    # (e.g. galera-bundle-docker-{0,1,2}), and a failure happens when\n    # there are no more replica to try.\n    # That is, when _at least_ one replica failed locally, and all the\n    # others either failed or are currently running elsewhere.\n    failures=$(bundle_failures_locally $HOST | grep -c -w INFINITY)\n    running=$(bundle_running_globally)\n    test $failures -gt 0 && \\\n    test $(( $failures + $running )) -ge $BUNDLE_REPLICAS\n}\n\ndid_resource_failed_globally() {\n    local remotecount\n    local failures\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# we check the state of an ocf resource only if the\n\t# pcmkremotes are started\n        remotecount=$(crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node)\" -)\n\tif [ \"${remotecount}\" = \"0\" ]; then\n\t    # no pcmkremote is running, so check the bundle state\n\t    # instead of checking the ocf resource\n\t    # bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\t    failures=$(bundle_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\telse\n\t    # ocf resource failed if it failed to start on\n\t    # all $BUNDLE_REPLICAS bundle nodes\n\t    failures=$(ocf_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\tfi\n    else\n\t# bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\tfailures=$(bundle_failures_globally | grep -c -w INFINITY)\n\ttest $failures -eq $BUNDLE_REPLICAS\n    fi\n}\n\n\n# Input validation\n#\n\nNAME=$1\nif [ -z \"${NAME}\" ]; then\n    echo 2>&1 \"Error: argument NAME must not be empty\"\n    exit 1\nfi\n\nBUNDLE_NAME=$2\nif [ -z \"${BUNDLE_NAME}\" ]; then\n    echo 2>&1 \"Error: argument BUNDLE_NAME must not be empty\"\n    exit 1\nfi\n\nROLE_LOCAL=$3\nif [ \"${ROLE_LOCAL}\" = \"_\" ]; then\n    ROLE_LOCAL=\"\"\nfi\n\nROLE_ANYWHERE=$4\nif [ \"${ROLE_ANYWHERE}\" = \"_\" ]; then\n    ROLE_ANYWHERE=\"\"\nfi\n\nif [ -z \"${ROLE_LOCAL}\" ]; then\n    if [ -z \"${ROLE_ANYWHERE}\" ]; then\n        echo 2>&1 \"Error: either ROLE_LOCAL or ROLE_ANYWHERE must be non empty\"\n        exit 1\n    fi\nelse\n    if !(echo \"${ROLE_LOCAL}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n        echo 2>&1 \"Error: argument ROLE_LOCAL must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n        exit 1\n    fi\nfi\n\nif [ -n \"${ROLE_ANYWHERE}\" ] && !(echo \"${ROLE_ANYWHERE}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n    echo 2>&1 \"Error: argument ROLE_ANYWHERE must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n    exit 1\nfi\n\n# Ensure compatibility with pacemaker 2.1\nif pacemaker_supports_promoted; then\n    ROLE_LOCAL=$(echo \"$ROLE_LOCAL\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    ROLE_ANYWHERE=$(echo \"$ROLE_ANYWHERE\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    OCF=\"ocf\"\nelse\n    OCF=\"ocf:\"\nfi\n\nHOST=${5:-$(facter hostname)}\nTIMEOUT=${6:-600}\n\n\n# Configure the search\n# ----\n# Note: we can't use crm_resource in all searches because we can't\n# easily extract the host the OCF resources run on (crm_resource\n# returns the pcmk-remote nodes rather than the hosts)\n# So instead, we implement various searches with XPath directly.\n\nif [ \"${BUNDLE_NAME}\" != \"${NAME}\" ]; then\n# ocf resource\nlocal_resource_xpath=\"//bundle/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node[@name='${HOST}']/../../resource[@id='${NAME}']\"\nany_resource_xpath=\"//bundle//resource[@id='${NAME}']\"\nreplicas_xpath=\"//bundle/primitive[@id='${BUNDLE_NAME}']/../*[boolean(@image) and boolean(@replicas)]\"\nelse\n# bundle resource\nlocal_resource_xpath=\"//bundle[@id='${NAME}']/replica/resource/node[@name='${HOST}']/../../resource\"\nany_resource_xpath=\"//bundle[@id='${NAME}']//resource\"\nreplicas_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nfi\n\nbundle_def_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nBUNDLE_CONTAINER_ENGINE=$(cibadmin -Q | xmllint --xpath \"name(${bundle_def_xpath})\" -)\nBUNDLE_REPLICAS=$(cibadmin -Q | xmllint --xpath \"string(${bundle_def_xpath}/@replicas)\" -)\n\n\n# The wait algorithm follows a two-stage approach\n#  1. Depending on how the script is called, we first check whether\n#     the resource is restarted locally. An A/P resource may be\n#     restarted elsewhere in the cluster.\n#  2. If needed, check whether the A/P resource has restarted\n#     elsewhere. For A/P M/S resources, in case the resource is\n#     restarted as Slave locally, ensure a Master is available.\n\nsuccess=1\nbailout=1\ntimeout=$TIMEOUT\nrole=\"\"\n\n# Stage 1: local check\nif [ -n \"$ROLE_LOCAL\" ]; then\n    log \"Waiting until ${NAME} has restarted on ${HOST} and is in state ${ROLE_LOCAL}\"\n    log \"Will probe resource state with the following XPath pattern: ${local_resource_xpath}\"\n\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resource=$(crm_mon -r --as-xml | xmllint --xpath \"${local_resource_xpath}\" - 2>/dev/null)\n        role=$(echo \"${resource}\" | sed -ne 's/.*\\Wrole=\"\\([^\"]*\\)\".*/\\1/p')\n\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resource}\" | grep -q -w \"\\Wblocked=\\\"true\\\"\"; then\n            log \"${NAME} is blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_locally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif [ \"$role\" = \"$ROLE_LOCAL\" ]; then\n            success=0\n            continue\n        elif [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" = \"$ROLE_ANYWHERE\" ]; then\n            # A/P: we are restarted in the expected state\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_LOCAL} on ${HOST}\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\n# Stage 2: global check\nif [ $timeout -gt 0 ] && [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" != \"$ROLE_ANYWHERE\" ]; then\n    log \"Wait until ${NAME} is restarted anywhere in the cluster in state ${ROLE_ANYWHERE}\"\n    log \"Will probe resource state with the following XPath pattern: ${any_resource_xpath}\"\n\n    success=1\n    bailout=1\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resources=$(crm_mon -r --as-xml | xmllint --xpath \"${any_resource_xpath}\" - 2>/dev/null)\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif ! (echo \"${resources}\" | grep -q -w \"\\Wblocked=\\\"false\\\"\"); then\n            log \"${NAME} blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_globally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resources}\" | grep -q -w \"\\Wrole=\\\"${ROLE_ANYWHERE}\\\"\"; then\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_ANYWHERE} anywhere in the cluster\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\nif [ $timeout -le 0 ]; then\n    log \"Timeout reached after ${TIMEOUT}s while waiting for ${NAME} to be restarted\"\nelif [ $bailout -le 0 ]; then\n    log \"Restart monitoring for ${NAME} cancelled\"\nfi\n\nif [ $success -eq 0 ]; then\n    log \"${NAME} successfully restarted\"\nelse\n    log \"${NAME} was not restarted properly\"\nfi\n\n# Don't block minor update or stack update if the wait was unsuccessful\nexit 0\n"}, "wait-port-and-run.sh": {"mode": "0755", "content": "#!/usr/bin/bash\nset -eu\n\nHOST=$1\nPORT=$2\n\necho \"$(date -u): Checking whether we can bind to ${HOST}:${PORT}\"\nwhile (ss -Htnl src \"${HOST}\" \"sport = :${PORT}\" | grep -wq \"${PORT}\"); do\n    echo \"$(date -u): ${HOST}:${PORT} still in use, waiting...\";\n    sleep 10;\ndone\n\nshift 2\nCOMMAND=\"$*\"\nif [ -z \"${COMMAND}\" ]; then\n    COMMAND=\"true\"\nfi\nexec $COMMAND\n"}, "pacemaker_resource_lock.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nMAX_RETRIES=10\nCIB_ENOTFOUND=105\n\nusage() {\n   echo \"Set a global property in the cluster with a validity timestamp.\"\n   echo \"Usage:\"\n   echo \"   $0 --acquire <lock_name> <lock_owner> <lock_ttl_in_seconds>\"\n   echo \"   $0 --release <lock_name> <lock_owner>\"\n   echo\n}\n\nlog() {\n    echo \"$(date -u): $1\" 1>&2\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\nlock_create() {\n    local name=$1\n    local data=$2\n    # cibadmin won't overwrite a key if someone else succeeded to create it concurrently\n    cibadmin --sync-call --scope crm_config --create --xml-text \"<cluster_property_set id='${name}'><nvpair id='${name}-pair' name='${name}' value='${data}'/></cluster_property_set>\" &>/dev/null\n    return $?\n}\n\nlock_update() {\n    local name=$1\n    local expected_data=$2\n    local new_data=$3\n    # we only update the lock we expect to see, so we can't update someone else's lock\n    cibadmin --sync-call --scope crm_config --modify --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" --xml-text \"<nvpair id='${name}-pair' name='${name}' value='${new_data}'/>\" &>/dev/null\n    return $?\n}\n\nlock_delete() {\n    local name=$1\n    local expected_data=$2\n    # we only delete the lock we expect to see, so we can't delete someone else's lock\n    cibadmin --sync-call --scope crm_config --delete --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" &>/dev/null\n    return $?\n}\n\nlock_get() {\n    local lockname=$1\n    local res\n    local rc\n    res=$(cibadmin --query --scope crm_config --xpath \"//cluster_property_set/nvpair[@name='$lockname']\" 2>/dev/null)\n    rc=$?\n    if [ $rc -eq 0 ]; then\n        echo \"$res\" | sed -n 's/.*value=\"\\([^\"]*\\)\".*/\\1/p'\n    fi\n    return $rc\n}\n\nlock_owner() {\n    local lock=$1\n    echo \"$lock\" | cut -d':' -f1\n}\n\nlock_has_expired() {\n    local lock=$1\n    local expiry=$(echo \"$lock\" | cut -d':' -f2)\n    local now=$(date +%s)\n    test $now -ge $expiry\n}\n\n\n# Perform a lock action and restart if the CIB has been modified before\n# committing the lock action\ntry_action() {\n    local fun=$1\n    local lock=$2\n    local requester=$3\n    local args=${4:-}\n    local tries=$MAX_RETRIES\n    local rc=1\n    if [ \"$fun\" = \"lock_acquire\" ] || [ \"$fun\" = \"lock_release\" ]; then\n        log \"Try running $fun\"\n    else\n        return 2\n    fi\n    while [ $rc -ne 0 ]; do\n        $fun $lock $requester $args\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Operation $1 succeeded\"\n            return 0\n        elif [ $rc -eq 3 ]; then\n            # rc == 3 -> CIB changed before push\n            if [ $tries -eq 0 ]; then\n                log \"Failed to commit after $MAX_RETRIES retries. Bailing out.\"\n                return 2\n            else\n                log \"Failed to commit. Retrying operation.\"\n                tries=$(($tries - 1))\n            fi\n        elif [ $rc -eq 2 ]; then\n            # rc == 2 -> unrecoverable cib error (e.g. pacemaker down)\n            log \"Unexpected failure. Bailing out\"\n            return $rc\n        else\n            # rc == 1 -> lock error (not owner, lock doesn't exists)\n            return $rc\n        fi\n    done\n}\n\n# The lock mechanism uses cibadmin's atomic creation so cluster-wide\n# state coherency is guaranteed by pacemaker\nlock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc\n    local lock\n    local expiry\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -n \"$lock\" ]; then\n        lock_has_expired $lock\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Lock has expired, now available for being held\"\n        else\n            # lock is still held. check whether we're the owner\n            owner=$(lock_owner $lock)\n            if [ \"$owner\" = \"$requester\" ];then\n                log \"Requester already owns the lock, acquiring attempt will just reconfigure the TTL\"\n            else\n                log \"Lock is held by someone else ($owner)\"\n                return 1\n            fi\n        fi\n    else\n        log \"Lock is not held yet\"\n    fi\n\n    # prepare the lock info\n    expiry=$(($(date +%s) + $ttl))\n\n    if [ -n \"$lock\" ]; then\n        log \"Attempting to update the lock\"\n        lock_update $lockname \"$lock\" \"$requester:$expiry\"\n        rc=$?\n    else\n        log \"Attempting to acquire the lock\"\n        lock_create $lockname \"$requester:$expiry\"\n        rc=$?\n    fi\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' acquired by '$requester', valid until $(date -d @$expiry)\"\n        return 0\n    else\n        log \"CIB changed, lock cannot be acquired\"\n        return 3\n    fi\n}\n\n\n# The lock mechanism uses the CIB's num_updates tag to implement\n# a conditional store. Cluster-wide locking is guaranteed by pacemaker\nlock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n    local lock\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        log \"Lock doesn't exist. Nothing to release\"\n        return 0\n    else\n        log \"Lock exists, check whether we're the owner\"\n        owner=$(lock_owner $lock)\n        if [ \"$owner\" != \"$requester\" ];then\n            log \"Lock is held by someone else ($owner), will not unlock\"\n            return 1\n        fi\n    fi\n\n    lock_delete $lockname \"$lock\"\n    rc=$?\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' released by '$requester'\"\n        return 0\n    else\n        log \"CIB deletion error, lock cannot be released\"\n        return 3\n    fi\n}\n\n\n# Retrieve the owner of a lock from the CIB\n# this is a read-only operation, so no need to log debug info\nlock_get_owner() {\n    local lockname=$1\n    local rc\n    local lock\n    local owner\n\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        return 1\n    else\n        lock_owner $lock\n        return 0\n    fi\n}\n\n\nACTION=$1\nLOCKNAME=$2\nREQUESTER=$3\nTTL=${4:-60}\n\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nif [ $ACTION != \"--help\" ]; then\n    if [ -z \"$LOCKNAME\" ]; then\n        error \"You must specific a lock name\"\n    fi\n    if [ $ACTION != \"--owner\" ] && [ $ACTION != \"-o\" ]; then\n        if [ -z \"$REQUESTER\" ]; then\n            error \"You must specific a lock requester\"\n        fi\n    fi\nfi\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) try_action lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --release|-r) try_action lock_release $LOCKNAME $REQUESTER;;\n    --acquire-once|-A) lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --owner|-o) lock_get_owner $LOCKNAME;;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}, "pacemaker_mutex_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_restart_bundle.sh --lock mysql galera galera-bundle Master _\n# pacemaker_mutex_restart_bundle.sh --lock ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\n\nset -u\n\nusage() {\n    echo \"Restart a clustered resource in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --lock <tripleo-service> <pcmk-resource> <pcmk-bundle> <target-state-local> <target-state-cluster>\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\nACTION=$1\ncase $ACTION in\n    --help) usage; exit 0;;\n    --lock) ;;\n    *) error \"Unknown action '$ACTION'\";;\nesac\n\nTRIPLEO_SERVICE=$2\nLOCK_NAME=${TRIPLEO_SERVICE}-restart-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to restart resource $TRIPLEO_SERVICE\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\nRESOURCE_NAME=$3\nBUNDLE_NAME=$4\nWAIT_TARGET_LOCAL=$5\nWAIT_TARGET_ANYWHERE=${6:-_}\n\nif pacemaker_supports_promoted; then\n    WAIT_TARGET_LOCAL=$(echo \"$5\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    WAIT_TARGET_ANYWHERE=$(echo \"${6:-_}\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    promoted_role=\"Promoted\"\nelse\n    promoted_role=\"Master\"\nfi\n\n# The lock TTL should accomodate for the resource start/promote timeout\nif [ \"$RESOURCE_NAME\" != \"$BUNDLE_NAME\" ]; then\n    if [ \"$WAIT_TARGET_LOCAL\" = \"$promoted_role\" ] || [ \"$WAIT_TARGET_ANYWHERE\" = \"$promoted_role\" ]; then\n        rsc_op=\"promote\"\n    else\n        rsc_op=\"start\"\n    fi\n    # <op id=\"galera-promote-interval-0s\" interval=\"0s\" name=\"promote\" on-fail=\"block\" timeout=\"300s\"/>\n    PCMK_TTL=$(cibadmin -Q | xmllint -xpath \"string(//primitive[@id='${RESOURCE_NAME}']/operations/op[@name='${rsc_op}']/@timeout)\" - | sed 's/s$//')\n    LOCK_TTL=$((PCMK_TTL + 30))\nelse\n    # The podman RA's default start timeout\n    LOCK_TTL=90\nfi\n\nlog \"Acquire a ${LOCK_TTL}s restart lock for service $TRIPLEO_SERVICE before restarting it\"\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nrc=1\nwhile [ $rc -ne 0 ]; do\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire $LOCK_NAME $LOCK_OWNER $LOCK_TTL\n    rc=$?\n    if [ $rc != 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not acquire lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Could not acquire lock, retrying\"\n            sleep 10\n        fi\n    fi\ndone\n\nlog \"Restart the service $TRIPLEO_SERVICE locally\"\n# Reuse the local restart script in t-h-t (driven by env var TRIPLEO_MINOR_UPDATE)\nTRIPLEO_MINOR_UPDATE=true /var/lib/container-config-scripts/pacemaker_restart_bundle.sh $TRIPLEO_SERVICE $RESOURCE_NAME $BUNDLE_NAME $WAIT_TARGET_LOCAL $WAIT_TARGET_ANYWHERE\n\n# If we reached this point, always try to release the lock\nlog \"Release the restart lock for service $TRIPLEO_SERVICE\"\n/var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $LOCK_NAME $LOCK_OWNER\nrc=$?\nif [ $rc -ne 0 ] && [ $rc -ne 1 ]; then\n    error \"Could not release held lock (rc: $rc)\"\nfi\n"}, "pacemaker_mutex_shutdown.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_shutdown.sh --acquire\n# pacemaker_mutex_shutdown.sh --release\n\nset -u\n\nusage() {\n    echo \"Shutdown a cluster node in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --acquire # prevent other node from shutting down until we hold the lock\"\n    echo \"   $0 --release # release the lock, other node can compete for the shutdown lock\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nshutdown_lock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc=1\n    local current_owner\n    local owner_stopped\n    local owner_rc\n\n    log \"Acquiring the shutdown lock\"\n    while [ $rc -ne 0 ]; do\n        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire-once $lockname $requester $ttl\n        rc=$?\n        if [ $rc -ne 0 ]; then\n            if [ $rc -eq 2 ]; then\n                error \"Could not acquire the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n            else\n                # The lock is held by another node.\n                current_owner=$(/var/lib/container-config-scripts/pacemaker_resource_lock.sh --owner $lockname)\n                owner_rc=$?\n                if [ $owner_rc -eq 2 ]; then\n                    error \"Could not get the shutdown lock owner due to unrecoverable error (rc: $owner_rc), bailing out\"\n                fi\n                if [ $owner_rc -eq 0 ]; then\n                    # If the owner is marked as offline, that means it has shutdown and\n                    # we can clean the lock preemptively and try to acquire it.\n                    owner_stopped=$(crm_mon -1X | xmllint --xpath 'count(//nodes/node[@name=\"'${current_owner}'\" and @online=\"false\" and @unclean=\"false\"])' -)\n                    if [ \"${owner_stopped}\" = \"1\" ]; then\n                        log \"Shutdown lock held by stopped node '${current_owner}', lock can be released\"\n                        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $current_owner\n                        continue\n                    fi\n                fi\n                log \"Shutdown lock held by another node (rc: $rc), retrying\"\n                sleep 10\n            fi\n        fi\n    done\n    log \"Shutdown lock acquired\"\n    return 0\n}\n\n\n# Release the lock if we still own it. Not owning it anymore is not fatal\nshutdown_lock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n\n    log \"Releasing the shutdown lock\"\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $requester\n    rc=$?\n    if [ $rc -ne 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not release the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Shutdown lock no longer held, nothing to do\"\n        fi\n    else\n        log \"Shutdown lock released\"\n    fi\n    return 0\n}\n\n\nACTION=$1\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nLOCK_NAME=tripleo-shutdown-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to aquire the shutdown lock\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\n# We start with a very high TTL, that long enough to accomodate a cluster stop.\n# As soon as the node will get offline, the other competing node will be entitled\n# to steal the lock, so they should never wait that long in practice.\nLOCK_TTL=600\n\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) shutdown_lock_acquire ${LOCK_NAME} ${LOCK_OWNER} ${LOCK_TTL};;\n    --release|-r) shutdown_lock_release ${LOCK_NAME} ${LOCK_OWNER};;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}}, "tuple:('role_data', 'docker_config')": {"step_3": {"cinder_backup_init_logs": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-backup:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/cinder:/var/log/cinder:z"], "command": ["/bin/bash", "-c", "chown -R cinder:cinder /var/log/cinder"]}}}, "tuple:('role_data', 'config_settings')": {"cinder::database_connection": "mysql+pymysql://cinder:q4G6h4a5N51huVgDb7vMEqcRq@172.17.0.2/cinder?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "cinder::logging::debug": true, "cinder::storage_availability_zone": "nova", "cinder::rabbit_heartbeat_timeout_threshold": 60, "cinder::rpc_response_timeout": 60, "cinder::rabbit_heartbeat_in_pthread": false, "cinder::db::database_db_max_retries": -1, "cinder::db::database_max_retries": -1, "cinder::cron::db_purge::minute": "1", "cinder::cron::db_purge::hour": "0", "cinder::cron::db_purge::monthday": "*", "cinder::cron::db_purge::month": "*", "cinder::cron::db_purge::weekday": "*", "cinder::cron::db_purge::user": "cinder", "cinder::cron::db_purge::age": "30", "cinder::cron::db_purge::destination": "/var/log/cinder/cinder-rowsflush.log", "cinder::cron::db_purge::maxdelay": "3600", "cinder::glance::glance_api_servers": "http://172.17.0.2:9293", "cinder::keystone::service_user::send_service_user_token": true, "cinder::keystone::service_user::project_name": "service", "cinder::keystone::service_user::auth_type": "password", "cinder::keystone::service_user::auth_url": "http://172.17.0.2:5000/", "cinder::keystone::service_user::password": "q4G6h4a5N51huVgDb7vMEqcRq", "cinder::keystone::service_user::region_name": "regionOne", "cinder::nova::interface": "admin", "cinder::nova::project_name": "service", "cinder::nova::auth_type": "password", "cinder::nova::auth_url": "http://172.17.0.2:5000/", "cinder::nova::password": "LS8Q05rmlMlHeKHPO1GdkVzQT", "cinder::nova::region_name": "regionOne", "cinder::backup::backup_workers": 1, "cinder::backup::backup_max_operations": 15, "cinder::backup::ceph::backup_ceph_user": "openstack", "cinder::backup::ceph::backup_ceph_pool": "backups", "cinder::backup::ceph::backup_ceph_conf": "/etc/ceph/ceph.conf", "tripleo::profile::pacemaker::cinder::backup_bundle::cinder_backup_docker_image": "cluster.common.tag/cinder-backup:pcmklatest", "tripleo::profile::pacemaker::cinder::backup_bundle::docker_volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro", "/var/log/containers/cinder:/var/log/cinder:z", "/var/lib/kolla/config_files/cinder_backup.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/dev:/dev", "/run:/run", "/sys:/sys", "/lib/modules:/lib/modules:ro", "/var/lib/cinder:/var/lib/cinder:z", "/var/lib/iscsi:/var/lib/iscsi:z"], "tripleo::profile::pacemaker::cinder::backup_bundle::docker_environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}, "tripleo::profile::pacemaker::cinder::backup_bundle::container_backend": "podman", "tripleo::profile::pacemaker::cinder::backup_bundle::ceph_conf_path": "/var/lib/tripleo-config/ceph", "cinder::backup::manage_service": false, "cinder::backup::enabled": false}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-16-mm7wr6xribeg/33673d21-6238-4930-afcf-423d7441fa8a"}


created_at: 2026-01-21 15:58:41.997511
data:
  {"type": "json", "value": {"ContainerCinderSchedulerImage": "registry.redhat.io/rhosp-rhel9/openstack-cinder-scheduler:17.1", "ContainerCinderConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-cinder-api:17.1"}}


created_at: 2026-01-21 15:58:48.038400
data:
  {"value": {"ContainerCinderSchedulerImage": "registry.redhat.io/rhosp-rhel9/openstack-cinder-scheduler:17.1", "ContainerCinderConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-cinder-api:17.1"}}


created_at: 2026-01-21 15:58:48.095518
data:
  {"healthcheck_rpc_port": {"test": "/openstack/healthcheck 5672"}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-17-t2yspfeno3yu-ContainersCommon-4y6gw6a6afuh/07ffed91-bf25-44ad-ad64-9691464cc9b8"}


created_at: 2026-01-21 15:58:48.245532
data:
  {"cinder_nvmeof_volumes": null, "cinder_nvmeof_host_prep_tasks": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-17-t2yspfeno3yu-CinderCommon-eqiair32jflx-CinderNVMeOF-i5rgdsa6vym2/e526d2f9-9045-4ba2-bec8-6b83055389f4"}


created_at: 2026-01-21 15:58:48.291659
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-17-t2yspfeno3yu-CinderCommon-eqiair32jflx-ContainersCommon-5np4raa5pwsu/65f652d8-c14b-4c79-8183-bcd8f5588be0"}


created_at: 2026-01-21 15:58:48.302723
data:
  {"cinder_common_volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro", "/var/log/containers/cinder:/var/log/cinder:z"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-17-t2yspfeno3yu-CinderCommon-eqiair32jflx/c963f78a-3de8-4ec2-95db-28b044d7cddf"}


created_at: 2026-01-21 15:58:48.339701
data:
  {"tuple:('role_data', 'step_config')": "include tripleo::profile::base::database::mysql::client", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-17-t2yspfeno3yu-MySQLClient-66kblj25ucfy/f278dea0-4ace-4523-9cf1-1011dec59b01"}


created_at: 2026-01-21 15:58:48.394763
data:
  {"tuple:('role_data', 'step_config')": null, "tuple:('role_data', 'config_settings')": {"cinder::database_connection": "mysql+pymysql://cinder:q4G6h4a5N51huVgDb7vMEqcRq@172.17.0.2/cinder?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "cinder::logging::debug": true, "cinder::storage_availability_zone": "nova", "cinder::rabbit_heartbeat_timeout_threshold": 60, "cinder::rpc_response_timeout": 60, "cinder::rabbit_heartbeat_in_pthread": false, "cinder::db::database_db_max_retries": -1, "cinder::db::database_max_retries": -1, "cinder::cron::db_purge::minute": "1", "cinder::cron::db_purge::hour": "0", "cinder::cron::db_purge::monthday": "*", "cinder::cron::db_purge::month": "*", "cinder::cron::db_purge::weekday": "*", "cinder::cron::db_purge::user": "cinder", "cinder::cron::db_purge::age": "30", "cinder::cron::db_purge::destination": "/var/log/cinder/cinder-rowsflush.log", "cinder::cron::db_purge::maxdelay": "3600", "cinder::glance::glance_api_servers": "http://172.17.0.2:9293", "cinder::keystone::service_user::send_service_user_token": true, "cinder::keystone::service_user::project_name": "service", "cinder::keystone::service_user::auth_type": "password", "cinder::keystone::service_user::auth_url": "http://172.17.0.2:5000/", "cinder::keystone::service_user::password": "q4G6h4a5N51huVgDb7vMEqcRq", "cinder::keystone::service_user::region_name": "regionOne", "cinder::nova::interface": "admin", "cinder::nova::project_name": "service", "cinder::nova::auth_type": "password", "cinder::nova::auth_url": "http://172.17.0.2:5000/", "cinder::nova::password": "LS8Q05rmlMlHeKHPO1GdkVzQT", "cinder::nova::region_name": "regionOne"}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-17-t2yspfeno3yu-CinderBase-vs3djg37jjxz/109f71e4-71cb-4bef-85fd-e54202ecc32c"}


created_at: 2026-01-21 15:58:48.407814
data:
  {"tuple:('role_data', 'step_config')": null, "role_data": {"service_name": "cinder_scheduler", "monitoring_subscription": "overcloud-cinder-scheduler", "config_settings": {"cinder::database_connection": "mysql+pymysql://cinder:q4G6h4a5N51huVgDb7vMEqcRq@172.17.0.2/cinder?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "cinder::logging::debug": true, "cinder::storage_availability_zone": "nova", "cinder::rabbit_heartbeat_timeout_threshold": 60, "cinder::rpc_response_timeout": 60, "cinder::rabbit_heartbeat_in_pthread": false, "cinder::db::database_db_max_retries": -1, "cinder::db::database_max_retries": -1, "cinder::cron::db_purge::minute": "1", "cinder::cron::db_purge::hour": "0", "cinder::cron::db_purge::monthday": "*", "cinder::cron::db_purge::month": "*", "cinder::cron::db_purge::weekday": "*", "cinder::cron::db_purge::user": "cinder", "cinder::cron::db_purge::age": "30", "cinder::cron::db_purge::destination": "/var/log/cinder/cinder-rowsflush.log", "cinder::cron::db_purge::maxdelay": "3600", "cinder::glance::glance_api_servers": "http://172.17.0.2:9293", "cinder::keystone::service_user::send_service_user_token": true, "cinder::keystone::service_user::project_name": "service", "cinder::keystone::service_user::auth_type": "password", "cinder::keystone::service_user::auth_url": "http://172.17.0.2:5000/", "cinder::keystone::service_user::password": "q4G6h4a5N51huVgDb7vMEqcRq", "cinder::keystone::service_user::region_name": "regionOne", "cinder::nova::interface": "admin", "cinder::nova::project_name": "service", "cinder::nova::auth_type": "password", "cinder::nova::auth_url": "http://172.17.0.2:5000/", "cinder::nova::password": "LS8Q05rmlMlHeKHPO1GdkVzQT", "cinder::nova::region_name": "regionOne", "cinder::scheduler::scheduler_driver": "cinder.scheduler.filter_scheduler.FilterScheduler"}, "service_config_settings": {"rsyslog": {"tripleo_logging_sources_cinder_scheduler": [{"tag": "openstack.cinder.scheduler", "file": "/var/log/containers/cinder/cinder-scheduler.log"}]}}, "puppet_config": {"config_volume": "cinder", "puppet_tags": "cinder_config,file,concat,file_line", "step_config": "include tripleo::profile::base::cinder::scheduler\n\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-api:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/cinder_scheduler.json": {"command": "/usr/bin/cinder-scheduler --config-file /usr/share/cinder/cinder-dist.conf --config-file /etc/cinder/cinder.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}], "permissions": [{"path": "/var/log/cinder", "owner": "cinder:cinder", "recurse": true}, {"path": "/etc/pki/tls/certs/etcd.crt", "owner": "cinder:cinder"}, {"path": "/etc/pki/tls/private/etcd.key", "owner": "cinder:cinder"}]}}, "docker_config": {"step_2": {"cinder_scheduler_init_logs": {"image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-scheduler:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/cinder:/var/log/cinder:z"], "command": ["/bin/bash", "-c", "chown -R cinder:cinder /var/log/cinder"]}}, "step_4": {"cinder_scheduler": {"image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-scheduler:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck 5672"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro", "/var/log/containers/cinder:/var/log/cinder:z", "/var/lib/kolla/config_files/cinder_scheduler.json:/var/lib/kolla/config_files/config.json:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "host_prep_tasks": [{"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/cinder", "setype": "container_file_t", "mode": "0750"}]}, {"name": "enable virt_sandbox_use_netlink for healthcheck", "seboolean": {"name": "virt_sandbox_use_netlink", "persistent": true, "state": true}, "when": ["ansible_facts.selinux is defined", "ansible_facts.selinux.status == \"enabled\""]}], "external_upgrade_tasks": [{"when": ["step|int == 1"], "tags": ["never", "system_upgrade_transfer_data", "system_upgrade_stop_services"], "block": [{"name": "Stop cinder scheduler container", "import_role": {"name": "tripleo_container_stop"}, "vars": {"tripleo_containers_to_stop": ["cinder_scheduler"], "tripleo_delegate_to": "{{ groups['cinder_scheduler'] | difference(groups['excluded_overcloud']) }}"}}]}]}, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "cinder_scheduler", "tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'docker_config')": {"step_2": {"cinder_scheduler_init_logs": {"image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-scheduler:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/cinder:/var/log/cinder:z"], "command": ["/bin/bash", "-c", "chown -R cinder:cinder /var/log/cinder"]}}, "step_4": {"cinder_scheduler": {"image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-scheduler:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck 5672"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro", "/var/log/containers/cinder:/var/log/cinder:z", "/var/lib/kolla/config_files/cinder_scheduler.json:/var/lib/kolla/config_files/config.json:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "tuple:('role_data', 'config_settings')": {"cinder::database_connection": "mysql+pymysql://cinder:q4G6h4a5N51huVgDb7vMEqcRq@172.17.0.2/cinder?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "cinder::logging::debug": true, "cinder::storage_availability_zone": "nova", "cinder::rabbit_heartbeat_timeout_threshold": 60, "cinder::rpc_response_timeout": 60, "cinder::rabbit_heartbeat_in_pthread": false, "cinder::db::database_db_max_retries": -1, "cinder::db::database_max_retries": -1, "cinder::cron::db_purge::minute": "1", "cinder::cron::db_purge::hour": "0", "cinder::cron::db_purge::monthday": "*", "cinder::cron::db_purge::month": "*", "cinder::cron::db_purge::weekday": "*", "cinder::cron::db_purge::user": "cinder", "cinder::cron::db_purge::age": "30", "cinder::cron::db_purge::destination": "/var/log/cinder/cinder-rowsflush.log", "cinder::cron::db_purge::maxdelay": "3600", "cinder::glance::glance_api_servers": "http://172.17.0.2:9293", "cinder::keystone::service_user::send_service_user_token": true, "cinder::keystone::service_user::project_name": "service", "cinder::keystone::service_user::auth_type": "password", "cinder::keystone::service_user::auth_url": "http://172.17.0.2:5000/", "cinder::keystone::service_user::password": "q4G6h4a5N51huVgDb7vMEqcRq", "cinder::keystone::service_user::region_name": "regionOne", "cinder::nova::interface": "admin", "cinder::nova::project_name": "service", "cinder::nova::auth_type": "password", "cinder::nova::auth_url": "http://172.17.0.2:5000/", "cinder::nova::password": "LS8Q05rmlMlHeKHPO1GdkVzQT", "cinder::nova::region_name": "regionOne", "cinder::scheduler::scheduler_driver": "cinder.scheduler.filter_scheduler.FilterScheduler"}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-17-t2yspfeno3yu/ba722a53-cad8-4340-af26-ea4ea65220bd"}


created_at: 2026-01-21 15:58:52.032443
data:
  {"type": "json", "value": {"ContainerCinderVolumeImage": "registry.redhat.io/rhosp-rhel9/openstack-cinder-volume:17.1", "ContainerCinderConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-cinder-api:17.1"}}


created_at: 2026-01-21 15:58:58.890461
data:
  {"value": {"ContainerCinderVolumeImage": "registry.redhat.io/rhosp-rhel9/openstack-cinder-volume:17.1", "ContainerCinderConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-cinder-api:17.1"}}


created_at: 2026-01-21 15:58:58.945619
data:
  {"container_config_scripts": {"container_puppet_apply.sh": {"mode": "0700", "content": "#!/bin/bash\nset -eux\nSTEP=$1\nTAGS=$2\nCONFIG=$3\nEXTRA_ARGS=${4:-''}\nif [ -d /tmp/puppet-etc ]; then\n  # ignore copy failures as these may be the same file depending on docker mounts\n  cp -a /tmp/puppet-etc/* /etc/puppet || true\nfi\necho \"{\\\"step\\\": ${STEP}}\" > /etc/puppet/hieradata/docker_puppet.json\n# $::deployment_type in puppet-tripleo\nexport FACTER_deployment_type=containers\nset +e\npuppet apply $EXTRA_ARGS \\\n    --verbose \\\n    --detailed-exitcodes \\\n    --summarize \\\n    --color=false \\\n    --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \\\n    --tags $TAGS \\\n    -e \"noop_resource('package'); ${CONFIG}\"\nrc=$?\nset -e\nset +ux\nif [ $rc -eq 2 -o $rc -eq 0 ]; then\n    exit 0\nfi\nexit $rc\n"}, "pyshim.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n#\n# Usage: pyshim.sh <script and/or arguments>\n#\n# Unfortunately THT doesn't know which version of python might be in a\n# container so we need this script to be able to try python3 or python2\n# depending on availability.  Since this is a temporary shim until we've\n# fully cut over to python3, we check for the existence of python3 first\n# before falling back to python2. This will help in the transition from\n# python2 based containers to python3.\n\nshow_usage() {\n    echo \"Usage: pyshim.sh <script and/or arguments>\"\n}\n\nif [ $# -lt 1 ]\nthen\n    show_usage\n    exit 1\nfi\n\nset -x\nif command -v python3 >/dev/null; then\n    python3 \"$@\"\nelif command -v python2 >/dev/null; then\n    python2 \"$@\"\nelif command -v python >/dev/null; then\n    python \"$@\"\nelse\n    echo \"ERROR: python is not available!\"\n    exit 1\nfi\n"}, "pacemaker_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nset -u\n\n# ./pacemaker_restart_bundle.sh mysql galera galera-bundle Master _\n# ./pacemaker_restart_bundle.sh redis redis redis-bundle Slave Master\n# ./pacemaker_restart_bundle.sh ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\nRESTART_SCRIPTS_DIR=$(dirname $0)\nTRIPLEO_SERVICE=$1\nRESOURCE_NAME=$2\nBUNDLE_NAME=$3\nWAIT_TARGET_LOCAL=$4\nWAIT_TARGET_ANYWHERE=${5:-_}\nTRIPLEO_MINOR_UPDATE=\"${TRIPLEO_MINOR_UPDATE:-false}\"\nTRIPLEO_HA_WRAPPER_RESOURCE_EXISTS=\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS:-false}\"\n\nbundle_can_be_restarted() {\n    local bundle=$1\n    # As long as the resource bundle is managed by pacemaker and is\n    # not meant to stay stopped, no matter the state of any inner\n    # pcmk_remote or ocf resource, we should restart it to give it a\n    # chance to read the new config.\n    [ \"$(crm_resource --meta -r $1 -g is-managed 2>/dev/null)\" != \"false\" ] && \\\n    [ \"$(crm_resource --meta -r $1 -g target-role 2>/dev/null)\" != \"Stopped\" ]\n}\n\nlog() {\n    local msg=$1\n    logger -t pcmkrestart \"$1\"\n}\n\nHOSTNAME=$(/bin/hostname -s)\nif [ x\"${TRIPLEO_MINOR_UPDATE,,}\" != x\"true\" ]; then\n    if [ x\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS,,}\" = x\"false\" ]; then\n        # Do not restart during initial deployment, as the resource\n        # has just been created.\n        SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n        if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n            log \"Initial deployment, skipping the restart of ${BUNDLE_NAME}\"\n\tfi\n        exit 0\n    else\n        # During a stack update, this script is called in parallel on\n        # every node the resource runs on, after the service's configs\n        # have been updated on all nodes. So we need to run pcs only\n        # once (e.g. on the service's boostrap node).\n        if bundle_can_be_restarted ${BUNDLE_NAME}; then\n            SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n            if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n                replicas_running=$(crm_resource -Q -r $BUNDLE_NAME --locate 2>&1 | wc -l)\n                if [ \"$replicas_running\" != \"0\" ]; then\n                    log \"Restarting ${BUNDLE_NAME} globally. Stopping:\"\n                    /sbin/pcs resource disable --wait=600 $BUNDLE_NAME\n                    log \"Restarting ${BUNDLE_NAME} globally. Starting:\"\n                    /sbin/pcs resource enable --wait=600 $BUNDLE_NAME\n                else\n                    log \"${BUNDLE_NAME} is not running anywhere,\" \\\n                         \"cleaning up to restart it globally if necessary\"\n                    /sbin/pcs resource cleanup $BUNDLE_NAME\n                fi\n            else\n                log \"Skipping global restart of ${BUNDLE_NAME} on ${HOSTNAME} it will be restarted by node ${SERVICE_NODEID}\"\n            fi\n\n        else\n            log \"No global restart needed for ${BUNDLE_NAME}.\"\n        fi\n    fi\nelse\n    # During a minor update workflow however, a host gets fully\n    # updated before updating the next one. So unlike stack\n    # update, at the time this script is called, the service's\n    # configs aren't updated on all nodes yet. So only restart the\n    # resource locally, where it's guaranteed that the config is\n    # up to date.\n    HOST=$(facter hostname)\n\n    if bundle_can_be_restarted ${BUNDLE_NAME}; then\n\t# if the resource is running locally, restart it\n\tif crm_resource -r $BUNDLE_NAME --locate 2>&1 | grep -w -q \"${HOST}\"; then\n            log \"Restarting ${BUNDLE_NAME} locally on '${HOST}'\"\n            /sbin/pcs resource restart $BUNDLE_NAME \"${HOST}\"\n\n\telse\n\t    # At this point, if no resource is running locally, it's\n\t    # either because a) it has failed previously, or b) because\n\t    # it's an A/P resource running elsewhere.\n\t    # By cleaning up resource, we ensure that a) it will try to\n\t    # restart, or b) it won't do anything if the resource is\n\t    # already running elsewhere.\n            log \"${BUNDLE_NAME} is currently not running on '${HOST}',\" \\\n                 \"cleaning up its state to restart it if necessary\"\n            /sbin/pcs resource cleanup $BUNDLE_NAME node=\"${HOST}\"\n\tfi\n\n\t# Wait until the resource is in the expected target state\n\t$RESTART_SCRIPTS_DIR/pacemaker_wait_bundle.sh \\\n            $RESOURCE_NAME $BUNDLE_NAME \\\n            \"$WAIT_TARGET_LOCAL\" \"$WAIT_TARGET_ANYWHERE\" \\\n\t    \"${HOST}\" 600\n    else\n        log \"No restart needed for ${BUNDLE_NAME}.\"\n    fi\nfi\n"}, "pacemaker_wait_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# ----\n# Wait for an OCF resource or a bundle to be restarted\n# ----\n# e.g.:\n# M/S OCF:      $0 galera galera-bundle Master\n# clone OCF:    $0 rabbitmq rabbitmq-bundle Started\n# A/P M/S OCF:  $0 redis redis-bundle Slave Master\n# A/P bundle:   $0 openstack-cinder-volume openstack-cinder-volume _ Started\n# clone bundle: $0 haproxy-bundle haproxy-bundle Started\n\n# design note 1:\n#  - this script is called during a minor update; it is called\n#    once per node that hosts a service replica.\n#  - the purpose of this script is to ensure that restarting the\n#    service replica locally won't disrupt the service availability\n#    for the end user. To reach that goal, the script waits until the\n#    service is restarted locally or globallu and reaches a given\n#    target state (i.e. Started, Slave or Master).\n# design note 2:\n#   - we don't want to track restart error: our only job is to ensure\n#     service restart synchronization, not service health.\n#   - In particular, we don't want to error out in case the resource\n#     cannot be restarted locally, because that would make the minor\n#     update fail, even if potentially other replicas still provide\n#     the service.\n# design note 3:\n#   - we can bail out early if we determine that the resource can't\n#     be restarted automatically by pacemaker (e.g. its \"blocked\",\n#     unmanaged or disabled).\n\nlog() {\n    local msg=$1\n    echo \"$(date -u): $1\"\n}\n\nusage() {\n    echo 2>&1 \"Usage: $0 NAME BUNDLE_NAME ROLE_LOCAL [ROLE_ANYWHERE] [HOST] [TIMEOUT]\"\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\n#\n# Utility functions to detect stuck resources\n#\n\nbundle_failures_locally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local replica_name\n    for i in $(seq 0 $last); do\n\treplica_name=${BUNDLE_NAME}-${engine}-${i}\n\tcrm_failcount -q -G -r $replica_name -N $HOST\n    done\n}\n\nbundle_failures_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    for i in $(seq 0 $last); do\n\tcrm_failcount -q -G -r ${BUNDLE_NAME}-${engine}-${i}\n    done\n}\n\nbundle_running_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    # return the number of running bundles replica, i.e. the number of\n    # docker/podman resource replicas currently running in the cluster\n    crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:heartbeat:${engine}']/node)\" -\n}\n\nocf_failures_globally() {\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local bundle_node\n    for i in $(seq 0 $last); do\n\tbundle_node=${BUNDLE_NAME}-${i}\n\tcrm_failcount -q -G -r $NAME -N $bundle_node\n    done\n}\n\ndid_resource_failed_locally() {\n    local failures\n    local running\n    local remotehost\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# if we're dealing with an ocf resource, it is running on a\n\t# pacemaker_remote rather that on the real host, and the\n\t# failcounts are thus associated to the pcmk remote. Replace\n\t# the host's name with the pcmk remote's name.\n        remotehost=$(crm_mon --as-xml | xmllint --xpath \"string(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource/node[@name='${HOST}']/../../resource[@resource_agent='${OCF}:pacemaker:remote']/@id)\" -)\n\tif [ -n \"${remotehost}\" ]; then\n\t    crm_failcount -q -G -r $NAME -N $remotehost | grep -q -w INFINITY\n\t    return $?\n\tfi\n\t# If no pcmk remote is currently running, the failcount from\n\t# the ocf resource is useless, compute the failcount from the\n\t# bundle case instead (computed below).\n    fi\n\n    # for bundles, pacemaker can run any bundle replica locally\n    # (e.g. galera-bundle-docker-{0,1,2}), and a failure happens when\n    # there are no more replica to try.\n    # That is, when _at least_ one replica failed locally, and all the\n    # others either failed or are currently running elsewhere.\n    failures=$(bundle_failures_locally $HOST | grep -c -w INFINITY)\n    running=$(bundle_running_globally)\n    test $failures -gt 0 && \\\n    test $(( $failures + $running )) -ge $BUNDLE_REPLICAS\n}\n\ndid_resource_failed_globally() {\n    local remotecount\n    local failures\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# we check the state of an ocf resource only if the\n\t# pcmkremotes are started\n        remotecount=$(crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node)\" -)\n\tif [ \"${remotecount}\" = \"0\" ]; then\n\t    # no pcmkremote is running, so check the bundle state\n\t    # instead of checking the ocf resource\n\t    # bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\t    failures=$(bundle_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\telse\n\t    # ocf resource failed if it failed to start on\n\t    # all $BUNDLE_REPLICAS bundle nodes\n\t    failures=$(ocf_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\tfi\n    else\n\t# bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\tfailures=$(bundle_failures_globally | grep -c -w INFINITY)\n\ttest $failures -eq $BUNDLE_REPLICAS\n    fi\n}\n\n\n# Input validation\n#\n\nNAME=$1\nif [ -z \"${NAME}\" ]; then\n    echo 2>&1 \"Error: argument NAME must not be empty\"\n    exit 1\nfi\n\nBUNDLE_NAME=$2\nif [ -z \"${BUNDLE_NAME}\" ]; then\n    echo 2>&1 \"Error: argument BUNDLE_NAME must not be empty\"\n    exit 1\nfi\n\nROLE_LOCAL=$3\nif [ \"${ROLE_LOCAL}\" = \"_\" ]; then\n    ROLE_LOCAL=\"\"\nfi\n\nROLE_ANYWHERE=$4\nif [ \"${ROLE_ANYWHERE}\" = \"_\" ]; then\n    ROLE_ANYWHERE=\"\"\nfi\n\nif [ -z \"${ROLE_LOCAL}\" ]; then\n    if [ -z \"${ROLE_ANYWHERE}\" ]; then\n        echo 2>&1 \"Error: either ROLE_LOCAL or ROLE_ANYWHERE must be non empty\"\n        exit 1\n    fi\nelse\n    if !(echo \"${ROLE_LOCAL}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n        echo 2>&1 \"Error: argument ROLE_LOCAL must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n        exit 1\n    fi\nfi\n\nif [ -n \"${ROLE_ANYWHERE}\" ] && !(echo \"${ROLE_ANYWHERE}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n    echo 2>&1 \"Error: argument ROLE_ANYWHERE must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n    exit 1\nfi\n\n# Ensure compatibility with pacemaker 2.1\nif pacemaker_supports_promoted; then\n    ROLE_LOCAL=$(echo \"$ROLE_LOCAL\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    ROLE_ANYWHERE=$(echo \"$ROLE_ANYWHERE\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    OCF=\"ocf\"\nelse\n    OCF=\"ocf:\"\nfi\n\nHOST=${5:-$(facter hostname)}\nTIMEOUT=${6:-600}\n\n\n# Configure the search\n# ----\n# Note: we can't use crm_resource in all searches because we can't\n# easily extract the host the OCF resources run on (crm_resource\n# returns the pcmk-remote nodes rather than the hosts)\n# So instead, we implement various searches with XPath directly.\n\nif [ \"${BUNDLE_NAME}\" != \"${NAME}\" ]; then\n# ocf resource\nlocal_resource_xpath=\"//bundle/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node[@name='${HOST}']/../../resource[@id='${NAME}']\"\nany_resource_xpath=\"//bundle//resource[@id='${NAME}']\"\nreplicas_xpath=\"//bundle/primitive[@id='${BUNDLE_NAME}']/../*[boolean(@image) and boolean(@replicas)]\"\nelse\n# bundle resource\nlocal_resource_xpath=\"//bundle[@id='${NAME}']/replica/resource/node[@name='${HOST}']/../../resource\"\nany_resource_xpath=\"//bundle[@id='${NAME}']//resource\"\nreplicas_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nfi\n\nbundle_def_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nBUNDLE_CONTAINER_ENGINE=$(cibadmin -Q | xmllint --xpath \"name(${bundle_def_xpath})\" -)\nBUNDLE_REPLICAS=$(cibadmin -Q | xmllint --xpath \"string(${bundle_def_xpath}/@replicas)\" -)\n\n\n# The wait algorithm follows a two-stage approach\n#  1. Depending on how the script is called, we first check whether\n#     the resource is restarted locally. An A/P resource may be\n#     restarted elsewhere in the cluster.\n#  2. If needed, check whether the A/P resource has restarted\n#     elsewhere. For A/P M/S resources, in case the resource is\n#     restarted as Slave locally, ensure a Master is available.\n\nsuccess=1\nbailout=1\ntimeout=$TIMEOUT\nrole=\"\"\n\n# Stage 1: local check\nif [ -n \"$ROLE_LOCAL\" ]; then\n    log \"Waiting until ${NAME} has restarted on ${HOST} and is in state ${ROLE_LOCAL}\"\n    log \"Will probe resource state with the following XPath pattern: ${local_resource_xpath}\"\n\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resource=$(crm_mon -r --as-xml | xmllint --xpath \"${local_resource_xpath}\" - 2>/dev/null)\n        role=$(echo \"${resource}\" | sed -ne 's/.*\\Wrole=\"\\([^\"]*\\)\".*/\\1/p')\n\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resource}\" | grep -q -w \"\\Wblocked=\\\"true\\\"\"; then\n            log \"${NAME} is blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_locally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif [ \"$role\" = \"$ROLE_LOCAL\" ]; then\n            success=0\n            continue\n        elif [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" = \"$ROLE_ANYWHERE\" ]; then\n            # A/P: we are restarted in the expected state\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_LOCAL} on ${HOST}\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\n# Stage 2: global check\nif [ $timeout -gt 0 ] && [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" != \"$ROLE_ANYWHERE\" ]; then\n    log \"Wait until ${NAME} is restarted anywhere in the cluster in state ${ROLE_ANYWHERE}\"\n    log \"Will probe resource state with the following XPath pattern: ${any_resource_xpath}\"\n\n    success=1\n    bailout=1\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resources=$(crm_mon -r --as-xml | xmllint --xpath \"${any_resource_xpath}\" - 2>/dev/null)\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif ! (echo \"${resources}\" | grep -q -w \"\\Wblocked=\\\"false\\\"\"); then\n            log \"${NAME} blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_globally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resources}\" | grep -q -w \"\\Wrole=\\\"${ROLE_ANYWHERE}\\\"\"; then\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_ANYWHERE} anywhere in the cluster\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\nif [ $timeout -le 0 ]; then\n    log \"Timeout reached after ${TIMEOUT}s while waiting for ${NAME} to be restarted\"\nelif [ $bailout -le 0 ]; then\n    log \"Restart monitoring for ${NAME} cancelled\"\nfi\n\nif [ $success -eq 0 ]; then\n    log \"${NAME} successfully restarted\"\nelse\n    log \"${NAME} was not restarted properly\"\nfi\n\n# Don't block minor update or stack update if the wait was unsuccessful\nexit 0\n"}, "wait-port-and-run.sh": {"mode": "0755", "content": "#!/usr/bin/bash\nset -eu\n\nHOST=$1\nPORT=$2\n\necho \"$(date -u): Checking whether we can bind to ${HOST}:${PORT}\"\nwhile (ss -Htnl src \"${HOST}\" \"sport = :${PORT}\" | grep -wq \"${PORT}\"); do\n    echo \"$(date -u): ${HOST}:${PORT} still in use, waiting...\";\n    sleep 10;\ndone\n\nshift 2\nCOMMAND=\"$*\"\nif [ -z \"${COMMAND}\" ]; then\n    COMMAND=\"true\"\nfi\nexec $COMMAND\n"}, "pacemaker_resource_lock.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nMAX_RETRIES=10\nCIB_ENOTFOUND=105\n\nusage() {\n   echo \"Set a global property in the cluster with a validity timestamp.\"\n   echo \"Usage:\"\n   echo \"   $0 --acquire <lock_name> <lock_owner> <lock_ttl_in_seconds>\"\n   echo \"   $0 --release <lock_name> <lock_owner>\"\n   echo\n}\n\nlog() {\n    echo \"$(date -u): $1\" 1>&2\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\nlock_create() {\n    local name=$1\n    local data=$2\n    # cibadmin won't overwrite a key if someone else succeeded to create it concurrently\n    cibadmin --sync-call --scope crm_config --create --xml-text \"<cluster_property_set id='${name}'><nvpair id='${name}-pair' name='${name}' value='${data}'/></cluster_property_set>\" &>/dev/null\n    return $?\n}\n\nlock_update() {\n    local name=$1\n    local expected_data=$2\n    local new_data=$3\n    # we only update the lock we expect to see, so we can't update someone else's lock\n    cibadmin --sync-call --scope crm_config --modify --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" --xml-text \"<nvpair id='${name}-pair' name='${name}' value='${new_data}'/>\" &>/dev/null\n    return $?\n}\n\nlock_delete() {\n    local name=$1\n    local expected_data=$2\n    # we only delete the lock we expect to see, so we can't delete someone else's lock\n    cibadmin --sync-call --scope crm_config --delete --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" &>/dev/null\n    return $?\n}\n\nlock_get() {\n    local lockname=$1\n    local res\n    local rc\n    res=$(cibadmin --query --scope crm_config --xpath \"//cluster_property_set/nvpair[@name='$lockname']\" 2>/dev/null)\n    rc=$?\n    if [ $rc -eq 0 ]; then\n        echo \"$res\" | sed -n 's/.*value=\"\\([^\"]*\\)\".*/\\1/p'\n    fi\n    return $rc\n}\n\nlock_owner() {\n    local lock=$1\n    echo \"$lock\" | cut -d':' -f1\n}\n\nlock_has_expired() {\n    local lock=$1\n    local expiry=$(echo \"$lock\" | cut -d':' -f2)\n    local now=$(date +%s)\n    test $now -ge $expiry\n}\n\n\n# Perform a lock action and restart if the CIB has been modified before\n# committing the lock action\ntry_action() {\n    local fun=$1\n    local lock=$2\n    local requester=$3\n    local args=${4:-}\n    local tries=$MAX_RETRIES\n    local rc=1\n    if [ \"$fun\" = \"lock_acquire\" ] || [ \"$fun\" = \"lock_release\" ]; then\n        log \"Try running $fun\"\n    else\n        return 2\n    fi\n    while [ $rc -ne 0 ]; do\n        $fun $lock $requester $args\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Operation $1 succeeded\"\n            return 0\n        elif [ $rc -eq 3 ]; then\n            # rc == 3 -> CIB changed before push\n            if [ $tries -eq 0 ]; then\n                log \"Failed to commit after $MAX_RETRIES retries. Bailing out.\"\n                return 2\n            else\n                log \"Failed to commit. Retrying operation.\"\n                tries=$(($tries - 1))\n            fi\n        elif [ $rc -eq 2 ]; then\n            # rc == 2 -> unrecoverable cib error (e.g. pacemaker down)\n            log \"Unexpected failure. Bailing out\"\n            return $rc\n        else\n            # rc == 1 -> lock error (not owner, lock doesn't exists)\n            return $rc\n        fi\n    done\n}\n\n# The lock mechanism uses cibadmin's atomic creation so cluster-wide\n# state coherency is guaranteed by pacemaker\nlock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc\n    local lock\n    local expiry\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -n \"$lock\" ]; then\n        lock_has_expired $lock\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Lock has expired, now available for being held\"\n        else\n            # lock is still held. check whether we're the owner\n            owner=$(lock_owner $lock)\n            if [ \"$owner\" = \"$requester\" ];then\n                log \"Requester already owns the lock, acquiring attempt will just reconfigure the TTL\"\n            else\n                log \"Lock is held by someone else ($owner)\"\n                return 1\n            fi\n        fi\n    else\n        log \"Lock is not held yet\"\n    fi\n\n    # prepare the lock info\n    expiry=$(($(date +%s) + $ttl))\n\n    if [ -n \"$lock\" ]; then\n        log \"Attempting to update the lock\"\n        lock_update $lockname \"$lock\" \"$requester:$expiry\"\n        rc=$?\n    else\n        log \"Attempting to acquire the lock\"\n        lock_create $lockname \"$requester:$expiry\"\n        rc=$?\n    fi\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' acquired by '$requester', valid until $(date -d @$expiry)\"\n        return 0\n    else\n        log \"CIB changed, lock cannot be acquired\"\n        return 3\n    fi\n}\n\n\n# The lock mechanism uses the CIB's num_updates tag to implement\n# a conditional store. Cluster-wide locking is guaranteed by pacemaker\nlock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n    local lock\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        log \"Lock doesn't exist. Nothing to release\"\n        return 0\n    else\n        log \"Lock exists, check whether we're the owner\"\n        owner=$(lock_owner $lock)\n        if [ \"$owner\" != \"$requester\" ];then\n            log \"Lock is held by someone else ($owner), will not unlock\"\n            return 1\n        fi\n    fi\n\n    lock_delete $lockname \"$lock\"\n    rc=$?\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' released by '$requester'\"\n        return 0\n    else\n        log \"CIB deletion error, lock cannot be released\"\n        return 3\n    fi\n}\n\n\n# Retrieve the owner of a lock from the CIB\n# this is a read-only operation, so no need to log debug info\nlock_get_owner() {\n    local lockname=$1\n    local rc\n    local lock\n    local owner\n\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        return 1\n    else\n        lock_owner $lock\n        return 0\n    fi\n}\n\n\nACTION=$1\nLOCKNAME=$2\nREQUESTER=$3\nTTL=${4:-60}\n\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nif [ $ACTION != \"--help\" ]; then\n    if [ -z \"$LOCKNAME\" ]; then\n        error \"You must specific a lock name\"\n    fi\n    if [ $ACTION != \"--owner\" ] && [ $ACTION != \"-o\" ]; then\n        if [ -z \"$REQUESTER\" ]; then\n            error \"You must specific a lock requester\"\n        fi\n    fi\nfi\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) try_action lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --release|-r) try_action lock_release $LOCKNAME $REQUESTER;;\n    --acquire-once|-A) lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --owner|-o) lock_get_owner $LOCKNAME;;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}, "pacemaker_mutex_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_restart_bundle.sh --lock mysql galera galera-bundle Master _\n# pacemaker_mutex_restart_bundle.sh --lock ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\n\nset -u\n\nusage() {\n    echo \"Restart a clustered resource in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --lock <tripleo-service> <pcmk-resource> <pcmk-bundle> <target-state-local> <target-state-cluster>\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\nACTION=$1\ncase $ACTION in\n    --help) usage; exit 0;;\n    --lock) ;;\n    *) error \"Unknown action '$ACTION'\";;\nesac\n\nTRIPLEO_SERVICE=$2\nLOCK_NAME=${TRIPLEO_SERVICE}-restart-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to restart resource $TRIPLEO_SERVICE\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\nRESOURCE_NAME=$3\nBUNDLE_NAME=$4\nWAIT_TARGET_LOCAL=$5\nWAIT_TARGET_ANYWHERE=${6:-_}\n\nif pacemaker_supports_promoted; then\n    WAIT_TARGET_LOCAL=$(echo \"$5\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    WAIT_TARGET_ANYWHERE=$(echo \"${6:-_}\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    promoted_role=\"Promoted\"\nelse\n    promoted_role=\"Master\"\nfi\n\n# The lock TTL should accomodate for the resource start/promote timeout\nif [ \"$RESOURCE_NAME\" != \"$BUNDLE_NAME\" ]; then\n    if [ \"$WAIT_TARGET_LOCAL\" = \"$promoted_role\" ] || [ \"$WAIT_TARGET_ANYWHERE\" = \"$promoted_role\" ]; then\n        rsc_op=\"promote\"\n    else\n        rsc_op=\"start\"\n    fi\n    # <op id=\"galera-promote-interval-0s\" interval=\"0s\" name=\"promote\" on-fail=\"block\" timeout=\"300s\"/>\n    PCMK_TTL=$(cibadmin -Q | xmllint -xpath \"string(//primitive[@id='${RESOURCE_NAME}']/operations/op[@name='${rsc_op}']/@timeout)\" - | sed 's/s$//')\n    LOCK_TTL=$((PCMK_TTL + 30))\nelse\n    # The podman RA's default start timeout\n    LOCK_TTL=90\nfi\n\nlog \"Acquire a ${LOCK_TTL}s restart lock for service $TRIPLEO_SERVICE before restarting it\"\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nrc=1\nwhile [ $rc -ne 0 ]; do\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire $LOCK_NAME $LOCK_OWNER $LOCK_TTL\n    rc=$?\n    if [ $rc != 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not acquire lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Could not acquire lock, retrying\"\n            sleep 10\n        fi\n    fi\ndone\n\nlog \"Restart the service $TRIPLEO_SERVICE locally\"\n# Reuse the local restart script in t-h-t (driven by env var TRIPLEO_MINOR_UPDATE)\nTRIPLEO_MINOR_UPDATE=true /var/lib/container-config-scripts/pacemaker_restart_bundle.sh $TRIPLEO_SERVICE $RESOURCE_NAME $BUNDLE_NAME $WAIT_TARGET_LOCAL $WAIT_TARGET_ANYWHERE\n\n# If we reached this point, always try to release the lock\nlog \"Release the restart lock for service $TRIPLEO_SERVICE\"\n/var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $LOCK_NAME $LOCK_OWNER\nrc=$?\nif [ $rc -ne 0 ] && [ $rc -ne 1 ]; then\n    error \"Could not release held lock (rc: $rc)\"\nfi\n"}, "pacemaker_mutex_shutdown.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_shutdown.sh --acquire\n# pacemaker_mutex_shutdown.sh --release\n\nset -u\n\nusage() {\n    echo \"Shutdown a cluster node in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --acquire # prevent other node from shutting down until we hold the lock\"\n    echo \"   $0 --release # release the lock, other node can compete for the shutdown lock\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nshutdown_lock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc=1\n    local current_owner\n    local owner_stopped\n    local owner_rc\n\n    log \"Acquiring the shutdown lock\"\n    while [ $rc -ne 0 ]; do\n        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire-once $lockname $requester $ttl\n        rc=$?\n        if [ $rc -ne 0 ]; then\n            if [ $rc -eq 2 ]; then\n                error \"Could not acquire the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n            else\n                # The lock is held by another node.\n                current_owner=$(/var/lib/container-config-scripts/pacemaker_resource_lock.sh --owner $lockname)\n                owner_rc=$?\n                if [ $owner_rc -eq 2 ]; then\n                    error \"Could not get the shutdown lock owner due to unrecoverable error (rc: $owner_rc), bailing out\"\n                fi\n                if [ $owner_rc -eq 0 ]; then\n                    # If the owner is marked as offline, that means it has shutdown and\n                    # we can clean the lock preemptively and try to acquire it.\n                    owner_stopped=$(crm_mon -1X | xmllint --xpath 'count(//nodes/node[@name=\"'${current_owner}'\" and @online=\"false\" and @unclean=\"false\"])' -)\n                    if [ \"${owner_stopped}\" = \"1\" ]; then\n                        log \"Shutdown lock held by stopped node '${current_owner}', lock can be released\"\n                        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $current_owner\n                        continue\n                    fi\n                fi\n                log \"Shutdown lock held by another node (rc: $rc), retrying\"\n                sleep 10\n            fi\n        fi\n    done\n    log \"Shutdown lock acquired\"\n    return 0\n}\n\n\n# Release the lock if we still own it. Not owning it anymore is not fatal\nshutdown_lock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n\n    log \"Releasing the shutdown lock\"\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $requester\n    rc=$?\n    if [ $rc -ne 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not release the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Shutdown lock no longer held, nothing to do\"\n        fi\n    else\n        log \"Shutdown lock released\"\n    fi\n    return 0\n}\n\n\nACTION=$1\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nLOCK_NAME=tripleo-shutdown-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to aquire the shutdown lock\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\n# We start with a very high TTL, that long enough to accomodate a cluster stop.\n# As soon as the node will get offline, the other competing node will be entitled\n# to steal the lock, so they should never wait that long in practice.\nLOCK_TTL=600\n\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) shutdown_lock_acquire ${LOCK_NAME} ${LOCK_OWNER} ${LOCK_TTL};;\n    --release|-r) shutdown_lock_release ${LOCK_NAME} ${LOCK_OWNER};;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-18-we2j4xvmzvly-ContainersCommon-5pgzki4cj4b6/fffea443-683e-43ee-82ab-e2f1ecbcd6a4"}


created_at: 2026-01-21 15:58:59.096913
data:
  {"cinder_nvmeof_volumes": null, "cinder_nvmeof_host_prep_tasks": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-18-we2j4xvmzvly-CinderCommon-36gmja3p6avc-CinderNVMeOF-gib2rz3fxsbx/20f702e1-b7dc-4a5b-a4c6-e3b14202b464"}


created_at: 2026-01-21 15:58:59.145457
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-18-we2j4xvmzvly-CinderCommon-36gmja3p6avc-ContainersCommon-gzplwwm7yjca/2e11b5c7-9a02-4e64-baf0-6b6486556e3e"}


created_at: 2026-01-21 15:58:59.161218
data:
  {"cinder_common_kolla_config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-iscsid/*", "dest": "/etc/iscsi/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}], "cinder_common_kolla_permissions": [{"path": "/var/log/cinder", "owner": "cinder:cinder", "recurse": true}, {"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "cinder:cinder", "perm": "0600"}, {"path": "/etc/pki/tls/certs/etcd.crt", "owner": "cinder:cinder"}, {"path": "/etc/pki/tls/private/etcd.key", "owner": "cinder:cinder"}], "cinder_volume_environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}, "cinder_volume_host_prep_tasks": [{"name": "create fcontext entry for cinder data", "community.general.sefcontext": {"target": "/var/lib/cinder(/.*)?", "setype": "container_file_t", "state": "present"}}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/log/containers/cinder", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/lib/cinder", "setype": "container_file_t"}]}, {"name": "ensure ceph configurations exist", "file": {"path": "/var/lib/tripleo-config/ceph", "state": "directory"}}, {"name": "Support using an NFS share for cinder image conversion", "vars": {"image_conversion_nfs_enabled": false}, "when": ["image_conversion_nfs_enabled|bool"], "block": [{"name": "Create cinder image conversion directory", "file": {"path": "/var/lib/cinder_image_conversion", "state": "directory"}}, {"name": "Mount cinder's image conversion NFS share", "vars": {"image_conversion_nfs_share": "", "image_conversion_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"path": "/var/lib/cinder_image_conversion", "state": "mounted", "fstype": "nfs4", "src": "{{ image_conversion_nfs_share }}", "opts": "{{ image_conversion_nfs_options }}"}}]}, {"name": "cinder_configure_lvm fact", "set_fact": {"cinder_configure_lvm": false}}, {"when": "cinder_configure_lvm|bool", "block": [{"name": "ensure LVM rpm dependencies are installed", "package": {"name": "lvm2", "state": "latest"}}, {"name": "cinder create LVM volume group dd", "command": "dd if=/dev/zero of=/var/lib/cinder/cinder-volumes bs=1 count=0 seek=10280M", "args": {"creates": "/var/lib/cinder/cinder-volumes"}}, {"name": "Get or create LVM loopback device", "shell": "exit_code=0\nexisting_device=$(losetup -j /var/lib/cinder/cinder-volumes -l -n -O NAME)\nif [[ -z \"${existing_device}\" ]]; then\n    losetup -f /var/lib/cinder/cinder-volumes --show\n    exit_code=2\nelse\n    echo ${existing_device%$'\\n'*}\nfi\nexit ${exit_code}", "args": {"executable": "/bin/bash"}, "register": "_loopback_device", "changed_when": "_loopback_device.rc == 2", "failed_when": "_loopback_device.rc not in [0,2]"}, {"name": "Create LVM volume group", "community.general.lvg": {"vg": "cinder-volumes", "pvs": "{{ _loopback_device.stdout }}", "state": "present"}, "when": ["not (ansible_check_mode | bool)"]}, {"name": "cinder create service to run losetup for LVM on startup", "copy": {"dest": "/etc/systemd/system/cinder-lvm-losetup.service", "content": "[Unit]\nDescription=Cinder LVM losetup\nDefaultDependencies=no\nConflicts=umount.target\nRequires=lvm2-monitor.service systemd-udev-settle.service\nBefore=local-fs.target umount.target\nAfter=var.mount lvm2-monitor.service systemd-udev-settle.service\n\n[Service]\nType=oneshot\nExecStart=/sbin/losetup {{ _loopback_device.stdout }} /var/lib/cinder/cinder-volumes\nExecStop=/sbin/losetup -d {{ _loopback_device.stdout }}\nRemainAfterExit=yes\n\n[Install]\nWantedBy=local-fs-pre.target\n"}, "when": ["not (ansible_check_mode | bool)"]}, {"name": "cinder enable the LVM losetup service", "systemd": {"name": "cinder-lvm-losetup", "enabled": true, "daemon_reload": true}}]}], "cinder_volume_volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro", "/var/log/containers/cinder:/var/log/cinder:z", "/var/lib/kolla/config_files/cinder_volume.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/lib/modules:/lib/modules:ro", "/dev:/dev", "/run:/run", "/sys:/sys", "/var/lib/cinder:/var/lib/cinder:z", "/var/lib/iscsi:/var/lib/iscsi:z"], "cinder_volume_upgrade_tasks": [{"name": "cinder-volume pre system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 3", "upgrade_leapp_enabled"], "block": [{"name": "Unmount cinder's image conversion NFS share", "vars": {"image_conversion_nfs_share": "", "image_conversion_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0", "image_conversion_nfs_enabled": false}, "when": "image_conversion_nfs_enabled|bool", "mount": {"path": "/var/lib/cinder_image_conversion", "state": "absent", "fstype": "nfs4"}}]}, {"name": "cinder-volume post system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 5", "upgrade_leapp_enabled"], "block": [{"name": "Support using an NFS share for cinder image conversion", "vars": {"image_conversion_nfs_enabled": false}, "when": ["image_conversion_nfs_enabled|bool"], "block": [{"name": "Create cinder image conversion directory", "file": {"path": "/var/lib/cinder_image_conversion", "state": "directory"}}, {"name": "Mount cinder's image conversion NFS share", "vars": {"image_conversion_nfs_share": "", "image_conversion_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"path": "/var/lib/cinder_image_conversion", "state": "mounted", "fstype": "nfs4", "src": "{{ image_conversion_nfs_share }}", "opts": "{{ image_conversion_nfs_options }}"}}]}]}], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-18-we2j4xvmzvly-CinderCommon-36gmja3p6avc/e1a80a2b-dee7-4834-b626-3ebbab092229"}


created_at: 2026-01-21 15:58:59.190468
data:
  {"tuple:('role_data', 'step_config')": "include tripleo::profile::base::database::mysql::client", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-18-we2j4xvmzvly-MySQLClient-noaynaopfy2y/ac9edd9f-650b-4088-a7d5-8ad8268de4ab"}


created_at: 2026-01-21 15:58:59.299804
data:
  {"healthcheck_rpc_port": {"test": "/openstack/healthcheck 5672"}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-18-we2j4xvmzvly-CinderBase-i6ew7tyrxozc-ContainersCommon-zyq3j34sck4v/4ea07271-8a43-49f2-a695-83be4e7f7334"}


created_at: 2026-01-21 15:58:59.450496
data:
  {"cinder_nvmeof_volumes": null, "cinder_nvmeof_host_prep_tasks": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-18-we2j4xvmzvly-CinderBase-i6ew7tyrxozc-CinderCommon-7dygemztimnc-CinderNVMeOF-k3yioxpiszrd/68c7f5ee-5b4c-490c-955e-06a7814ca730"}


created_at: 2026-01-21 15:58:59.502435
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-18-we2j4xvmzvly-CinderBase-i6ew7tyrxozc-CinderCommon-7dygemztimnc-ContainersCommon-3h3f427iqng4/f26433ea-b828-4ad2-9043-1025a7540402"}


created_at: 2026-01-21 15:58:59.518840
data:
  {"cinder_common_kolla_config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-iscsid/*", "dest": "/etc/iscsi/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}], "cinder_volume_config_settings": {}, "cinder_common_kolla_permissions": [{"path": "/var/log/cinder", "owner": "cinder:cinder", "recurse": true}, {"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "cinder:cinder", "perm": "0600"}, {"path": "/etc/pki/tls/certs/etcd.crt", "owner": "cinder:cinder"}, {"path": "/etc/pki/tls/private/etcd.key", "owner": "cinder:cinder"}], "cinder_volume_environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}, "cinder_volume_host_prep_tasks": [{"name": "create fcontext entry for cinder data", "community.general.sefcontext": {"target": "/var/lib/cinder(/.*)?", "setype": "container_file_t", "state": "present"}}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/log/containers/cinder", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/lib/cinder", "setype": "container_file_t"}]}, {"name": "ensure ceph configurations exist", "file": {"path": "/var/lib/tripleo-config/ceph", "state": "directory"}}, {"name": "Support using an NFS share for cinder image conversion", "vars": {"image_conversion_nfs_enabled": false}, "when": ["image_conversion_nfs_enabled|bool"], "block": [{"name": "Create cinder image conversion directory", "file": {"path": "/var/lib/cinder_image_conversion", "state": "directory"}}, {"name": "Mount cinder's image conversion NFS share", "vars": {"image_conversion_nfs_share": "", "image_conversion_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"path": "/var/lib/cinder_image_conversion", "state": "mounted", "fstype": "nfs4", "src": "{{ image_conversion_nfs_share }}", "opts": "{{ image_conversion_nfs_options }}"}}]}, {"name": "cinder_configure_lvm fact", "set_fact": {"cinder_configure_lvm": false}}, {"when": "cinder_configure_lvm|bool", "block": [{"name": "ensure LVM rpm dependencies are installed", "package": {"name": "lvm2", "state": "latest"}}, {"name": "cinder create LVM volume group dd", "command": "dd if=/dev/zero of=/var/lib/cinder/cinder-volumes bs=1 count=0 seek=10280M", "args": {"creates": "/var/lib/cinder/cinder-volumes"}}, {"name": "Get or create LVM loopback device", "shell": "exit_code=0\nexisting_device=$(losetup -j /var/lib/cinder/cinder-volumes -l -n -O NAME)\nif [[ -z \"${existing_device}\" ]]; then\n    losetup -f /var/lib/cinder/cinder-volumes --show\n    exit_code=2\nelse\n    echo ${existing_device%$'\\n'*}\nfi\nexit ${exit_code}", "args": {"executable": "/bin/bash"}, "register": "_loopback_device", "changed_when": "_loopback_device.rc == 2", "failed_when": "_loopback_device.rc not in [0,2]"}, {"name": "Create LVM volume group", "community.general.lvg": {"vg": "cinder-volumes", "pvs": "{{ _loopback_device.stdout }}", "state": "present"}, "when": ["not (ansible_check_mode | bool)"]}, {"name": "cinder create service to run losetup for LVM on startup", "copy": {"dest": "/etc/systemd/system/cinder-lvm-losetup.service", "content": "[Unit]\nDescription=Cinder LVM losetup\nDefaultDependencies=no\nConflicts=umount.target\nRequires=lvm2-monitor.service systemd-udev-settle.service\nBefore=local-fs.target umount.target\nAfter=var.mount lvm2-monitor.service systemd-udev-settle.service\n\n[Service]\nType=oneshot\nExecStart=/sbin/losetup {{ _loopback_device.stdout }} /var/lib/cinder/cinder-volumes\nExecStop=/sbin/losetup -d {{ _loopback_device.stdout }}\nRemainAfterExit=yes\n\n[Install]\nWantedBy=local-fs-pre.target\n"}, "when": ["not (ansible_check_mode | bool)"]}, {"name": "cinder enable the LVM losetup service", "systemd": {"name": "cinder-lvm-losetup", "enabled": true, "daemon_reload": true}}]}], "cinder_volume_volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro", "/var/log/containers/cinder:/var/log/cinder:z", "/var/lib/kolla/config_files/cinder_volume.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/lib/modules:/lib/modules:ro", "/dev:/dev", "/run:/run", "/sys:/sys", "/var/lib/cinder:/var/lib/cinder:z", "/var/lib/iscsi:/var/lib/iscsi:z"], "cinder_volume_upgrade_tasks": [{"name": "cinder-volume pre system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 3", "upgrade_leapp_enabled"], "block": [{"name": "Unmount cinder's image conversion NFS share", "vars": {"image_conversion_nfs_share": "", "image_conversion_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0", "image_conversion_nfs_enabled": false}, "when": "image_conversion_nfs_enabled|bool", "mount": {"path": "/var/lib/cinder_image_conversion", "state": "absent", "fstype": "nfs4"}}]}, {"name": "cinder-volume post system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 5", "upgrade_leapp_enabled"], "block": [{"name": "Support using an NFS share for cinder image conversion", "vars": {"image_conversion_nfs_enabled": false}, "when": ["image_conversion_nfs_enabled|bool"], "block": [{"name": "Create cinder image conversion directory", "file": {"path": "/var/lib/cinder_image_conversion", "state": "directory"}}, {"name": "Mount cinder's image conversion NFS share", "vars": {"image_conversion_nfs_share": "", "image_conversion_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"path": "/var/lib/cinder_image_conversion", "state": "mounted", "fstype": "nfs4", "src": "{{ image_conversion_nfs_share }}", "opts": "{{ image_conversion_nfs_options }}"}}]}]}], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-18-we2j4xvmzvly-CinderBase-i6ew7tyrxozc-CinderCommon-7dygemztimnc/5b4326cd-5be4-47ad-a13f-6fda5378d913"}


created_at: 2026-01-21 15:58:59.543168
data:
  {"tuple:('role_data', 'step_config')": "include tripleo::profile::base::database::mysql::client", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-18-we2j4xvmzvly-CinderBase-i6ew7tyrxozc-MySQLClient-pq6ady5ekbot/ddfb6d18-7bf2-4ffc-88de-7c895fcb87a8"}


created_at: 2026-01-21 15:58:59.606981
data:
  {"tuple:('role_data', 'config_settings')": {"cinder::database_connection": "mysql+pymysql://cinder:q4G6h4a5N51huVgDb7vMEqcRq@172.17.0.2/cinder?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "cinder::logging::debug": true, "cinder::storage_availability_zone": "nova", "cinder::rabbit_heartbeat_timeout_threshold": 60, "cinder::rpc_response_timeout": 60, "cinder::rabbit_heartbeat_in_pthread": false, "cinder::db::database_db_max_retries": -1, "cinder::db::database_max_retries": -1, "cinder::cron::db_purge::minute": "1", "cinder::cron::db_purge::hour": "0", "cinder::cron::db_purge::monthday": "*", "cinder::cron::db_purge::month": "*", "cinder::cron::db_purge::weekday": "*", "cinder::cron::db_purge::user": "cinder", "cinder::cron::db_purge::age": "30", "cinder::cron::db_purge::destination": "/var/log/cinder/cinder-rowsflush.log", "cinder::cron::db_purge::maxdelay": "3600", "cinder::glance::glance_api_servers": "http://172.17.0.2:9293", "cinder::keystone::service_user::send_service_user_token": true, "cinder::keystone::service_user::project_name": "service", "cinder::keystone::service_user::auth_type": "password", "cinder::keystone::service_user::auth_url": "http://172.17.0.2:5000/", "cinder::keystone::service_user::password": "q4G6h4a5N51huVgDb7vMEqcRq", "cinder::keystone::service_user::region_name": "regionOne", "cinder::nova::interface": "admin", "cinder::nova::project_name": "service", "cinder::nova::auth_type": "password", "cinder::nova::auth_url": "http://172.17.0.2:5000/", "cinder::nova::password": "LS8Q05rmlMlHeKHPO1GdkVzQT", "cinder::nova::region_name": "regionOne"}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-18-we2j4xvmzvly-CinderBase-i6ew7tyrxozc-CinderBase-kcpqvmiuev35/42ab7a2d-68c0-4908-8249-b55eb6e857a0"}


created_at: 2026-01-21 15:58:59.621417
data:
  {"tuple:('role_data', 'firewall_rules')": {"120 iscsi initiator": {"dport": 3260}}, "tuple:('role_data', 'service_config_settings')": {"rsyslog": {"tripleo_logging_sources_cinder_volume": [{"tag": "openstack.cinder.volume", "file": "/var/log/containers/cinder/cinder-volume.log"}]}}, "tuple:('role_data', 'config_settings')": {"cinder::database_connection": "mysql+pymysql://cinder:q4G6h4a5N51huVgDb7vMEqcRq@172.17.0.2/cinder?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "cinder::logging::debug": true, "cinder::storage_availability_zone": "nova", "cinder::rabbit_heartbeat_timeout_threshold": 60, "cinder::rpc_response_timeout": 60, "cinder::rabbit_heartbeat_in_pthread": false, "cinder::db::database_db_max_retries": -1, "cinder::db::database_max_retries": -1, "cinder::cron::db_purge::minute": "1", "cinder::cron::db_purge::hour": "0", "cinder::cron::db_purge::monthday": "*", "cinder::cron::db_purge::month": "*", "cinder::cron::db_purge::weekday": "*", "cinder::cron::db_purge::user": "cinder", "cinder::cron::db_purge::age": "30", "cinder::cron::db_purge::destination": "/var/log/cinder/cinder-rowsflush.log", "cinder::cron::db_purge::maxdelay": "3600", "cinder::glance::glance_api_servers": "http://172.17.0.2:9293", "cinder::keystone::service_user::send_service_user_token": true, "cinder::keystone::service_user::project_name": "service", "cinder::keystone::service_user::auth_type": "password", "cinder::keystone::service_user::auth_url": "http://172.17.0.2:5000/", "cinder::keystone::service_user::password": "q4G6h4a5N51huVgDb7vMEqcRq", "cinder::keystone::service_user::region_name": "regionOne", "cinder::nova::interface": "admin", "cinder::nova::project_name": "service", "cinder::nova::auth_type": "password", "cinder::nova::auth_url": "http://172.17.0.2:5000/", "cinder::nova::password": "LS8Q05rmlMlHeKHPO1GdkVzQT", "cinder::nova::region_name": "regionOne", "tripleo::profile::base::lvm::enable_udev": false, "tripleo::profile::base::cinder::volume::cinder_enable_iscsi_backend": false, "tripleo::profile::base::cinder::volume::cinder_enable_nfs_backend": false, "tripleo::profile::base::cinder::volume::cinder_enable_rbd_backend": true, "tripleo::profile::base::cinder::volume::cinder_volume_cluster": "", "tripleo::profile::base::cinder::volume::nfs::cinder_nfs_mount_options": "context=system_u:object_r:container_file_t:s0", "tripleo::profile::base::cinder::volume::nfs::cinder_nfs_servers": [], "tripleo::profile::base::cinder::volume::nfs::cinder_nfs_snapshot_support": false, "tripleo::profile::base::cinder::volume::nfs::cinder_nas_secure_file_operations": "False", "tripleo::profile::base::cinder::volume::nfs::cinder_nas_secure_file_permissions": "False", "tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_helper": "lioadm", "tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_protocol": "iscsi", "tripleo::profile::base::cinder::volume::rbd::backend_name": ["tripleo_ceph"], "tripleo::profile::base::cinder::volume::rbd::cinder_rbd_ceph_conf": "/etc/ceph/ceph.conf", "tripleo::profile::base::cinder::volume::rbd::cinder_rbd_pool_name": "volumes", "tripleo::profile::base::cinder::volume::rbd::cinder_rbd_extra_pools": [], "tripleo::profile::base::cinder::volume::rbd::cinder_rbd_secret_uuid": "41e4325c-1291-5fe0-8134-34414eb23649", "tripleo::profile::base::cinder::volume::rbd::cinder_rbd_user_name": "openstack", "tripleo::profile::base::cinder::volume::rbd::cinder_rbd_flatten_volume_from_snapshot": false, "tripleo::profile::base::cinder::volume::rbd::multi_config": {}, "tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_address": "%{hiera('storage')}"}, "tuple:('role_data', 'monitoring_subscription')": "overcloud-cinder-volume", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-18-we2j4xvmzvly-CinderBase-i6ew7tyrxozc/41607a85-1967-479f-ad42-0fb00e60749d"}


created_at: 2026-01-21 15:58:59.635649
data:
  {"tuple:('role_data', 'step_config')": null, "role_data": {"service_name": "cinder_volume", "firewall_rules": {"120 iscsi initiator": {"dport": 3260}}, "monitoring_subscription": "overcloud-cinder-volume", "config_settings": {"cinder::database_connection": "mysql+pymysql://cinder:q4G6h4a5N51huVgDb7vMEqcRq@172.17.0.2/cinder?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "cinder::logging::debug": true, "cinder::storage_availability_zone": "nova", "cinder::rabbit_heartbeat_timeout_threshold": 60, "cinder::rpc_response_timeout": 60, "cinder::rabbit_heartbeat_in_pthread": false, "cinder::db::database_db_max_retries": -1, "cinder::db::database_max_retries": -1, "cinder::cron::db_purge::minute": "1", "cinder::cron::db_purge::hour": "0", "cinder::cron::db_purge::monthday": "*", "cinder::cron::db_purge::month": "*", "cinder::cron::db_purge::weekday": "*", "cinder::cron::db_purge::user": "cinder", "cinder::cron::db_purge::age": "30", "cinder::cron::db_purge::destination": "/var/log/cinder/cinder-rowsflush.log", "cinder::cron::db_purge::maxdelay": "3600", "cinder::glance::glance_api_servers": "http://172.17.0.2:9293", "cinder::keystone::service_user::send_service_user_token": true, "cinder::keystone::service_user::project_name": "service", "cinder::keystone::service_user::auth_type": "password", "cinder::keystone::service_user::auth_url": "http://172.17.0.2:5000/", "cinder::keystone::service_user::password": "q4G6h4a5N51huVgDb7vMEqcRq", "cinder::keystone::service_user::region_name": "regionOne", "cinder::nova::interface": "admin", "cinder::nova::project_name": "service", "cinder::nova::auth_type": "password", "cinder::nova::auth_url": "http://172.17.0.2:5000/", "cinder::nova::password": "LS8Q05rmlMlHeKHPO1GdkVzQT", "cinder::nova::region_name": "regionOne", "tripleo::profile::base::lvm::enable_udev": false, "tripleo::profile::base::cinder::volume::cinder_enable_iscsi_backend": false, "tripleo::profile::base::cinder::volume::cinder_enable_nfs_backend": false, "tripleo::profile::base::cinder::volume::cinder_enable_rbd_backend": true, "tripleo::profile::base::cinder::volume::cinder_volume_cluster": "", "tripleo::profile::base::cinder::volume::nfs::cinder_nfs_mount_options": "context=system_u:object_r:container_file_t:s0", "tripleo::profile::base::cinder::volume::nfs::cinder_nfs_servers": [], "tripleo::profile::base::cinder::volume::nfs::cinder_nfs_snapshot_support": false, "tripleo::profile::base::cinder::volume::nfs::cinder_nas_secure_file_operations": "False", "tripleo::profile::base::cinder::volume::nfs::cinder_nas_secure_file_permissions": "False", "tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_helper": "lioadm", "tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_protocol": "iscsi", "tripleo::profile::base::cinder::volume::rbd::backend_name": ["tripleo_ceph"], "tripleo::profile::base::cinder::volume::rbd::cinder_rbd_ceph_conf": "/etc/ceph/ceph.conf", "tripleo::profile::base::cinder::volume::rbd::cinder_rbd_pool_name": "volumes", "tripleo::profile::base::cinder::volume::rbd::cinder_rbd_extra_pools": [], "tripleo::profile::base::cinder::volume::rbd::cinder_rbd_secret_uuid": "41e4325c-1291-5fe0-8134-34414eb23649", "tripleo::profile::base::cinder::volume::rbd::cinder_rbd_user_name": "openstack", "tripleo::profile::base::cinder::volume::rbd::cinder_rbd_flatten_volume_from_snapshot": false, "tripleo::profile::base::cinder::volume::rbd::multi_config": {}, "tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_address": "%{hiera('storage')}", "tripleo::profile::pacemaker::cinder::volume_bundle::cinder_volume_docker_image": "cluster.common.tag/cinder-volume:pcmklatest", "tripleo::profile::pacemaker::cinder::volume_bundle::docker_volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro", "/var/log/containers/cinder:/var/log/cinder:z", "/var/lib/kolla/config_files/cinder_volume.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/lib/modules:/lib/modules:ro", "/dev:/dev", "/run:/run", "/sys:/sys", "/var/lib/cinder:/var/lib/cinder:z", "/var/lib/iscsi:/var/lib/iscsi:z"], "tripleo::profile::pacemaker::cinder::volume_bundle::docker_environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}, "tripleo::profile::pacemaker::cinder::volume_bundle::container_backend": "podman", "tripleo::profile::pacemaker::cinder::volume_bundle::ceph_conf_path": "/var/lib/tripleo-config/ceph", "cinder::volume::manage_service": false, "cinder::volume::enabled": false, "cinder::backend_host": "hostgroup"}, "service_config_settings": {"rsyslog": {"tripleo_logging_sources_cinder_volume": [{"tag": "openstack.cinder.volume", "file": "/var/log/containers/cinder/cinder-volume.log"}]}}, "puppet_config": {"config_volume": "cinder", "puppet_tags": "cinder_config,file,concat,file_line", "step_config": "include tripleo::profile::base::lvm\ninclude tripleo::profile::pacemaker::cinder::volume_bundle\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-api:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/cinder_volume.json": {"command": "/usr/bin/cinder-volume --config-file /usr/share/cinder/cinder-dist.conf --config-file /etc/cinder/cinder.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-iscsid/*", "dest": "/etc/iscsi/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}], "permissions": [{"path": "/var/log/cinder", "owner": "cinder:cinder", "recurse": true}, {"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "cinder:cinder", "perm": "0600"}, {"path": "/etc/pki/tls/certs/etcd.crt", "owner": "cinder:cinder"}, {"path": "/etc/pki/tls/private/etcd.key", "owner": "cinder:cinder"}]}}, "container_config_scripts": {"container_puppet_apply.sh": {"mode": "0700", "content": "#!/bin/bash\nset -eux\nSTEP=$1\nTAGS=$2\nCONFIG=$3\nEXTRA_ARGS=${4:-''}\nif [ -d /tmp/puppet-etc ]; then\n  # ignore copy failures as these may be the same file depending on docker mounts\n  cp -a /tmp/puppet-etc/* /etc/puppet || true\nfi\necho \"{\\\"step\\\": ${STEP}}\" > /etc/puppet/hieradata/docker_puppet.json\n# $::deployment_type in puppet-tripleo\nexport FACTER_deployment_type=containers\nset +e\npuppet apply $EXTRA_ARGS \\\n    --verbose \\\n    --detailed-exitcodes \\\n    --summarize \\\n    --color=false \\\n    --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \\\n    --tags $TAGS \\\n    -e \"noop_resource('package'); ${CONFIG}\"\nrc=$?\nset -e\nset +ux\nif [ $rc -eq 2 -o $rc -eq 0 ]; then\n    exit 0\nfi\nexit $rc\n"}, "pyshim.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n#\n# Usage: pyshim.sh <script and/or arguments>\n#\n# Unfortunately THT doesn't know which version of python might be in a\n# container so we need this script to be able to try python3 or python2\n# depending on availability.  Since this is a temporary shim until we've\n# fully cut over to python3, we check for the existence of python3 first\n# before falling back to python2. This will help in the transition from\n# python2 based containers to python3.\n\nshow_usage() {\n    echo \"Usage: pyshim.sh <script and/or arguments>\"\n}\n\nif [ $# -lt 1 ]\nthen\n    show_usage\n    exit 1\nfi\n\nset -x\nif command -v python3 >/dev/null; then\n    python3 \"$@\"\nelif command -v python2 >/dev/null; then\n    python2 \"$@\"\nelif command -v python >/dev/null; then\n    python \"$@\"\nelse\n    echo \"ERROR: python is not available!\"\n    exit 1\nfi\n"}, "pacemaker_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nset -u\n\n# ./pacemaker_restart_bundle.sh mysql galera galera-bundle Master _\n# ./pacemaker_restart_bundle.sh redis redis redis-bundle Slave Master\n# ./pacemaker_restart_bundle.sh ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\nRESTART_SCRIPTS_DIR=$(dirname $0)\nTRIPLEO_SERVICE=$1\nRESOURCE_NAME=$2\nBUNDLE_NAME=$3\nWAIT_TARGET_LOCAL=$4\nWAIT_TARGET_ANYWHERE=${5:-_}\nTRIPLEO_MINOR_UPDATE=\"${TRIPLEO_MINOR_UPDATE:-false}\"\nTRIPLEO_HA_WRAPPER_RESOURCE_EXISTS=\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS:-false}\"\n\nbundle_can_be_restarted() {\n    local bundle=$1\n    # As long as the resource bundle is managed by pacemaker and is\n    # not meant to stay stopped, no matter the state of any inner\n    # pcmk_remote or ocf resource, we should restart it to give it a\n    # chance to read the new config.\n    [ \"$(crm_resource --meta -r $1 -g is-managed 2>/dev/null)\" != \"false\" ] && \\\n    [ \"$(crm_resource --meta -r $1 -g target-role 2>/dev/null)\" != \"Stopped\" ]\n}\n\nlog() {\n    local msg=$1\n    logger -t pcmkrestart \"$1\"\n}\n\nHOSTNAME=$(/bin/hostname -s)\nif [ x\"${TRIPLEO_MINOR_UPDATE,,}\" != x\"true\" ]; then\n    if [ x\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS,,}\" = x\"false\" ]; then\n        # Do not restart during initial deployment, as the resource\n        # has just been created.\n        SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n        if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n            log \"Initial deployment, skipping the restart of ${BUNDLE_NAME}\"\n\tfi\n        exit 0\n    else\n        # During a stack update, this script is called in parallel on\n        # every node the resource runs on, after the service's configs\n        # have been updated on all nodes. So we need to run pcs only\n        # once (e.g. on the service's boostrap node).\n        if bundle_can_be_restarted ${BUNDLE_NAME}; then\n            SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n            if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n                replicas_running=$(crm_resource -Q -r $BUNDLE_NAME --locate 2>&1 | wc -l)\n                if [ \"$replicas_running\" != \"0\" ]; then\n                    log \"Restarting ${BUNDLE_NAME} globally. Stopping:\"\n                    /sbin/pcs resource disable --wait=600 $BUNDLE_NAME\n                    log \"Restarting ${BUNDLE_NAME} globally. Starting:\"\n                    /sbin/pcs resource enable --wait=600 $BUNDLE_NAME\n                else\n                    log \"${BUNDLE_NAME} is not running anywhere,\" \\\n                         \"cleaning up to restart it globally if necessary\"\n                    /sbin/pcs resource cleanup $BUNDLE_NAME\n                fi\n            else\n                log \"Skipping global restart of ${BUNDLE_NAME} on ${HOSTNAME} it will be restarted by node ${SERVICE_NODEID}\"\n            fi\n\n        else\n            log \"No global restart needed for ${BUNDLE_NAME}.\"\n        fi\n    fi\nelse\n    # During a minor update workflow however, a host gets fully\n    # updated before updating the next one. So unlike stack\n    # update, at the time this script is called, the service's\n    # configs aren't updated on all nodes yet. So only restart the\n    # resource locally, where it's guaranteed that the config is\n    # up to date.\n    HOST=$(facter hostname)\n\n    if bundle_can_be_restarted ${BUNDLE_NAME}; then\n\t# if the resource is running locally, restart it\n\tif crm_resource -r $BUNDLE_NAME --locate 2>&1 | grep -w -q \"${HOST}\"; then\n            log \"Restarting ${BUNDLE_NAME} locally on '${HOST}'\"\n            /sbin/pcs resource restart $BUNDLE_NAME \"${HOST}\"\n\n\telse\n\t    # At this point, if no resource is running locally, it's\n\t    # either because a) it has failed previously, or b) because\n\t    # it's an A/P resource running elsewhere.\n\t    # By cleaning up resource, we ensure that a) it will try to\n\t    # restart, or b) it won't do anything if the resource is\n\t    # already running elsewhere.\n            log \"${BUNDLE_NAME} is currently not running on '${HOST}',\" \\\n                 \"cleaning up its state to restart it if necessary\"\n            /sbin/pcs resource cleanup $BUNDLE_NAME node=\"${HOST}\"\n\tfi\n\n\t# Wait until the resource is in the expected target state\n\t$RESTART_SCRIPTS_DIR/pacemaker_wait_bundle.sh \\\n            $RESOURCE_NAME $BUNDLE_NAME \\\n            \"$WAIT_TARGET_LOCAL\" \"$WAIT_TARGET_ANYWHERE\" \\\n\t    \"${HOST}\" 600\n    else\n        log \"No restart needed for ${BUNDLE_NAME}.\"\n    fi\nfi\n"}, "pacemaker_wait_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# ----\n# Wait for an OCF resource or a bundle to be restarted\n# ----\n# e.g.:\n# M/S OCF:      $0 galera galera-bundle Master\n# clone OCF:    $0 rabbitmq rabbitmq-bundle Started\n# A/P M/S OCF:  $0 redis redis-bundle Slave Master\n# A/P bundle:   $0 openstack-cinder-volume openstack-cinder-volume _ Started\n# clone bundle: $0 haproxy-bundle haproxy-bundle Started\n\n# design note 1:\n#  - this script is called during a minor update; it is called\n#    once per node that hosts a service replica.\n#  - the purpose of this script is to ensure that restarting the\n#    service replica locally won't disrupt the service availability\n#    for the end user. To reach that goal, the script waits until the\n#    service is restarted locally or globallu and reaches a given\n#    target state (i.e. Started, Slave or Master).\n# design note 2:\n#   - we don't want to track restart error: our only job is to ensure\n#     service restart synchronization, not service health.\n#   - In particular, we don't want to error out in case the resource\n#     cannot be restarted locally, because that would make the minor\n#     update fail, even if potentially other replicas still provide\n#     the service.\n# design note 3:\n#   - we can bail out early if we determine that the resource can't\n#     be restarted automatically by pacemaker (e.g. its \"blocked\",\n#     unmanaged or disabled).\n\nlog() {\n    local msg=$1\n    echo \"$(date -u): $1\"\n}\n\nusage() {\n    echo 2>&1 \"Usage: $0 NAME BUNDLE_NAME ROLE_LOCAL [ROLE_ANYWHERE] [HOST] [TIMEOUT]\"\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\n#\n# Utility functions to detect stuck resources\n#\n\nbundle_failures_locally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local replica_name\n    for i in $(seq 0 $last); do\n\treplica_name=${BUNDLE_NAME}-${engine}-${i}\n\tcrm_failcount -q -G -r $replica_name -N $HOST\n    done\n}\n\nbundle_failures_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    for i in $(seq 0 $last); do\n\tcrm_failcount -q -G -r ${BUNDLE_NAME}-${engine}-${i}\n    done\n}\n\nbundle_running_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    # return the number of running bundles replica, i.e. the number of\n    # docker/podman resource replicas currently running in the cluster\n    crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:heartbeat:${engine}']/node)\" -\n}\n\nocf_failures_globally() {\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local bundle_node\n    for i in $(seq 0 $last); do\n\tbundle_node=${BUNDLE_NAME}-${i}\n\tcrm_failcount -q -G -r $NAME -N $bundle_node\n    done\n}\n\ndid_resource_failed_locally() {\n    local failures\n    local running\n    local remotehost\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# if we're dealing with an ocf resource, it is running on a\n\t# pacemaker_remote rather that on the real host, and the\n\t# failcounts are thus associated to the pcmk remote. Replace\n\t# the host's name with the pcmk remote's name.\n        remotehost=$(crm_mon --as-xml | xmllint --xpath \"string(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource/node[@name='${HOST}']/../../resource[@resource_agent='${OCF}:pacemaker:remote']/@id)\" -)\n\tif [ -n \"${remotehost}\" ]; then\n\t    crm_failcount -q -G -r $NAME -N $remotehost | grep -q -w INFINITY\n\t    return $?\n\tfi\n\t# If no pcmk remote is currently running, the failcount from\n\t# the ocf resource is useless, compute the failcount from the\n\t# bundle case instead (computed below).\n    fi\n\n    # for bundles, pacemaker can run any bundle replica locally\n    # (e.g. galera-bundle-docker-{0,1,2}), and a failure happens when\n    # there are no more replica to try.\n    # That is, when _at least_ one replica failed locally, and all the\n    # others either failed or are currently running elsewhere.\n    failures=$(bundle_failures_locally $HOST | grep -c -w INFINITY)\n    running=$(bundle_running_globally)\n    test $failures -gt 0 && \\\n    test $(( $failures + $running )) -ge $BUNDLE_REPLICAS\n}\n\ndid_resource_failed_globally() {\n    local remotecount\n    local failures\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# we check the state of an ocf resource only if the\n\t# pcmkremotes are started\n        remotecount=$(crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node)\" -)\n\tif [ \"${remotecount}\" = \"0\" ]; then\n\t    # no pcmkremote is running, so check the bundle state\n\t    # instead of checking the ocf resource\n\t    # bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\t    failures=$(bundle_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\telse\n\t    # ocf resource failed if it failed to start on\n\t    # all $BUNDLE_REPLICAS bundle nodes\n\t    failures=$(ocf_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\tfi\n    else\n\t# bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\tfailures=$(bundle_failures_globally | grep -c -w INFINITY)\n\ttest $failures -eq $BUNDLE_REPLICAS\n    fi\n}\n\n\n# Input validation\n#\n\nNAME=$1\nif [ -z \"${NAME}\" ]; then\n    echo 2>&1 \"Error: argument NAME must not be empty\"\n    exit 1\nfi\n\nBUNDLE_NAME=$2\nif [ -z \"${BUNDLE_NAME}\" ]; then\n    echo 2>&1 \"Error: argument BUNDLE_NAME must not be empty\"\n    exit 1\nfi\n\nROLE_LOCAL=$3\nif [ \"${ROLE_LOCAL}\" = \"_\" ]; then\n    ROLE_LOCAL=\"\"\nfi\n\nROLE_ANYWHERE=$4\nif [ \"${ROLE_ANYWHERE}\" = \"_\" ]; then\n    ROLE_ANYWHERE=\"\"\nfi\n\nif [ -z \"${ROLE_LOCAL}\" ]; then\n    if [ -z \"${ROLE_ANYWHERE}\" ]; then\n        echo 2>&1 \"Error: either ROLE_LOCAL or ROLE_ANYWHERE must be non empty\"\n        exit 1\n    fi\nelse\n    if !(echo \"${ROLE_LOCAL}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n        echo 2>&1 \"Error: argument ROLE_LOCAL must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n        exit 1\n    fi\nfi\n\nif [ -n \"${ROLE_ANYWHERE}\" ] && !(echo \"${ROLE_ANYWHERE}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n    echo 2>&1 \"Error: argument ROLE_ANYWHERE must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n    exit 1\nfi\n\n# Ensure compatibility with pacemaker 2.1\nif pacemaker_supports_promoted; then\n    ROLE_LOCAL=$(echo \"$ROLE_LOCAL\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    ROLE_ANYWHERE=$(echo \"$ROLE_ANYWHERE\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    OCF=\"ocf\"\nelse\n    OCF=\"ocf:\"\nfi\n\nHOST=${5:-$(facter hostname)}\nTIMEOUT=${6:-600}\n\n\n# Configure the search\n# ----\n# Note: we can't use crm_resource in all searches because we can't\n# easily extract the host the OCF resources run on (crm_resource\n# returns the pcmk-remote nodes rather than the hosts)\n# So instead, we implement various searches with XPath directly.\n\nif [ \"${BUNDLE_NAME}\" != \"${NAME}\" ]; then\n# ocf resource\nlocal_resource_xpath=\"//bundle/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node[@name='${HOST}']/../../resource[@id='${NAME}']\"\nany_resource_xpath=\"//bundle//resource[@id='${NAME}']\"\nreplicas_xpath=\"//bundle/primitive[@id='${BUNDLE_NAME}']/../*[boolean(@image) and boolean(@replicas)]\"\nelse\n# bundle resource\nlocal_resource_xpath=\"//bundle[@id='${NAME}']/replica/resource/node[@name='${HOST}']/../../resource\"\nany_resource_xpath=\"//bundle[@id='${NAME}']//resource\"\nreplicas_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nfi\n\nbundle_def_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nBUNDLE_CONTAINER_ENGINE=$(cibadmin -Q | xmllint --xpath \"name(${bundle_def_xpath})\" -)\nBUNDLE_REPLICAS=$(cibadmin -Q | xmllint --xpath \"string(${bundle_def_xpath}/@replicas)\" -)\n\n\n# The wait algorithm follows a two-stage approach\n#  1. Depending on how the script is called, we first check whether\n#     the resource is restarted locally. An A/P resource may be\n#     restarted elsewhere in the cluster.\n#  2. If needed, check whether the A/P resource has restarted\n#     elsewhere. For A/P M/S resources, in case the resource is\n#     restarted as Slave locally, ensure a Master is available.\n\nsuccess=1\nbailout=1\ntimeout=$TIMEOUT\nrole=\"\"\n\n# Stage 1: local check\nif [ -n \"$ROLE_LOCAL\" ]; then\n    log \"Waiting until ${NAME} has restarted on ${HOST} and is in state ${ROLE_LOCAL}\"\n    log \"Will probe resource state with the following XPath pattern: ${local_resource_xpath}\"\n\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resource=$(crm_mon -r --as-xml | xmllint --xpath \"${local_resource_xpath}\" - 2>/dev/null)\n        role=$(echo \"${resource}\" | sed -ne 's/.*\\Wrole=\"\\([^\"]*\\)\".*/\\1/p')\n\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resource}\" | grep -q -w \"\\Wblocked=\\\"true\\\"\"; then\n            log \"${NAME} is blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_locally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif [ \"$role\" = \"$ROLE_LOCAL\" ]; then\n            success=0\n            continue\n        elif [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" = \"$ROLE_ANYWHERE\" ]; then\n            # A/P: we are restarted in the expected state\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_LOCAL} on ${HOST}\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\n# Stage 2: global check\nif [ $timeout -gt 0 ] && [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" != \"$ROLE_ANYWHERE\" ]; then\n    log \"Wait until ${NAME} is restarted anywhere in the cluster in state ${ROLE_ANYWHERE}\"\n    log \"Will probe resource state with the following XPath pattern: ${any_resource_xpath}\"\n\n    success=1\n    bailout=1\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resources=$(crm_mon -r --as-xml | xmllint --xpath \"${any_resource_xpath}\" - 2>/dev/null)\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif ! (echo \"${resources}\" | grep -q -w \"\\Wblocked=\\\"false\\\"\"); then\n            log \"${NAME} blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_globally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resources}\" | grep -q -w \"\\Wrole=\\\"${ROLE_ANYWHERE}\\\"\"; then\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_ANYWHERE} anywhere in the cluster\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\nif [ $timeout -le 0 ]; then\n    log \"Timeout reached after ${TIMEOUT}s while waiting for ${NAME} to be restarted\"\nelif [ $bailout -le 0 ]; then\n    log \"Restart monitoring for ${NAME} cancelled\"\nfi\n\nif [ $success -eq 0 ]; then\n    log \"${NAME} successfully restarted\"\nelse\n    log \"${NAME} was not restarted properly\"\nfi\n\n# Don't block minor update or stack update if the wait was unsuccessful\nexit 0\n"}, "wait-port-and-run.sh": {"mode": "0755", "content": "#!/usr/bin/bash\nset -eu\n\nHOST=$1\nPORT=$2\n\necho \"$(date -u): Checking whether we can bind to ${HOST}:${PORT}\"\nwhile (ss -Htnl src \"${HOST}\" \"sport = :${PORT}\" | grep -wq \"${PORT}\"); do\n    echo \"$(date -u): ${HOST}:${PORT} still in use, waiting...\";\n    sleep 10;\ndone\n\nshift 2\nCOMMAND=\"$*\"\nif [ -z \"${COMMAND}\" ]; then\n    COMMAND=\"true\"\nfi\nexec $COMMAND\n"}, "pacemaker_resource_lock.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nMAX_RETRIES=10\nCIB_ENOTFOUND=105\n\nusage() {\n   echo \"Set a global property in the cluster with a validity timestamp.\"\n   echo \"Usage:\"\n   echo \"   $0 --acquire <lock_name> <lock_owner> <lock_ttl_in_seconds>\"\n   echo \"   $0 --release <lock_name> <lock_owner>\"\n   echo\n}\n\nlog() {\n    echo \"$(date -u): $1\" 1>&2\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\nlock_create() {\n    local name=$1\n    local data=$2\n    # cibadmin won't overwrite a key if someone else succeeded to create it concurrently\n    cibadmin --sync-call --scope crm_config --create --xml-text \"<cluster_property_set id='${name}'><nvpair id='${name}-pair' name='${name}' value='${data}'/></cluster_property_set>\" &>/dev/null\n    return $?\n}\n\nlock_update() {\n    local name=$1\n    local expected_data=$2\n    local new_data=$3\n    # we only update the lock we expect to see, so we can't update someone else's lock\n    cibadmin --sync-call --scope crm_config --modify --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" --xml-text \"<nvpair id='${name}-pair' name='${name}' value='${new_data}'/>\" &>/dev/null\n    return $?\n}\n\nlock_delete() {\n    local name=$1\n    local expected_data=$2\n    # we only delete the lock we expect to see, so we can't delete someone else's lock\n    cibadmin --sync-call --scope crm_config --delete --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" &>/dev/null\n    return $?\n}\n\nlock_get() {\n    local lockname=$1\n    local res\n    local rc\n    res=$(cibadmin --query --scope crm_config --xpath \"//cluster_property_set/nvpair[@name='$lockname']\" 2>/dev/null)\n    rc=$?\n    if [ $rc -eq 0 ]; then\n        echo \"$res\" | sed -n 's/.*value=\"\\([^\"]*\\)\".*/\\1/p'\n    fi\n    return $rc\n}\n\nlock_owner() {\n    local lock=$1\n    echo \"$lock\" | cut -d':' -f1\n}\n\nlock_has_expired() {\n    local lock=$1\n    local expiry=$(echo \"$lock\" | cut -d':' -f2)\n    local now=$(date +%s)\n    test $now -ge $expiry\n}\n\n\n# Perform a lock action and restart if the CIB has been modified before\n# committing the lock action\ntry_action() {\n    local fun=$1\n    local lock=$2\n    local requester=$3\n    local args=${4:-}\n    local tries=$MAX_RETRIES\n    local rc=1\n    if [ \"$fun\" = \"lock_acquire\" ] || [ \"$fun\" = \"lock_release\" ]; then\n        log \"Try running $fun\"\n    else\n        return 2\n    fi\n    while [ $rc -ne 0 ]; do\n        $fun $lock $requester $args\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Operation $1 succeeded\"\n            return 0\n        elif [ $rc -eq 3 ]; then\n            # rc == 3 -> CIB changed before push\n            if [ $tries -eq 0 ]; then\n                log \"Failed to commit after $MAX_RETRIES retries. Bailing out.\"\n                return 2\n            else\n                log \"Failed to commit. Retrying operation.\"\n                tries=$(($tries - 1))\n            fi\n        elif [ $rc -eq 2 ]; then\n            # rc == 2 -> unrecoverable cib error (e.g. pacemaker down)\n            log \"Unexpected failure. Bailing out\"\n            return $rc\n        else\n            # rc == 1 -> lock error (not owner, lock doesn't exists)\n            return $rc\n        fi\n    done\n}\n\n# The lock mechanism uses cibadmin's atomic creation so cluster-wide\n# state coherency is guaranteed by pacemaker\nlock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc\n    local lock\n    local expiry\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -n \"$lock\" ]; then\n        lock_has_expired $lock\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Lock has expired, now available for being held\"\n        else\n            # lock is still held. check whether we're the owner\n            owner=$(lock_owner $lock)\n            if [ \"$owner\" = \"$requester\" ];then\n                log \"Requester already owns the lock, acquiring attempt will just reconfigure the TTL\"\n            else\n                log \"Lock is held by someone else ($owner)\"\n                return 1\n            fi\n        fi\n    else\n        log \"Lock is not held yet\"\n    fi\n\n    # prepare the lock info\n    expiry=$(($(date +%s) + $ttl))\n\n    if [ -n \"$lock\" ]; then\n        log \"Attempting to update the lock\"\n        lock_update $lockname \"$lock\" \"$requester:$expiry\"\n        rc=$?\n    else\n        log \"Attempting to acquire the lock\"\n        lock_create $lockname \"$requester:$expiry\"\n        rc=$?\n    fi\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' acquired by '$requester', valid until $(date -d @$expiry)\"\n        return 0\n    else\n        log \"CIB changed, lock cannot be acquired\"\n        return 3\n    fi\n}\n\n\n# The lock mechanism uses the CIB's num_updates tag to implement\n# a conditional store. Cluster-wide locking is guaranteed by pacemaker\nlock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n    local lock\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        log \"Lock doesn't exist. Nothing to release\"\n        return 0\n    else\n        log \"Lock exists, check whether we're the owner\"\n        owner=$(lock_owner $lock)\n        if [ \"$owner\" != \"$requester\" ];then\n            log \"Lock is held by someone else ($owner), will not unlock\"\n            return 1\n        fi\n    fi\n\n    lock_delete $lockname \"$lock\"\n    rc=$?\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' released by '$requester'\"\n        return 0\n    else\n        log \"CIB deletion error, lock cannot be released\"\n        return 3\n    fi\n}\n\n\n# Retrieve the owner of a lock from the CIB\n# this is a read-only operation, so no need to log debug info\nlock_get_owner() {\n    local lockname=$1\n    local rc\n    local lock\n    local owner\n\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        return 1\n    else\n        lock_owner $lock\n        return 0\n    fi\n}\n\n\nACTION=$1\nLOCKNAME=$2\nREQUESTER=$3\nTTL=${4:-60}\n\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nif [ $ACTION != \"--help\" ]; then\n    if [ -z \"$LOCKNAME\" ]; then\n        error \"You must specific a lock name\"\n    fi\n    if [ $ACTION != \"--owner\" ] && [ $ACTION != \"-o\" ]; then\n        if [ -z \"$REQUESTER\" ]; then\n            error \"You must specific a lock requester\"\n        fi\n    fi\nfi\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) try_action lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --release|-r) try_action lock_release $LOCKNAME $REQUESTER;;\n    --acquire-once|-A) lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --owner|-o) lock_get_owner $LOCKNAME;;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}, "pacemaker_mutex_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_restart_bundle.sh --lock mysql galera galera-bundle Master _\n# pacemaker_mutex_restart_bundle.sh --lock ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\n\nset -u\n\nusage() {\n    echo \"Restart a clustered resource in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --lock <tripleo-service> <pcmk-resource> <pcmk-bundle> <target-state-local> <target-state-cluster>\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\nACTION=$1\ncase $ACTION in\n    --help) usage; exit 0;;\n    --lock) ;;\n    *) error \"Unknown action '$ACTION'\";;\nesac\n\nTRIPLEO_SERVICE=$2\nLOCK_NAME=${TRIPLEO_SERVICE}-restart-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to restart resource $TRIPLEO_SERVICE\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\nRESOURCE_NAME=$3\nBUNDLE_NAME=$4\nWAIT_TARGET_LOCAL=$5\nWAIT_TARGET_ANYWHERE=${6:-_}\n\nif pacemaker_supports_promoted; then\n    WAIT_TARGET_LOCAL=$(echo \"$5\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    WAIT_TARGET_ANYWHERE=$(echo \"${6:-_}\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    promoted_role=\"Promoted\"\nelse\n    promoted_role=\"Master\"\nfi\n\n# The lock TTL should accomodate for the resource start/promote timeout\nif [ \"$RESOURCE_NAME\" != \"$BUNDLE_NAME\" ]; then\n    if [ \"$WAIT_TARGET_LOCAL\" = \"$promoted_role\" ] || [ \"$WAIT_TARGET_ANYWHERE\" = \"$promoted_role\" ]; then\n        rsc_op=\"promote\"\n    else\n        rsc_op=\"start\"\n    fi\n    # <op id=\"galera-promote-interval-0s\" interval=\"0s\" name=\"promote\" on-fail=\"block\" timeout=\"300s\"/>\n    PCMK_TTL=$(cibadmin -Q | xmllint -xpath \"string(//primitive[@id='${RESOURCE_NAME}']/operations/op[@name='${rsc_op}']/@timeout)\" - | sed 's/s$//')\n    LOCK_TTL=$((PCMK_TTL + 30))\nelse\n    # The podman RA's default start timeout\n    LOCK_TTL=90\nfi\n\nlog \"Acquire a ${LOCK_TTL}s restart lock for service $TRIPLEO_SERVICE before restarting it\"\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nrc=1\nwhile [ $rc -ne 0 ]; do\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire $LOCK_NAME $LOCK_OWNER $LOCK_TTL\n    rc=$?\n    if [ $rc != 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not acquire lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Could not acquire lock, retrying\"\n            sleep 10\n        fi\n    fi\ndone\n\nlog \"Restart the service $TRIPLEO_SERVICE locally\"\n# Reuse the local restart script in t-h-t (driven by env var TRIPLEO_MINOR_UPDATE)\nTRIPLEO_MINOR_UPDATE=true /var/lib/container-config-scripts/pacemaker_restart_bundle.sh $TRIPLEO_SERVICE $RESOURCE_NAME $BUNDLE_NAME $WAIT_TARGET_LOCAL $WAIT_TARGET_ANYWHERE\n\n# If we reached this point, always try to release the lock\nlog \"Release the restart lock for service $TRIPLEO_SERVICE\"\n/var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $LOCK_NAME $LOCK_OWNER\nrc=$?\nif [ $rc -ne 0 ] && [ $rc -ne 1 ]; then\n    error \"Could not release held lock (rc: $rc)\"\nfi\n"}, "pacemaker_mutex_shutdown.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_shutdown.sh --acquire\n# pacemaker_mutex_shutdown.sh --release\n\nset -u\n\nusage() {\n    echo \"Shutdown a cluster node in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --acquire # prevent other node from shutting down until we hold the lock\"\n    echo \"   $0 --release # release the lock, other node can compete for the shutdown lock\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nshutdown_lock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc=1\n    local current_owner\n    local owner_stopped\n    local owner_rc\n\n    log \"Acquiring the shutdown lock\"\n    while [ $rc -ne 0 ]; do\n        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire-once $lockname $requester $ttl\n        rc=$?\n        if [ $rc -ne 0 ]; then\n            if [ $rc -eq 2 ]; then\n                error \"Could not acquire the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n            else\n                # The lock is held by another node.\n                current_owner=$(/var/lib/container-config-scripts/pacemaker_resource_lock.sh --owner $lockname)\n                owner_rc=$?\n                if [ $owner_rc -eq 2 ]; then\n                    error \"Could not get the shutdown lock owner due to unrecoverable error (rc: $owner_rc), bailing out\"\n                fi\n                if [ $owner_rc -eq 0 ]; then\n                    # If the owner is marked as offline, that means it has shutdown and\n                    # we can clean the lock preemptively and try to acquire it.\n                    owner_stopped=$(crm_mon -1X | xmllint --xpath 'count(//nodes/node[@name=\"'${current_owner}'\" and @online=\"false\" and @unclean=\"false\"])' -)\n                    if [ \"${owner_stopped}\" = \"1\" ]; then\n                        log \"Shutdown lock held by stopped node '${current_owner}', lock can be released\"\n                        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $current_owner\n                        continue\n                    fi\n                fi\n                log \"Shutdown lock held by another node (rc: $rc), retrying\"\n                sleep 10\n            fi\n        fi\n    done\n    log \"Shutdown lock acquired\"\n    return 0\n}\n\n\n# Release the lock if we still own it. Not owning it anymore is not fatal\nshutdown_lock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n\n    log \"Releasing the shutdown lock\"\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $requester\n    rc=$?\n    if [ $rc -ne 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not release the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Shutdown lock no longer held, nothing to do\"\n        fi\n    else\n        log \"Shutdown lock released\"\n    fi\n    return 0\n}\n\n\nACTION=$1\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nLOCK_NAME=tripleo-shutdown-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to aquire the shutdown lock\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\n# We start with a very high TTL, that long enough to accomodate a cluster stop.\n# As soon as the node will get offline, the other competing node will be entitled\n# to steal the lock, so they should never wait that long in practice.\nLOCK_TTL=600\n\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) shutdown_lock_acquire ${LOCK_NAME} ${LOCK_OWNER} ${LOCK_TTL};;\n    --release|-r) shutdown_lock_release ${LOCK_NAME} ${LOCK_OWNER};;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}}, "docker_config": {"step_3": {"cinder_volume_init_logs": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-volume:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/cinder:/var/log/cinder"], "command": ["/bin/bash", "-c", "chown -R cinder:cinder /var/log/cinder"]}}}, "host_prep_tasks": [{"name": "create fcontext entry for cinder data", "community.general.sefcontext": {"target": "/var/lib/cinder(/.*)?", "setype": "container_file_t", "state": "present"}}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/log/containers/cinder", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/lib/cinder", "setype": "container_file_t"}]}, {"name": "ensure ceph configurations exist", "file": {"path": "/var/lib/tripleo-config/ceph", "state": "directory"}}, {"name": "Support using an NFS share for cinder image conversion", "vars": {"image_conversion_nfs_enabled": false}, "when": ["image_conversion_nfs_enabled|bool"], "block": [{"name": "Create cinder image conversion directory", "file": {"path": "/var/lib/cinder_image_conversion", "state": "directory"}}, {"name": "Mount cinder's image conversion NFS share", "vars": {"image_conversion_nfs_share": "", "image_conversion_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"path": "/var/lib/cinder_image_conversion", "state": "mounted", "fstype": "nfs4", "src": "{{ image_conversion_nfs_share }}", "opts": "{{ image_conversion_nfs_options }}"}}]}, {"name": "cinder_configure_lvm fact", "set_fact": {"cinder_configure_lvm": false}}, {"when": "cinder_configure_lvm|bool", "block": [{"name": "ensure LVM rpm dependencies are installed", "package": {"name": "lvm2", "state": "latest"}}, {"name": "cinder create LVM volume group dd", "command": "dd if=/dev/zero of=/var/lib/cinder/cinder-volumes bs=1 count=0 seek=10280M", "args": {"creates": "/var/lib/cinder/cinder-volumes"}}, {"name": "Get or create LVM loopback device", "shell": "exit_code=0\nexisting_device=$(losetup -j /var/lib/cinder/cinder-volumes -l -n -O NAME)\nif [[ -z \"${existing_device}\" ]]; then\n    losetup -f /var/lib/cinder/cinder-volumes --show\n    exit_code=2\nelse\n    echo ${existing_device%$'\\n'*}\nfi\nexit ${exit_code}", "args": {"executable": "/bin/bash"}, "register": "_loopback_device", "changed_when": "_loopback_device.rc == 2", "failed_when": "_loopback_device.rc not in [0,2]"}, {"name": "Create LVM volume group", "community.general.lvg": {"vg": "cinder-volumes", "pvs": "{{ _loopback_device.stdout }}", "state": "present"}, "when": ["not (ansible_check_mode | bool)"]}, {"name": "cinder create service to run losetup for LVM on startup", "copy": {"dest": "/etc/systemd/system/cinder-lvm-losetup.service", "content": "[Unit]\nDescription=Cinder LVM losetup\nDefaultDependencies=no\nConflicts=umount.target\nRequires=lvm2-monitor.service systemd-udev-settle.service\nBefore=local-fs.target umount.target\nAfter=var.mount lvm2-monitor.service systemd-udev-settle.service\n\n[Service]\nType=oneshot\nExecStart=/sbin/losetup {{ _loopback_device.stdout }} /var/lib/cinder/cinder-volumes\nExecStop=/sbin/losetup -d {{ _loopback_device.stdout }}\nRemainAfterExit=yes\n\n[Install]\nWantedBy=local-fs-pre.target\n"}, "when": ["not (ansible_check_mode | bool)"]}, {"name": "cinder enable the LVM losetup service", "systemd": {"name": "cinder-lvm-losetup", "enabled": true, "daemon_reload": true}}]}], "deploy_steps_tasks": [{"name": "Cinder Volume tag container image for pacemaker", "when": "step|int == 1", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-volume:17.1", "container_image_latest": "cluster.common.tag/cinder-volume:pcmklatest"}}, {"name": "Cinder Volume HA Wrappers Step", "when": "step|int == 5", "block": [{"name": "Cinder volume puppet bundle", "import_role": {"name": "tripleo_ha_wrapper"}, "vars": {"tripleo_ha_wrapper_service_name": "cinder_volume", "tripleo_ha_wrapper_resource_name": "openstack-cinder-volume", "tripleo_ha_wrapper_bundle_name": "openstack-cinder-volume", "tripleo_ha_wrapper_resource_state": "_ Started", "tripleo_ha_wrapper_puppet_config_volume": "cinder", "tripleo_ha_wrapper_puppet_execute": "include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::cinder::volume_bundle", "tripleo_ha_wrapper_puppet_tags": "pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation", "tripleo_ha_wrapper_puppet_debug": false, "tripleo_ha_wrapper_config_suffix": ".cinder_volume_previous_run"}}]}], "external_update_tasks": [{"when": "step|int == 1", "tags": "ha_image_update", "block": [{"block": [{"name": "Get cinder_volume image from pacemaker", "become": true, "register": "xmllint_pcmk_cinder_volume_image", "shell": "xmllint --xpath \"string(//bundle[@id='openstack-cinder-volume']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container cinder_volume image", "set_fact": {"cinder_volume_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-volume:17.1", "cinder_volume_image_latest": "cluster.common.tag/cinder-volume:pcmklatest", "pcmk_cinder_volume_image": "{{xmllint_pcmk_cinder_volume_image.stdout}}"}}], "delegate_to": "{{ (groups[\"cinder_volume\"] | difference(groups[\"excluded_overcloud\"]))[0] }}"}, {"name": "cinder-volume temporary pacemaker container tag in case of image switch", "become": true, "import_role": {"name": "tripleo_ha_image_update"}, "vars": {"tripleo_ha_image_update_node_names": "{{ groups[\"cinder_volume\"] | difference(groups[\"excluded_overcloud\"]) }}", "tripleo_ha_image_update_bundle": "openstack-cinder-volume", "tripleo_ha_image_update_new_image": "{{cinder_volume_image_latest}}", "tripleo_ha_image_update_old_image": "{{pcmk_cinder_volume_image}}"}, "when": ["(pcmk_cinder_volume_image != \"\")", "(pcmk_cinder_volume_image != cinder_volume_image_latest)"]}]}], "update_tasks": [{"block": [{"name": "Get cinder_volume image from pacemaker", "become": true, "register": "xmllint_pcmk_cinder_volume_image", "shell": "xmllint --xpath \"string(//bundle[@id='openstack-cinder-volume']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container cinder_volume image", "set_fact": {"cinder_volume_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-volume:17.1", "cinder_volume_image_latest": "cluster.common.tag/cinder-volume:pcmklatest", "pcmk_cinder_volume_image": "{{xmllint_pcmk_cinder_volume_image.stdout}}"}}], "when": "(step|int == 0 or step|int == 2)"}, {"name": "Check for update of cinder-volume container image name", "when": "step|int == 0", "assert": {"that": "pcmk_cinder_volume_image == cinder_volume_image_latest", "fail_msg": "cinder-volume image change detected, run overcloud external-update --tags ha_image_update first"}}, {"name": "Tear-down non-HA cinder_volume container", "when": ["step|int == 1"], "block": [{"name": "Remove non-HA cinder_volume container", "include_role": {"name": "tripleo_container_rm"}, "vars": {"tripleo_container_cli": "{{ container_cli }}", "tripleo_containers_to_rm": ["cinder_volume"]}}]}, {"name": "cinder_volume fetch and retag container image for pacemaker", "when": "step|int == 2", "block": [{"name": "Retag pcmklatest to latest cinder_volume image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{cinder_volume_image}}", "container_image_latest": "{{cinder_volume_image_latest}}"}}]}], "post_update_tasks": [{"name": "Cinder volume bundle post update", "when": "step|int == 1", "block": [{"name": "Cinder volume puppet bundle", "import_role": {"name": "tripleo_ha_wrapper"}, "vars": {"tripleo_ha_wrapper_service_name": "cinder_volume", "tripleo_ha_wrapper_resource_name": "openstack-cinder-volume", "tripleo_ha_wrapper_bundle_name": "openstack-cinder-volume", "tripleo_ha_wrapper_resource_state": "_ Started", "tripleo_ha_wrapper_puppet_config_volume": "cinder", "tripleo_ha_wrapper_puppet_execute": "include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::cinder::volume_bundle", "tripleo_ha_wrapper_puppet_tags": "pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation", "tripleo_ha_wrapper_puppet_debug": false, "tripleo_ha_wrapper_config_suffix": ".cinder_volume_previous_run"}}], "vars": {"tripleo_ha_wrapper_minor_update": true}}], "upgrade_tasks": [{"name": "Tear-down non-HA cinder_volume container", "when": ["step|int == 0"], "block": [{"name": "Remove non-HA cinder_volume container", "include_role": {"name": "tripleo_container_rm"}, "vars": {"tripleo_container_cli": "{{ container_cli }}", "tripleo_containers_to_rm": ["cinder_volume"]}}]}, {"name": "Prepare switch of cinder_volume image name", "when": ["step|int == 0"], "block": [{"name": "Get cinder_volume image id currently used by pacemaker", "shell": "pcs resource config openstack-cinder-volume | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'", "register": "cinder_volume_image_current_res", "failed_when": false}, {"name": "cinder_volume image facts", "set_fact": {"cinder_volume_image_latest": "cluster.common.tag/cinder-volume:pcmklatest", "cinder_volume_image_current": "{{cinder_volume_image_current_res.stdout}}"}}, {"name": "Temporarily tag the current cinder_volume image id with the upgraded image name", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{cinder_volume_image_current}}", "container_image_latest": "{{cinder_volume_image_latest}}", "pull_image": false}, "when": ["cinder_volume_image_current != ''", "cinder_volume_image_current != cinder_volume_image_latest"]}, {"name": "Create cinder_volume retag statefile", "file": {"path": "/var/lib/tripleo/cinder_volume_needs_retag", "state": "touch"}, "when": ["cinder_volume_image_current != ''", "cinder_volume_image_current != cinder_volume_image_latest"]}]}, {"name": "Update cinder_volume pcs resource bundle for new container image", "when": ["step|int == 1"], "block": [{"name": "set is_cinder_volume_bootstrap_node fact", "tags": "common", "set_fact": "is_cinder_volume_bootstrap_node={{cinder_volume_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}"}, {"name": "Check for cinder_volume retag statefile", "stat": {"path": "/var/lib/tripleo/cinder_volume_needs_retag"}, "register": "cinder_volume_retag_state_file"}]}, {"name": "Update cinder_volume pcs resource bundle for new container image", "when": ["step|int == 1", "is_cinder_volume_bootstrap_node", "cinder_volume_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the cinder_volume cluster resource before container upgrade", "pacemaker_resource": {"resource": "openstack-cinder-volume", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "pcs resource bundle update cinder_volume for new container image name", "command": "pcs resource bundle update openstack-cinder-volume container image={{cinder_volume_image_latest}}"}, {"name": "Enable the cinder_volume cluster resource", "pacemaker_resource": {"resource": "openstack-cinder-volume", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}]}, {"name": "Check for cinder_volume retag statefile", "when": ["step|int == 3"], "stat": {"path": "/var/lib/tripleo/cinder_volume_needs_retag"}, "register": "cinder_volume_retag_state_file"}, {"name": "Retag pacemaker cinder_volume", "when": ["step|int == 3", "cinder_volume_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the cinder_volume cluster resource before container upgrade", "pacemaker_resource": {"resource": "openstack-cinder-volume", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Retag the pacemaker image if containerized", "block": [{"block": [{"name": "Get cinder_volume image from pacemaker", "become": true, "register": "xmllint_pcmk_cinder_volume_image", "shell": "xmllint --xpath \"string(//bundle[@id='openstack-cinder-volume']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container cinder_volume image", "set_fact": {"cinder_volume_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-volume:17.1", "cinder_volume_image_latest": "cluster.common.tag/cinder-volume:pcmklatest", "pcmk_cinder_volume_image": "{{xmllint_pcmk_cinder_volume_image.stdout}}"}}]}, {"block": [{"name": "Retag pcmklatest to latest cinder_volume image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{cinder_volume_image}}", "container_image_latest": "{{cinder_volume_image_latest}}"}}]}]}, {"name": "Enable the cinder_volume cluster resource", "pacemaker_resource": {"resource": "openstack-cinder-volume", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Remove cinder_volume retag statefile", "file": {"path": "/var/lib/tripleo/cinder_volume_needs_retag", "state": "absent"}}]}, {"name": "cinder-volume pre system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 3", "upgrade_leapp_enabled"], "block": [{"name": "Unmount cinder's image conversion NFS share", "vars": {"image_conversion_nfs_share": "", "image_conversion_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0", "image_conversion_nfs_enabled": false}, "when": "image_conversion_nfs_enabled|bool", "mount": {"path": "/var/lib/cinder_image_conversion", "state": "absent", "fstype": "nfs4"}}]}, {"name": "cinder-volume post system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 5", "upgrade_leapp_enabled"], "block": [{"name": "Support using an NFS share for cinder image conversion", "vars": {"image_conversion_nfs_enabled": false}, "when": ["image_conversion_nfs_enabled|bool"], "block": [{"name": "Create cinder image conversion directory", "file": {"path": "/var/lib/cinder_image_conversion", "state": "directory"}}, {"name": "Mount cinder's image conversion NFS share", "vars": {"image_conversion_nfs_share": "", "image_conversion_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"path": "/var/lib/cinder_image_conversion", "state": "mounted", "fstype": "nfs4", "src": "{{ image_conversion_nfs_share }}", "opts": "{{ image_conversion_nfs_options }}"}}]}]}], "post_upgrade_tasks": [{"name": "Start cinder_volume service (pacemaker)", "become": true, "when": "step|int == 1", "pacemaker_resource": {"resource": "openstack-cinder-volume", "state": "enable"}}]}, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "cinder_volume", "tuple:('role_data', 'container_config_scripts')": {"container_puppet_apply.sh": {"mode": "0700", "content": "#!/bin/bash\nset -eux\nSTEP=$1\nTAGS=$2\nCONFIG=$3\nEXTRA_ARGS=${4:-''}\nif [ -d /tmp/puppet-etc ]; then\n  # ignore copy failures as these may be the same file depending on docker mounts\n  cp -a /tmp/puppet-etc/* /etc/puppet || true\nfi\necho \"{\\\"step\\\": ${STEP}}\" > /etc/puppet/hieradata/docker_puppet.json\n# $::deployment_type in puppet-tripleo\nexport FACTER_deployment_type=containers\nset +e\npuppet apply $EXTRA_ARGS \\\n    --verbose \\\n    --detailed-exitcodes \\\n    --summarize \\\n    --color=false \\\n    --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \\\n    --tags $TAGS \\\n    -e \"noop_resource('package'); ${CONFIG}\"\nrc=$?\nset -e\nset +ux\nif [ $rc -eq 2 -o $rc -eq 0 ]; then\n    exit 0\nfi\nexit $rc\n"}, "pyshim.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n#\n# Usage: pyshim.sh <script and/or arguments>\n#\n# Unfortunately THT doesn't know which version of python might be in a\n# container so we need this script to be able to try python3 or python2\n# depending on availability.  Since this is a temporary shim until we've\n# fully cut over to python3, we check for the existence of python3 first\n# before falling back to python2. This will help in the transition from\n# python2 based containers to python3.\n\nshow_usage() {\n    echo \"Usage: pyshim.sh <script and/or arguments>\"\n}\n\nif [ $# -lt 1 ]\nthen\n    show_usage\n    exit 1\nfi\n\nset -x\nif command -v python3 >/dev/null; then\n    python3 \"$@\"\nelif command -v python2 >/dev/null; then\n    python2 \"$@\"\nelif command -v python >/dev/null; then\n    python \"$@\"\nelse\n    echo \"ERROR: python is not available!\"\n    exit 1\nfi\n"}, "pacemaker_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nset -u\n\n# ./pacemaker_restart_bundle.sh mysql galera galera-bundle Master _\n# ./pacemaker_restart_bundle.sh redis redis redis-bundle Slave Master\n# ./pacemaker_restart_bundle.sh ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\nRESTART_SCRIPTS_DIR=$(dirname $0)\nTRIPLEO_SERVICE=$1\nRESOURCE_NAME=$2\nBUNDLE_NAME=$3\nWAIT_TARGET_LOCAL=$4\nWAIT_TARGET_ANYWHERE=${5:-_}\nTRIPLEO_MINOR_UPDATE=\"${TRIPLEO_MINOR_UPDATE:-false}\"\nTRIPLEO_HA_WRAPPER_RESOURCE_EXISTS=\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS:-false}\"\n\nbundle_can_be_restarted() {\n    local bundle=$1\n    # As long as the resource bundle is managed by pacemaker and is\n    # not meant to stay stopped, no matter the state of any inner\n    # pcmk_remote or ocf resource, we should restart it to give it a\n    # chance to read the new config.\n    [ \"$(crm_resource --meta -r $1 -g is-managed 2>/dev/null)\" != \"false\" ] && \\\n    [ \"$(crm_resource --meta -r $1 -g target-role 2>/dev/null)\" != \"Stopped\" ]\n}\n\nlog() {\n    local msg=$1\n    logger -t pcmkrestart \"$1\"\n}\n\nHOSTNAME=$(/bin/hostname -s)\nif [ x\"${TRIPLEO_MINOR_UPDATE,,}\" != x\"true\" ]; then\n    if [ x\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS,,}\" = x\"false\" ]; then\n        # Do not restart during initial deployment, as the resource\n        # has just been created.\n        SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n        if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n            log \"Initial deployment, skipping the restart of ${BUNDLE_NAME}\"\n\tfi\n        exit 0\n    else\n        # During a stack update, this script is called in parallel on\n        # every node the resource runs on, after the service's configs\n        # have been updated on all nodes. So we need to run pcs only\n        # once (e.g. on the service's boostrap node).\n        if bundle_can_be_restarted ${BUNDLE_NAME}; then\n            SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n            if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n                replicas_running=$(crm_resource -Q -r $BUNDLE_NAME --locate 2>&1 | wc -l)\n                if [ \"$replicas_running\" != \"0\" ]; then\n                    log \"Restarting ${BUNDLE_NAME} globally. Stopping:\"\n                    /sbin/pcs resource disable --wait=600 $BUNDLE_NAME\n                    log \"Restarting ${BUNDLE_NAME} globally. Starting:\"\n                    /sbin/pcs resource enable --wait=600 $BUNDLE_NAME\n                else\n                    log \"${BUNDLE_NAME} is not running anywhere,\" \\\n                         \"cleaning up to restart it globally if necessary\"\n                    /sbin/pcs resource cleanup $BUNDLE_NAME\n                fi\n            else\n                log \"Skipping global restart of ${BUNDLE_NAME} on ${HOSTNAME} it will be restarted by node ${SERVICE_NODEID}\"\n            fi\n\n        else\n            log \"No global restart needed for ${BUNDLE_NAME}.\"\n        fi\n    fi\nelse\n    # During a minor update workflow however, a host gets fully\n    # updated before updating the next one. So unlike stack\n    # update, at the time this script is called, the service's\n    # configs aren't updated on all nodes yet. So only restart the\n    # resource locally, where it's guaranteed that the config is\n    # up to date.\n    HOST=$(facter hostname)\n\n    if bundle_can_be_restarted ${BUNDLE_NAME}; then\n\t# if the resource is running locally, restart it\n\tif crm_resource -r $BUNDLE_NAME --locate 2>&1 | grep -w -q \"${HOST}\"; then\n            log \"Restarting ${BUNDLE_NAME} locally on '${HOST}'\"\n            /sbin/pcs resource restart $BUNDLE_NAME \"${HOST}\"\n\n\telse\n\t    # At this point, if no resource is running locally, it's\n\t    # either because a) it has failed previously, or b) because\n\t    # it's an A/P resource running elsewhere.\n\t    # By cleaning up resource, we ensure that a) it will try to\n\t    # restart, or b) it won't do anything if the resource is\n\t    # already running elsewhere.\n            log \"${BUNDLE_NAME} is currently not running on '${HOST}',\" \\\n                 \"cleaning up its state to restart it if necessary\"\n            /sbin/pcs resource cleanup $BUNDLE_NAME node=\"${HOST}\"\n\tfi\n\n\t# Wait until the resource is in the expected target state\n\t$RESTART_SCRIPTS_DIR/pacemaker_wait_bundle.sh \\\n            $RESOURCE_NAME $BUNDLE_NAME \\\n            \"$WAIT_TARGET_LOCAL\" \"$WAIT_TARGET_ANYWHERE\" \\\n\t    \"${HOST}\" 600\n    else\n        log \"No restart needed for ${BUNDLE_NAME}.\"\n    fi\nfi\n"}, "pacemaker_wait_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# ----\n# Wait for an OCF resource or a bundle to be restarted\n# ----\n# e.g.:\n# M/S OCF:      $0 galera galera-bundle Master\n# clone OCF:    $0 rabbitmq rabbitmq-bundle Started\n# A/P M/S OCF:  $0 redis redis-bundle Slave Master\n# A/P bundle:   $0 openstack-cinder-volume openstack-cinder-volume _ Started\n# clone bundle: $0 haproxy-bundle haproxy-bundle Started\n\n# design note 1:\n#  - this script is called during a minor update; it is called\n#    once per node that hosts a service replica.\n#  - the purpose of this script is to ensure that restarting the\n#    service replica locally won't disrupt the service availability\n#    for the end user. To reach that goal, the script waits until the\n#    service is restarted locally or globallu and reaches a given\n#    target state (i.e. Started, Slave or Master).\n# design note 2:\n#   - we don't want to track restart error: our only job is to ensure\n#     service restart synchronization, not service health.\n#   - In particular, we don't want to error out in case the resource\n#     cannot be restarted locally, because that would make the minor\n#     update fail, even if potentially other replicas still provide\n#     the service.\n# design note 3:\n#   - we can bail out early if we determine that the resource can't\n#     be restarted automatically by pacemaker (e.g. its \"blocked\",\n#     unmanaged or disabled).\n\nlog() {\n    local msg=$1\n    echo \"$(date -u): $1\"\n}\n\nusage() {\n    echo 2>&1 \"Usage: $0 NAME BUNDLE_NAME ROLE_LOCAL [ROLE_ANYWHERE] [HOST] [TIMEOUT]\"\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\n#\n# Utility functions to detect stuck resources\n#\n\nbundle_failures_locally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local replica_name\n    for i in $(seq 0 $last); do\n\treplica_name=${BUNDLE_NAME}-${engine}-${i}\n\tcrm_failcount -q -G -r $replica_name -N $HOST\n    done\n}\n\nbundle_failures_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    for i in $(seq 0 $last); do\n\tcrm_failcount -q -G -r ${BUNDLE_NAME}-${engine}-${i}\n    done\n}\n\nbundle_running_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    # return the number of running bundles replica, i.e. the number of\n    # docker/podman resource replicas currently running in the cluster\n    crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:heartbeat:${engine}']/node)\" -\n}\n\nocf_failures_globally() {\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local bundle_node\n    for i in $(seq 0 $last); do\n\tbundle_node=${BUNDLE_NAME}-${i}\n\tcrm_failcount -q -G -r $NAME -N $bundle_node\n    done\n}\n\ndid_resource_failed_locally() {\n    local failures\n    local running\n    local remotehost\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# if we're dealing with an ocf resource, it is running on a\n\t# pacemaker_remote rather that on the real host, and the\n\t# failcounts are thus associated to the pcmk remote. Replace\n\t# the host's name with the pcmk remote's name.\n        remotehost=$(crm_mon --as-xml | xmllint --xpath \"string(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource/node[@name='${HOST}']/../../resource[@resource_agent='${OCF}:pacemaker:remote']/@id)\" -)\n\tif [ -n \"${remotehost}\" ]; then\n\t    crm_failcount -q -G -r $NAME -N $remotehost | grep -q -w INFINITY\n\t    return $?\n\tfi\n\t# If no pcmk remote is currently running, the failcount from\n\t# the ocf resource is useless, compute the failcount from the\n\t# bundle case instead (computed below).\n    fi\n\n    # for bundles, pacemaker can run any bundle replica locally\n    # (e.g. galera-bundle-docker-{0,1,2}), and a failure happens when\n    # there are no more replica to try.\n    # That is, when _at least_ one replica failed locally, and all the\n    # others either failed or are currently running elsewhere.\n    failures=$(bundle_failures_locally $HOST | grep -c -w INFINITY)\n    running=$(bundle_running_globally)\n    test $failures -gt 0 && \\\n    test $(( $failures + $running )) -ge $BUNDLE_REPLICAS\n}\n\ndid_resource_failed_globally() {\n    local remotecount\n    local failures\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# we check the state of an ocf resource only if the\n\t# pcmkremotes are started\n        remotecount=$(crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node)\" -)\n\tif [ \"${remotecount}\" = \"0\" ]; then\n\t    # no pcmkremote is running, so check the bundle state\n\t    # instead of checking the ocf resource\n\t    # bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\t    failures=$(bundle_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\telse\n\t    # ocf resource failed if it failed to start on\n\t    # all $BUNDLE_REPLICAS bundle nodes\n\t    failures=$(ocf_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\tfi\n    else\n\t# bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\tfailures=$(bundle_failures_globally | grep -c -w INFINITY)\n\ttest $failures -eq $BUNDLE_REPLICAS\n    fi\n}\n\n\n# Input validation\n#\n\nNAME=$1\nif [ -z \"${NAME}\" ]; then\n    echo 2>&1 \"Error: argument NAME must not be empty\"\n    exit 1\nfi\n\nBUNDLE_NAME=$2\nif [ -z \"${BUNDLE_NAME}\" ]; then\n    echo 2>&1 \"Error: argument BUNDLE_NAME must not be empty\"\n    exit 1\nfi\n\nROLE_LOCAL=$3\nif [ \"${ROLE_LOCAL}\" = \"_\" ]; then\n    ROLE_LOCAL=\"\"\nfi\n\nROLE_ANYWHERE=$4\nif [ \"${ROLE_ANYWHERE}\" = \"_\" ]; then\n    ROLE_ANYWHERE=\"\"\nfi\n\nif [ -z \"${ROLE_LOCAL}\" ]; then\n    if [ -z \"${ROLE_ANYWHERE}\" ]; then\n        echo 2>&1 \"Error: either ROLE_LOCAL or ROLE_ANYWHERE must be non empty\"\n        exit 1\n    fi\nelse\n    if !(echo \"${ROLE_LOCAL}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n        echo 2>&1 \"Error: argument ROLE_LOCAL must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n        exit 1\n    fi\nfi\n\nif [ -n \"${ROLE_ANYWHERE}\" ] && !(echo \"${ROLE_ANYWHERE}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n    echo 2>&1 \"Error: argument ROLE_ANYWHERE must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n    exit 1\nfi\n\n# Ensure compatibility with pacemaker 2.1\nif pacemaker_supports_promoted; then\n    ROLE_LOCAL=$(echo \"$ROLE_LOCAL\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    ROLE_ANYWHERE=$(echo \"$ROLE_ANYWHERE\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    OCF=\"ocf\"\nelse\n    OCF=\"ocf:\"\nfi\n\nHOST=${5:-$(facter hostname)}\nTIMEOUT=${6:-600}\n\n\n# Configure the search\n# ----\n# Note: we can't use crm_resource in all searches because we can't\n# easily extract the host the OCF resources run on (crm_resource\n# returns the pcmk-remote nodes rather than the hosts)\n# So instead, we implement various searches with XPath directly.\n\nif [ \"${BUNDLE_NAME}\" != \"${NAME}\" ]; then\n# ocf resource\nlocal_resource_xpath=\"//bundle/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node[@name='${HOST}']/../../resource[@id='${NAME}']\"\nany_resource_xpath=\"//bundle//resource[@id='${NAME}']\"\nreplicas_xpath=\"//bundle/primitive[@id='${BUNDLE_NAME}']/../*[boolean(@image) and boolean(@replicas)]\"\nelse\n# bundle resource\nlocal_resource_xpath=\"//bundle[@id='${NAME}']/replica/resource/node[@name='${HOST}']/../../resource\"\nany_resource_xpath=\"//bundle[@id='${NAME}']//resource\"\nreplicas_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nfi\n\nbundle_def_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nBUNDLE_CONTAINER_ENGINE=$(cibadmin -Q | xmllint --xpath \"name(${bundle_def_xpath})\" -)\nBUNDLE_REPLICAS=$(cibadmin -Q | xmllint --xpath \"string(${bundle_def_xpath}/@replicas)\" -)\n\n\n# The wait algorithm follows a two-stage approach\n#  1. Depending on how the script is called, we first check whether\n#     the resource is restarted locally. An A/P resource may be\n#     restarted elsewhere in the cluster.\n#  2. If needed, check whether the A/P resource has restarted\n#     elsewhere. For A/P M/S resources, in case the resource is\n#     restarted as Slave locally, ensure a Master is available.\n\nsuccess=1\nbailout=1\ntimeout=$TIMEOUT\nrole=\"\"\n\n# Stage 1: local check\nif [ -n \"$ROLE_LOCAL\" ]; then\n    log \"Waiting until ${NAME} has restarted on ${HOST} and is in state ${ROLE_LOCAL}\"\n    log \"Will probe resource state with the following XPath pattern: ${local_resource_xpath}\"\n\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resource=$(crm_mon -r --as-xml | xmllint --xpath \"${local_resource_xpath}\" - 2>/dev/null)\n        role=$(echo \"${resource}\" | sed -ne 's/.*\\Wrole=\"\\([^\"]*\\)\".*/\\1/p')\n\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resource}\" | grep -q -w \"\\Wblocked=\\\"true\\\"\"; then\n            log \"${NAME} is blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_locally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif [ \"$role\" = \"$ROLE_LOCAL\" ]; then\n            success=0\n            continue\n        elif [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" = \"$ROLE_ANYWHERE\" ]; then\n            # A/P: we are restarted in the expected state\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_LOCAL} on ${HOST}\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\n# Stage 2: global check\nif [ $timeout -gt 0 ] && [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" != \"$ROLE_ANYWHERE\" ]; then\n    log \"Wait until ${NAME} is restarted anywhere in the cluster in state ${ROLE_ANYWHERE}\"\n    log \"Will probe resource state with the following XPath pattern: ${any_resource_xpath}\"\n\n    success=1\n    bailout=1\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resources=$(crm_mon -r --as-xml | xmllint --xpath \"${any_resource_xpath}\" - 2>/dev/null)\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif ! (echo \"${resources}\" | grep -q -w \"\\Wblocked=\\\"false\\\"\"); then\n            log \"${NAME} blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_globally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resources}\" | grep -q -w \"\\Wrole=\\\"${ROLE_ANYWHERE}\\\"\"; then\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_ANYWHERE} anywhere in the cluster\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\nif [ $timeout -le 0 ]; then\n    log \"Timeout reached after ${TIMEOUT}s while waiting for ${NAME} to be restarted\"\nelif [ $bailout -le 0 ]; then\n    log \"Restart monitoring for ${NAME} cancelled\"\nfi\n\nif [ $success -eq 0 ]; then\n    log \"${NAME} successfully restarted\"\nelse\n    log \"${NAME} was not restarted properly\"\nfi\n\n# Don't block minor update or stack update if the wait was unsuccessful\nexit 0\n"}, "wait-port-and-run.sh": {"mode": "0755", "content": "#!/usr/bin/bash\nset -eu\n\nHOST=$1\nPORT=$2\n\necho \"$(date -u): Checking whether we can bind to ${HOST}:${PORT}\"\nwhile (ss -Htnl src \"${HOST}\" \"sport = :${PORT}\" | grep -wq \"${PORT}\"); do\n    echo \"$(date -u): ${HOST}:${PORT} still in use, waiting...\";\n    sleep 10;\ndone\n\nshift 2\nCOMMAND=\"$*\"\nif [ -z \"${COMMAND}\" ]; then\n    COMMAND=\"true\"\nfi\nexec $COMMAND\n"}, "pacemaker_resource_lock.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nMAX_RETRIES=10\nCIB_ENOTFOUND=105\n\nusage() {\n   echo \"Set a global property in the cluster with a validity timestamp.\"\n   echo \"Usage:\"\n   echo \"   $0 --acquire <lock_name> <lock_owner> <lock_ttl_in_seconds>\"\n   echo \"   $0 --release <lock_name> <lock_owner>\"\n   echo\n}\n\nlog() {\n    echo \"$(date -u): $1\" 1>&2\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\nlock_create() {\n    local name=$1\n    local data=$2\n    # cibadmin won't overwrite a key if someone else succeeded to create it concurrently\n    cibadmin --sync-call --scope crm_config --create --xml-text \"<cluster_property_set id='${name}'><nvpair id='${name}-pair' name='${name}' value='${data}'/></cluster_property_set>\" &>/dev/null\n    return $?\n}\n\nlock_update() {\n    local name=$1\n    local expected_data=$2\n    local new_data=$3\n    # we only update the lock we expect to see, so we can't update someone else's lock\n    cibadmin --sync-call --scope crm_config --modify --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" --xml-text \"<nvpair id='${name}-pair' name='${name}' value='${new_data}'/>\" &>/dev/null\n    return $?\n}\n\nlock_delete() {\n    local name=$1\n    local expected_data=$2\n    # we only delete the lock we expect to see, so we can't delete someone else's lock\n    cibadmin --sync-call --scope crm_config --delete --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" &>/dev/null\n    return $?\n}\n\nlock_get() {\n    local lockname=$1\n    local res\n    local rc\n    res=$(cibadmin --query --scope crm_config --xpath \"//cluster_property_set/nvpair[@name='$lockname']\" 2>/dev/null)\n    rc=$?\n    if [ $rc -eq 0 ]; then\n        echo \"$res\" | sed -n 's/.*value=\"\\([^\"]*\\)\".*/\\1/p'\n    fi\n    return $rc\n}\n\nlock_owner() {\n    local lock=$1\n    echo \"$lock\" | cut -d':' -f1\n}\n\nlock_has_expired() {\n    local lock=$1\n    local expiry=$(echo \"$lock\" | cut -d':' -f2)\n    local now=$(date +%s)\n    test $now -ge $expiry\n}\n\n\n# Perform a lock action and restart if the CIB has been modified before\n# committing the lock action\ntry_action() {\n    local fun=$1\n    local lock=$2\n    local requester=$3\n    local args=${4:-}\n    local tries=$MAX_RETRIES\n    local rc=1\n    if [ \"$fun\" = \"lock_acquire\" ] || [ \"$fun\" = \"lock_release\" ]; then\n        log \"Try running $fun\"\n    else\n        return 2\n    fi\n    while [ $rc -ne 0 ]; do\n        $fun $lock $requester $args\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Operation $1 succeeded\"\n            return 0\n        elif [ $rc -eq 3 ]; then\n            # rc == 3 -> CIB changed before push\n            if [ $tries -eq 0 ]; then\n                log \"Failed to commit after $MAX_RETRIES retries. Bailing out.\"\n                return 2\n            else\n                log \"Failed to commit. Retrying operation.\"\n                tries=$(($tries - 1))\n            fi\n        elif [ $rc -eq 2 ]; then\n            # rc == 2 -> unrecoverable cib error (e.g. pacemaker down)\n            log \"Unexpected failure. Bailing out\"\n            return $rc\n        else\n            # rc == 1 -> lock error (not owner, lock doesn't exists)\n            return $rc\n        fi\n    done\n}\n\n# The lock mechanism uses cibadmin's atomic creation so cluster-wide\n# state coherency is guaranteed by pacemaker\nlock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc\n    local lock\n    local expiry\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -n \"$lock\" ]; then\n        lock_has_expired $lock\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Lock has expired, now available for being held\"\n        else\n            # lock is still held. check whether we're the owner\n            owner=$(lock_owner $lock)\n            if [ \"$owner\" = \"$requester\" ];then\n                log \"Requester already owns the lock, acquiring attempt will just reconfigure the TTL\"\n            else\n                log \"Lock is held by someone else ($owner)\"\n                return 1\n            fi\n        fi\n    else\n        log \"Lock is not held yet\"\n    fi\n\n    # prepare the lock info\n    expiry=$(($(date +%s) + $ttl))\n\n    if [ -n \"$lock\" ]; then\n        log \"Attempting to update the lock\"\n        lock_update $lockname \"$lock\" \"$requester:$expiry\"\n        rc=$?\n    else\n        log \"Attempting to acquire the lock\"\n        lock_create $lockname \"$requester:$expiry\"\n        rc=$?\n    fi\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' acquired by '$requester', valid until $(date -d @$expiry)\"\n        return 0\n    else\n        log \"CIB changed, lock cannot be acquired\"\n        return 3\n    fi\n}\n\n\n# The lock mechanism uses the CIB's num_updates tag to implement\n# a conditional store. Cluster-wide locking is guaranteed by pacemaker\nlock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n    local lock\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        log \"Lock doesn't exist. Nothing to release\"\n        return 0\n    else\n        log \"Lock exists, check whether we're the owner\"\n        owner=$(lock_owner $lock)\n        if [ \"$owner\" != \"$requester\" ];then\n            log \"Lock is held by someone else ($owner), will not unlock\"\n            return 1\n        fi\n    fi\n\n    lock_delete $lockname \"$lock\"\n    rc=$?\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' released by '$requester'\"\n        return 0\n    else\n        log \"CIB deletion error, lock cannot be released\"\n        return 3\n    fi\n}\n\n\n# Retrieve the owner of a lock from the CIB\n# this is a read-only operation, so no need to log debug info\nlock_get_owner() {\n    local lockname=$1\n    local rc\n    local lock\n    local owner\n\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        return 1\n    else\n        lock_owner $lock\n        return 0\n    fi\n}\n\n\nACTION=$1\nLOCKNAME=$2\nREQUESTER=$3\nTTL=${4:-60}\n\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nif [ $ACTION != \"--help\" ]; then\n    if [ -z \"$LOCKNAME\" ]; then\n        error \"You must specific a lock name\"\n    fi\n    if [ $ACTION != \"--owner\" ] && [ $ACTION != \"-o\" ]; then\n        if [ -z \"$REQUESTER\" ]; then\n            error \"You must specific a lock requester\"\n        fi\n    fi\nfi\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) try_action lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --release|-r) try_action lock_release $LOCKNAME $REQUESTER;;\n    --acquire-once|-A) lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --owner|-o) lock_get_owner $LOCKNAME;;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}, "pacemaker_mutex_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_restart_bundle.sh --lock mysql galera galera-bundle Master _\n# pacemaker_mutex_restart_bundle.sh --lock ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\n\nset -u\n\nusage() {\n    echo \"Restart a clustered resource in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --lock <tripleo-service> <pcmk-resource> <pcmk-bundle> <target-state-local> <target-state-cluster>\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\nACTION=$1\ncase $ACTION in\n    --help) usage; exit 0;;\n    --lock) ;;\n    *) error \"Unknown action '$ACTION'\";;\nesac\n\nTRIPLEO_SERVICE=$2\nLOCK_NAME=${TRIPLEO_SERVICE}-restart-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to restart resource $TRIPLEO_SERVICE\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\nRESOURCE_NAME=$3\nBUNDLE_NAME=$4\nWAIT_TARGET_LOCAL=$5\nWAIT_TARGET_ANYWHERE=${6:-_}\n\nif pacemaker_supports_promoted; then\n    WAIT_TARGET_LOCAL=$(echo \"$5\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    WAIT_TARGET_ANYWHERE=$(echo \"${6:-_}\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    promoted_role=\"Promoted\"\nelse\n    promoted_role=\"Master\"\nfi\n\n# The lock TTL should accomodate for the resource start/promote timeout\nif [ \"$RESOURCE_NAME\" != \"$BUNDLE_NAME\" ]; then\n    if [ \"$WAIT_TARGET_LOCAL\" = \"$promoted_role\" ] || [ \"$WAIT_TARGET_ANYWHERE\" = \"$promoted_role\" ]; then\n        rsc_op=\"promote\"\n    else\n        rsc_op=\"start\"\n    fi\n    # <op id=\"galera-promote-interval-0s\" interval=\"0s\" name=\"promote\" on-fail=\"block\" timeout=\"300s\"/>\n    PCMK_TTL=$(cibadmin -Q | xmllint -xpath \"string(//primitive[@id='${RESOURCE_NAME}']/operations/op[@name='${rsc_op}']/@timeout)\" - | sed 's/s$//')\n    LOCK_TTL=$((PCMK_TTL + 30))\nelse\n    # The podman RA's default start timeout\n    LOCK_TTL=90\nfi\n\nlog \"Acquire a ${LOCK_TTL}s restart lock for service $TRIPLEO_SERVICE before restarting it\"\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nrc=1\nwhile [ $rc -ne 0 ]; do\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire $LOCK_NAME $LOCK_OWNER $LOCK_TTL\n    rc=$?\n    if [ $rc != 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not acquire lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Could not acquire lock, retrying\"\n            sleep 10\n        fi\n    fi\ndone\n\nlog \"Restart the service $TRIPLEO_SERVICE locally\"\n# Reuse the local restart script in t-h-t (driven by env var TRIPLEO_MINOR_UPDATE)\nTRIPLEO_MINOR_UPDATE=true /var/lib/container-config-scripts/pacemaker_restart_bundle.sh $TRIPLEO_SERVICE $RESOURCE_NAME $BUNDLE_NAME $WAIT_TARGET_LOCAL $WAIT_TARGET_ANYWHERE\n\n# If we reached this point, always try to release the lock\nlog \"Release the restart lock for service $TRIPLEO_SERVICE\"\n/var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $LOCK_NAME $LOCK_OWNER\nrc=$?\nif [ $rc -ne 0 ] && [ $rc -ne 1 ]; then\n    error \"Could not release held lock (rc: $rc)\"\nfi\n"}, "pacemaker_mutex_shutdown.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_shutdown.sh --acquire\n# pacemaker_mutex_shutdown.sh --release\n\nset -u\n\nusage() {\n    echo \"Shutdown a cluster node in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --acquire # prevent other node from shutting down until we hold the lock\"\n    echo \"   $0 --release # release the lock, other node can compete for the shutdown lock\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nshutdown_lock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc=1\n    local current_owner\n    local owner_stopped\n    local owner_rc\n\n    log \"Acquiring the shutdown lock\"\n    while [ $rc -ne 0 ]; do\n        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire-once $lockname $requester $ttl\n        rc=$?\n        if [ $rc -ne 0 ]; then\n            if [ $rc -eq 2 ]; then\n                error \"Could not acquire the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n            else\n                # The lock is held by another node.\n                current_owner=$(/var/lib/container-config-scripts/pacemaker_resource_lock.sh --owner $lockname)\n                owner_rc=$?\n                if [ $owner_rc -eq 2 ]; then\n                    error \"Could not get the shutdown lock owner due to unrecoverable error (rc: $owner_rc), bailing out\"\n                fi\n                if [ $owner_rc -eq 0 ]; then\n                    # If the owner is marked as offline, that means it has shutdown and\n                    # we can clean the lock preemptively and try to acquire it.\n                    owner_stopped=$(crm_mon -1X | xmllint --xpath 'count(//nodes/node[@name=\"'${current_owner}'\" and @online=\"false\" and @unclean=\"false\"])' -)\n                    if [ \"${owner_stopped}\" = \"1\" ]; then\n                        log \"Shutdown lock held by stopped node '${current_owner}', lock can be released\"\n                        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $current_owner\n                        continue\n                    fi\n                fi\n                log \"Shutdown lock held by another node (rc: $rc), retrying\"\n                sleep 10\n            fi\n        fi\n    done\n    log \"Shutdown lock acquired\"\n    return 0\n}\n\n\n# Release the lock if we still own it. Not owning it anymore is not fatal\nshutdown_lock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n\n    log \"Releasing the shutdown lock\"\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $requester\n    rc=$?\n    if [ $rc -ne 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not release the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Shutdown lock no longer held, nothing to do\"\n        fi\n    else\n        log \"Shutdown lock released\"\n    fi\n    return 0\n}\n\n\nACTION=$1\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nLOCK_NAME=tripleo-shutdown-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to aquire the shutdown lock\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\n# We start with a very high TTL, that long enough to accomodate a cluster stop.\n# As soon as the node will get offline, the other competing node will be entitled\n# to steal the lock, so they should never wait that long in practice.\nLOCK_TTL=600\n\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) shutdown_lock_acquire ${LOCK_NAME} ${LOCK_OWNER} ${LOCK_TTL};;\n    --release|-r) shutdown_lock_release ${LOCK_NAME} ${LOCK_OWNER};;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}}, "tuple:('role_data', 'docker_config')": {"step_3": {"cinder_volume_init_logs": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-volume:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/cinder:/var/log/cinder"], "command": ["/bin/bash", "-c", "chown -R cinder:cinder /var/log/cinder"]}}}, "tuple:('role_data', 'config_settings')": {"cinder::database_connection": "mysql+pymysql://cinder:q4G6h4a5N51huVgDb7vMEqcRq@172.17.0.2/cinder?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "cinder::logging::debug": true, "cinder::storage_availability_zone": "nova", "cinder::rabbit_heartbeat_timeout_threshold": 60, "cinder::rpc_response_timeout": 60, "cinder::rabbit_heartbeat_in_pthread": false, "cinder::db::database_db_max_retries": -1, "cinder::db::database_max_retries": -1, "cinder::cron::db_purge::minute": "1", "cinder::cron::db_purge::hour": "0", "cinder::cron::db_purge::monthday": "*", "cinder::cron::db_purge::month": "*", "cinder::cron::db_purge::weekday": "*", "cinder::cron::db_purge::user": "cinder", "cinder::cron::db_purge::age": "30", "cinder::cron::db_purge::destination": "/var/log/cinder/cinder-rowsflush.log", "cinder::cron::db_purge::maxdelay": "3600", "cinder::glance::glance_api_servers": "http://172.17.0.2:9293", "cinder::keystone::service_user::send_service_user_token": true, "cinder::keystone::service_user::project_name": "service", "cinder::keystone::service_user::auth_type": "password", "cinder::keystone::service_user::auth_url": "http://172.17.0.2:5000/", "cinder::keystone::service_user::password": "q4G6h4a5N51huVgDb7vMEqcRq", "cinder::keystone::service_user::region_name": "regionOne", "cinder::nova::interface": "admin", "cinder::nova::project_name": "service", "cinder::nova::auth_type": "password", "cinder::nova::auth_url": "http://172.17.0.2:5000/", "cinder::nova::password": "LS8Q05rmlMlHeKHPO1GdkVzQT", "cinder::nova::region_name": "regionOne", "tripleo::profile::base::lvm::enable_udev": false, "tripleo::profile::base::cinder::volume::cinder_enable_iscsi_backend": false, "tripleo::profile::base::cinder::volume::cinder_enable_nfs_backend": false, "tripleo::profile::base::cinder::volume::cinder_enable_rbd_backend": true, "tripleo::profile::base::cinder::volume::cinder_volume_cluster": "", "tripleo::profile::base::cinder::volume::nfs::cinder_nfs_mount_options": "context=system_u:object_r:container_file_t:s0", "tripleo::profile::base::cinder::volume::nfs::cinder_nfs_servers": [], "tripleo::profile::base::cinder::volume::nfs::cinder_nfs_snapshot_support": false, "tripleo::profile::base::cinder::volume::nfs::cinder_nas_secure_file_operations": "False", "tripleo::profile::base::cinder::volume::nfs::cinder_nas_secure_file_permissions": "False", "tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_helper": "lioadm", "tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_protocol": "iscsi", "tripleo::profile::base::cinder::volume::rbd::backend_name": ["tripleo_ceph"], "tripleo::profile::base::cinder::volume::rbd::cinder_rbd_ceph_conf": "/etc/ceph/ceph.conf", "tripleo::profile::base::cinder::volume::rbd::cinder_rbd_pool_name": "volumes", "tripleo::profile::base::cinder::volume::rbd::cinder_rbd_extra_pools": [], "tripleo::profile::base::cinder::volume::rbd::cinder_rbd_secret_uuid": "41e4325c-1291-5fe0-8134-34414eb23649", "tripleo::profile::base::cinder::volume::rbd::cinder_rbd_user_name": "openstack", "tripleo::profile::base::cinder::volume::rbd::cinder_rbd_flatten_volume_from_snapshot": false, "tripleo::profile::base::cinder::volume::rbd::multi_config": {}, "tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_address": "%{hiera('storage')}", "tripleo::profile::pacemaker::cinder::volume_bundle::cinder_volume_docker_image": "cluster.common.tag/cinder-volume:pcmklatest", "tripleo::profile::pacemaker::cinder::volume_bundle::docker_volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro", "/var/log/containers/cinder:/var/log/cinder:z", "/var/lib/kolla/config_files/cinder_volume.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/lib/modules:/lib/modules:ro", "/dev:/dev", "/run:/run", "/sys:/sys", "/var/lib/cinder:/var/lib/cinder:z", "/var/lib/iscsi:/var/lib/iscsi:z"], "tripleo::profile::pacemaker::cinder::volume_bundle::docker_environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}, "tripleo::profile::pacemaker::cinder::volume_bundle::container_backend": "podman", "tripleo::profile::pacemaker::cinder::volume_bundle::ceph_conf_path": "/var/lib/tripleo-config/ceph", "cinder::volume::manage_service": false, "cinder::volume::enabled": false, "cinder::backend_host": "hostgroup"}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-18-we2j4xvmzvly/21240534-5c20-4fa9-a4fd-1831132cd275"}


created_at: 2026-01-21 15:59:01.211101
data:
  {"type": "json", "value": {"ContainerMysqlImage": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1", "ContainerMysqlConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1"}}


created_at: 2026-01-21 15:59:02.093637
data:
  {"type": "json", "value": {"ContainerClustercheckImage": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1", "ContainerClustercheckConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1"}}


created_at: 2026-01-21 15:59:06.234018
data:
  {"tuple:('role_data', 'metadata_settings')": null, "tuple:('role_data', 'service_name')": "mysql", "tuple:('role_data', 'config_settings')": {"mysql::server::package_name": "mariadb-galera-server", "mysql::server::manage_config_file": true, "mysql_ipv6": false, "mysql_max_connections": 4096, "mysql::server::root_password": "Yh8kdMCiyn", "mysql_clustercheck_password": "vJa4x1mNX6BeiiDv44awoz5Im", "enable_galera": true, "mysql_auth_ed25519": false, "mysql_bind_host": "%{hiera('internal_api')}", "tripleo::profile::base::database::mysql::bind_address": "%{hiera('fqdn_internal_api')}", "tripleo::profile::base::database::mysql::client_bind_address": "%{hiera('internal_api')}", "tripleo::profile::base::database::mysql::generate_dropin_file_limit": true, "innodb_buffer_pool_size": "128M"}, "mysql_drop_unused_users": [{"name": "Drop unused OpenStack DB users", "when": ["step|int == 1", "mysql_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower"], "block": [{"name": "mysql container id", "command": "podman ps -q --filter name={{ mysql_container_name }} --filter status=running", "register": "mysql_container_id"}, {"name": "set mysql container id fact", "set_fact": {"mysql_container": "{{ mysql_container_id.stdout }}"}}, {"name": "Mysql script to drop unused DB users", "when": "( mysql_container | length ) > 0", "block": [{"name": "Get the list of all OpenStack DB users", "shell": "jq -r 'to_entries[] | select(.key|endswith(\"::db::mysql::user\")) | .value' /etc/puppet/hieradata/service_configs.json", "register": "openstack_db_users"}, {"name": "List all DB users that match the DB users to be dropped", "shell": "for u in {{ openstack_db_users.stdout_lines | join(' ') }}; do podman exec -u root -it \"{{ mysql_container }}\" mysql -sNe \"select concat('\\`',user,'\\`@\\`',host,'\\`') from mysql.user where user = '$u' and host != '%';\"; done", "register": "mysql_db_users"}, {"name": "resulting DB users to be dropped", "debug": {"msg": "{{ mysql_db_users.stdout_lines }}"}}, {"name": "Drop all unneeded Openstack DB users", "shell": "podman exec -u root -it \"{{ mysql_container }}\" mysql -sNe 'drop user {{ item }};'", "loop": "{{ mysql_db_users.stdout_lines }}"}]}]}], "tuple:('role_data', 'deploy_steps_tasks')": [{"name": "Certificate generation", "when": ["step|int == 1", "enable_internal_tls"], "block": [{"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "mysql", "dns": ["{{fqdn_internal_api}}", "{{cloud_names.cloud_name_internal_api}}"], "principal": "mysql/{{fqdn_internal_api}}@{{idm_realm}}", "key_size": "2048", "ca": "ipa"}]}}]}], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-19-jjftxlaoy6r6-MysqlPuppetBase-326j26vyaq7z-MysqlBase-udtun2edivn3/b0e85aca-4b03-426d-a0cf-e7afeea9dca1"}


created_at: 2026-01-21 15:59:06.238853
data:
  {"value": {"ContainerMysqlImage": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1", "ContainerMysqlConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1"}}


created_at: 2026-01-21 15:59:06.288082
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "container_config_scripts": {"container_puppet_apply.sh": {"mode": "0700", "content": "#!/bin/bash\nset -eux\nSTEP=$1\nTAGS=$2\nCONFIG=$3\nEXTRA_ARGS=${4:-''}\nif [ -d /tmp/puppet-etc ]; then\n  # ignore copy failures as these may be the same file depending on docker mounts\n  cp -a /tmp/puppet-etc/* /etc/puppet || true\nfi\necho \"{\\\"step\\\": ${STEP}}\" > /etc/puppet/hieradata/docker_puppet.json\n# $::deployment_type in puppet-tripleo\nexport FACTER_deployment_type=containers\nset +e\npuppet apply $EXTRA_ARGS \\\n    --verbose \\\n    --detailed-exitcodes \\\n    --summarize \\\n    --color=false \\\n    --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \\\n    --tags $TAGS \\\n    -e \"noop_resource('package'); ${CONFIG}\"\nrc=$?\nset -e\nset +ux\nif [ $rc -eq 2 -o $rc -eq 0 ]; then\n    exit 0\nfi\nexit $rc\n"}, "pyshim.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n#\n# Usage: pyshim.sh <script and/or arguments>\n#\n# Unfortunately THT doesn't know which version of python might be in a\n# container so we need this script to be able to try python3 or python2\n# depending on availability.  Since this is a temporary shim until we've\n# fully cut over to python3, we check for the existence of python3 first\n# before falling back to python2. This will help in the transition from\n# python2 based containers to python3.\n\nshow_usage() {\n    echo \"Usage: pyshim.sh <script and/or arguments>\"\n}\n\nif [ $# -lt 1 ]\nthen\n    show_usage\n    exit 1\nfi\n\nset -x\nif command -v python3 >/dev/null; then\n    python3 \"$@\"\nelif command -v python2 >/dev/null; then\n    python2 \"$@\"\nelif command -v python >/dev/null; then\n    python \"$@\"\nelse\n    echo \"ERROR: python is not available!\"\n    exit 1\nfi\n"}, "pacemaker_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nset -u\n\n# ./pacemaker_restart_bundle.sh mysql galera galera-bundle Master _\n# ./pacemaker_restart_bundle.sh redis redis redis-bundle Slave Master\n# ./pacemaker_restart_bundle.sh ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\nRESTART_SCRIPTS_DIR=$(dirname $0)\nTRIPLEO_SERVICE=$1\nRESOURCE_NAME=$2\nBUNDLE_NAME=$3\nWAIT_TARGET_LOCAL=$4\nWAIT_TARGET_ANYWHERE=${5:-_}\nTRIPLEO_MINOR_UPDATE=\"${TRIPLEO_MINOR_UPDATE:-false}\"\nTRIPLEO_HA_WRAPPER_RESOURCE_EXISTS=\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS:-false}\"\n\nbundle_can_be_restarted() {\n    local bundle=$1\n    # As long as the resource bundle is managed by pacemaker and is\n    # not meant to stay stopped, no matter the state of any inner\n    # pcmk_remote or ocf resource, we should restart it to give it a\n    # chance to read the new config.\n    [ \"$(crm_resource --meta -r $1 -g is-managed 2>/dev/null)\" != \"false\" ] && \\\n    [ \"$(crm_resource --meta -r $1 -g target-role 2>/dev/null)\" != \"Stopped\" ]\n}\n\nlog() {\n    local msg=$1\n    logger -t pcmkrestart \"$1\"\n}\n\nHOSTNAME=$(/bin/hostname -s)\nif [ x\"${TRIPLEO_MINOR_UPDATE,,}\" != x\"true\" ]; then\n    if [ x\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS,,}\" = x\"false\" ]; then\n        # Do not restart during initial deployment, as the resource\n        # has just been created.\n        SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n        if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n            log \"Initial deployment, skipping the restart of ${BUNDLE_NAME}\"\n\tfi\n        exit 0\n    else\n        # During a stack update, this script is called in parallel on\n        # every node the resource runs on, after the service's configs\n        # have been updated on all nodes. So we need to run pcs only\n        # once (e.g. on the service's boostrap node).\n        if bundle_can_be_restarted ${BUNDLE_NAME}; then\n            SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n            if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n                replicas_running=$(crm_resource -Q -r $BUNDLE_NAME --locate 2>&1 | wc -l)\n                if [ \"$replicas_running\" != \"0\" ]; then\n                    log \"Restarting ${BUNDLE_NAME} globally. Stopping:\"\n                    /sbin/pcs resource disable --wait=600 $BUNDLE_NAME\n                    log \"Restarting ${BUNDLE_NAME} globally. Starting:\"\n                    /sbin/pcs resource enable --wait=600 $BUNDLE_NAME\n                else\n                    log \"${BUNDLE_NAME} is not running anywhere,\" \\\n                         \"cleaning up to restart it globally if necessary\"\n                    /sbin/pcs resource cleanup $BUNDLE_NAME\n                fi\n            else\n                log \"Skipping global restart of ${BUNDLE_NAME} on ${HOSTNAME} it will be restarted by node ${SERVICE_NODEID}\"\n            fi\n\n        else\n            log \"No global restart needed for ${BUNDLE_NAME}.\"\n        fi\n    fi\nelse\n    # During a minor update workflow however, a host gets fully\n    # updated before updating the next one. So unlike stack\n    # update, at the time this script is called, the service's\n    # configs aren't updated on all nodes yet. So only restart the\n    # resource locally, where it's guaranteed that the config is\n    # up to date.\n    HOST=$(facter hostname)\n\n    if bundle_can_be_restarted ${BUNDLE_NAME}; then\n\t# if the resource is running locally, restart it\n\tif crm_resource -r $BUNDLE_NAME --locate 2>&1 | grep -w -q \"${HOST}\"; then\n            log \"Restarting ${BUNDLE_NAME} locally on '${HOST}'\"\n            /sbin/pcs resource restart $BUNDLE_NAME \"${HOST}\"\n\n\telse\n\t    # At this point, if no resource is running locally, it's\n\t    # either because a) it has failed previously, or b) because\n\t    # it's an A/P resource running elsewhere.\n\t    # By cleaning up resource, we ensure that a) it will try to\n\t    # restart, or b) it won't do anything if the resource is\n\t    # already running elsewhere.\n            log \"${BUNDLE_NAME} is currently not running on '${HOST}',\" \\\n                 \"cleaning up its state to restart it if necessary\"\n            /sbin/pcs resource cleanup $BUNDLE_NAME node=\"${HOST}\"\n\tfi\n\n\t# Wait until the resource is in the expected target state\n\t$RESTART_SCRIPTS_DIR/pacemaker_wait_bundle.sh \\\n            $RESOURCE_NAME $BUNDLE_NAME \\\n            \"$WAIT_TARGET_LOCAL\" \"$WAIT_TARGET_ANYWHERE\" \\\n\t    \"${HOST}\" 600\n    else\n        log \"No restart needed for ${BUNDLE_NAME}.\"\n    fi\nfi\n"}, "pacemaker_wait_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# ----\n# Wait for an OCF resource or a bundle to be restarted\n# ----\n# e.g.:\n# M/S OCF:      $0 galera galera-bundle Master\n# clone OCF:    $0 rabbitmq rabbitmq-bundle Started\n# A/P M/S OCF:  $0 redis redis-bundle Slave Master\n# A/P bundle:   $0 openstack-cinder-volume openstack-cinder-volume _ Started\n# clone bundle: $0 haproxy-bundle haproxy-bundle Started\n\n# design note 1:\n#  - this script is called during a minor update; it is called\n#    once per node that hosts a service replica.\n#  - the purpose of this script is to ensure that restarting the\n#    service replica locally won't disrupt the service availability\n#    for the end user. To reach that goal, the script waits until the\n#    service is restarted locally or globallu and reaches a given\n#    target state (i.e. Started, Slave or Master).\n# design note 2:\n#   - we don't want to track restart error: our only job is to ensure\n#     service restart synchronization, not service health.\n#   - In particular, we don't want to error out in case the resource\n#     cannot be restarted locally, because that would make the minor\n#     update fail, even if potentially other replicas still provide\n#     the service.\n# design note 3:\n#   - we can bail out early if we determine that the resource can't\n#     be restarted automatically by pacemaker (e.g. its \"blocked\",\n#     unmanaged or disabled).\n\nlog() {\n    local msg=$1\n    echo \"$(date -u): $1\"\n}\n\nusage() {\n    echo 2>&1 \"Usage: $0 NAME BUNDLE_NAME ROLE_LOCAL [ROLE_ANYWHERE] [HOST] [TIMEOUT]\"\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\n#\n# Utility functions to detect stuck resources\n#\n\nbundle_failures_locally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local replica_name\n    for i in $(seq 0 $last); do\n\treplica_name=${BUNDLE_NAME}-${engine}-${i}\n\tcrm_failcount -q -G -r $replica_name -N $HOST\n    done\n}\n\nbundle_failures_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    for i in $(seq 0 $last); do\n\tcrm_failcount -q -G -r ${BUNDLE_NAME}-${engine}-${i}\n    done\n}\n\nbundle_running_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    # return the number of running bundles replica, i.e. the number of\n    # docker/podman resource replicas currently running in the cluster\n    crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:heartbeat:${engine}']/node)\" -\n}\n\nocf_failures_globally() {\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local bundle_node\n    for i in $(seq 0 $last); do\n\tbundle_node=${BUNDLE_NAME}-${i}\n\tcrm_failcount -q -G -r $NAME -N $bundle_node\n    done\n}\n\ndid_resource_failed_locally() {\n    local failures\n    local running\n    local remotehost\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# if we're dealing with an ocf resource, it is running on a\n\t# pacemaker_remote rather that on the real host, and the\n\t# failcounts are thus associated to the pcmk remote. Replace\n\t# the host's name with the pcmk remote's name.\n        remotehost=$(crm_mon --as-xml | xmllint --xpath \"string(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource/node[@name='${HOST}']/../../resource[@resource_agent='${OCF}:pacemaker:remote']/@id)\" -)\n\tif [ -n \"${remotehost}\" ]; then\n\t    crm_failcount -q -G -r $NAME -N $remotehost | grep -q -w INFINITY\n\t    return $?\n\tfi\n\t# If no pcmk remote is currently running, the failcount from\n\t# the ocf resource is useless, compute the failcount from the\n\t# bundle case instead (computed below).\n    fi\n\n    # for bundles, pacemaker can run any bundle replica locally\n    # (e.g. galera-bundle-docker-{0,1,2}), and a failure happens when\n    # there are no more replica to try.\n    # That is, when _at least_ one replica failed locally, and all the\n    # others either failed or are currently running elsewhere.\n    failures=$(bundle_failures_locally $HOST | grep -c -w INFINITY)\n    running=$(bundle_running_globally)\n    test $failures -gt 0 && \\\n    test $(( $failures + $running )) -ge $BUNDLE_REPLICAS\n}\n\ndid_resource_failed_globally() {\n    local remotecount\n    local failures\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# we check the state of an ocf resource only if the\n\t# pcmkremotes are started\n        remotecount=$(crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node)\" -)\n\tif [ \"${remotecount}\" = \"0\" ]; then\n\t    # no pcmkremote is running, so check the bundle state\n\t    # instead of checking the ocf resource\n\t    # bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\t    failures=$(bundle_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\telse\n\t    # ocf resource failed if it failed to start on\n\t    # all $BUNDLE_REPLICAS bundle nodes\n\t    failures=$(ocf_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\tfi\n    else\n\t# bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\tfailures=$(bundle_failures_globally | grep -c -w INFINITY)\n\ttest $failures -eq $BUNDLE_REPLICAS\n    fi\n}\n\n\n# Input validation\n#\n\nNAME=$1\nif [ -z \"${NAME}\" ]; then\n    echo 2>&1 \"Error: argument NAME must not be empty\"\n    exit 1\nfi\n\nBUNDLE_NAME=$2\nif [ -z \"${BUNDLE_NAME}\" ]; then\n    echo 2>&1 \"Error: argument BUNDLE_NAME must not be empty\"\n    exit 1\nfi\n\nROLE_LOCAL=$3\nif [ \"${ROLE_LOCAL}\" = \"_\" ]; then\n    ROLE_LOCAL=\"\"\nfi\n\nROLE_ANYWHERE=$4\nif [ \"${ROLE_ANYWHERE}\" = \"_\" ]; then\n    ROLE_ANYWHERE=\"\"\nfi\n\nif [ -z \"${ROLE_LOCAL}\" ]; then\n    if [ -z \"${ROLE_ANYWHERE}\" ]; then\n        echo 2>&1 \"Error: either ROLE_LOCAL or ROLE_ANYWHERE must be non empty\"\n        exit 1\n    fi\nelse\n    if !(echo \"${ROLE_LOCAL}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n        echo 2>&1 \"Error: argument ROLE_LOCAL must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n        exit 1\n    fi\nfi\n\nif [ -n \"${ROLE_ANYWHERE}\" ] && !(echo \"${ROLE_ANYWHERE}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n    echo 2>&1 \"Error: argument ROLE_ANYWHERE must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n    exit 1\nfi\n\n# Ensure compatibility with pacemaker 2.1\nif pacemaker_supports_promoted; then\n    ROLE_LOCAL=$(echo \"$ROLE_LOCAL\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    ROLE_ANYWHERE=$(echo \"$ROLE_ANYWHERE\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    OCF=\"ocf\"\nelse\n    OCF=\"ocf:\"\nfi\n\nHOST=${5:-$(facter hostname)}\nTIMEOUT=${6:-600}\n\n\n# Configure the search\n# ----\n# Note: we can't use crm_resource in all searches because we can't\n# easily extract the host the OCF resources run on (crm_resource\n# returns the pcmk-remote nodes rather than the hosts)\n# So instead, we implement various searches with XPath directly.\n\nif [ \"${BUNDLE_NAME}\" != \"${NAME}\" ]; then\n# ocf resource\nlocal_resource_xpath=\"//bundle/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node[@name='${HOST}']/../../resource[@id='${NAME}']\"\nany_resource_xpath=\"//bundle//resource[@id='${NAME}']\"\nreplicas_xpath=\"//bundle/primitive[@id='${BUNDLE_NAME}']/../*[boolean(@image) and boolean(@replicas)]\"\nelse\n# bundle resource\nlocal_resource_xpath=\"//bundle[@id='${NAME}']/replica/resource/node[@name='${HOST}']/../../resource\"\nany_resource_xpath=\"//bundle[@id='${NAME}']//resource\"\nreplicas_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nfi\n\nbundle_def_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nBUNDLE_CONTAINER_ENGINE=$(cibadmin -Q | xmllint --xpath \"name(${bundle_def_xpath})\" -)\nBUNDLE_REPLICAS=$(cibadmin -Q | xmllint --xpath \"string(${bundle_def_xpath}/@replicas)\" -)\n\n\n# The wait algorithm follows a two-stage approach\n#  1. Depending on how the script is called, we first check whether\n#     the resource is restarted locally. An A/P resource may be\n#     restarted elsewhere in the cluster.\n#  2. If needed, check whether the A/P resource has restarted\n#     elsewhere. For A/P M/S resources, in case the resource is\n#     restarted as Slave locally, ensure a Master is available.\n\nsuccess=1\nbailout=1\ntimeout=$TIMEOUT\nrole=\"\"\n\n# Stage 1: local check\nif [ -n \"$ROLE_LOCAL\" ]; then\n    log \"Waiting until ${NAME} has restarted on ${HOST} and is in state ${ROLE_LOCAL}\"\n    log \"Will probe resource state with the following XPath pattern: ${local_resource_xpath}\"\n\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resource=$(crm_mon -r --as-xml | xmllint --xpath \"${local_resource_xpath}\" - 2>/dev/null)\n        role=$(echo \"${resource}\" | sed -ne 's/.*\\Wrole=\"\\([^\"]*\\)\".*/\\1/p')\n\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resource}\" | grep -q -w \"\\Wblocked=\\\"true\\\"\"; then\n            log \"${NAME} is blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_locally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif [ \"$role\" = \"$ROLE_LOCAL\" ]; then\n            success=0\n            continue\n        elif [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" = \"$ROLE_ANYWHERE\" ]; then\n            # A/P: we are restarted in the expected state\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_LOCAL} on ${HOST}\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\n# Stage 2: global check\nif [ $timeout -gt 0 ] && [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" != \"$ROLE_ANYWHERE\" ]; then\n    log \"Wait until ${NAME} is restarted anywhere in the cluster in state ${ROLE_ANYWHERE}\"\n    log \"Will probe resource state with the following XPath pattern: ${any_resource_xpath}\"\n\n    success=1\n    bailout=1\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resources=$(crm_mon -r --as-xml | xmllint --xpath \"${any_resource_xpath}\" - 2>/dev/null)\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif ! (echo \"${resources}\" | grep -q -w \"\\Wblocked=\\\"false\\\"\"); then\n            log \"${NAME} blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_globally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resources}\" | grep -q -w \"\\Wrole=\\\"${ROLE_ANYWHERE}\\\"\"; then\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_ANYWHERE} anywhere in the cluster\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\nif [ $timeout -le 0 ]; then\n    log \"Timeout reached after ${TIMEOUT}s while waiting for ${NAME} to be restarted\"\nelif [ $bailout -le 0 ]; then\n    log \"Restart monitoring for ${NAME} cancelled\"\nfi\n\nif [ $success -eq 0 ]; then\n    log \"${NAME} successfully restarted\"\nelse\n    log \"${NAME} was not restarted properly\"\nfi\n\n# Don't block minor update or stack update if the wait was unsuccessful\nexit 0\n"}, "wait-port-and-run.sh": {"mode": "0755", "content": "#!/usr/bin/bash\nset -eu\n\nHOST=$1\nPORT=$2\n\necho \"$(date -u): Checking whether we can bind to ${HOST}:${PORT}\"\nwhile (ss -Htnl src \"${HOST}\" \"sport = :${PORT}\" | grep -wq \"${PORT}\"); do\n    echo \"$(date -u): ${HOST}:${PORT} still in use, waiting...\";\n    sleep 10;\ndone\n\nshift 2\nCOMMAND=\"$*\"\nif [ -z \"${COMMAND}\" ]; then\n    COMMAND=\"true\"\nfi\nexec $COMMAND\n"}, "pacemaker_resource_lock.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nMAX_RETRIES=10\nCIB_ENOTFOUND=105\n\nusage() {\n   echo \"Set a global property in the cluster with a validity timestamp.\"\n   echo \"Usage:\"\n   echo \"   $0 --acquire <lock_name> <lock_owner> <lock_ttl_in_seconds>\"\n   echo \"   $0 --release <lock_name> <lock_owner>\"\n   echo\n}\n\nlog() {\n    echo \"$(date -u): $1\" 1>&2\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\nlock_create() {\n    local name=$1\n    local data=$2\n    # cibadmin won't overwrite a key if someone else succeeded to create it concurrently\n    cibadmin --sync-call --scope crm_config --create --xml-text \"<cluster_property_set id='${name}'><nvpair id='${name}-pair' name='${name}' value='${data}'/></cluster_property_set>\" &>/dev/null\n    return $?\n}\n\nlock_update() {\n    local name=$1\n    local expected_data=$2\n    local new_data=$3\n    # we only update the lock we expect to see, so we can't update someone else's lock\n    cibadmin --sync-call --scope crm_config --modify --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" --xml-text \"<nvpair id='${name}-pair' name='${name}' value='${new_data}'/>\" &>/dev/null\n    return $?\n}\n\nlock_delete() {\n    local name=$1\n    local expected_data=$2\n    # we only delete the lock we expect to see, so we can't delete someone else's lock\n    cibadmin --sync-call --scope crm_config --delete --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" &>/dev/null\n    return $?\n}\n\nlock_get() {\n    local lockname=$1\n    local res\n    local rc\n    res=$(cibadmin --query --scope crm_config --xpath \"//cluster_property_set/nvpair[@name='$lockname']\" 2>/dev/null)\n    rc=$?\n    if [ $rc -eq 0 ]; then\n        echo \"$res\" | sed -n 's/.*value=\"\\([^\"]*\\)\".*/\\1/p'\n    fi\n    return $rc\n}\n\nlock_owner() {\n    local lock=$1\n    echo \"$lock\" | cut -d':' -f1\n}\n\nlock_has_expired() {\n    local lock=$1\n    local expiry=$(echo \"$lock\" | cut -d':' -f2)\n    local now=$(date +%s)\n    test $now -ge $expiry\n}\n\n\n# Perform a lock action and restart if the CIB has been modified before\n# committing the lock action\ntry_action() {\n    local fun=$1\n    local lock=$2\n    local requester=$3\n    local args=${4:-}\n    local tries=$MAX_RETRIES\n    local rc=1\n    if [ \"$fun\" = \"lock_acquire\" ] || [ \"$fun\" = \"lock_release\" ]; then\n        log \"Try running $fun\"\n    else\n        return 2\n    fi\n    while [ $rc -ne 0 ]; do\n        $fun $lock $requester $args\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Operation $1 succeeded\"\n            return 0\n        elif [ $rc -eq 3 ]; then\n            # rc == 3 -> CIB changed before push\n            if [ $tries -eq 0 ]; then\n                log \"Failed to commit after $MAX_RETRIES retries. Bailing out.\"\n                return 2\n            else\n                log \"Failed to commit. Retrying operation.\"\n                tries=$(($tries - 1))\n            fi\n        elif [ $rc -eq 2 ]; then\n            # rc == 2 -> unrecoverable cib error (e.g. pacemaker down)\n            log \"Unexpected failure. Bailing out\"\n            return $rc\n        else\n            # rc == 1 -> lock error (not owner, lock doesn't exists)\n            return $rc\n        fi\n    done\n}\n\n# The lock mechanism uses cibadmin's atomic creation so cluster-wide\n# state coherency is guaranteed by pacemaker\nlock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc\n    local lock\n    local expiry\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -n \"$lock\" ]; then\n        lock_has_expired $lock\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Lock has expired, now available for being held\"\n        else\n            # lock is still held. check whether we're the owner\n            owner=$(lock_owner $lock)\n            if [ \"$owner\" = \"$requester\" ];then\n                log \"Requester already owns the lock, acquiring attempt will just reconfigure the TTL\"\n            else\n                log \"Lock is held by someone else ($owner)\"\n                return 1\n            fi\n        fi\n    else\n        log \"Lock is not held yet\"\n    fi\n\n    # prepare the lock info\n    expiry=$(($(date +%s) + $ttl))\n\n    if [ -n \"$lock\" ]; then\n        log \"Attempting to update the lock\"\n        lock_update $lockname \"$lock\" \"$requester:$expiry\"\n        rc=$?\n    else\n        log \"Attempting to acquire the lock\"\n        lock_create $lockname \"$requester:$expiry\"\n        rc=$?\n    fi\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' acquired by '$requester', valid until $(date -d @$expiry)\"\n        return 0\n    else\n        log \"CIB changed, lock cannot be acquired\"\n        return 3\n    fi\n}\n\n\n# The lock mechanism uses the CIB's num_updates tag to implement\n# a conditional store. Cluster-wide locking is guaranteed by pacemaker\nlock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n    local lock\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        log \"Lock doesn't exist. Nothing to release\"\n        return 0\n    else\n        log \"Lock exists, check whether we're the owner\"\n        owner=$(lock_owner $lock)\n        if [ \"$owner\" != \"$requester\" ];then\n            log \"Lock is held by someone else ($owner), will not unlock\"\n            return 1\n        fi\n    fi\n\n    lock_delete $lockname \"$lock\"\n    rc=$?\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' released by '$requester'\"\n        return 0\n    else\n        log \"CIB deletion error, lock cannot be released\"\n        return 3\n    fi\n}\n\n\n# Retrieve the owner of a lock from the CIB\n# this is a read-only operation, so no need to log debug info\nlock_get_owner() {\n    local lockname=$1\n    local rc\n    local lock\n    local owner\n\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        return 1\n    else\n        lock_owner $lock\n        return 0\n    fi\n}\n\n\nACTION=$1\nLOCKNAME=$2\nREQUESTER=$3\nTTL=${4:-60}\n\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nif [ $ACTION != \"--help\" ]; then\n    if [ -z \"$LOCKNAME\" ]; then\n        error \"You must specific a lock name\"\n    fi\n    if [ $ACTION != \"--owner\" ] && [ $ACTION != \"-o\" ]; then\n        if [ -z \"$REQUESTER\" ]; then\n            error \"You must specific a lock requester\"\n        fi\n    fi\nfi\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) try_action lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --release|-r) try_action lock_release $LOCKNAME $REQUESTER;;\n    --acquire-once|-A) lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --owner|-o) lock_get_owner $LOCKNAME;;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}, "pacemaker_mutex_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_restart_bundle.sh --lock mysql galera galera-bundle Master _\n# pacemaker_mutex_restart_bundle.sh --lock ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\n\nset -u\n\nusage() {\n    echo \"Restart a clustered resource in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --lock <tripleo-service> <pcmk-resource> <pcmk-bundle> <target-state-local> <target-state-cluster>\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\nACTION=$1\ncase $ACTION in\n    --help) usage; exit 0;;\n    --lock) ;;\n    *) error \"Unknown action '$ACTION'\";;\nesac\n\nTRIPLEO_SERVICE=$2\nLOCK_NAME=${TRIPLEO_SERVICE}-restart-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to restart resource $TRIPLEO_SERVICE\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\nRESOURCE_NAME=$3\nBUNDLE_NAME=$4\nWAIT_TARGET_LOCAL=$5\nWAIT_TARGET_ANYWHERE=${6:-_}\n\nif pacemaker_supports_promoted; then\n    WAIT_TARGET_LOCAL=$(echo \"$5\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    WAIT_TARGET_ANYWHERE=$(echo \"${6:-_}\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    promoted_role=\"Promoted\"\nelse\n    promoted_role=\"Master\"\nfi\n\n# The lock TTL should accomodate for the resource start/promote timeout\nif [ \"$RESOURCE_NAME\" != \"$BUNDLE_NAME\" ]; then\n    if [ \"$WAIT_TARGET_LOCAL\" = \"$promoted_role\" ] || [ \"$WAIT_TARGET_ANYWHERE\" = \"$promoted_role\" ]; then\n        rsc_op=\"promote\"\n    else\n        rsc_op=\"start\"\n    fi\n    # <op id=\"galera-promote-interval-0s\" interval=\"0s\" name=\"promote\" on-fail=\"block\" timeout=\"300s\"/>\n    PCMK_TTL=$(cibadmin -Q | xmllint -xpath \"string(//primitive[@id='${RESOURCE_NAME}']/operations/op[@name='${rsc_op}']/@timeout)\" - | sed 's/s$//')\n    LOCK_TTL=$((PCMK_TTL + 30))\nelse\n    # The podman RA's default start timeout\n    LOCK_TTL=90\nfi\n\nlog \"Acquire a ${LOCK_TTL}s restart lock for service $TRIPLEO_SERVICE before restarting it\"\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nrc=1\nwhile [ $rc -ne 0 ]; do\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire $LOCK_NAME $LOCK_OWNER $LOCK_TTL\n    rc=$?\n    if [ $rc != 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not acquire lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Could not acquire lock, retrying\"\n            sleep 10\n        fi\n    fi\ndone\n\nlog \"Restart the service $TRIPLEO_SERVICE locally\"\n# Reuse the local restart script in t-h-t (driven by env var TRIPLEO_MINOR_UPDATE)\nTRIPLEO_MINOR_UPDATE=true /var/lib/container-config-scripts/pacemaker_restart_bundle.sh $TRIPLEO_SERVICE $RESOURCE_NAME $BUNDLE_NAME $WAIT_TARGET_LOCAL $WAIT_TARGET_ANYWHERE\n\n# If we reached this point, always try to release the lock\nlog \"Release the restart lock for service $TRIPLEO_SERVICE\"\n/var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $LOCK_NAME $LOCK_OWNER\nrc=$?\nif [ $rc -ne 0 ] && [ $rc -ne 1 ]; then\n    error \"Could not release held lock (rc: $rc)\"\nfi\n"}, "pacemaker_mutex_shutdown.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_shutdown.sh --acquire\n# pacemaker_mutex_shutdown.sh --release\n\nset -u\n\nusage() {\n    echo \"Shutdown a cluster node in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --acquire # prevent other node from shutting down until we hold the lock\"\n    echo \"   $0 --release # release the lock, other node can compete for the shutdown lock\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nshutdown_lock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc=1\n    local current_owner\n    local owner_stopped\n    local owner_rc\n\n    log \"Acquiring the shutdown lock\"\n    while [ $rc -ne 0 ]; do\n        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire-once $lockname $requester $ttl\n        rc=$?\n        if [ $rc -ne 0 ]; then\n            if [ $rc -eq 2 ]; then\n                error \"Could not acquire the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n            else\n                # The lock is held by another node.\n                current_owner=$(/var/lib/container-config-scripts/pacemaker_resource_lock.sh --owner $lockname)\n                owner_rc=$?\n                if [ $owner_rc -eq 2 ]; then\n                    error \"Could not get the shutdown lock owner due to unrecoverable error (rc: $owner_rc), bailing out\"\n                fi\n                if [ $owner_rc -eq 0 ]; then\n                    # If the owner is marked as offline, that means it has shutdown and\n                    # we can clean the lock preemptively and try to acquire it.\n                    owner_stopped=$(crm_mon -1X | xmllint --xpath 'count(//nodes/node[@name=\"'${current_owner}'\" and @online=\"false\" and @unclean=\"false\"])' -)\n                    if [ \"${owner_stopped}\" = \"1\" ]; then\n                        log \"Shutdown lock held by stopped node '${current_owner}', lock can be released\"\n                        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $current_owner\n                        continue\n                    fi\n                fi\n                log \"Shutdown lock held by another node (rc: $rc), retrying\"\n                sleep 10\n            fi\n        fi\n    done\n    log \"Shutdown lock acquired\"\n    return 0\n}\n\n\n# Release the lock if we still own it. Not owning it anymore is not fatal\nshutdown_lock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n\n    log \"Releasing the shutdown lock\"\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $requester\n    rc=$?\n    if [ $rc -ne 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not release the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Shutdown lock no longer held, nothing to do\"\n        fi\n    else\n        log \"Shutdown lock released\"\n    fi\n    return 0\n}\n\n\nACTION=$1\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nLOCK_NAME=tripleo-shutdown-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to aquire the shutdown lock\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\n# We start with a very high TTL, that long enough to accomodate a cluster stop.\n# As soon as the node will get offline, the other competing node will be entitled\n# to steal the lock, so they should never wait that long in practice.\nLOCK_TTL=600\n\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) shutdown_lock_acquire ${LOCK_NAME} ${LOCK_OWNER} ${LOCK_TTL};;\n    --release|-r) shutdown_lock_release ${LOCK_NAME} ${LOCK_OWNER};;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}}, "container_puppet_apply_volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/var/lib/container-config-scripts/container_puppet_apply.sh:/container_puppet_apply.sh:ro", "/etc/puppet:/tmp/puppet-etc:ro", "/usr/share/openstack-puppet/modules:/usr/share/openstack-puppet/modules:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-19-jjftxlaoy6r6-MysqlPuppetBase-326j26vyaq7z-ContainersCommon-pevamkxt3f7l/9f5fffa3-ccd0-410b-8a0b-265629a38472"}


created_at: 2026-01-21 15:59:06.302067
data:
  {"tuple:('role_data', 'config_settings')": {"mysql::server::package_name": "mariadb-galera-server", "mysql::server::manage_config_file": true, "mysql_ipv6": false, "mysql_max_connections": 4096, "mysql::server::root_password": "Yh8kdMCiyn", "mysql_clustercheck_password": "vJa4x1mNX6BeiiDv44awoz5Im", "enable_galera": true, "mysql_auth_ed25519": false, "mysql_bind_host": "%{hiera('internal_api')}", "tripleo::profile::base::database::mysql::bind_address": "%{hiera('fqdn_internal_api')}", "tripleo::profile::base::database::mysql::client_bind_address": "%{hiera('internal_api')}", "tripleo::profile::base::database::mysql::generate_dropin_file_limit": true, "innodb_buffer_pool_size": "128M", "tripleo::profile::pacemaker::database::mysql::bind_address": "%{hiera('fqdn_internal_api')}", "tripleo::profile::pacemaker::database::mysql::gmcast_listen_addr": "%{hiera('internal_api')}", "tripleo::profile::pacemaker::database::mysql::ca_file": "/etc/ipa/ca.crt", "tripleo::profile::pacemaker::database::mysql_bundle::mysql_docker_image": "cluster.common.tag/mariadb:pcmklatest", "tripleo::profile::pacemaker::database::mysql_bundle::control_port": 3123, "tripleo::profile::pacemaker::database::mysql_bundle::container_backend": "podman", "tripleo::profile::pacemaker::database::mysql_bundle::bind_address": "%{hiera('fqdn_internal_api')}", "tripleo::profile::pacemaker::database::mysql_bundle::sst_method": "rsync", "tripleo::profile::pacemaker::database::mysql_bundle::mariabackup_user": "mariabackup", "tripleo::profile::pacemaker::database::mysql_bundle::mariabackup_password": "dP58Xn0BQwrcU8e8DfLjmB9zo", "tripleo::profile::pacemaker::database::mysql_bundle::force_ocf": true, "tripleo::profile::pacemaker::database::mysql_bundle::gcomm_cipher": "AES128-SHA256"}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-19-jjftxlaoy6r6-MysqlPuppetBase-326j26vyaq7z/565f9898-3952-4cd7-880a-69345a8dc67f"}


created_at: 2026-01-21 15:59:06.305855
data:
  {"value": {"ContainerClustercheckImage": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1", "ContainerClustercheckConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1"}}


created_at: 2026-01-21 15:59:06.332337
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-19-jjftxlaoy6r6-ContainersCommon-qbrzy4pftkiv/5733ed38-bd8c-4326-9029-55650d5d8727"}


created_at: 2026-01-21 15:59:06.343064
data:
  {"tuple:('role_data', 'step_config')": null, "role_data": {"service_name": "clustercheck", "config_settings": {"mysql::server::package_name": "mariadb-galera-server", "mysql::server::manage_config_file": true, "mysql_ipv6": false, "mysql_max_connections": 4096, "mysql::server::root_password": "Yh8kdMCiyn", "mysql_clustercheck_password": "vJa4x1mNX6BeiiDv44awoz5Im", "enable_galera": true, "mysql_auth_ed25519": false, "mysql_bind_host": "%{hiera('internal_api')}", "tripleo::profile::base::database::mysql::bind_address": "%{hiera('fqdn_internal_api')}", "tripleo::profile::base::database::mysql::client_bind_address": "%{hiera('internal_api')}", "tripleo::profile::base::database::mysql::generate_dropin_file_limit": true, "innodb_buffer_pool_size": "128M", "tripleo::profile::pacemaker::database::mysql::bind_address": "%{hiera('fqdn_internal_api')}", "tripleo::profile::pacemaker::database::mysql::gmcast_listen_addr": "%{hiera('internal_api')}", "tripleo::profile::pacemaker::database::mysql::ca_file": "/etc/ipa/ca.crt", "tripleo::profile::pacemaker::database::mysql_bundle::mysql_docker_image": "cluster.common.tag/mariadb:pcmklatest", "tripleo::profile::pacemaker::database::mysql_bundle::control_port": 3123, "tripleo::profile::pacemaker::database::mysql_bundle::container_backend": "podman", "tripleo::profile::pacemaker::database::mysql_bundle::bind_address": "%{hiera('fqdn_internal_api')}", "tripleo::profile::pacemaker::database::mysql_bundle::sst_method": "rsync", "tripleo::profile::pacemaker::database::mysql_bundle::mariabackup_user": "mariabackup", "tripleo::profile::pacemaker::database::mysql_bundle::mariabackup_password": "dP58Xn0BQwrcU8e8DfLjmB9zo", "tripleo::profile::pacemaker::database::mysql_bundle::force_ocf": true, "tripleo::profile::pacemaker::database::mysql_bundle::gcomm_cipher": "AES128-SHA256", "tripleo::profile::pacemaker::clustercheck::bind_address": "%{hiera('internal_api')}"}, "puppet_config": {"config_volume": "clustercheck", "puppet_tags": "file", "step_config": "include tripleo::profile::pacemaker::clustercheck", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/clustercheck.json": {"command": "bash -c $* -- eval source /etc/sysconfig/clustercheck; exec socat -T\"${TRIPLEO_HEALTHCHECK_TIMEOUT:-2}\" \"$TRIPLEO_SOCAT_BIND\" system:\"grep -qPe \\\"^\\\\r\\$\\\" && /usr/bin/clustercheck\"", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}}, "docker_config": {"step_2": {"clustercheck": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1", "restart": "always", "net": "host", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/clustercheck.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/clustercheck:/var/lib/kolla/config_files/src:ro", "/var/lib/mysql:/var/lib/mysql"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "host_prep_tasks": null, "upgrade_tasks": null, "update_tasks": null, "external_upgrade_tasks": [{"when": ["step|int == 1"], "tags": ["never", "system_upgrade_transfer_data", "system_upgrade_stop_services"], "block": [{"name": "Stop clustercheck container", "import_role": {"name": "tripleo_container_stop"}, "vars": {"tripleo_containers_to_stop": ["clustercheck"], "tripleo_delegate_to": "{{ groups['clustercheck'] | difference(groups['excluded_overcloud']) }}"}}]}]}, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "clustercheck", "tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'docker_config')": {"step_2": {"clustercheck": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1", "restart": "always", "net": "host", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/clustercheck.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/clustercheck:/var/lib/kolla/config_files/src:ro", "/var/lib/mysql:/var/lib/mysql"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "tuple:('role_data', 'config_settings')": {"mysql::server::package_name": "mariadb-galera-server", "mysql::server::manage_config_file": true, "mysql_ipv6": false, "mysql_max_connections": 4096, "mysql::server::root_password": "Yh8kdMCiyn", "mysql_clustercheck_password": "vJa4x1mNX6BeiiDv44awoz5Im", "enable_galera": true, "mysql_auth_ed25519": false, "mysql_bind_host": "%{hiera('internal_api')}", "tripleo::profile::base::database::mysql::bind_address": "%{hiera('fqdn_internal_api')}", "tripleo::profile::base::database::mysql::client_bind_address": "%{hiera('internal_api')}", "tripleo::profile::base::database::mysql::generate_dropin_file_limit": true, "innodb_buffer_pool_size": "128M", "tripleo::profile::pacemaker::database::mysql::bind_address": "%{hiera('fqdn_internal_api')}", "tripleo::profile::pacemaker::database::mysql::gmcast_listen_addr": "%{hiera('internal_api')}", "tripleo::profile::pacemaker::database::mysql::ca_file": "/etc/ipa/ca.crt", "tripleo::profile::pacemaker::database::mysql_bundle::mysql_docker_image": "cluster.common.tag/mariadb:pcmklatest", "tripleo::profile::pacemaker::database::mysql_bundle::control_port": 3123, "tripleo::profile::pacemaker::database::mysql_bundle::container_backend": "podman", "tripleo::profile::pacemaker::database::mysql_bundle::bind_address": "%{hiera('fqdn_internal_api')}", "tripleo::profile::pacemaker::database::mysql_bundle::sst_method": "rsync", "tripleo::profile::pacemaker::database::mysql_bundle::mariabackup_user": "mariabackup", "tripleo::profile::pacemaker::database::mysql_bundle::mariabackup_password": "dP58Xn0BQwrcU8e8DfLjmB9zo", "tripleo::profile::pacemaker::database::mysql_bundle::force_ocf": true, "tripleo::profile::pacemaker::database::mysql_bundle::gcomm_cipher": "AES128-SHA256", "tripleo::profile::pacemaker::clustercheck::bind_address": "%{hiera('internal_api')}"}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-19-jjftxlaoy6r6/83e82ad2-7be5-4741-aa2b-883cd3049aa5"}


created_at: 2026-01-21 15:59:06.723524
data:
  {"type": "json", "value": {"ContainerCeilometerComputeImage": "registry.redhat.io/rhosp-rhel9/openstack-ceilometer-compute:17.1", "ContainerCeilometerConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-ceilometer-central:17.1"}}


created_at: 2026-01-21 15:59:10.850498
data:
  {"tuple:('role_data', 'service_config_settings')": {"keystone": {"tripleo::profile::base::keystone::ceilometer_notification_topics": ["notifications"]}}, "tuple:('role_data', 'config_settings')": {"ceilometer::logging::debug": true, "ceilometer::agent::polling::manage_polling": false, "ceilometer::agent::service_credentials::password": "y798zuGNL24PRK6LJJsi1FtgG", "ceilometer::agent::service_credentials::auth_url": "http://172.17.0.2:5000", "ceilometer::agent::service_credentials::region_name": "regionOne", "ceilometer::agent::service_credentials::project_name": "service", "ceilometer::agent::service_credentials::user_domain_name": "Default", "ceilometer::agent::service_credentials::auth_project_domain_name": "Default", "ceilometer::agent::service_credentials::interface": "internalURL", "ceilometer::notification_driver": ["messagingv2"], "ceilometer::amqp_rpc_address_prefix": "", "ceilometer::amqp_notify_address_prefix": "", "ceilometer::telemetry_secret": "psMwIyiedEAsv5FpNTTEKMlr0", "ceilometer::snmpd_readonly_username": "ro_snmp_user", "ceilometer::snmpd_readonly_user_password": "9tgIBZnAxvVBKp4YexoqDCL2", "ceilometer::host": "%{hiera('fqdn_canonical')}", "ceilometer::rabbit_heartbeat_in_pthread": false, "ceilometer::cache::enabled": true, "ceilometer::cache::tls_enabled": false, "ceilometer::cache::backend": "dogpile.cache.memcached"}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-20-duk45i64tjor-CeilometerServiceBase-evbvfn2lroqo/d5db8976-5f9e-4412-a4dd-1d5e91c76bb6"}


created_at: 2026-01-21 15:59:10.854627
data:
  {"value": {"ContainerCeilometerComputeImage": "registry.redhat.io/rhosp-rhel9/openstack-ceilometer-compute:17.1", "ContainerCeilometerConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-ceilometer-central:17.1"}}


created_at: 2026-01-21 15:59:10.896494
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-20-duk45i64tjor-ContainersCommon-y5ohvwsl6pjp/f91e2aa2-1706-4e96-b290-5e0abd0a9670"}


created_at: 2026-01-21 15:59:10.911285
data:
  {"tuple:('role_data', 'step_config')": null, "role_data": {"service_name": "ceilometer_agent_compute", "monitoring_subscription": "overcloud-ceilometer-agent-compute", "config_settings": {"ceilometer::logging::debug": true, "ceilometer::agent::polling::manage_polling": false, "ceilometer::agent::service_credentials::password": "y798zuGNL24PRK6LJJsi1FtgG", "ceilometer::agent::service_credentials::auth_url": "http://172.17.0.2:5000", "ceilometer::agent::service_credentials::region_name": "regionOne", "ceilometer::agent::service_credentials::project_name": "service", "ceilometer::agent::service_credentials::user_domain_name": "Default", "ceilometer::agent::service_credentials::auth_project_domain_name": "Default", "ceilometer::agent::service_credentials::interface": "internalURL", "ceilometer::notification_driver": ["messagingv2"], "ceilometer::amqp_rpc_address_prefix": "", "ceilometer::amqp_notify_address_prefix": "", "ceilometer::telemetry_secret": "psMwIyiedEAsv5FpNTTEKMlr0", "ceilometer::snmpd_readonly_username": "ro_snmp_user", "ceilometer::snmpd_readonly_user_password": "9tgIBZnAxvVBKp4YexoqDCL2", "ceilometer::host": "%{hiera('fqdn_canonical')}", "ceilometer::rabbit_heartbeat_in_pthread": false, "ceilometer::cache::enabled": true, "ceilometer::cache::tls_enabled": false, "ceilometer::cache::backend": "dogpile.cache.memcached", "ceilometer::agent::polling::instance_discovery_method": "libvirt_metadata", "ceilometer_redis_password": "nl61E6DzbLoe80Ys1a0I9feTJ", "compute_namespace": true, "ceilometer::agent::polling::tenant_name_discovery": false}, "service_config_settings": {"keystone": {"tripleo::profile::base::keystone::ceilometer_notification_topics": ["notifications"]}}, "puppet_config": {"config_volume": "ceilometer", "puppet_tags": "ceilometer_config", "step_config": "include tripleo::profile::base::ceilometer::agent::polling", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-ceilometer-central:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/ceilometer_agent_compute.json": {"command": "/usr/bin/ceilometer-polling --polling-namespaces compute --logfile /var/log/ceilometer/compute.log", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}}, "docker_config": {"step_4": {"ceilometer_agent_compute": {"image": "registry.redhat.io/rhosp-rhel9/openstack-ceilometer-compute:17.1", "net": "host", "privileged": false, "restart": "always", "depends_on": ["tripleo_nova_libvirt.target"], "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/ceilometer_agent_compute.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/ceilometer:/var/lib/kolla/config_files/src:ro", "/run/libvirt:/run/libvirt:shared,z", "/var/log/containers/ceilometer:/var/log/ceilometer:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "host_prep_tasks": [{"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/ceilometer", "setype": "container_file_t", "mode": "0750"}]}, {"name": "enable virt_sandbox_use_netlink for healthcheck", "seboolean": {"name": "virt_sandbox_use_netlink", "persistent": true, "state": true}, "when": ["ansible_facts.selinux is defined", "ansible_facts.selinux.status == \"enabled\""]}]}, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "ceilometer_agent_compute", "tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'docker_config')": {"step_4": {"ceilometer_agent_compute": {"image": "registry.redhat.io/rhosp-rhel9/openstack-ceilometer-compute:17.1", "net": "host", "privileged": false, "restart": "always", "depends_on": ["tripleo_nova_libvirt.target"], "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/ceilometer_agent_compute.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/ceilometer:/var/lib/kolla/config_files/src:ro", "/run/libvirt:/run/libvirt:shared,z", "/var/log/containers/ceilometer:/var/log/ceilometer:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "tuple:('role_data', 'config_settings')": {"ceilometer::logging::debug": true, "ceilometer::agent::polling::manage_polling": false, "ceilometer::agent::service_credentials::password": "y798zuGNL24PRK6LJJsi1FtgG", "ceilometer::agent::service_credentials::auth_url": "http://172.17.0.2:5000", "ceilometer::agent::service_credentials::region_name": "regionOne", "ceilometer::agent::service_credentials::project_name": "service", "ceilometer::agent::service_credentials::user_domain_name": "Default", "ceilometer::agent::service_credentials::auth_project_domain_name": "Default", "ceilometer::agent::service_credentials::interface": "internalURL", "ceilometer::notification_driver": ["messagingv2"], "ceilometer::amqp_rpc_address_prefix": "", "ceilometer::amqp_notify_address_prefix": "", "ceilometer::telemetry_secret": "psMwIyiedEAsv5FpNTTEKMlr0", "ceilometer::snmpd_readonly_username": "ro_snmp_user", "ceilometer::snmpd_readonly_user_password": "9tgIBZnAxvVBKp4YexoqDCL2", "ceilometer::host": "%{hiera('fqdn_canonical')}", "ceilometer::rabbit_heartbeat_in_pthread": false, "ceilometer::cache::enabled": true, "ceilometer::cache::tls_enabled": false, "ceilometer::cache::backend": "dogpile.cache.memcached", "ceilometer::agent::polling::instance_discovery_method": "libvirt_metadata", "ceilometer_redis_password": "nl61E6DzbLoe80Ys1a0I9feTJ", "compute_namespace": true, "ceilometer::agent::polling::tenant_name_discovery": false}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-20-duk45i64tjor/27b68436-b149-41fc-9f89-137b38b2a2cb"}


created_at: 2026-01-21 15:59:12.416435
data:
  {"tuple:('role_data', 'step_config')": null, "role_data": {"service_name": "container_image_prepare", "external_deploy_tasks": [{"name": "Run tripleo-container-image-prepare role", "import_role": {"name": "tripleo_container_image_prepare"}, "vars": {"tripleo_container_image_prepare_log_file": "/var/log/tripleo-container-image-prepare.log", "tripleo_container_image_prepare_debug": true, "tripleo_container_image_prepare_roles": [{"name": "Standalone", "description": "A standalone role that a minimal set of services. This can be used for\ntesting in a single node configuration with the\n'openstack tripleo deploy --standalone' command or via an Undercloud using\n'openstack overcloud deploy'.\n", "CountDefault": 1, "tags": ["primary", "controller", "standalone"], "default_route_networks": [], "networks": {"External": {"subnet": "external_subnet"}, "InternalApi": {"subnet": "internal_api_subnet"}, "Storage": {"subnet": "storage_subnet"}, "StorageMgmt": {"subnet": "storage_mgmt_subnet"}, "StorageNFS": {"subnet": "storage_nfs_subnet"}, "Tenant": {"subnet": "tenant_subnet"}}, "RoleParametersDefault": {"OVNCMSOptions": "enable-chassis-as-gw"}, "ServicesDefault": ["OS::TripleO::Services::Aide", "OS::TripleO::Services::AodhApi", "OS::TripleO::Services::AodhEvaluator", "OS::TripleO::Services::AodhListener", "OS::TripleO::Services::AodhNotifier", "OS::TripleO::Services::AuditD", "OS::TripleO::Services::BootParams", "OS::TripleO::Services::BarbicanApi", "OS::TripleO::Services::BarbicanBackendDogtag", "OS::TripleO::Services::BarbicanBackendKmip", "OS::TripleO::Services::BarbicanBackendPkcs11Crypto", "OS::TripleO::Services::BarbicanBackendSimpleCrypto", "OS::TripleO::Services::CACerts", "OS::TripleO::Services::CeilometerAgentCentral", "OS::TripleO::Services::CeilometerAgentNotification", "OS::TripleO::Services::CephClient", "OS::TripleO::Services::CephExternal", "OS::TripleO::Services::CephGrafana", "OS::TripleO::Services::CephMds", "OS::TripleO::Services::CephMgr", "OS::TripleO::Services::CephMon", "OS::TripleO::Services::CephNfs", "OS::TripleO::Services::CephRbdMirror", "OS::TripleO::Services::CephRgw", "OS::TripleO::Services::CephOSD", "OS::TripleO::Services::CinderApi", "OS::TripleO::Services::CinderBackendDellEMCPowerFlex", "OS::TripleO::Services::CinderBackendDellEMCPowermax", "OS::TripleO::Services::CinderBackendDellEMCPowerStore", "OS::TripleO::Services::CinderBackendDellEMCSc", "OS::TripleO::Services::CinderBackendDellEMCUnity", "OS::TripleO::Services::CinderBackendDellEMCVMAXISCSI", "OS::TripleO::Services::CinderBackendDellEMCVNX", "OS::TripleO::Services::CinderBackendDellEMCVxFlexOS", "OS::TripleO::Services::CinderBackendDellEMCXtremio", "OS::TripleO::Services::CinderBackendDellSc", "OS::TripleO::Services::CinderBackendNVMeOF", "OS::TripleO::Services::CinderBackendPure", "OS::TripleO::Services::CinderBackendNetApp", "OS::TripleO::Services::CinderBackendScaleIO", "OS::TripleO::Services::CinderBackup", "OS::TripleO::Services::CinderHPELeftHandISCSI", "OS::TripleO::Services::CinderScheduler", "OS::TripleO::Services::CinderVolume", "OS::TripleO::Services::Clustercheck", "OS::TripleO::Services::Collectd", "OS::TripleO::Services::ComputeCeilometerAgent", "OS::TripleO::Services::CeilometerAgentIpmi", "OS::TripleO::Services::ContainerImagePrepare", "OS::TripleO::Services::ContainersLogrotateCrond", "OS::TripleO::Services::DesignateApi", "OS::TripleO::Services::DesignateCentral", "OS::TripleO::Services::DesignateMDNS", "OS::TripleO::Services::DesignateProducer", "OS::TripleO::Services::DesignateSink", "OS::TripleO::Services::DesignateBind", "OS::TripleO::Services::DesignateWorker", "OS::TripleO::Services::DockerRegistry", "OS::TripleO::Services::Etcd", "OS::TripleO::Services::ExternalSwiftProxy", "OS::TripleO::Services::Frr", "OS::TripleO::Services::GlanceApi", "OS::TripleO::Services::GlanceApiInternal", "OS::TripleO::Services::GnocchiApi", "OS::TripleO::Services::GnocchiMetricd", "OS::TripleO::Services::GnocchiStatsd", "OS::TripleO::Services::HAproxy", "OS::TripleO::Services::HeatApi", "OS::TripleO::Services::HeatApiCfn", "OS::TripleO::Services::HeatApiCloudwatch", "OS::TripleO::Services::HeatEngine", "OS::TripleO::Services::Horizon", "OS::TripleO::Services::IpaClient", "OS::TripleO::Services::Ipsec", "OS::TripleO::Services::IronicApi", "OS::TripleO::Services::IronicConductor", "OS::TripleO::Services::IronicInspector", "OS::TripleO::Services::IronicNeutronAgent", "OS::TripleO::Services::IronicPxe", "OS::TripleO::Services::Iscsid", "OS::TripleO::Services::Kernel", "OS::TripleO::Services::Keystone", "OS::TripleO::Services::LoginDefs", "OS::TripleO::Services::ManilaApi", "OS::TripleO::Services::ManilaBackendCephFs", "OS::TripleO::Services::ManilaBackendIsilon", "OS::TripleO::Services::ManilaBackendNetapp", "OS::TripleO::Services::ManilaBackendPowerMax", "OS::TripleO::Services::ManilaBackendUnity", "OS::TripleO::Services::ManilaBackendVMAX", "OS::TripleO::Services::ManilaBackendVNX", "OS::TripleO::Services::ManilaScheduler", "OS::TripleO::Services::ManilaShare", "OS::TripleO::Services::MasqueradeNetworks", "OS::TripleO::Services::Memcached", "OS::TripleO::Services::MetricsQdr", "OS::TripleO::Services::Multipathd", "OS::TripleO::Services::MySQL", "OS::TripleO::Services::MySQLClient", "OS::TripleO::Services::NeutronApi", "OS::TripleO::Services::NeutronBgpVpnApi", "OS::TripleO::Services::NeutronBgpVpnBagpipe", "OS::TripleO::Services::NeutronCorePlugin", "OS::TripleO::Services::NeutronL2gwAgent", "OS::TripleO::Services::NeutronL2gwApi", "OS::TripleO::Services::NeutronL3Agent", "OS::TripleO::Services::NeutronLinuxbridgeAgent", "OS::TripleO::Services::NeutronMetadataAgent", "OS::TripleO::Services::NeutronOvsAgent", "OS::TripleO::Services::NeutronSfcApi", "OS::TripleO::Services::NeutronSriovAgent", "OS::TripleO::Services::NeutronDhcpAgent", "OS::TripleO::Services::NeutronVppAgent", "OS::TripleO::Services::NovaApi", "OS::TripleO::Services::NovaConductor", "OS::TripleO::Services::NovaIronic", "OS::TripleO::Services::NovaMetadata", "OS::TripleO::Services::NovaScheduler", "OS::TripleO::Services::NovaCompute", "OS::TripleO::Services::NovaLibvirt", "OS::TripleO::Services::NovaMigrationTarget", "OS::TripleO::Services::NovaVncProxy", "OS::TripleO::Services::OVNController", "OS::TripleO::Services::OVNDBs", "OS::TripleO::Services::OVNMetadataAgent", "OS::TripleO::Services::OctaviaApi", "OS::TripleO::Services::OctaviaDeploymentConfig", "OS::TripleO::Services::OctaviaHealthManager", "OS::TripleO::Services::OctaviaHousekeeping", "OS::TripleO::Services::OctaviaWorker", "OS::TripleO::Services::OpenStackClients", "OS::TripleO::Services::OsloMessagingNotify", "OS::TripleO::Services::OsloMessagingRpc", "OS::TripleO::Services::Pacemaker", "OS::TripleO::Services::PlacementApi", "OS::TripleO::Services::Podman", "OS::TripleO::Services::Redis", "OS::TripleO::Services::Rhsm", "OS::TripleO::Services::Rsyslog", "OS::TripleO::Services::RsyslogSidecar", "OS::TripleO::Services::Securetty", "OS::TripleO::Services::Snmp", "OS::TripleO::Services::Sshd", "OS::TripleO::Services::SwiftDispersion", "OS::TripleO::Services::SwiftProxy", "OS::TripleO::Services::SwiftRingBuilder", "OS::TripleO::Services::SwiftStorage", "OS::TripleO::Services::Timesync", "OS::TripleO::Services::Timezone", "OS::TripleO::Services::Tmpwatch", "OS::TripleO::Services::TripleoFirewall", "OS::TripleO::Services::TripleoPackages", "OS::TripleO::Services::Unbound", "OS::TripleO::Services::Tuned", "OS::TripleO::Services::Vpp"]}], "tripleo_container_image_prepare_content": {"parameter_defaults": {"ContainerImagePrepare": [{"set": {"ceph_alertmanager_image": "ose-prometheus-alertmanager", "ceph_alertmanager_namespace": "registry.redhat.io/openshift4", "ceph_alertmanager_tag": "v4.12", "ceph_grafana_image": "rhceph-6-dashboard-rhel9", "ceph_grafana_namespace": "registry.redhat.io/rhceph", "ceph_grafana_tag": "latest", "ceph_image": "rhceph-7-rhel9", "ceph_namespace": "registry.redhat.io/rhceph", "ceph_node_exporter_image": "ose-prometheus-node-exporter", "ceph_node_exporter_namespace": "registry.redhat.io/openshift4", "ceph_node_exporter_tag": "v4.12", "ceph_prometheus_image": "ose-prometheus", "ceph_prometheus_namespace": "registry.redhat.io/openshift4", "ceph_prometheus_tag": "v4.12", "ceph_tag": "latest", "name_prefix": "openstack-", "name_suffix": "", "namespace": "registry.redhat.io/rhosp-rhel9", "neutron_driver": "ovn", "rhel_containers": false, "tag": "17.1"}, "tag_from_label": "{version}-{release}"}], "DockerInsecureRegistryAddress": ["192.168.122.100:8787"], "NeutronMechanismDrivers": ["sriovnicswitch", "ovn"], "DockerRegistryMirror": "", "ContainerImageRegistryCredentials": {}, "AdditionalArchitectures": [], "StandaloneContainerImagePrepare": {}, "StandaloneServices": ["OS::TripleO::Services::AodhApi", "OS::TripleO::Services::AodhEvaluator", "OS::TripleO::Services::AodhListener", "OS::TripleO::Services::AodhNotifier", "OS::TripleO::Services::BootParams", "OS::TripleO::Services::BarbicanApi", "OS::TripleO::Services::BarbicanBackendSimpleCrypto", "OS::TripleO::Services::CACerts", "OS::TripleO::Services::CeilometerAgentCentral", "OS::TripleO::Services::CeilometerAgentNotification", "OS::TripleO::Services::CephClient", "OS::TripleO::Services::CephMds", "OS::TripleO::Services::CephMgr", "OS::TripleO::Services::CephMon", "OS::TripleO::Services::CephOSD", "OS::TripleO::Services::CinderApi", "OS::TripleO::Services::CinderBackup", "OS::TripleO::Services::CinderScheduler", "OS::TripleO::Services::CinderVolume", "OS::TripleO::Services::Clustercheck", "OS::TripleO::Services::ComputeCeilometerAgent", "OS::TripleO::Services::ContainerImagePrepare", "OS::TripleO::Services::ContainersLogrotateCrond", "OS::TripleO::Services::DockerRegistry", "OS::TripleO::Services::GlanceApi", "OS::TripleO::Services::GlanceApiInternal", "OS::TripleO::Services::GnocchiApi", "OS::TripleO::Services::GnocchiMetricd", "OS::TripleO::Services::GnocchiStatsd", "OS::TripleO::Services::HAproxy", "OS::TripleO::Services::HeatApi", "OS::TripleO::Services::HeatApiCfn", "OS::TripleO::Services::HeatEngine", "OS::TripleO::Services::Horizon", "OS::TripleO::Services::Iscsid", "OS::TripleO::Services::Kernel", "OS::TripleO::Services::Keystone", "OS::TripleO::Services::ManilaApi", "OS::TripleO::Services::ManilaBackendCephFs", "OS::TripleO::Services::ManilaScheduler", "OS::TripleO::Services::ManilaShare", "OS::TripleO::Services::Memcached", "OS::TripleO::Services::MySQL", "OS::TripleO::Services::MySQLClient", "OS::TripleO::Services::NeutronApi", "OS::TripleO::Services::NeutronCorePlugin", "OS::TripleO::Services::NeutronSriovAgent", "OS::TripleO::Services::NeutronDhcpAgent", "OS::TripleO::Services::NovaApi", "OS::TripleO::Services::NovaConductor", "OS::TripleO::Services::NovaMetadata", "OS::TripleO::Services::NovaScheduler", "OS::TripleO::Services::NovaCompute", "OS::TripleO::Services::NovaLibvirt", "OS::TripleO::Services::NovaMigrationTarget", "OS::TripleO::Services::NovaVncProxy", "OS::TripleO::Services::OVNController", "OS::TripleO::Services::OVNDBs", "OS::TripleO::Services::OVNMetadataAgent", "OS::TripleO::Services::OctaviaApi", "OS::TripleO::Services::OctaviaDeploymentConfig", "OS::TripleO::Services::OctaviaHealthManager", "OS::TripleO::Services::OctaviaHousekeeping", "OS::TripleO::Services::OctaviaWorker", "OS::TripleO::Services::OpenStackClients", "OS::TripleO::Services::OsloMessagingNotify", "OS::TripleO::Services::OsloMessagingRpc", "OS::TripleO::Services::Pacemaker", "OS::TripleO::Services::PlacementApi", "OS::TripleO::Services::Podman", "OS::TripleO::Services::Redis", "OS::TripleO::Services::Rsyslog", "OS::TripleO::Services::Snmp", "OS::TripleO::Services::Sshd", "OS::TripleO::Services::SwiftProxy", "OS::TripleO::Services::SwiftRingBuilder", "OS::TripleO::Services::SwiftStorage", "OS::TripleO::Services::Timesync", "OS::TripleO::Services::Timezone", "OS::TripleO::Services::Tmpwatch", "OS::TripleO::Services::TripleoFirewall", "OS::TripleO::Services::TripleoPackages", "OS::TripleO::Services::Tuned"], "StandaloneCount": 1}}}, "when": ["(step | int) == 1"]}]}, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "container_image_prepare", "tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'docker_config')": null, "tuple:('role_data', 'config_settings')": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-fovdmetaemsn-ServiceChain-fnmq4s6gvnxy-21-eibhmaizudch/d0824dbf-6baa-453e-a91e-851e52d36257"}


