# resource_properties_data

created_at: 2025-10-10 07:31:48.297886
data:
  {"type": "comma_delimited_list", "value": [{"name": "upgrade prepare for leapp to align kernel arg shortcommings in leapp", "tags": ["never", "system_upgrade", "system_upgrade_prepare"], "when": ["step|int == 3", "upgrade_leapp_enabled"], "block": [{"name": "fix grub entries to have name start with GRUB_", "replace": {"path": "/etc/default/grub", "regexp": "^(TRIPLEO_HEAT_TEMPLATE_KERNEL_ARGS)(.*)", "replace": "GRUB_\\1\\2"}}, {"name": "fix grub entries in append statement", "replace": {"path": "/etc/default/grub", "regexp": "(.*){(TRIPLEO_HEAT_TEMPLATE_KERNEL_ARGS)}(.*)", "replace": "\\1{GRUB_\\2}\\3"}}]}, {"name": "Tear-down non-HA cinder_backup container", "when": ["step|int == 0"], "block": [{"name": "Remove non-HA cinder-backup container", "include_role": {"name": "tripleo_container_rm"}, "vars": {"tripleo_container_cli": "{{ container_cli }}", "tripleo_containers_to_rm": ["cinder_backup"]}}]}, {"name": "Prepare switch of cinder_backup image name", "when": ["step|int == 0"], "block": [{"name": "Get cinder_backup image id currently used by pacemaker", "shell": "pcs resource config openstack-cinder-backup | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'", "register": "cinder_backup_image_current_res", "failed_when": false}, {"name": "cinder_backup image facts", "set_fact": {"cinder_backup_image_latest": "cluster.common.tag/cinder-backup:pcmklatest", "cinder_backup_image_current": "{{cinder_backup_image_current_res.stdout}}"}}, {"name": "Temporarily tag the current cinder_backup image id with the upgraded image name", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{cinder_backup_image_current}}", "container_image_latest": "{{cinder_backup_image_latest}}", "pull_image": false}, "when": ["cinder_backup_image_current != ''", "cinder_backup_image_current != cinder_backup_image_latest"]}, {"name": "Create cinder_backup retag statefile", "file": {"path": "/var/lib/tripleo/cinder_backup_needs_retag", "state": "touch"}, "when": ["cinder_backup_image_current != ''", "cinder_backup_image_current != cinder_backup_image_latest"]}]}, {"name": "Update cinder_backup pcs resource bundle for new container image - check", "when": ["step|int == 1"], "block": [{"name": "set is_cinder_backup_bootstrap_node fact", "tags": "common", "set_fact": "is_cinder_backup_bootstrap_node={{cinder_backup_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}"}, {"name": "Check for cinder_backup retag statefile", "stat": {"path": "/var/lib/tripleo/cinder_backup_needs_retag"}, "register": "cinder_backup_retag_state_file"}]}, {"name": "Update cinder_backup pcs resource bundle for new container image", "when": ["step|int == 1", "is_cinder_backup_bootstrap_node", "cinder_backup_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the cinder_backup cluster resource before container upgrade step1", "pacemaker_resource": {"resource": "openstack-cinder-backup", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Update the cinder_backup bundle to use the new container image name", "command": "pcs resource bundle update openstack-cinder-backup container image={{cinder_backup_image_latest}}"}, {"name": "Enable the cinder_backup cluster resource", "pacemaker_resource": {"resource": "openstack-cinder-backup", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}]}, {"name": "Check for cinder_backup retag statefile", "when": ["step|int == 3"], "stat": {"path": "/var/lib/tripleo/cinder_backup_needs_retag"}, "register": "cinder_backup_retag_state_file"}, {"name": "Retag the pacemaker image for cinder_backup", "when": ["step|int == 3", "cinder_backup_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the cinder_backup cluster resource before container upgrade step3", "pacemaker_resource": {"resource": "openstack-cinder-backup", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Retag the pacemaker image if containerized", "block": [{"block": [{"name": "Get cinder_backup image from pacemaker", "become": true, "register": "xmllint_pcmk_cinder_backup_image", "shell": "xmllint --xpath \"string(//bundle[@id='openstack-cinder-backup']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container cinder_backup image", "set_fact": {"cinder_backup_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-backup:17.1", "cinder_backup_image_latest": "cluster.common.tag/cinder-backup:pcmklatest", "pcmk_cinder_backup_image": "{{xmllint_pcmk_cinder_backup_image.stdout}}"}}]}, {"block": [{"name": "Retag pcmklatest to latest cinder_backup image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{cinder_backup_image}}", "container_image_latest": "{{cinder_backup_image_latest}}"}}]}]}, {"name": "Enable the cinder_backup cluster resource", "pacemaker_resource": {"resource": "openstack-cinder-backup", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Remove cinder_backup retag statefile", "file": {"path": "/var/lib/tripleo/cinder_backup_needs_retag", "state": "absent"}}]}, {"name": "Tear-down non-HA cinder_volume container", "when": ["step|int == 0"], "block": [{"name": "Remove non-HA cinder_volume container", "include_role": {"name": "tripleo_container_rm"}, "vars": {"tripleo_container_cli": "{{ container_cli }}", "tripleo_containers_to_rm": ["cinder_volume"]}}]}, {"name": "Prepare switch of cinder_volume image name", "when": ["step|int == 0"], "block": [{"name": "Get cinder_volume image id currently used by pacemaker", "shell": "pcs resource config openstack-cinder-volume | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'", "register": "cinder_volume_image_current_res", "failed_when": false}, {"name": "cinder_volume image facts", "set_fact": {"cinder_volume_image_latest": "cluster.common.tag/cinder-volume:pcmklatest", "cinder_volume_image_current": "{{cinder_volume_image_current_res.stdout}}"}}, {"name": "Temporarily tag the current cinder_volume image id with the upgraded image name", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{cinder_volume_image_current}}", "container_image_latest": "{{cinder_volume_image_latest}}", "pull_image": false}, "when": ["cinder_volume_image_current != ''", "cinder_volume_image_current != cinder_volume_image_latest"]}, {"name": "Create cinder_volume retag statefile", "file": {"path": "/var/lib/tripleo/cinder_volume_needs_retag", "state": "touch"}, "when": ["cinder_volume_image_current != ''", "cinder_volume_image_current != cinder_volume_image_latest"]}]}, {"name": "Update cinder_volume pcs resource bundle for new container image", "when": ["step|int == 1"], "block": [{"name": "set is_cinder_volume_bootstrap_node fact", "tags": "common", "set_fact": "is_cinder_volume_bootstrap_node={{cinder_volume_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}"}, {"name": "Check for cinder_volume retag statefile", "stat": {"path": "/var/lib/tripleo/cinder_volume_needs_retag"}, "register": "cinder_volume_retag_state_file"}]}, {"name": "Update cinder_volume pcs resource bundle for new container image", "when": ["step|int == 1", "is_cinder_volume_bootstrap_node", "cinder_volume_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the cinder_volume cluster resource before container upgrade", "pacemaker_resource": {"resource": "openstack-cinder-volume", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "pcs resource bundle update cinder_volume for new container image name", "command": "pcs resource bundle update openstack-cinder-volume container image={{cinder_volume_image_latest}}"}, {"name": "Enable the cinder_volume cluster resource", "pacemaker_resource": {"resource": "openstack-cinder-volume", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}]}, {"name": "Check for cinder_volume retag statefile", "when": ["step|int == 3"], "stat": {"path": "/var/lib/tripleo/cinder_volume_needs_retag"}, "register": "cinder_volume_retag_state_file"}, {"name": "Retag pacemaker cinder_volume", "when": ["step|int == 3", "cinder_volume_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the cinder_volume cluster resource before container upgrade", "pacemaker_resource": {"resource": "openstack-cinder-volume", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Retag the pacemaker image if containerized", "block": [{"block": [{"name": "Get cinder_volume image from pacemaker", "become": true, "register": "xmllint_pcmk_cinder_volume_image", "shell": "xmllint --xpath \"string(//bundle[@id='openstack-cinder-volume']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container cinder_volume image", "set_fact": {"cinder_volume_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-volume:17.1", "cinder_volume_image_latest": "cluster.common.tag/cinder-volume:pcmklatest", "pcmk_cinder_volume_image": "{{xmllint_pcmk_cinder_volume_image.stdout}}"}}]}, {"block": [{"name": "Retag pcmklatest to latest cinder_volume image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{cinder_volume_image}}", "container_image_latest": "{{cinder_volume_image_latest}}"}}]}]}, {"name": "Enable the cinder_volume cluster resource", "pacemaker_resource": {"resource": "openstack-cinder-volume", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Remove cinder_volume retag statefile", "file": {"path": "/var/lib/tripleo/cinder_volume_needs_retag", "state": "absent"}}]}, {"name": "cinder-volume pre system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 3", "upgrade_leapp_enabled"], "block": [{"name": "Unmount cinder's image conversion NFS share", "vars": {"image_conversion_nfs_share": "", "image_conversion_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0", "image_conversion_nfs_enabled": false}, "when": "image_conversion_nfs_enabled|bool", "mount": {"path": "/var/lib/cinder_image_conversion", "state": "absent", "fstype": "nfs4"}}]}, {"name": "cinder-volume post system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 5", "upgrade_leapp_enabled"], "block": [{"name": "Support using an NFS share for cinder image conversion", "vars": {"image_conversion_nfs_enabled": false}, "when": ["image_conversion_nfs_enabled|bool"], "block": [{"name": "Create cinder image conversion directory", "file": {"path": "/var/lib/cinder_image_conversion", "state": "directory"}}, {"name": "Mount cinder's image conversion NFS share", "vars": {"image_conversion_nfs_share": "", "image_conversion_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"path": "/var/lib/cinder_image_conversion", "state": "mounted", "fstype": "nfs4", "src": "{{ image_conversion_nfs_share }}", "opts": "{{ image_conversion_nfs_options }}"}}]}]}, {"name": "Ensure old cron.daily is absent", "when": "step|int == 1", "file": {"path": "/etc/cron.daily/containers-tmpwatch", "state": "absent"}}, {"name": "Uninstall docker-distribution", "when": "step|int == 3", "block": [{"name": "check if docker-distribution is installed", "command": "/usr/bin/rpm -q docker-distribution", "failed_when": false, "register": "docker_distribution_installed", "check_mode": false}, {"name": "Stop, disable docker-distribution", "systemd": {"enabled": false, "state": "stopped", "name": "docker-distribution"}, "when": "docker_distribution_installed.rc == 0"}, {"name": "Uninstall docker-distribution", "package": "name=docker-distribution state=absent", "when": "docker_distribution_installed.rc == 0"}]}, {"name": "glance-api pre system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 3", "upgrade_leapp_enabled"], "block": [{"name": "Unmount and remove NFS glance entry", "vars": {"nfs_backend_enabled": false, "glance_netapp_nfs_enabled": false}, "mount": {"name": "/var/lib/glance/images", "fstype": "nfs", "state": "absent"}, "when": "nfs_backend_enabled or glance_netapp_nfs_enabled"}, {"name": "Unmount and remove NFS glance-staging entry", "vars": {"glance_node_staging_uri": "file:///var/lib/glance/staging", "glance_staging_nfs_share": ""}, "mount": {"name": "{{glance_node_staging_uri[7:]}}", "fstype": "nfs", "state": "absent"}, "when": "glance_staging_nfs_share != ''"}]}, {"name": "glance-api post system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 5", "upgrade_leapp_enabled"], "block": [{"name": "Mount NFS on host", "vars": {"nfs_backend_enabled": false, "glance_netapp_nfs_enabled": false, "glance_nfs_share": "", "netapp_share_location": "", "nfs_share": "{{ glance_nfs_share if (glance_nfs_share) else netapp_share_location }}", "nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"name": "/var/lib/glance/images", "state": "mounted", "fstype": "nfs", "src": "{{nfs_share}}", "opts": "{{nfs_options}}"}, "when": "nfs_backend_enabled or glance_netapp_nfs_enabled"}, {"name": "Mount Node Staging Location", "vars": {"glance_node_staging_uri": "file:///var/lib/glance/staging", "glance_staging_nfs_share": "", "glance_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"name": "{{glance_node_staging_uri[7:]}}", "state": "mounted", "fstype": "nfs", "src": "{{glance_staging_nfs_share}}", "opts": "{{glance_nfs_options}}"}, "when": "glance_staging_nfs_share != ''"}]}, {"name": "Tear-down non-HA haproxy container", "when": ["step|int == 0"], "block": [{"name": "Remove non-HA haproxy container", "include_role": {"name": "tripleo_container_rm"}, "vars": {"tripleo_container_cli": "{{ container_cli }}", "tripleo_containers_to_rm": ["haproxy"]}}]}, {"name": "Prepare switch of haproxy image name", "when": ["step|int == 0"], "block": [{"name": "Get haproxy image id currently used by pacemaker", "shell": "pcs resource config haproxy-bundle | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'", "register": "haproxy_image_current_res", "failed_when": false}, {"name": "Image facts for haproxy", "set_fact": {"haproxy_image_latest": "cluster.common.tag/haproxy:pcmklatest", "haproxy_image_current": "{{haproxy_image_current_res.stdout}}"}}, {"name": "Temporarily tag the current haproxy image id with the upgraded image name", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{haproxy_image_current}}", "container_image_latest": "{{haproxy_image_latest}}", "pull_image": false}, "when": ["haproxy_image_current != ''", "haproxy_image_current != haproxy_image_latest"]}, {"name": "Create haproxy retag statefile", "file": {"path": "/var/lib/tripleo/haproxy_needs_retag", "state": "touch"}, "when": ["haproxy_image_current != ''", "haproxy_image_current != haproxy_image_latest"]}]}, {"name": "Update haproxy pcs resource bundle for new container image", "when": ["step|int == 1"], "block": [{"name": "Set upgrade haproxy facts", "set_fact": {"is_haproxy_bootstrap_node": "{{haproxy_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}"}}, {"name": "Check for haproxy retag statefile", "stat": {"path": "/var/lib/tripleo/haproxy_needs_retag"}, "register": "haproxy_retag_state_file"}]}, {"name": "Update haproxy pcs resource bundle for new container image", "when": ["step|int == 1", "is_haproxy_bootstrap_node|bool", "haproxy_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the haproxy cluster resource before container upgrade", "pacemaker_resource": {"resource": "haproxy-bundle", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Expose HAProxy stats socket on the host and mount TLS cert if needed", "block": [{"name": "Check haproxy stats socket configuration in pacemaker", "command": "cibadmin --query --xpath \"//storage-mapping[@id='haproxy-var-lib']\"", "failed_when": false, "register": "haproxy_stats_exposed"}, {"name": "Check haproxy public certificate configuration in pacemaker", "command": "cibadmin --query --xpath \"//storage-mapping[@id='haproxy-cert']\"", "failed_when": false, "register": "haproxy_cert_mounted"}, {"name": "Add a bind mount for stats socket in the haproxy bundle", "command": "pcs resource bundle update haproxy-bundle storage-map add id=haproxy-var-lib source-dir=/var/lib/haproxy target-dir=/var/lib/haproxy options=rw", "when": "haproxy_stats_exposed.rc == 6"}, {"name": "Set HAProxy public cert volume mount fact", "set_fact": {"haproxy_public_cert_path": "/etc/pki/tls/private/overcloud_endpoint.pem", "haproxy_public_tls_enabled": true}}, {"name": "Add a bind mount for public certificate in the haproxy bundle", "command": "pcs resource bundle update haproxy-bundle storage-map add id=haproxy-cert source-dir={{ haproxy_public_cert_path }} target-dir=/var/lib/kolla/config_files/src-tls/{{ haproxy_public_cert_path }} options=ro", "when": ["haproxy_cert_mounted.rc == 6", "haproxy_public_tls_enabled|bool"]}]}, {"name": "Update the haproxy bundle to use the new container image name", "command": "pcs resource bundle update haproxy-bundle container image={{haproxy_image_latest}}"}, {"name": "Enable the haproxy cluster resource", "pacemaker_resource": {"resource": "haproxy-bundle", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Remove haproxy retag statefile", "file": {"path": "/var/lib/tripleo/haproxy_needs_retag", "state": "absent"}}]}, {"name": "Retag the pacemaker image if containerized", "when": ["step|int == 3"], "block": [{"block": [{"name": "Get haproxy image from pacemaker", "become": true, "register": "xmllint_pcmk_haproxy_image", "shell": "xmllint --xpath \"string(//bundle[@id='haproxy-bundle']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container haproxy image", "set_fact": {"haproxy_image": "registry.redhat.io/rhosp-rhel9/openstack-haproxy:17.1", "haproxy_image_latest": "cluster.common.tag/haproxy:pcmklatest", "pcmk_haproxy_image": "{{xmllint_pcmk_haproxy_image.stdout}}"}}]}, {"block": [{"name": "Retag pcmklatest to latest haproxy image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{haproxy_image}}", "container_image_latest": "{{haproxy_image_latest}}"}}]}, {"name": "Ensure config works for the new config", "shell": "set -o pipefail\nawk -i inplace -v INPLACE_SUFFIX=.bak '/  rsprep/ {print \"  http-response replace-header Location \" $3\" \"$5; next;}; {print} ' /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg"}]}, {"name": "Anchor for upgrade and update tasks", "when": "step|int == 0", "block": [{"name": "Reset selinux label on /var/tmp", "file": {"path": "/var/tmp", "state": "directory", "setype": "tmp_t", "mode": 1023}}]}, {"name": "Prepare switch of manila_share image name", "when": ["step|int == 0"], "block": [{"name": "Get manila_share image id currently used by pacemaker", "shell": "pcs resource config openstack-manila-share | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'", "register": "manila_share_image_current_res", "failed_when": false}, {"name": "manila_share image facts", "set_fact": {"manila_share_image_latest": "cluster.common.tag/manila-share:pcmklatest", "manila_share_image_current": "{{manila_share_image_current_res.stdout}}"}}, {"name": "Temporarily tag the current manila_share image id with the upgraded image name", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{manila_share_image_current}}", "container_image_latest": "{{manila_share_image_latest}}", "pull_image": false}, "when": ["manila_share_image_current != ''", "manila_share_image_current != manila_share_image_latest"]}, {"name": "Create manila_share retag statefile", "file": {"path": "/var/lib/tripleo/manila_share_needs_retag", "state": "touch"}, "when": ["manila_share_image_current != ''", "manila_share_image_current != manila_share_image_latest"]}]}, {"name": "Update openstack-manila-share pcs resource bundle for new container image", "when": ["step|int == 1"], "block": [{"name": "set is_manila_share_bootstrap_node fact", "tags": "common", "set_fact": "is_manila_share_bootstrap_node={{manila_share_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}"}, {"name": "Check for manila_share retag statefile", "stat": {"path": "/var/lib/tripleo/manila_share_needs_retag"}, "register": "manila_share_retag_state_file"}]}, {"name": "Update openstack-manila-share pcs resource bundle for new container image", "when": ["step|int == 1", "is_manila_share_bootstrap_node", "manila_share_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the manila_share cluster resource before container upgrade", "pacemaker_resource": {"resource": "openstack-manila-share", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "pcs resource bundle update manila_share for new container image name", "command": "pcs resource bundle update openstack-manila-share container image={{manila_share_image_latest}}"}, {"name": "Enable the manila_share cluster resource", "pacemaker_resource": {"resource": "openstack-manila-share", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}]}, {"name": "Check for manila_share retag statefile", "when": ["step|int == 3"], "stat": {"path": "/var/lib/tripleo/manila_share_needs_retag"}, "register": "manila_share_retag_state_file"}, {"name": "Retag openstack-manila-share container image", "when": ["step|int == 3"], "block": [{"name": "Disable the manila_share cluster resource before container upgrade", "pacemaker_resource": {"resource": "openstack-manila-share", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Retag the pacemaker image if containerized", "block": [{"block": [{"name": "Get manila_share image from pacemaker", "become": true, "register": "xmllint_pcmk_manila_share_image", "shell": "xmllint --xpath \"string(//bundle[@id='openstack-manila-share']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container manila_share image", "set_fact": {"manila_share_image": "registry.redhat.io/rhosp-rhel9/openstack-manila-share:17.1", "manila_share_image_latest": "cluster.common.tag/manila-share:pcmklatest", "pcmk_manila_share_image": "{{xmllint_pcmk_manila_share_image.stdout}}"}}]}, {"block": [{"name": "Retag pcmklatest to latest manila_share image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{manila_share_image}}", "container_image_latest": "{{manila_share_image_latest}}"}}]}]}, {"name": "Enable the manila_share cluster resource", "pacemaker_resource": {"resource": "openstack-manila-share", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Remove manila_share retag statefile", "file": {"path": "/var/lib/tripleo/manila_share_needs_retag", "state": "absent"}}]}, {"name": "Tear-down non-HA mysql container", "when": ["step|int == 0"], "block": [{"name": "stat mysql container", "command": "podman container exists mysql", "failed_when": false, "changed_when": false, "register": "stat_mysql_container"}, {"name": "Create clustercheck user and permissions", "command": {"argv": "{{ mysql_exec_data | container_exec_cmd }}"}, "changed_when": true, "when": ["stat_mysql_container.rc == 0"], "vars": {"mysql_exec_data": {"environment": {"CLUSTERCHECK_PASSWORD": "Zw0aiGnnc8uyvmHM4YShomHk2"}, "command": ["mysql", "/bin/sh", "-c", "mysql -e \"CREATE USER IF NOT EXISTS 'clustercheck'@'localhost' IDENTIFIED BY '${CLUSTERCHECK_PASSWORD}'; GRANT PROCESS ON *.* TO 'clustercheck'@'localhost' WITH GRANT OPTION;\""]}}}, {"name": "Remove non-HA mysql container", "include_role": {"name": "tripleo_container_rm"}, "vars": {"tripleo_container_cli": "{{ container_cli }}", "tripleo_containers_to_rm": ["mysql"]}}]}, {"name": "set mysql container name fact", "when": ["step|int == 1"], "set_fact": {"mysql_container_name": "galera-bundle"}}, {"name": "Drop unused OpenStack DB users", "when": ["step|int == 1", "mysql_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower"], "block": [{"name": "mysql container id", "command": "podman ps -q --filter name={{ mysql_container_name }} --filter status=running", "register": "mysql_container_id"}, {"name": "set mysql container id fact", "set_fact": {"mysql_container": "{{ mysql_container_id.stdout }}"}}, {"name": "Mysql script to drop unused DB users", "when": "( mysql_container | length ) > 0", "block": [{"name": "Get the list of all OpenStack DB users", "shell": "jq -r 'to_entries[] | select(.key|endswith(\"::db::mysql::user\")) | .value' /etc/puppet/hieradata/service_configs.json", "register": "openstack_db_users"}, {"name": "List all DB users that match the DB users to be dropped", "shell": "for u in {{ openstack_db_users.stdout_lines | join(' ') }}; do podman exec -u root -it \"{{ mysql_container }}\" mysql -sNe \"select concat('\\`',user,'\\`@\\`',host,'\\`') from mysql.user where user = '$u' and host != '%';\"; done", "register": "mysql_db_users"}, {"name": "resulting DB users to be dropped", "debug": {"msg": "{{ mysql_db_users.stdout_lines }}"}}, {"name": "Drop all unneeded Openstack DB users", "shell": "podman exec -u root -it \"{{ mysql_container }}\" mysql -sNe 'drop user {{ item }};'", "loop": "{{ mysql_db_users.stdout_lines }}"}]}]}, {"vars": {"mysql_upgrade_persist": false}, "when": ["step|int == 3", "mysql_upgrade_persist"], "tags": ["never", "system_upgrade", "system_upgrade_prepare"], "block": [{"name": "Persist mysql data", "include_role": {"name": "tripleo_persist", "tasks_from": "persist.yml"}, "vars": {"tripleo_persist_dir": "/var/lib/mysql"}}]}, {"vars": {"mysql_upgrade_persist": false}, "when": ["step|int == 5", "mysql_upgrade_persist"], "tags": ["never", "system_upgrade", "system_upgrade_run"], "block": [{"name": "Restore mysql data", "include_role": {"name": "tripleo_persist", "tasks_from": "restore.yml"}, "vars": {"tripleo_persist_dir": "/var/lib/mysql"}}]}, {"name": "Prepare switch of galera image name", "when": ["step|int == 0"], "block": [{"name": "Get galera image id currently used by pacemaker", "shell": "pcs resource config galera-bundle | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'", "register": "galera_image_current_res", "failed_when": false}, {"name": "Image facts for galera", "set_fact": {"galera_image_latest": "cluster.common.tag/mariadb:pcmklatest", "galera_image_current": "{{galera_image_current_res.stdout}}"}}, {"name": "Temporarily tag the current galera image id with the upgraded image name", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{galera_image_current}}", "container_image_latest": "{{galera_image_latest}}", "pull_image": false}, "when": ["galera_image_current != ''", "galera_image_current != galera_image_latest"]}, {"name": "Create galera retag statefile", "file": {"path": "/var/lib/tripleo/galera_needs_retag", "state": "touch"}, "when": ["galera_image_current != ''", "galera_image_current != galera_image_latest"]}]}, {"name": "Update galera pcs resource bundle for new container image - check", "when": ["step|int == 1"], "block": [{"name": "set is_mysql_bootstrap_node fact", "tags": "common", "set_fact": "is_mysql_bootstrap_node={{mysql_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}"}, {"name": "Check for galera retag statefile", "stat": {"path": "/var/lib/tripleo/galera_needs_retag"}, "register": "galera_retag_state_file"}]}, {"name": "Update galera pcs resource bundle for new container image", "when": ["step|int == 1", "is_mysql_bootstrap_node|bool", "galera_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the galera cluster resource before container upgrade", "pacemaker_resource": {"resource": "galera-bundle", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Move Mysql logging to /var/log/containers", "block": [{"name": "Check Mysql logging configuration in pacemaker", "command": "cibadmin --query --xpath \"//storage-mapping[@id='mysql-log']\"", "failed_when": false, "register": "mysql_logs_moved"}, {"name": "Change Mysql logging configuration in pacemaker", "when": "mysql_logs_moved.rc == 6", "block": [{"name": "Add a bind mount for logging in the galera bundle", "command": "pcs resource bundle update galera-bundle storage-map add id=mysql-log source-dir=/var/log/containers/mysql target-dir=/var/log/mysql options=rw"}, {"name": "Reconfigure Mysql log file in the galera resource agent", "command": "pcs resource update galera log=/var/log/mysql/mysqld.log"}]}]}, {"name": "Update the galera bundle to use the new container image name", "command": "pcs resource bundle update galera-bundle container image={{galera_image_latest}}"}, {"name": "Enable the galera cluster resource", "pacemaker_resource": {"resource": "galera-bundle", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}]}, {"name": "Upgrade galera in step3", "when": ["step|int == 3"], "block": [{"name": "Bind mounts for temporary container", "set_fact": {"mysql_upgrade_db_bind_mounts": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/mysql.json:/var/lib/kolla/config_files/config.json:rw,z", "/var/lib/config-data/puppet-generated/mysql:/var/lib/kolla/config_files/src:ro,z", "/var/lib/mysql:/var/lib/mysql:rw,z", "/var/log/containers/mysql:/var/log/mysql:rw,z", "/etc/pki/tls/certs/mysql.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/mysql.crt:ro", "/etc/pki/tls/private/mysql.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/mysql.key:ro"]}}, {"name": "Check if Galera needs upgrade", "shell": "{{ container_cli }} run --rm --log-driver=k8s-file --log-opt path=/var/log/containers/mysql/db-upgrade.log \\ -u root --net=host -e \"KOLLA_CONFIG_STRATEGY=COPY_ALWAYS\" -v {{ mysql_upgrade_db_bind_mounts | join(' -v ')}} \"cluster.common.tag/mariadb:pcmklatest\" /bin/bash -ecx \"$UPGRADE_SCRIPT\"", "environment": {"UPGRADE_SCRIPT": "kolla_set_configs\nupgraded_ver=$(cat /var/lib/mysql/mysql_upgrade_info 2>/dev/null || true)\nmysql_ver=$(mysql --version | awk -F'[ ,]*' '{print $5}')\nif [ \"${upgraded_ver}\" = \"${mysql_ver}\" ]; then\n    echo \"mysql already upgraded\"\nelse\n    echo \"${upgraded_ver} VS ${mysql_ver}\"\nfi\n"}, "register": "mysql_upgrade_needed"}, {"name": "Set fact upgrade_mysql", "set_fact": {"upgrade_mysql": "{{ (mysql_upgrade_needed.stdout != \"mysql already upgraded\") | bool }}"}}, {"debug": {"msg": "MYSQL check - {{ mysql_upgrade_needed.stdout }} - Upgrade needed: {{ upgrade_mysql }}"}}, {"name": "Disable the galera cluster resource before container upgrade", "when": ["upgrade_mysql|bool"], "pacemaker_resource": {"resource": "galera-bundle", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"block": [{"name": "Get galera image from pacemaker", "become": true, "register": "xmllint_pcmk_galera_image", "shell": "xmllint --xpath \"string(//bundle[@id='galera-bundle']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container galera image", "set_fact": {"galera_image": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1", "galera_image_latest": "cluster.common.tag/mariadb:pcmklatest", "pcmk_galera_image": "{{xmllint_pcmk_galera_image.stdout}}"}}]}, {"name": "Check for galera retag statefile", "stat": {"path": "/var/lib/tripleo/galera_needs_retag"}, "register": "galera_retag_state_file"}, {"name": "Retag the pacemaker image if containerized", "when": ["galera_retag_state_file.stat.exists|bool"], "block": [{"name": "Retag pcmklatest to latest galera image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{galera_image}}", "container_image_latest": "{{galera_image_latest}}"}}]}, {"name": "Remove galera retag statefile", "file": {"path": "/var/lib/tripleo/galera_needs_retag", "state": "absent"}}, {"name": "Mysql upgrade script", "when": ["upgrade_mysql|bool"], "set_fact": {"mysql_upgrade_script": "kolla_set_configs\nif mysqladmin ping --silent; then exit 0; fi\nupgraded_ver=$(cat /var/lib/mysql/mysql_upgrade_info 2>/dev/null || true)\nmysql_ver=$(mysql --version | awk -F'[ ,]*' '{print $5}')\nif [ \"${upgraded_ver}\" = \"${mysql_ver}\" ]; then\n    echo \"mysql already upgraded\"\n    exit 0\nfi\nchown -R mysql:mysql /var/lib/mysql\nchown -R mysql:mysql /var/log/mysql\nmysqld_safe --user=mysql --wsrep-provider=none --skip-networking --wsrep-on=off --log-error=/var/log/mysql/mysqld-upgrade.log &\n\n#!/usr/bin/bash\n\nset -e\n\n# Wait until we know the mysql server is up and responding\ntimeout ${DB_MAX_TIMEOUT:-60} /bin/bash -c 'until mysqladmin -uroot ping 2>/dev/null; do sleep 1; done'\n\n# After an upgrade, make sure that the running mysql had a chance to\n# update its data table on disk.\nmysql_upgrade\n\n# Upgrade to 10.3: the default table row format changed from COMPACT\n# to DYNAMIC, so upgrade the existing tables.\ncompact_tables=$(mysql -se 'SELECT CONCAT(\"`\",TABLE_SCHEMA,\"`.`\",TABLE_NAME,\"`\") FROM information_schema.tables WHERE ENGINE = \"InnoDB\" and ROW_FORMAT = \"Compact\";');\nfor i in $compact_tables; do echo converting row format of table $i; mysql -e \"ALTER TABLE $i ROW_FORMAT=DYNAMIC;\"; done;\n\nmysqladmin shutdown"}}, {"name": "Upgrade Mysql database from a temporary container", "when": ["upgrade_mysql|bool"], "shell": "{{ container_cli }} run --rm --log-driver=k8s-file --log-opt path=/var/log/containers/mysql/db-upgrade.log \\ -u root --net=host -e \"KOLLA_CONFIG_STRATEGY=COPY_ALWAYS\" -v {{ mysql_upgrade_db_bind_mounts | join(' -v ')}} \"cluster.common.tag/mariadb:pcmklatest\" /bin/bash -ecx \"$UPGRADE_SCRIPT\"", "environment": {"UPGRADE_SCRIPT": "{{ mysql_upgrade_script }}"}}, {"name": "Enable the galera cluster resource", "when": ["upgrade_mysql|bool"], "pacemaker_resource": {"resource": "galera-bundle", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}]}, {"name": "Remove openstack-nova-compute and python-nova package during upgrade", "package": {"name": ["openstack-nova-compute", "python-nova"], "state": "removed"}, "failed_when": false, "when": "step|int == 2"}, {"name": "nova_compute pre system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 3", "upgrade_leapp_enabled"], "block": [{"name": "Unmount Nova NFS Share", "vars": {"nfs_backend_enable": false}, "mount": {"name": "/var/lib/nova/instances", "state": "absent", "fstype": "nfs4"}, "when": "nfs_backend_enable|bool"}]}, {"name": "nova_compute post system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 5", "upgrade_leapp_enabled"], "block": [{"name": "Mount Nova NFS Share", "vars": {"nfs_backend_enable": false, "nfs_share": "", "nfs_options": "context=system_u:object_r:nfs_t:s0", "nfs_vers": "4.2"}, "mount": {"name": "/var/lib/nova/instances", "state": "mounted", "fstype": "nfs4", "src": "{{nfs_share}}", "opts": "_netdev,bg,{{nfs_options}},nfsvers={{nfs_vers}}"}, "when": "nfs_backend_enable|bool"}]}, {"name": "Fail if we are on RHEL8 as this is monolithic libvirt deployment", "when": ["step|int == 0", "'system_upgrade' not in ansible_run_tags", "ansible_facts['distribution_major_version'] is version('8', '==')"], "fail": {"msg": "Use of the Modular Libvirt deployment on RHEL8 results in loss of workloads. Use NovaLibvirtLegacy in roles data."}}, {"name": "nova_libvirt_container_tmpfile_cleanup", "when": "step|int == 1", "block": [{"name": "Remove old tmpfiles.d config", "file": {"path": "/etc/tmpfiles.d/var-run-libvirt.conf", "state": "absent"}}]}, {"name": "Get container virtlogd image", "when": "step|int == 1", "tags": "always", "set_fact": {"virtlogd_image": "registry.redhat.io/rhosp-rhel9/openstack-nova-libvirt:17.1"}}, {"name": "Force pull image novalibvirt", "when": ["step|int == 1"], "containers.podman.podman_image": {"name": "{{ virtlogd_image }}", "force": true}}, {"name": "Diff OS release in container image and baremetal", "when": "step|int == 1", "shell": "diff /etc/redhat-release <(podman run {{ virtlogd_image }} cat /etc/redhat-release)\n", "args": {"executable": "/bin/bash"}, "failed_when": false, "register": "libvirt_ubi_diff"}, {"name": "Fail if UBI of the container does not match RHEL of running host", "when": ["'system_upgrade' not in ansible_run_tags", "step|int == 1", "libvirt_ubi_diff.rc == 1"], "fail": {"msg": "The host operating system versus container UBI does not match.\n{{ libvirt_ubi_diff.stdout }}\nMost likely container passed to NovaLibvirt was EL8 one.\nYou have to pass the correct container for container-image-prepare.\nIf you would continue all running workloads would get destroyed.\n"}}, {"name": "Switch virtlogd image before system upgrade", "when": "step|int == 1", "tags": ["never", "system_upgrade"], "block": [{"name": "Get running image version", "shell": "podman ps --filter name=^nova_virtlogd$ --format \"{% raw %}{{ .Image }}{% endraw %}\"\n", "register": "old_virtlogd_image"}, {"name": "Switch running image to new image in wrapper script", "shell": "set -o pipefail\nsed -i -e 's|{{ old_virtlogd_image.stdout }}|{{ virtlogd_image }}|' /var/lib/container-config-scripts/virtlogd_wrapper\n", "when": ["old_virtlogd_image.stdout != virtlogd_image", "old_virtlogd_image.stdout != ''"]}]}, {"name": "nova_migration_target_tmpfile_cleanup", "when": "step|int == 1", "block": [{"name": "Remove old tmpfiles.d config", "file": {"path": "/etc/tmpfiles.d/var-run-libvirt.conf", "state": "absent"}}]}, {"name": "Fetch running ovn_controller image", "shell": "set -e\npodman inspect --format \"{{'{{'}}.ImageName{{'}}'}}\" ovn_controller\n", "register": "running_ovn_image", "when": ["step|int == 4"], "tags": ["ovn", "ovn_image"]}, {"name": "Run ovn_controller upgrade", "tags": ["ovn", "ovn_image"], "vars": {"ovn_controller_image": "registry.redhat.io/rhosp-rhel9/openstack-ovn-controller:17.1"}, "when": ["step|int == 4", "running_ovn_image.stdout != ovn_controller_image"], "block": [{"name": "Force pull image in case image name doesn't change.", "when": "step|int == 4", "tags": ["ovn", "ovn_image"], "containers.podman.podman_image": {"name": "registry.redhat.io/rhosp-rhel9/openstack-ovn-controller:17.1", "validate_certs": false, "force": true}}, {"name": "Update OVN OVS related parameters before update.", "when": ["step|int == 4"], "tags": ["ovn"], "vars": {"timeout": 8000}, "shell": "set -e\novs-vsctl set Open_vSwitch . external_ids:ovn-ofctrl-wait-before-clear={{ timeout }}\novs-vsctl set Open_vSwitch . external_ids:ovn-monitor-all=true\novs-vsctl set Open_vSwitch . external_ids:ovn-match-northd-version=false\n"}, {"name": "Find ovn_controller configs in container-startup-configs", "find": {"paths": "/var/lib/tripleo-config/container-startup-config/", "patterns": "*ovn_controller.json", "recurse": true}, "register": "ovn_cont_17_0", "when": ["step|int == 4"], "tags": ["ovn"]}, {"name": "get directory path from the ovn_cont_17_0", "set_fact": {"ovn_config_path": "{{ ovn_cont_17_0.files.0.path | dirname }}"}, "when": "step|int == 4", "tags": "ovn"}, {"name": "Get PIDfile used by systemd on each ovn node", "when": ["step|int == 4"], "tags": ["ovn"], "shell": "set -e\ngrep PID /etc/systemd/system/tripleo_ovn_controller.service | cut -d= -f2\n", "register": "pidfile"}, {"name": "Update ovn_controller.", "vars": {"config_step": "{{ ('step_4' in ovn_config_path) | ternary('4', '3')}}"}, "when": "step|int == 4", "tags": "ovn", "tripleo_container_manage": {"config_dir": "{{ ovn_config_path }}", "config_patterns": "*ovn_controller.json", "config_id": ["tripleo_step{{config_step}}"], "log_base_path": "{{ container_log_stdout_path }}", "debug": "{{ enable_debug | bool }}", "config_overrides": {".*ovn_controller": {"image": "registry.redhat.io/rhosp-rhel9/openstack-ovn-controller:17.1", "conmon_pidfile": "{{ pidfile.stdout }}", "name": "ovn_controller"}}}}, {"name": "Pause for 30s to give ovn_controllers time to reconnect to dbs", "when": ["step|int == 4"], "tags": "ovn", "wait_for": {"timeout": 30}}]}, {"name": "Tear-down non-HA rabbitmq container", "when": ["step|int == 0"], "block": [{"name": "Remove non-HA rabbitmq container", "include_role": {"name": "tripleo_container_rm"}, "vars": {"tripleo_container_cli": "{{ container_cli }}", "tripleo_containers_to_rm": ["rabbitmq"]}}]}, {"name": "Prepare switch of rabbitmq image name", "when": ["step|int == 0"], "block": [{"name": "Get rabbitmq image id currently used by pacemaker", "shell": "pcs resource config rabbitmq-bundle | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'", "register": "rabbitmq_rpc_image_current_res", "failed_when": false}, {"name": "Image facts for rabbitmq", "set_fact": {"rabbitmq_rpc_image_latest": "cluster.common.tag/rabbitmq:pcmklatest", "rabbitmq_rpc_image_current": "{{rabbitmq_rpc_image_current_res.stdout}}"}}, {"name": "Temporarily tag the current rabbitmq image id with the upgraded image name", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{rabbitmq_rpc_image_current}}", "container_image_latest": "{{rabbitmq_rpc_image_latest}}", "pull_image": false}, "when": ["rabbitmq_rpc_image_current != ''", "rabbitmq_rpc_image_current != rabbitmq_rpc_image_latest"]}, {"name": "Create rabbitmq_rpc retag statefile", "file": {"path": "/var/lib/tripleo/rabbitmq_rpc_needs_retag", "state": "touch"}, "when": ["rabbitmq_rpc_image_current != ''", "rabbitmq_rpc_image_current != rabbitmq_rpc_image_latest"]}]}, {"name": "Update rabbitmq-bundle pcs resource bundle for new container image", "when": ["step|int == 1"], "block": [{"name": "set is_rpc_rabbitmq_bootstrap_node fact", "set_fact": "is_rpc_rabbitmq_bootstrap_node={{oslo_messaging_rpc_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}"}, {"name": "Check for rabbitmq_rpc retag statefile", "stat": {"path": "/var/lib/tripleo/rabbitmq_rpc_needs_retag"}, "register": "rabbitmq_rpc_retag_state_file"}]}, {"name": "Update rabbitmq-bundle pcs resource bundle for new container image", "when": ["step|int == 1", "is_rpc_rabbitmq_bootstrap_node|bool", "rabbitmq_rpc_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the rabbitmq cluster resource before container upgrade", "pacemaker_resource": {"resource": "rabbitmq-bundle", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Check rabbitmq logging configuration in pacemaker", "command": "cibadmin --query --xpath \"//storage-mapping[@id='rabbitmq-log']\"", "failed_when": false, "register": "rabbitmq_logs_moved"}, {"name": "Add a bind mount for logging in the rabbitmq bundle", "when": "rabbitmq_logs_moved.rc == 6", "command": "pcs resource bundle update rabbitmq-bundle storage-map add id=rabbitmq-log source-dir=/var/log/containers/rabbitmq target-dir=/var/log/rabbitmq options=rw"}, {"name": "Update the rabbitmq bundle to use the new container image name", "command": "pcs resource bundle update rabbitmq-bundle container image={{rabbitmq_rpc_image_latest}}"}, {"name": "Enable the rabbitmq cluster resource", "pacemaker_resource": {"resource": "rabbitmq-bundle", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}]}, {"name": "Check for rabbitmq_rpc retag statefile", "when": ["step|int == 3"], "stat": {"path": "/var/lib/tripleo/rabbitmq_rpc_needs_retag"}, "register": "rabbitmq_rpc_retag_state_file"}, {"name": "Retag rabbitmq-bundle container image", "when": ["step|int == 3", "rabbitmq_rpc_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the rabbitmq cluster resource before container upgrade", "pacemaker_resource": {"resource": "rabbitmq-bundle", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Retag the pacemaker image if containerized", "block": [{"block": [{"name": "Get rabbitmq image from pacemaker", "become": true, "register": "xmllint_pcmk_rabbitmq_rpc_image", "shell": "xmllint --xpath \"string(//bundle[@id='rabbitmq-bundle']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container rabbitmq image", "set_fact": {"rabbitmq_rpc_image": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1", "rabbitmq_rpc_image_latest": "cluster.common.tag/rabbitmq:pcmklatest", "pcmk_rabbitmq_rpc_image": "{{xmllint_pcmk_rabbitmq_rpc_image.stdout}}"}}]}, {"block": [{"name": "Retag pcmklatest to latest rabbitmq image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{rabbitmq_rpc_image}}", "container_image_latest": "{{rabbitmq_rpc_image_latest}}"}}]}]}, {"name": "Enable the rabbitmq cluster resource", "pacemaker_resource": {"resource": "rabbitmq-bundle", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Remove rabbitmq_rpc retag statefile", "file": {"path": "/var/lib/tripleo/rabbitmq_rpc_needs_retag", "state": "absent"}}]}, {"name": "Ensure redis is removed", "when": ["step|int == 5", "\"redis\" not in enabled_services|list", "{{ (pacemaker_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower)|bool}}"], "become": true, "shell": "if crm_resource -r redis-bundle -q &>/dev/null; then\n   pcs resource delete redis-bundle || true\n   pcs resource delete ip-$(hiera redis_vip) || true\nfi\n"}, {"name": "Clean up cluster node cache", "when": ["step|int == 5", "\"redis\" not in enabled_services|list", "{{ (pacemaker_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower)|bool}}"], "become": true, "shell": "pcs cluster node clear redis-bundle-0\npcs cluster node clear redis-bundle-1\npcs cluster node clear redis-bundle-2\ncrm_attribute --name redis_REPL_INFO --delete\n"}, {"name": "Clean up redis attribute", "when": ["step|int == 5", "\"redis\" not in enabled_services|list", "{{ (pacemaker_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower)|bool}}"], "become": true, "shell": "pcs node attribute \"{{ item }}\" redis-role= || true\n", "loop": "{{ pacemaker_short_node_names }}"}, {"name": "Configure Podman registry", "when": ["step|int == 1"], "block": [{"name": "Make sure the Undercloud hostname is included in /etc/hosts", "when": ["undercloud_hosts_entries is defined"], "lineinfile": {"dest": "/etc/hosts", "line": "{{ undercloud_hosts_entries | join('') }}", "state": "present"}}]}, {"name": "Run podman install", "tags": ["system_upgrade", "system_upgrade_run"], "when": ["step|int == 1"], "block": [{"name": "Set login facts", "no_log": true, "set_fact": {"container_registry_insecure_registries": ["192.168.122.100:8787"], "container_registry_login": false, "container_registry_logins": {}, "container_registry_logins_json": {}, "container_default_pids_limit": 4096, "container_events_logger_mechanism": "journald"}}, {"name": "Convert logins json to dict", "no_log": true, "set_fact": {"container_registry_logins": "{{ container_registry_logins_json | from_json }}"}, "when": ["container_registry_logins_json is string", "container_registry_login | bool", "(container_registry_logins_json | length) > 0"]}, {"name": "Set registry logins", "no_log": true, "set_fact": {"container_registry_logins": "{{ container_registry_logins_json }}"}, "when": ["container_registry_logins_json is mapping", "container_registry_login | bool", "(container_registry_logins_json | length) > 0"]}, {"name": "Run podman install", "include_role": {"name": "tripleo_podman", "tasks_from": "tripleo_podman_install.yml"}, "vars": {"tripleo_container_registry_insecure_registries": "{{ container_registry_insecure_registries }}", "tripleo_container_default_pids_limit": "{{ container_default_pids_limit }}", "tripleo_container_events_logger_mechanism": "{{ container_events_logger_mechanism }}"}}, {"name": "Run podman login", "include_role": {"name": "tripleo_podman", "tasks_from": "tripleo_podman_login.yml"}, "vars": {"tripleo_container_registry_logins": "{{ container_registry_logins }}", "tripleo_container_registry_login": "{{ container_registry_login | bool }}"}}]}, {"when": "step|int == 0", "block": [{"name": "Check if snmpd is enabled", "command": "systemctl is-enabled --quiet snmpd", "failed_when": false, "register": "snmpd_enabled_result"}, {"name": "Set fact snmpd_enabled", "set_fact": {"snmpd_enabled": "{{ snmpd_enabled_result.rc == 0 }}"}}]}, {"name": "Stop snmp service", "when": ["step|int == 1", "snmpd_enabled|bool"], "service": "name=snmpd state=stopped"}, {"name": "Cleanup tripleo-iptables services", "when": ["(step | int) == 1"], "block": [{"name": "Disable tripleo-iptables.service", "systemd": {"name": "tripleo-iptables.service", "state": "stopped", "enabled": false}, "register": "systemd_tripleo_iptables", "failed_when": false}, {"name": "Cleanup tripleo-iptables.services", "file": {"path": "/etc/systemd/system/tripleo-iptables.service", "state": "absent"}}, {"name": "Disable tripleo-ip6tables.service", "systemd": {"name": "tripleo-ip6tables.service", "state": "stopped", "enabled": false}, "register": "systemd_tripleo_ip6tables", "failed_when": false}, {"name": "Cleanup tripleo-ip6tables.services", "file": {"path": "/etc/systemd/system/tripleo-ip6tables.service", "state": "absent"}}, {"name": "Reload systemd", "systemd": {"daemon_reload": true}, "when": ["(systemd_tripleo_iptables is changed or systemd_tripleo_ip6tables is changed)"]}]}, {"when": ["(step | int) == 3"], "block": [{"name": "blank ipv6 rule before activating ipv6 firewall.", "shell": "cat /etc/sysconfig/ip6tables > /etc/sysconfig/ip6tables.n-o-upgrade; cat</dev/null>/etc/sysconfig/ip6tables", "args": {"creates": "/etc/sysconfig/ip6tables.n-o-upgrade"}}, {"name": "cleanup unmanaged rules pushed by iptables-services", "shell": "iptables -C INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT &>/dev/null && \\\n  iptables -D INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\niptables -C INPUT -p icmp -j ACCEPT &>/dev/null && \\\n  iptables -D INPUT -p icmp -j ACCEPT\niptables -C INPUT -i lo -j ACCEPT &>/dev/null && \\\n  iptables -D INPUT -i lo -j ACCEPT\niptables -C INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT &>/dev/null && \\\n  iptables -D INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT\niptables -C INPUT -j REJECT --reject-with icmp-host-prohibited &>/dev/null && \\\n  iptables -D INPUT -j REJECT --reject-with icmp-host-prohibited\niptables -C FORWARD -j REJECT --reject-with icmp-host-prohibited &>/dev/null && \\\n  iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited\n\nsed -i '/^-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT$/d' /etc/sysconfig/iptables\nsed -i '/^-A INPUT -p icmp -j ACCEPT$/d' /etc/sysconfig/iptables\nsed -i '/^-A INPUT -i lo -j ACCEPT$/d' /etc/sysconfig/iptables\nsed -i '/^-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT$/d' /etc/sysconfig/iptables\nsed -i '/^-A INPUT -j REJECT --reject-with icmp-host-prohibited$/d' /etc/sysconfig/iptables\nsed -i '/^-A FORWARD -j REJECT --reject-with icmp-host-prohibited$/d' /etc/sysconfig/iptables\n\nip6tables -C INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT &>/dev/null && \\\n  ip6tables -D INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\nip6tables -C INPUT -p ipv6-icmp -j ACCEPT &>/dev/null && \\\n  ip6tables -D INPUT -p ipv6-icmp -j ACCEPT\nip6tables -C INPUT -i lo -j ACCEPT &>/dev/null && \\\n  ip6tables -D INPUT -i lo -j ACCEPT\nip6tables -C INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT &>/dev/null && \\\n  ip6tables -D INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT\nip6tables -C INPUT -d fe80::/64 -p udp -m udp --dport 546 -m state --state NEW -j ACCEPT &>/dev/null && \\\n  ip6tables -D INPUT -d fe80::/64 -p udp -m udp --dport 546 -m state --state NEW -j ACCEPT\nip6tables -C INPUT -j REJECT --reject-with icmp6-adm-prohibited &>/dev/null && \\\n  ip6tables -D INPUT -j REJECT --reject-with icmp6-adm-prohibited\nip6tables -C FORWARD -j REJECT --reject-with icmp6-adm-prohibited &>/dev/null && \\\n  ip6tables -D FORWARD -j REJECT --reject-with icmp6-adm-prohibited\n\nsed -i '/^-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT$/d' /etc/sysconfig/ip6tables\nsed -i '/^-A INPUT -p ipv6-icmp -j ACCEPT$/d' /etc/sysconfig/ip6tables\nsed -i '/^-A INPUT -i lo -j ACCEPT$/d' /etc/sysconfig/ip6tables\nsed -i '/^-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT$/d' /etc/sysconfig/ip6tables\nsed -i '/^-A INPUT -d fe80::\\/64 -p udp -m udp --dport 546 -m state --state NEW -j ACCEPT$/d' /etc/sysconfig/ip6tables\nsed -i '/^-A INPUT -j REJECT --reject-with icmp6-adm-prohibited$/d' /etc/sysconfig/ip6tables\nsed -i '/^-A FORWARD -j REJECT --reject-with icmp6-adm-prohibited$/d' /etc/sysconfig/ip6tables"}]}, {"name": "Gather missing facts", "setup": {"gather_subset": ["!all", "!min", "distribution"]}, "tags": ["always"]}, {"name": "Set leapp facts", "set_fact": {"upgrade_leapp_enabled": "{{ _upgradeLeappEnabled | bool and\n   ansible_facts['distribution'] == 'RedHat' and\n   ansible_facts['distribution_major_version'] is version('8', '==') }}", "upgrade_leapp_debug": false, "upgrade_leapp_devel_skip": "", "upgrade_leapp_command_options": "", "upgrade_leapp_reboot_timeout": 3600, "upgrade_leapp_post_reboot_delay": 120}, "vars": {"_upgradeLeappEnabled": false}, "tags": ["always"]}, {"name": "system_upgrade_prepare step 3", "tags": ["never", "system_upgrade", "system_upgrade_prepare"], "when": ["step|int == 3", "upgrade_leapp_enabled"], "block": [{"name": "Run LeappRepoInitCommand", "shell": "#!/bin/bash\n\n"}, {"name": "Remove firewalld bindings", "package": {"name": "python3-firewall", "state": "absent"}}, {"name": "install leapp", "package": {"name": "leapp-repository-openstack", "state": "latest"}}, {"name": "Run LeappInitCommand", "shell": "#!/bin/bash\n\n"}, {"name": "Remove vdo", "package": {"name": "vdo", "state": "absent"}}, {"name": "add packages into Leapp's to_remove file", "vars": {"pkg_to_remove": []}, "lineinfile": {"path": "/etc/leapp/transaction/to_remove", "line": "{{ item }}"}, "loop": "{{ pkg_to_remove }}"}, {"name": "add packages into Leapp's to_install file", "vars": {"pkg_to_install": []}, "lineinfile": {"path": "/etc/leapp/transaction/to_install", "line": "{{ item }}"}, "loop": "{{ pkg_to_install }}"}, {"name": "check sshd_config file", "stat": {"path": "/etc/ssh/sshd_config"}, "register": "sshd_config_result"}, {"name": "add PermitRootLogin option for leapp", "lineinfile": {"path": "/etc/ssh/sshd_config", "regexp": "^(# *)?PermitRootLogin", "line": "PermitRootLogin without-password"}}, {"name": "Remove paunch-services", "package": {"name": "paunch-services", "state": "absent"}}, {"name": "tripleo_container_manage reconfiguration", "import_role": {"name": "tripleo_container_manage", "tasks_from": "shutdown.yml"}}]}, {"name": "system_upgrade_prepare step 4", "tags": ["never", "system_upgrade", "system_upgrade_prepare"], "when": ["step|int == 4", "upgrade_leapp_enabled"], "block": [{"name": "Delete the kernel modules in Leapp database (device_driver_deprecation_data.json)", "vars": {"modules_to_unload": []}, "shell": "set -o pipefail && jq '. | del(.data[] | select(.driver_name == \"{{ item }}\"))' /etc/leapp/files/device_driver_deprecation_data.json > /etc/leapp/files/device_driver_deprecation_data.json_modified && mv /etc/leapp/files/device_driver_deprecation_data.json_modified /etc/leapp/files/device_driver_deprecation_data.json\n", "loop": "{{ modules_to_unload }}"}, {"name": "Remove leapp actors to prevent them inhibiting the upgrade", "vars": {"actors_to_remove": []}, "command": {"cmd": "find /usr/share/leapp-repository/repositories/ -name {{ item }} -type d -print -exec rm -rf \"{}\" +"}, "loop": "{{ actors_to_remove }}"}, {"name": "set leapp required answers", "shell": "leapp answer --add --section check_vdo.confirm=True\n"}, {"name": "Replace EFI grub.cfg with redirect to /boot/grub2/grub.cfg", "import_role": {"name": "tripleo_kernel", "tasks_from": "efigrub.yml"}}, {"name": "Keep nics with prefix in NICsPrefixesToUdev from renaming", "vars": {"nics_prefixes_to_keep": []}, "shell": "ip -j link show | \\ jq -r --arg prefix \"{{ item }}\" '.[] |\n  select((.ifname | startswith($prefix)) and\n  (.ifname | test(\"^.*v[0-9]*$\") | not) and\n  (.ifname | test(\"^.*_[0-9]*$\") | not) and\n  (.ifname | test(\"^.*\\\\..*$\") | not)) |\n  if .permaddr? then .address=.permaddr else . end |\n  \"SUBSYSTEM==\\\"net\\\",ACTION==\\\"add\\\",DRIVERS==\\\"?*\\\",\" + \"NAME=\\\"\" + .ifname +\"\\\" ,ATTR{address}==\\\"\" + .address + \"\\\"\"' >> /etc/udev/rules.d/70-rhosp-persistent-net.rules\n", "loop": "{{ nics_prefixes_to_keep|list }}"}, {"name": "run leapp upgrade (download packages)", "shell": "{% if upgrade_leapp_devel_skip|default(false) %}{{ upgrade_leapp_devel_skip }}{% endif %} leapp upgrade {% if upgrade_leapp_debug|default(true) %}--debug{% endif %} {% if upgrade_leapp_command_options|default(false) %}{{ upgrade_leapp_command_options }}{% endif %}\n", "when": "upgrade_leapp_enabled"}]}, {"name": "system_upgrade_run step 4", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_reboot"], "when": ["step|int == 4", "upgrade_leapp_enabled", "'Undercloud' not in group_names"], "block": [{"name": "Run LeappPreRebootCommand", "shell": "#!/bin/bash\n\n"}, {"name": "Check that nova_libvirt is running", "shell": "podman ps --filter name=^nova_virtlogd$ --format \"{% raw %}{{ .Image }}{% endraw %}\"\n", "register": "is_virtlogd_image_running"}, {"name": "Remove systemd files to disable them", "file": {"path": "/etc/systemd/system/{{ item }}", "state": "absent"}, "with_items": ["tripleo_nova_libvirt.service", "tripleo_nova_virtlogd_wrapper.service", "tripleo_nova_libvirt.target"], "when": "is_virtlogd_image_running.stdout != ''"}, {"name": "reboot to perform the upgrade", "reboot": {"reboot_timeout": "{{upgrade_leapp_reboot_timeout}}", "test_command": "source /etc/os-release; [ \"${VERSION_ID%.*}\" -ge \"8\" ] && systemctl is-system-running | grep -qE \"running|degraded\" || exit 1", "post_reboot_delay": "{{ upgrade_leapp_post_reboot_delay }}"}}, {"name": "Set selinux back to enforcing after leapp reboot", "selinux": {"policy": "targeted", "state": "enforcing"}}, {"name": "Run LeappPostRebootCommand", "shell": "#!/bin/bash\n\n"}]}, {"name": "Host packages setup step0", "tags": "setup_packages", "when": "step|int == 0", "block": [{"name": "Package and repo update tasks", "block": [{"name": "Run UpgradeInitCommand", "shell": "#!/bin/bash\n\nif [[ -f /etc/resolv.conf.save ]] ; then rm /etc/resolv.conf.save; fi\n\n"}, {"name": "Run UpgradeInitCommonCommand", "shell": "#!/bin/bash\n\n"}, {"name": "Ensure DNF modules have the right stream", "vars": {"dnf_module_list": []}, "dnf": {"name": "@{{ item.module }}:{{ item.stream }}/{{ item.profile|default('common') }}", "state": "present"}, "loop": "{{ dnf_module_list|list }}", "when": ["dnf_module_list|length > 0", "item.distribution_version is defined", "ansible_facts['distribution_major_version'] is version(item.distribution_version, '==')"]}, {"name": "Ensure TripleO prerequisite packages are installed", "package": {"name": ["jq", "lvm2", "openstack-selinux", "os-net-config", "puppet-tripleo", "python3-heat-agent*", "rsync"], "state": "present"}, "when": "ansible_facts['distribution_major_version'] is version('8', '==')"}, {"name": "Ensure TripleO prerequisite packages are installed and use role based heat variable to provide specific list of packages", "vars": {"base_tripleo_packages": []}, "package": {"name": "{{ base_tripleo_packages }}", "state": "present"}, "when": ["ansible_facts['distribution_major_version'] is version('8', '==')", "base_tripleo_packages|length > 0"]}, {"name": "WA for 2240185 - If the image is schema 1 and lacks signatures than add empty signatures", "shell": "for manifest_file in `find /var/lib/containers/storage/overlay-images/ -name 'manifest'`\ndo\n    cat <<< $( jq  'if .schemaVersion == 1 then if has(\"signatures\") then . else .signatures=[] end else . end' $manifest_file ) > $manifest_file\ndone\n", "when": "ansible_facts['distribution_major_version'] is version('8', '==')"}]}, {"name": "check if libvirt is installed", "command": "/usr/bin/rpm -q libvirt-daemon", "failed_when": false, "register": "libvirt_installed", "check_mode": false}, {"name": "make sure libvirt services are disabled and masked", "service": {"name": "{{ item }}", "state": "stopped", "enabled": false, "masked": true, "daemon_reload": true}, "loop": ["libvirtd.service", "virtlogd.socket"], "when": ["libvirt_installed.rc == 0"]}]}, {"name": "Host packages setup step2", "tags": "setup_packages", "when": "step|int == 2", "block": [{"name": "Special treatment for OpenvSwitch", "tripleo_ovs_upgrade": null, "register": "ovs_upgrade"}, {"name": "Always ensure the openvswitch service is enabled and running after upgrades", "service": {"name": "openvswitch", "enabled": true, "state": "started"}, "when": ["ovs_upgrade.changed|bool"]}]}, {"name": "Host packages setup step3", "tags": "setup_packages", "when": "step|int == 3", "block": [{"name": "Check for os-net-config upgrade", "shell": "yum check-upgrade | awk '/os-net-config/{print}'", "register": "os_net_config_need_upgrade"}, {"name": "Check that os-net-config has legacy configuration", "stat": {"path": "/etc/os-net-config/config.json", "get_attributes": false, "get_checksum": false, "get_mime": false}, "register": "stat_config_json"}, {"name": "Check that os-net-config has new configuration", "stat": {"path": "/etc/os-net-config/config.yaml", "get_attributes": false, "get_checksum": false, "get_mime": false}, "register": "stat_config_yaml"}, {"name": "Slurp the os-net-config config.json", "slurp": {"src": "/etc/os-net-config/config.json"}, "register": "os_config_json", "when": ["stat_config_json.stat.exists", "not stat_config_yaml.stat.exists"]}, {"name": "Write updated /etc/os-net-config/config.yaml", "copy": {"content": "{{ os_config_json.content | b64decode | from_json | to_yaml }}", "dest": "/etc/os-net-config/config.yaml"}, "when": ["stat_config_json.stat.exists", "not stat_config_yaml.stat.exists"]}, {"name": "Remove legacy os-net-config configuration", "command": "mv /etc/os-net-config/config.json /etc/os-net-config/deprecated_config.json", "when": ["stat_config_json.stat.exists"]}, {"block": [{"name": "Upgrade os-net-config", "package": "name=os-net-config state=latest"}, {"name": "take new os-net-config parameters into account now", "command": "os-net-config --no-activate -c /etc/os-net-config/config.yaml -v --detailed-exit-codes", "register": "os_net_config_upgrade", "failed_when": "os_net_config_upgrade.rc not in [0,2]", "changed_when": "os_net_config_upgrade.rc == 2"}], "when": ["os_net_config_need_upgrade.stdout", "stat_config_yaml.stat.exists or stat_config_json.stat.exists"]}, {"name": "Update all packages", "when": ["not skip_package_update|bool"], "yum": {"name": "*", "state": "latest", "exclude": "ansible-core"}, "vars": {"skip_package_update": false}}, {"name": "Always ensure the openvswitch service is enabled and running after upgrades rhbz#2329821", "service": {"name": "openvswitch", "enabled": true, "state": "started"}}]}]}


created_at: 2025-10-10 07:31:48.763721
data:
  {"value": [{"service": "HTTP", "network": "ctlplane", "type": "node"}, {"service": "HTTP", "network": "storage", "type": "node"}, {"service": "HTTP", "network": "storage_mgmt", "type": "node"}, {"service": "HTTP", "network": "internal_api", "type": "node"}, {"service": "HTTP", "network": "external", "type": "node"}, {"service": "haproxy", "network": "external", "type": "vip"}, {"service": "haproxy", "network": "ctlplane", "type": "vip"}, {"service": "haproxy", "network": "ctlplane", "type": "node"}, {"service": "haproxy", "network": "storage", "type": "vip"}, {"service": "haproxy", "network": "storage", "type": "node"}, {"service": "haproxy", "network": "storage_mgmt", "type": "vip"}, {"service": "haproxy", "network": "storage_mgmt", "type": "node"}, {"service": "haproxy", "network": "internal_api", "type": "vip"}, {"service": "haproxy", "network": "internal_api", "type": "node"}, {"service": "memcached", "network": "internal_api", "type": "node"}, {"service": "mysql", "network": "internal_api", "type": "vip"}, {"service": "mysql", "network": "internal_api", "type": "node"}, {"service": "neutron_ovn", "network": "internal_api", "type": "node"}, {"service": "neutron", "network": "internal_api", "type": "node"}, {"service": "libvirt", "network": "internal_api", "type": "node"}, {"service": "qemu", "network": "internal_api", "type": "node"}, {"service": "libvirt-vnc", "network": "internal_api", "type": "node"}, {"service": "novnc-proxy", "network": "internal_api", "type": "node"}, {"service": "ovn_controller", "network": "internal_api", "type": "node"}, {"service": "ovn_dbs", "network": "internal_api", "type": "node"}, {"service": "ovn_metadata", "network": "internal_api", "type": "node"}, {"service": "rabbitmq", "network": "internal_api", "type": "node"}]}


created_at: 2025-10-10 07:31:49.038723
data:
  {"value": {"compact_service_HTTP": ["ctlplane", "storage", "storagemgmt", "internalapi", "external"], "compact_service_haproxy": ["ctlplane", "storage", "storagemgmt", "internalapi"], "compact_service_memcached": ["internalapi"], "compact_service_mysql": ["internalapi"], "compact_service_neutron_ovn": ["internalapi"], "compact_service_neutron": ["internalapi"], "compact_service_libvirt": ["internalapi"], "compact_service_qemu": ["internalapi"], "compact_service_libvirt-vnc": ["internalapi"], "compact_service_novnc-proxy": ["internalapi"], "compact_service_ovn_controller": ["internalapi"], "compact_service_ovn_dbs": ["internalapi"], "compact_service_ovn_metadata": ["internalapi"], "compact_service_rabbitmq": ["internalapi"]}}


created_at: 2025-10-10 07:31:49.068481
data:
  {"value": {"managed_service_haproxyexternal": "haproxy/standalone.ooo.test", "managed_service_haproxyctlplane": "haproxy/overcloud.ctlplane.ooo.test", "managed_service_haproxystorage": "haproxy/overcloud.storage.ooo.test", "managed_service_haproxystorage_mgmt": "haproxy/overcloud.storagemgmt.ooo.test", "managed_service_haproxyinternal_api": "haproxy/overcloud.internalapi.ooo.test", "managed_service_mysqlinternal_api": "mysql/overcloud.internalapi.ooo.test"}}


created_at: 2025-10-10 07:31:50.719476
data:
  {"value": [{"name": "upgrade prepare for leapp to align kernel arg shortcommings in leapp", "tags": ["never", "system_upgrade", "system_upgrade_prepare"], "when": ["step|int == 3", "upgrade_leapp_enabled"], "block": [{"name": "fix grub entries to have name start with GRUB_", "replace": {"path": "/etc/default/grub", "regexp": "^(TRIPLEO_HEAT_TEMPLATE_KERNEL_ARGS)(.*)", "replace": "GRUB_\\1\\2"}}, {"name": "fix grub entries in append statement", "replace": {"path": "/etc/default/grub", "regexp": "(.*){(TRIPLEO_HEAT_TEMPLATE_KERNEL_ARGS)}(.*)", "replace": "\\1{GRUB_\\2}\\3"}}]}, {"name": "Tear-down non-HA cinder_backup container", "when": ["step|int == 0"], "block": [{"name": "Remove non-HA cinder-backup container", "include_role": {"name": "tripleo_container_rm"}, "vars": {"tripleo_container_cli": "{{ container_cli }}", "tripleo_containers_to_rm": ["cinder_backup"]}}]}, {"name": "Prepare switch of cinder_backup image name", "when": ["step|int == 0"], "block": [{"name": "Get cinder_backup image id currently used by pacemaker", "shell": "pcs resource config openstack-cinder-backup | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'", "register": "cinder_backup_image_current_res", "failed_when": false}, {"name": "cinder_backup image facts", "set_fact": {"cinder_backup_image_latest": "cluster.common.tag/cinder-backup:pcmklatest", "cinder_backup_image_current": "{{cinder_backup_image_current_res.stdout}}"}}, {"name": "Temporarily tag the current cinder_backup image id with the upgraded image name", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{cinder_backup_image_current}}", "container_image_latest": "{{cinder_backup_image_latest}}", "pull_image": false}, "when": ["cinder_backup_image_current != ''", "cinder_backup_image_current != cinder_backup_image_latest"]}, {"name": "Create cinder_backup retag statefile", "file": {"path": "/var/lib/tripleo/cinder_backup_needs_retag", "state": "touch"}, "when": ["cinder_backup_image_current != ''", "cinder_backup_image_current != cinder_backup_image_latest"]}]}, {"name": "Update cinder_backup pcs resource bundle for new container image - check", "when": ["step|int == 1"], "block": [{"name": "set is_cinder_backup_bootstrap_node fact", "tags": "common", "set_fact": "is_cinder_backup_bootstrap_node={{cinder_backup_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}"}, {"name": "Check for cinder_backup retag statefile", "stat": {"path": "/var/lib/tripleo/cinder_backup_needs_retag"}, "register": "cinder_backup_retag_state_file"}]}, {"name": "Update cinder_backup pcs resource bundle for new container image", "when": ["step|int == 1", "is_cinder_backup_bootstrap_node", "cinder_backup_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the cinder_backup cluster resource before container upgrade step1", "pacemaker_resource": {"resource": "openstack-cinder-backup", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Update the cinder_backup bundle to use the new container image name", "command": "pcs resource bundle update openstack-cinder-backup container image={{cinder_backup_image_latest}}"}, {"name": "Enable the cinder_backup cluster resource", "pacemaker_resource": {"resource": "openstack-cinder-backup", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}]}, {"name": "Check for cinder_backup retag statefile", "when": ["step|int == 3"], "stat": {"path": "/var/lib/tripleo/cinder_backup_needs_retag"}, "register": "cinder_backup_retag_state_file"}, {"name": "Retag the pacemaker image for cinder_backup", "when": ["step|int == 3", "cinder_backup_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the cinder_backup cluster resource before container upgrade step3", "pacemaker_resource": {"resource": "openstack-cinder-backup", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Retag the pacemaker image if containerized", "block": [{"block": [{"name": "Get cinder_backup image from pacemaker", "become": true, "register": "xmllint_pcmk_cinder_backup_image", "shell": "xmllint --xpath \"string(//bundle[@id='openstack-cinder-backup']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container cinder_backup image", "set_fact": {"cinder_backup_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-backup:17.1", "cinder_backup_image_latest": "cluster.common.tag/cinder-backup:pcmklatest", "pcmk_cinder_backup_image": "{{xmllint_pcmk_cinder_backup_image.stdout}}"}}]}, {"block": [{"name": "Retag pcmklatest to latest cinder_backup image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{cinder_backup_image}}", "container_image_latest": "{{cinder_backup_image_latest}}"}}]}]}, {"name": "Enable the cinder_backup cluster resource", "pacemaker_resource": {"resource": "openstack-cinder-backup", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Remove cinder_backup retag statefile", "file": {"path": "/var/lib/tripleo/cinder_backup_needs_retag", "state": "absent"}}]}, {"name": "Tear-down non-HA cinder_volume container", "when": ["step|int == 0"], "block": [{"name": "Remove non-HA cinder_volume container", "include_role": {"name": "tripleo_container_rm"}, "vars": {"tripleo_container_cli": "{{ container_cli }}", "tripleo_containers_to_rm": ["cinder_volume"]}}]}, {"name": "Prepare switch of cinder_volume image name", "when": ["step|int == 0"], "block": [{"name": "Get cinder_volume image id currently used by pacemaker", "shell": "pcs resource config openstack-cinder-volume | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'", "register": "cinder_volume_image_current_res", "failed_when": false}, {"name": "cinder_volume image facts", "set_fact": {"cinder_volume_image_latest": "cluster.common.tag/cinder-volume:pcmklatest", "cinder_volume_image_current": "{{cinder_volume_image_current_res.stdout}}"}}, {"name": "Temporarily tag the current cinder_volume image id with the upgraded image name", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{cinder_volume_image_current}}", "container_image_latest": "{{cinder_volume_image_latest}}", "pull_image": false}, "when": ["cinder_volume_image_current != ''", "cinder_volume_image_current != cinder_volume_image_latest"]}, {"name": "Create cinder_volume retag statefile", "file": {"path": "/var/lib/tripleo/cinder_volume_needs_retag", "state": "touch"}, "when": ["cinder_volume_image_current != ''", "cinder_volume_image_current != cinder_volume_image_latest"]}]}, {"name": "Update cinder_volume pcs resource bundle for new container image", "when": ["step|int == 1"], "block": [{"name": "set is_cinder_volume_bootstrap_node fact", "tags": "common", "set_fact": "is_cinder_volume_bootstrap_node={{cinder_volume_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}"}, {"name": "Check for cinder_volume retag statefile", "stat": {"path": "/var/lib/tripleo/cinder_volume_needs_retag"}, "register": "cinder_volume_retag_state_file"}]}, {"name": "Update cinder_volume pcs resource bundle for new container image", "when": ["step|int == 1", "is_cinder_volume_bootstrap_node", "cinder_volume_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the cinder_volume cluster resource before container upgrade", "pacemaker_resource": {"resource": "openstack-cinder-volume", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "pcs resource bundle update cinder_volume for new container image name", "command": "pcs resource bundle update openstack-cinder-volume container image={{cinder_volume_image_latest}}"}, {"name": "Enable the cinder_volume cluster resource", "pacemaker_resource": {"resource": "openstack-cinder-volume", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}]}, {"name": "Check for cinder_volume retag statefile", "when": ["step|int == 3"], "stat": {"path": "/var/lib/tripleo/cinder_volume_needs_retag"}, "register": "cinder_volume_retag_state_file"}, {"name": "Retag pacemaker cinder_volume", "when": ["step|int == 3", "cinder_volume_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the cinder_volume cluster resource before container upgrade", "pacemaker_resource": {"resource": "openstack-cinder-volume", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Retag the pacemaker image if containerized", "block": [{"block": [{"name": "Get cinder_volume image from pacemaker", "become": true, "register": "xmllint_pcmk_cinder_volume_image", "shell": "xmllint --xpath \"string(//bundle[@id='openstack-cinder-volume']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container cinder_volume image", "set_fact": {"cinder_volume_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-volume:17.1", "cinder_volume_image_latest": "cluster.common.tag/cinder-volume:pcmklatest", "pcmk_cinder_volume_image": "{{xmllint_pcmk_cinder_volume_image.stdout}}"}}]}, {"block": [{"name": "Retag pcmklatest to latest cinder_volume image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{cinder_volume_image}}", "container_image_latest": "{{cinder_volume_image_latest}}"}}]}]}, {"name": "Enable the cinder_volume cluster resource", "pacemaker_resource": {"resource": "openstack-cinder-volume", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Remove cinder_volume retag statefile", "file": {"path": "/var/lib/tripleo/cinder_volume_needs_retag", "state": "absent"}}]}, {"name": "cinder-volume pre system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 3", "upgrade_leapp_enabled"], "block": [{"name": "Unmount cinder's image conversion NFS share", "vars": {"image_conversion_nfs_share": "", "image_conversion_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0", "image_conversion_nfs_enabled": false}, "when": "image_conversion_nfs_enabled|bool", "mount": {"path": "/var/lib/cinder_image_conversion", "state": "absent", "fstype": "nfs4"}}]}, {"name": "cinder-volume post system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 5", "upgrade_leapp_enabled"], "block": [{"name": "Support using an NFS share for cinder image conversion", "vars": {"image_conversion_nfs_enabled": false}, "when": ["image_conversion_nfs_enabled|bool"], "block": [{"name": "Create cinder image conversion directory", "file": {"path": "/var/lib/cinder_image_conversion", "state": "directory"}}, {"name": "Mount cinder's image conversion NFS share", "vars": {"image_conversion_nfs_share": "", "image_conversion_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"path": "/var/lib/cinder_image_conversion", "state": "mounted", "fstype": "nfs4", "src": "{{ image_conversion_nfs_share }}", "opts": "{{ image_conversion_nfs_options }}"}}]}]}, {"name": "Ensure old cron.daily is absent", "when": "step|int == 1", "file": {"path": "/etc/cron.daily/containers-tmpwatch", "state": "absent"}}, {"name": "Uninstall docker-distribution", "when": "step|int == 3", "block": [{"name": "check if docker-distribution is installed", "command": "/usr/bin/rpm -q docker-distribution", "failed_when": false, "register": "docker_distribution_installed", "check_mode": false}, {"name": "Stop, disable docker-distribution", "systemd": {"enabled": false, "state": "stopped", "name": "docker-distribution"}, "when": "docker_distribution_installed.rc == 0"}, {"name": "Uninstall docker-distribution", "package": "name=docker-distribution state=absent", "when": "docker_distribution_installed.rc == 0"}]}, {"name": "glance-api pre system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 3", "upgrade_leapp_enabled"], "block": [{"name": "Unmount and remove NFS glance entry", "vars": {"nfs_backend_enabled": false, "glance_netapp_nfs_enabled": false}, "mount": {"name": "/var/lib/glance/images", "fstype": "nfs", "state": "absent"}, "when": "nfs_backend_enabled or glance_netapp_nfs_enabled"}, {"name": "Unmount and remove NFS glance-staging entry", "vars": {"glance_node_staging_uri": "file:///var/lib/glance/staging", "glance_staging_nfs_share": ""}, "mount": {"name": "{{glance_node_staging_uri[7:]}}", "fstype": "nfs", "state": "absent"}, "when": "glance_staging_nfs_share != ''"}]}, {"name": "glance-api post system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 5", "upgrade_leapp_enabled"], "block": [{"name": "Mount NFS on host", "vars": {"nfs_backend_enabled": false, "glance_netapp_nfs_enabled": false, "glance_nfs_share": "", "netapp_share_location": "", "nfs_share": "{{ glance_nfs_share if (glance_nfs_share) else netapp_share_location }}", "nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"name": "/var/lib/glance/images", "state": "mounted", "fstype": "nfs", "src": "{{nfs_share}}", "opts": "{{nfs_options}}"}, "when": "nfs_backend_enabled or glance_netapp_nfs_enabled"}, {"name": "Mount Node Staging Location", "vars": {"glance_node_staging_uri": "file:///var/lib/glance/staging", "glance_staging_nfs_share": "", "glance_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"name": "{{glance_node_staging_uri[7:]}}", "state": "mounted", "fstype": "nfs", "src": "{{glance_staging_nfs_share}}", "opts": "{{glance_nfs_options}}"}, "when": "glance_staging_nfs_share != ''"}]}, {"name": "Tear-down non-HA haproxy container", "when": ["step|int == 0"], "block": [{"name": "Remove non-HA haproxy container", "include_role": {"name": "tripleo_container_rm"}, "vars": {"tripleo_container_cli": "{{ container_cli }}", "tripleo_containers_to_rm": ["haproxy"]}}]}, {"name": "Prepare switch of haproxy image name", "when": ["step|int == 0"], "block": [{"name": "Get haproxy image id currently used by pacemaker", "shell": "pcs resource config haproxy-bundle | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'", "register": "haproxy_image_current_res", "failed_when": false}, {"name": "Image facts for haproxy", "set_fact": {"haproxy_image_latest": "cluster.common.tag/haproxy:pcmklatest", "haproxy_image_current": "{{haproxy_image_current_res.stdout}}"}}, {"name": "Temporarily tag the current haproxy image id with the upgraded image name", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{haproxy_image_current}}", "container_image_latest": "{{haproxy_image_latest}}", "pull_image": false}, "when": ["haproxy_image_current != ''", "haproxy_image_current != haproxy_image_latest"]}, {"name": "Create haproxy retag statefile", "file": {"path": "/var/lib/tripleo/haproxy_needs_retag", "state": "touch"}, "when": ["haproxy_image_current != ''", "haproxy_image_current != haproxy_image_latest"]}]}, {"name": "Update haproxy pcs resource bundle for new container image", "when": ["step|int == 1"], "block": [{"name": "Set upgrade haproxy facts", "set_fact": {"is_haproxy_bootstrap_node": "{{haproxy_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}"}}, {"name": "Check for haproxy retag statefile", "stat": {"path": "/var/lib/tripleo/haproxy_needs_retag"}, "register": "haproxy_retag_state_file"}]}, {"name": "Update haproxy pcs resource bundle for new container image", "when": ["step|int == 1", "is_haproxy_bootstrap_node|bool", "haproxy_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the haproxy cluster resource before container upgrade", "pacemaker_resource": {"resource": "haproxy-bundle", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Expose HAProxy stats socket on the host and mount TLS cert if needed", "block": [{"name": "Check haproxy stats socket configuration in pacemaker", "command": "cibadmin --query --xpath \"//storage-mapping[@id='haproxy-var-lib']\"", "failed_when": false, "register": "haproxy_stats_exposed"}, {"name": "Check haproxy public certificate configuration in pacemaker", "command": "cibadmin --query --xpath \"//storage-mapping[@id='haproxy-cert']\"", "failed_when": false, "register": "haproxy_cert_mounted"}, {"name": "Add a bind mount for stats socket in the haproxy bundle", "command": "pcs resource bundle update haproxy-bundle storage-map add id=haproxy-var-lib source-dir=/var/lib/haproxy target-dir=/var/lib/haproxy options=rw", "when": "haproxy_stats_exposed.rc == 6"}, {"name": "Set HAProxy public cert volume mount fact", "set_fact": {"haproxy_public_cert_path": "/etc/pki/tls/private/overcloud_endpoint.pem", "haproxy_public_tls_enabled": true}}, {"name": "Add a bind mount for public certificate in the haproxy bundle", "command": "pcs resource bundle update haproxy-bundle storage-map add id=haproxy-cert source-dir={{ haproxy_public_cert_path }} target-dir=/var/lib/kolla/config_files/src-tls/{{ haproxy_public_cert_path }} options=ro", "when": ["haproxy_cert_mounted.rc == 6", "haproxy_public_tls_enabled|bool"]}]}, {"name": "Update the haproxy bundle to use the new container image name", "command": "pcs resource bundle update haproxy-bundle container image={{haproxy_image_latest}}"}, {"name": "Enable the haproxy cluster resource", "pacemaker_resource": {"resource": "haproxy-bundle", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Remove haproxy retag statefile", "file": {"path": "/var/lib/tripleo/haproxy_needs_retag", "state": "absent"}}]}, {"name": "Retag the pacemaker image if containerized", "when": ["step|int == 3"], "block": [{"block": [{"name": "Get haproxy image from pacemaker", "become": true, "register": "xmllint_pcmk_haproxy_image", "shell": "xmllint --xpath \"string(//bundle[@id='haproxy-bundle']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container haproxy image", "set_fact": {"haproxy_image": "registry.redhat.io/rhosp-rhel9/openstack-haproxy:17.1", "haproxy_image_latest": "cluster.common.tag/haproxy:pcmklatest", "pcmk_haproxy_image": "{{xmllint_pcmk_haproxy_image.stdout}}"}}]}, {"block": [{"name": "Retag pcmklatest to latest haproxy image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{haproxy_image}}", "container_image_latest": "{{haproxy_image_latest}}"}}]}, {"name": "Ensure config works for the new config", "shell": "set -o pipefail\nawk -i inplace -v INPLACE_SUFFIX=.bak '/  rsprep/ {print \"  http-response replace-header Location \" $3\" \"$5; next;}; {print} ' /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg"}]}, {"name": "Anchor for upgrade and update tasks", "when": "step|int == 0", "block": [{"name": "Reset selinux label on /var/tmp", "file": {"path": "/var/tmp", "state": "directory", "setype": "tmp_t", "mode": 1023}}]}, {"name": "Prepare switch of manila_share image name", "when": ["step|int == 0"], "block": [{"name": "Get manila_share image id currently used by pacemaker", "shell": "pcs resource config openstack-manila-share | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'", "register": "manila_share_image_current_res", "failed_when": false}, {"name": "manila_share image facts", "set_fact": {"manila_share_image_latest": "cluster.common.tag/manila-share:pcmklatest", "manila_share_image_current": "{{manila_share_image_current_res.stdout}}"}}, {"name": "Temporarily tag the current manila_share image id with the upgraded image name", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{manila_share_image_current}}", "container_image_latest": "{{manila_share_image_latest}}", "pull_image": false}, "when": ["manila_share_image_current != ''", "manila_share_image_current != manila_share_image_latest"]}, {"name": "Create manila_share retag statefile", "file": {"path": "/var/lib/tripleo/manila_share_needs_retag", "state": "touch"}, "when": ["manila_share_image_current != ''", "manila_share_image_current != manila_share_image_latest"]}]}, {"name": "Update openstack-manila-share pcs resource bundle for new container image", "when": ["step|int == 1"], "block": [{"name": "set is_manila_share_bootstrap_node fact", "tags": "common", "set_fact": "is_manila_share_bootstrap_node={{manila_share_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}"}, {"name": "Check for manila_share retag statefile", "stat": {"path": "/var/lib/tripleo/manila_share_needs_retag"}, "register": "manila_share_retag_state_file"}]}, {"name": "Update openstack-manila-share pcs resource bundle for new container image", "when": ["step|int == 1", "is_manila_share_bootstrap_node", "manila_share_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the manila_share cluster resource before container upgrade", "pacemaker_resource": {"resource": "openstack-manila-share", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "pcs resource bundle update manila_share for new container image name", "command": "pcs resource bundle update openstack-manila-share container image={{manila_share_image_latest}}"}, {"name": "Enable the manila_share cluster resource", "pacemaker_resource": {"resource": "openstack-manila-share", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}]}, {"name": "Check for manila_share retag statefile", "when": ["step|int == 3"], "stat": {"path": "/var/lib/tripleo/manila_share_needs_retag"}, "register": "manila_share_retag_state_file"}, {"name": "Retag openstack-manila-share container image", "when": ["step|int == 3"], "block": [{"name": "Disable the manila_share cluster resource before container upgrade", "pacemaker_resource": {"resource": "openstack-manila-share", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Retag the pacemaker image if containerized", "block": [{"block": [{"name": "Get manila_share image from pacemaker", "become": true, "register": "xmllint_pcmk_manila_share_image", "shell": "xmllint --xpath \"string(//bundle[@id='openstack-manila-share']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container manila_share image", "set_fact": {"manila_share_image": "registry.redhat.io/rhosp-rhel9/openstack-manila-share:17.1", "manila_share_image_latest": "cluster.common.tag/manila-share:pcmklatest", "pcmk_manila_share_image": "{{xmllint_pcmk_manila_share_image.stdout}}"}}]}, {"block": [{"name": "Retag pcmklatest to latest manila_share image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{manila_share_image}}", "container_image_latest": "{{manila_share_image_latest}}"}}]}]}, {"name": "Enable the manila_share cluster resource", "pacemaker_resource": {"resource": "openstack-manila-share", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Remove manila_share retag statefile", "file": {"path": "/var/lib/tripleo/manila_share_needs_retag", "state": "absent"}}]}, {"name": "Tear-down non-HA mysql container", "when": ["step|int == 0"], "block": [{"name": "stat mysql container", "command": "podman container exists mysql", "failed_when": false, "changed_when": false, "register": "stat_mysql_container"}, {"name": "Create clustercheck user and permissions", "command": {"argv": "{{ mysql_exec_data | container_exec_cmd }}"}, "changed_when": true, "when": ["stat_mysql_container.rc == 0"], "vars": {"mysql_exec_data": {"environment": {"CLUSTERCHECK_PASSWORD": "Zw0aiGnnc8uyvmHM4YShomHk2"}, "command": ["mysql", "/bin/sh", "-c", "mysql -e \"CREATE USER IF NOT EXISTS 'clustercheck'@'localhost' IDENTIFIED BY '${CLUSTERCHECK_PASSWORD}'; GRANT PROCESS ON *.* TO 'clustercheck'@'localhost' WITH GRANT OPTION;\""]}}}, {"name": "Remove non-HA mysql container", "include_role": {"name": "tripleo_container_rm"}, "vars": {"tripleo_container_cli": "{{ container_cli }}", "tripleo_containers_to_rm": ["mysql"]}}]}, {"name": "set mysql container name fact", "when": ["step|int == 1"], "set_fact": {"mysql_container_name": "galera-bundle"}}, {"name": "Drop unused OpenStack DB users", "when": ["step|int == 1", "mysql_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower"], "block": [{"name": "mysql container id", "command": "podman ps -q --filter name={{ mysql_container_name }} --filter status=running", "register": "mysql_container_id"}, {"name": "set mysql container id fact", "set_fact": {"mysql_container": "{{ mysql_container_id.stdout }}"}}, {"name": "Mysql script to drop unused DB users", "when": "( mysql_container | length ) > 0", "block": [{"name": "Get the list of all OpenStack DB users", "shell": "jq -r 'to_entries[] | select(.key|endswith(\"::db::mysql::user\")) | .value' /etc/puppet/hieradata/service_configs.json", "register": "openstack_db_users"}, {"name": "List all DB users that match the DB users to be dropped", "shell": "for u in {{ openstack_db_users.stdout_lines | join(' ') }}; do podman exec -u root -it \"{{ mysql_container }}\" mysql -sNe \"select concat('\\`',user,'\\`@\\`',host,'\\`') from mysql.user where user = '$u' and host != '%';\"; done", "register": "mysql_db_users"}, {"name": "resulting DB users to be dropped", "debug": {"msg": "{{ mysql_db_users.stdout_lines }}"}}, {"name": "Drop all unneeded Openstack DB users", "shell": "podman exec -u root -it \"{{ mysql_container }}\" mysql -sNe 'drop user {{ item }};'", "loop": "{{ mysql_db_users.stdout_lines }}"}]}]}, {"vars": {"mysql_upgrade_persist": false}, "when": ["step|int == 3", "mysql_upgrade_persist"], "tags": ["never", "system_upgrade", "system_upgrade_prepare"], "block": [{"name": "Persist mysql data", "include_role": {"name": "tripleo_persist", "tasks_from": "persist.yml"}, "vars": {"tripleo_persist_dir": "/var/lib/mysql"}}]}, {"vars": {"mysql_upgrade_persist": false}, "when": ["step|int == 5", "mysql_upgrade_persist"], "tags": ["never", "system_upgrade", "system_upgrade_run"], "block": [{"name": "Restore mysql data", "include_role": {"name": "tripleo_persist", "tasks_from": "restore.yml"}, "vars": {"tripleo_persist_dir": "/var/lib/mysql"}}]}, {"name": "Prepare switch of galera image name", "when": ["step|int == 0"], "block": [{"name": "Get galera image id currently used by pacemaker", "shell": "pcs resource config galera-bundle | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'", "register": "galera_image_current_res", "failed_when": false}, {"name": "Image facts for galera", "set_fact": {"galera_image_latest": "cluster.common.tag/mariadb:pcmklatest", "galera_image_current": "{{galera_image_current_res.stdout}}"}}, {"name": "Temporarily tag the current galera image id with the upgraded image name", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{galera_image_current}}", "container_image_latest": "{{galera_image_latest}}", "pull_image": false}, "when": ["galera_image_current != ''", "galera_image_current != galera_image_latest"]}, {"name": "Create galera retag statefile", "file": {"path": "/var/lib/tripleo/galera_needs_retag", "state": "touch"}, "when": ["galera_image_current != ''", "galera_image_current != galera_image_latest"]}]}, {"name": "Update galera pcs resource bundle for new container image - check", "when": ["step|int == 1"], "block": [{"name": "set is_mysql_bootstrap_node fact", "tags": "common", "set_fact": "is_mysql_bootstrap_node={{mysql_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}"}, {"name": "Check for galera retag statefile", "stat": {"path": "/var/lib/tripleo/galera_needs_retag"}, "register": "galera_retag_state_file"}]}, {"name": "Update galera pcs resource bundle for new container image", "when": ["step|int == 1", "is_mysql_bootstrap_node|bool", "galera_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the galera cluster resource before container upgrade", "pacemaker_resource": {"resource": "galera-bundle", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Move Mysql logging to /var/log/containers", "block": [{"name": "Check Mysql logging configuration in pacemaker", "command": "cibadmin --query --xpath \"//storage-mapping[@id='mysql-log']\"", "failed_when": false, "register": "mysql_logs_moved"}, {"name": "Change Mysql logging configuration in pacemaker", "when": "mysql_logs_moved.rc == 6", "block": [{"name": "Add a bind mount for logging in the galera bundle", "command": "pcs resource bundle update galera-bundle storage-map add id=mysql-log source-dir=/var/log/containers/mysql target-dir=/var/log/mysql options=rw"}, {"name": "Reconfigure Mysql log file in the galera resource agent", "command": "pcs resource update galera log=/var/log/mysql/mysqld.log"}]}]}, {"name": "Update the galera bundle to use the new container image name", "command": "pcs resource bundle update galera-bundle container image={{galera_image_latest}}"}, {"name": "Enable the galera cluster resource", "pacemaker_resource": {"resource": "galera-bundle", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}]}, {"name": "Upgrade galera in step3", "when": ["step|int == 3"], "block": [{"name": "Bind mounts for temporary container", "set_fact": {"mysql_upgrade_db_bind_mounts": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/mysql.json:/var/lib/kolla/config_files/config.json:rw,z", "/var/lib/config-data/puppet-generated/mysql:/var/lib/kolla/config_files/src:ro,z", "/var/lib/mysql:/var/lib/mysql:rw,z", "/var/log/containers/mysql:/var/log/mysql:rw,z", "/etc/pki/tls/certs/mysql.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/mysql.crt:ro", "/etc/pki/tls/private/mysql.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/mysql.key:ro"]}}, {"name": "Check if Galera needs upgrade", "shell": "{{ container_cli }} run --rm --log-driver=k8s-file --log-opt path=/var/log/containers/mysql/db-upgrade.log \\ -u root --net=host -e \"KOLLA_CONFIG_STRATEGY=COPY_ALWAYS\" -v {{ mysql_upgrade_db_bind_mounts | join(' -v ')}} \"cluster.common.tag/mariadb:pcmklatest\" /bin/bash -ecx \"$UPGRADE_SCRIPT\"", "environment": {"UPGRADE_SCRIPT": "kolla_set_configs\nupgraded_ver=$(cat /var/lib/mysql/mysql_upgrade_info 2>/dev/null || true)\nmysql_ver=$(mysql --version | awk -F'[ ,]*' '{print $5}')\nif [ \"${upgraded_ver}\" = \"${mysql_ver}\" ]; then\n    echo \"mysql already upgraded\"\nelse\n    echo \"${upgraded_ver} VS ${mysql_ver}\"\nfi\n"}, "register": "mysql_upgrade_needed"}, {"name": "Set fact upgrade_mysql", "set_fact": {"upgrade_mysql": "{{ (mysql_upgrade_needed.stdout != \"mysql already upgraded\") | bool }}"}}, {"debug": {"msg": "MYSQL check - {{ mysql_upgrade_needed.stdout }} - Upgrade needed: {{ upgrade_mysql }}"}}, {"name": "Disable the galera cluster resource before container upgrade", "when": ["upgrade_mysql|bool"], "pacemaker_resource": {"resource": "galera-bundle", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"block": [{"name": "Get galera image from pacemaker", "become": true, "register": "xmllint_pcmk_galera_image", "shell": "xmllint --xpath \"string(//bundle[@id='galera-bundle']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container galera image", "set_fact": {"galera_image": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1", "galera_image_latest": "cluster.common.tag/mariadb:pcmklatest", "pcmk_galera_image": "{{xmllint_pcmk_galera_image.stdout}}"}}]}, {"name": "Check for galera retag statefile", "stat": {"path": "/var/lib/tripleo/galera_needs_retag"}, "register": "galera_retag_state_file"}, {"name": "Retag the pacemaker image if containerized", "when": ["galera_retag_state_file.stat.exists|bool"], "block": [{"name": "Retag pcmklatest to latest galera image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{galera_image}}", "container_image_latest": "{{galera_image_latest}}"}}]}, {"name": "Remove galera retag statefile", "file": {"path": "/var/lib/tripleo/galera_needs_retag", "state": "absent"}}, {"name": "Mysql upgrade script", "when": ["upgrade_mysql|bool"], "set_fact": {"mysql_upgrade_script": "kolla_set_configs\nif mysqladmin ping --silent; then exit 0; fi\nupgraded_ver=$(cat /var/lib/mysql/mysql_upgrade_info 2>/dev/null || true)\nmysql_ver=$(mysql --version | awk -F'[ ,]*' '{print $5}')\nif [ \"${upgraded_ver}\" = \"${mysql_ver}\" ]; then\n    echo \"mysql already upgraded\"\n    exit 0\nfi\nchown -R mysql:mysql /var/lib/mysql\nchown -R mysql:mysql /var/log/mysql\nmysqld_safe --user=mysql --wsrep-provider=none --skip-networking --wsrep-on=off --log-error=/var/log/mysql/mysqld-upgrade.log &\n\n#!/usr/bin/bash\n\nset -e\n\n# Wait until we know the mysql server is up and responding\ntimeout ${DB_MAX_TIMEOUT:-60} /bin/bash -c 'until mysqladmin -uroot ping 2>/dev/null; do sleep 1; done'\n\n# After an upgrade, make sure that the running mysql had a chance to\n# update its data table on disk.\nmysql_upgrade\n\n# Upgrade to 10.3: the default table row format changed from COMPACT\n# to DYNAMIC, so upgrade the existing tables.\ncompact_tables=$(mysql -se 'SELECT CONCAT(\"`\",TABLE_SCHEMA,\"`.`\",TABLE_NAME,\"`\") FROM information_schema.tables WHERE ENGINE = \"InnoDB\" and ROW_FORMAT = \"Compact\";');\nfor i in $compact_tables; do echo converting row format of table $i; mysql -e \"ALTER TABLE $i ROW_FORMAT=DYNAMIC;\"; done;\n\nmysqladmin shutdown"}}, {"name": "Upgrade Mysql database from a temporary container", "when": ["upgrade_mysql|bool"], "shell": "{{ container_cli }} run --rm --log-driver=k8s-file --log-opt path=/var/log/containers/mysql/db-upgrade.log \\ -u root --net=host -e \"KOLLA_CONFIG_STRATEGY=COPY_ALWAYS\" -v {{ mysql_upgrade_db_bind_mounts | join(' -v ')}} \"cluster.common.tag/mariadb:pcmklatest\" /bin/bash -ecx \"$UPGRADE_SCRIPT\"", "environment": {"UPGRADE_SCRIPT": "{{ mysql_upgrade_script }}"}}, {"name": "Enable the galera cluster resource", "when": ["upgrade_mysql|bool"], "pacemaker_resource": {"resource": "galera-bundle", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}]}, {"name": "Remove openstack-nova-compute and python-nova package during upgrade", "package": {"name": ["openstack-nova-compute", "python-nova"], "state": "removed"}, "failed_when": false, "when": "step|int == 2"}, {"name": "nova_compute pre system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 3", "upgrade_leapp_enabled"], "block": [{"name": "Unmount Nova NFS Share", "vars": {"nfs_backend_enable": false}, "mount": {"name": "/var/lib/nova/instances", "state": "absent", "fstype": "nfs4"}, "when": "nfs_backend_enable|bool"}]}, {"name": "nova_compute post system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 5", "upgrade_leapp_enabled"], "block": [{"name": "Mount Nova NFS Share", "vars": {"nfs_backend_enable": false, "nfs_share": "", "nfs_options": "context=system_u:object_r:nfs_t:s0", "nfs_vers": "4.2"}, "mount": {"name": "/var/lib/nova/instances", "state": "mounted", "fstype": "nfs4", "src": "{{nfs_share}}", "opts": "_netdev,bg,{{nfs_options}},nfsvers={{nfs_vers}}"}, "when": "nfs_backend_enable|bool"}]}, {"name": "Fail if we are on RHEL8 as this is monolithic libvirt deployment", "when": ["step|int == 0", "'system_upgrade' not in ansible_run_tags", "ansible_facts['distribution_major_version'] is version('8', '==')"], "fail": {"msg": "Use of the Modular Libvirt deployment on RHEL8 results in loss of workloads. Use NovaLibvirtLegacy in roles data."}}, {"name": "nova_libvirt_container_tmpfile_cleanup", "when": "step|int == 1", "block": [{"name": "Remove old tmpfiles.d config", "file": {"path": "/etc/tmpfiles.d/var-run-libvirt.conf", "state": "absent"}}]}, {"name": "Get container virtlogd image", "when": "step|int == 1", "tags": "always", "set_fact": {"virtlogd_image": "registry.redhat.io/rhosp-rhel9/openstack-nova-libvirt:17.1"}}, {"name": "Force pull image novalibvirt", "when": ["step|int == 1"], "containers.podman.podman_image": {"name": "{{ virtlogd_image }}", "force": true}}, {"name": "Diff OS release in container image and baremetal", "when": "step|int == 1", "shell": "diff /etc/redhat-release <(podman run {{ virtlogd_image }} cat /etc/redhat-release)\n", "args": {"executable": "/bin/bash"}, "failed_when": false, "register": "libvirt_ubi_diff"}, {"name": "Fail if UBI of the container does not match RHEL of running host", "when": ["'system_upgrade' not in ansible_run_tags", "step|int == 1", "libvirt_ubi_diff.rc == 1"], "fail": {"msg": "The host operating system versus container UBI does not match.\n{{ libvirt_ubi_diff.stdout }}\nMost likely container passed to NovaLibvirt was EL8 one.\nYou have to pass the correct container for container-image-prepare.\nIf you would continue all running workloads would get destroyed.\n"}}, {"name": "Switch virtlogd image before system upgrade", "when": "step|int == 1", "tags": ["never", "system_upgrade"], "block": [{"name": "Get running image version", "shell": "podman ps --filter name=^nova_virtlogd$ --format \"{% raw %}{{ .Image }}{% endraw %}\"\n", "register": "old_virtlogd_image"}, {"name": "Switch running image to new image in wrapper script", "shell": "set -o pipefail\nsed -i -e 's|{{ old_virtlogd_image.stdout }}|{{ virtlogd_image }}|' /var/lib/container-config-scripts/virtlogd_wrapper\n", "when": ["old_virtlogd_image.stdout != virtlogd_image", "old_virtlogd_image.stdout != ''"]}]}, {"name": "nova_migration_target_tmpfile_cleanup", "when": "step|int == 1", "block": [{"name": "Remove old tmpfiles.d config", "file": {"path": "/etc/tmpfiles.d/var-run-libvirt.conf", "state": "absent"}}]}, {"name": "Fetch running ovn_controller image", "shell": "set -e\npodman inspect --format \"{{'{{'}}.ImageName{{'}}'}}\" ovn_controller\n", "register": "running_ovn_image", "when": ["step|int == 4"], "tags": ["ovn", "ovn_image"]}, {"name": "Run ovn_controller upgrade", "tags": ["ovn", "ovn_image"], "vars": {"ovn_controller_image": "registry.redhat.io/rhosp-rhel9/openstack-ovn-controller:17.1"}, "when": ["step|int == 4", "running_ovn_image.stdout != ovn_controller_image"], "block": [{"name": "Force pull image in case image name doesn't change.", "when": "step|int == 4", "tags": ["ovn", "ovn_image"], "containers.podman.podman_image": {"name": "registry.redhat.io/rhosp-rhel9/openstack-ovn-controller:17.1", "validate_certs": false, "force": true}}, {"name": "Update OVN OVS related parameters before update.", "when": ["step|int == 4"], "tags": ["ovn"], "vars": {"timeout": 8000}, "shell": "set -e\novs-vsctl set Open_vSwitch . external_ids:ovn-ofctrl-wait-before-clear={{ timeout }}\novs-vsctl set Open_vSwitch . external_ids:ovn-monitor-all=true\novs-vsctl set Open_vSwitch . external_ids:ovn-match-northd-version=false\n"}, {"name": "Find ovn_controller configs in container-startup-configs", "find": {"paths": "/var/lib/tripleo-config/container-startup-config/", "patterns": "*ovn_controller.json", "recurse": true}, "register": "ovn_cont_17_0", "when": ["step|int == 4"], "tags": ["ovn"]}, {"name": "get directory path from the ovn_cont_17_0", "set_fact": {"ovn_config_path": "{{ ovn_cont_17_0.files.0.path | dirname }}"}, "when": "step|int == 4", "tags": "ovn"}, {"name": "Get PIDfile used by systemd on each ovn node", "when": ["step|int == 4"], "tags": ["ovn"], "shell": "set -e\ngrep PID /etc/systemd/system/tripleo_ovn_controller.service | cut -d= -f2\n", "register": "pidfile"}, {"name": "Update ovn_controller.", "vars": {"config_step": "{{ ('step_4' in ovn_config_path) | ternary('4', '3')}}"}, "when": "step|int == 4", "tags": "ovn", "tripleo_container_manage": {"config_dir": "{{ ovn_config_path }}", "config_patterns": "*ovn_controller.json", "config_id": ["tripleo_step{{config_step}}"], "log_base_path": "{{ container_log_stdout_path }}", "debug": "{{ enable_debug | bool }}", "config_overrides": {".*ovn_controller": {"image": "registry.redhat.io/rhosp-rhel9/openstack-ovn-controller:17.1", "conmon_pidfile": "{{ pidfile.stdout }}", "name": "ovn_controller"}}}}, {"name": "Pause for 30s to give ovn_controllers time to reconnect to dbs", "when": ["step|int == 4"], "tags": "ovn", "wait_for": {"timeout": 30}}]}, {"name": "Tear-down non-HA rabbitmq container", "when": ["step|int == 0"], "block": [{"name": "Remove non-HA rabbitmq container", "include_role": {"name": "tripleo_container_rm"}, "vars": {"tripleo_container_cli": "{{ container_cli }}", "tripleo_containers_to_rm": ["rabbitmq"]}}]}, {"name": "Prepare switch of rabbitmq image name", "when": ["step|int == 0"], "block": [{"name": "Get rabbitmq image id currently used by pacemaker", "shell": "pcs resource config rabbitmq-bundle | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'", "register": "rabbitmq_rpc_image_current_res", "failed_when": false}, {"name": "Image facts for rabbitmq", "set_fact": {"rabbitmq_rpc_image_latest": "cluster.common.tag/rabbitmq:pcmklatest", "rabbitmq_rpc_image_current": "{{rabbitmq_rpc_image_current_res.stdout}}"}}, {"name": "Temporarily tag the current rabbitmq image id with the upgraded image name", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{rabbitmq_rpc_image_current}}", "container_image_latest": "{{rabbitmq_rpc_image_latest}}", "pull_image": false}, "when": ["rabbitmq_rpc_image_current != ''", "rabbitmq_rpc_image_current != rabbitmq_rpc_image_latest"]}, {"name": "Create rabbitmq_rpc retag statefile", "file": {"path": "/var/lib/tripleo/rabbitmq_rpc_needs_retag", "state": "touch"}, "when": ["rabbitmq_rpc_image_current != ''", "rabbitmq_rpc_image_current != rabbitmq_rpc_image_latest"]}]}, {"name": "Update rabbitmq-bundle pcs resource bundle for new container image", "when": ["step|int == 1"], "block": [{"name": "set is_rpc_rabbitmq_bootstrap_node fact", "set_fact": "is_rpc_rabbitmq_bootstrap_node={{oslo_messaging_rpc_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}"}, {"name": "Check for rabbitmq_rpc retag statefile", "stat": {"path": "/var/lib/tripleo/rabbitmq_rpc_needs_retag"}, "register": "rabbitmq_rpc_retag_state_file"}]}, {"name": "Update rabbitmq-bundle pcs resource bundle for new container image", "when": ["step|int == 1", "is_rpc_rabbitmq_bootstrap_node|bool", "rabbitmq_rpc_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the rabbitmq cluster resource before container upgrade", "pacemaker_resource": {"resource": "rabbitmq-bundle", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Check rabbitmq logging configuration in pacemaker", "command": "cibadmin --query --xpath \"//storage-mapping[@id='rabbitmq-log']\"", "failed_when": false, "register": "rabbitmq_logs_moved"}, {"name": "Add a bind mount for logging in the rabbitmq bundle", "when": "rabbitmq_logs_moved.rc == 6", "command": "pcs resource bundle update rabbitmq-bundle storage-map add id=rabbitmq-log source-dir=/var/log/containers/rabbitmq target-dir=/var/log/rabbitmq options=rw"}, {"name": "Update the rabbitmq bundle to use the new container image name", "command": "pcs resource bundle update rabbitmq-bundle container image={{rabbitmq_rpc_image_latest}}"}, {"name": "Enable the rabbitmq cluster resource", "pacemaker_resource": {"resource": "rabbitmq-bundle", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}]}, {"name": "Check for rabbitmq_rpc retag statefile", "when": ["step|int == 3"], "stat": {"path": "/var/lib/tripleo/rabbitmq_rpc_needs_retag"}, "register": "rabbitmq_rpc_retag_state_file"}, {"name": "Retag rabbitmq-bundle container image", "when": ["step|int == 3", "rabbitmq_rpc_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the rabbitmq cluster resource before container upgrade", "pacemaker_resource": {"resource": "rabbitmq-bundle", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Retag the pacemaker image if containerized", "block": [{"block": [{"name": "Get rabbitmq image from pacemaker", "become": true, "register": "xmllint_pcmk_rabbitmq_rpc_image", "shell": "xmllint --xpath \"string(//bundle[@id='rabbitmq-bundle']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container rabbitmq image", "set_fact": {"rabbitmq_rpc_image": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1", "rabbitmq_rpc_image_latest": "cluster.common.tag/rabbitmq:pcmklatest", "pcmk_rabbitmq_rpc_image": "{{xmllint_pcmk_rabbitmq_rpc_image.stdout}}"}}]}, {"block": [{"name": "Retag pcmklatest to latest rabbitmq image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{rabbitmq_rpc_image}}", "container_image_latest": "{{rabbitmq_rpc_image_latest}}"}}]}]}, {"name": "Enable the rabbitmq cluster resource", "pacemaker_resource": {"resource": "rabbitmq-bundle", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Remove rabbitmq_rpc retag statefile", "file": {"path": "/var/lib/tripleo/rabbitmq_rpc_needs_retag", "state": "absent"}}]}, {"name": "Ensure redis is removed", "when": ["step|int == 5", "\"redis\" not in enabled_services|list", "{{ (pacemaker_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower)|bool}}"], "become": true, "shell": "if crm_resource -r redis-bundle -q &>/dev/null; then\n   pcs resource delete redis-bundle || true\n   pcs resource delete ip-$(hiera redis_vip) || true\nfi\n"}, {"name": "Clean up cluster node cache", "when": ["step|int == 5", "\"redis\" not in enabled_services|list", "{{ (pacemaker_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower)|bool}}"], "become": true, "shell": "pcs cluster node clear redis-bundle-0\npcs cluster node clear redis-bundle-1\npcs cluster node clear redis-bundle-2\ncrm_attribute --name redis_REPL_INFO --delete\n"}, {"name": "Clean up redis attribute", "when": ["step|int == 5", "\"redis\" not in enabled_services|list", "{{ (pacemaker_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower)|bool}}"], "become": true, "shell": "pcs node attribute \"{{ item }}\" redis-role= || true\n", "loop": "{{ pacemaker_short_node_names }}"}, {"name": "Configure Podman registry", "when": ["step|int == 1"], "block": [{"name": "Make sure the Undercloud hostname is included in /etc/hosts", "when": ["undercloud_hosts_entries is defined"], "lineinfile": {"dest": "/etc/hosts", "line": "{{ undercloud_hosts_entries | join('') }}", "state": "present"}}]}, {"name": "Run podman install", "tags": ["system_upgrade", "system_upgrade_run"], "when": ["step|int == 1"], "block": [{"name": "Set login facts", "no_log": true, "set_fact": {"container_registry_insecure_registries": ["192.168.122.100:8787"], "container_registry_login": false, "container_registry_logins": {}, "container_registry_logins_json": {}, "container_default_pids_limit": 4096, "container_events_logger_mechanism": "journald"}}, {"name": "Convert logins json to dict", "no_log": true, "set_fact": {"container_registry_logins": "{{ container_registry_logins_json | from_json }}"}, "when": ["container_registry_logins_json is string", "container_registry_login | bool", "(container_registry_logins_json | length) > 0"]}, {"name": "Set registry logins", "no_log": true, "set_fact": {"container_registry_logins": "{{ container_registry_logins_json }}"}, "when": ["container_registry_logins_json is mapping", "container_registry_login | bool", "(container_registry_logins_json | length) > 0"]}, {"name": "Run podman install", "include_role": {"name": "tripleo_podman", "tasks_from": "tripleo_podman_install.yml"}, "vars": {"tripleo_container_registry_insecure_registries": "{{ container_registry_insecure_registries }}", "tripleo_container_default_pids_limit": "{{ container_default_pids_limit }}", "tripleo_container_events_logger_mechanism": "{{ container_events_logger_mechanism }}"}}, {"name": "Run podman login", "include_role": {"name": "tripleo_podman", "tasks_from": "tripleo_podman_login.yml"}, "vars": {"tripleo_container_registry_logins": "{{ container_registry_logins }}", "tripleo_container_registry_login": "{{ container_registry_login | bool }}"}}]}, {"when": "step|int == 0", "block": [{"name": "Check if snmpd is enabled", "command": "systemctl is-enabled --quiet snmpd", "failed_when": false, "register": "snmpd_enabled_result"}, {"name": "Set fact snmpd_enabled", "set_fact": {"snmpd_enabled": "{{ snmpd_enabled_result.rc == 0 }}"}}]}, {"name": "Stop snmp service", "when": ["step|int == 1", "snmpd_enabled|bool"], "service": "name=snmpd state=stopped"}, {"name": "Cleanup tripleo-iptables services", "when": ["(step | int) == 1"], "block": [{"name": "Disable tripleo-iptables.service", "systemd": {"name": "tripleo-iptables.service", "state": "stopped", "enabled": false}, "register": "systemd_tripleo_iptables", "failed_when": false}, {"name": "Cleanup tripleo-iptables.services", "file": {"path": "/etc/systemd/system/tripleo-iptables.service", "state": "absent"}}, {"name": "Disable tripleo-ip6tables.service", "systemd": {"name": "tripleo-ip6tables.service", "state": "stopped", "enabled": false}, "register": "systemd_tripleo_ip6tables", "failed_when": false}, {"name": "Cleanup tripleo-ip6tables.services", "file": {"path": "/etc/systemd/system/tripleo-ip6tables.service", "state": "absent"}}, {"name": "Reload systemd", "systemd": {"daemon_reload": true}, "when": ["(systemd_tripleo_iptables is changed or systemd_tripleo_ip6tables is changed)"]}]}, {"when": ["(step | int) == 3"], "block": [{"name": "blank ipv6 rule before activating ipv6 firewall.", "shell": "cat /etc/sysconfig/ip6tables > /etc/sysconfig/ip6tables.n-o-upgrade; cat</dev/null>/etc/sysconfig/ip6tables", "args": {"creates": "/etc/sysconfig/ip6tables.n-o-upgrade"}}, {"name": "cleanup unmanaged rules pushed by iptables-services", "shell": "iptables -C INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT &>/dev/null && \\\n  iptables -D INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\niptables -C INPUT -p icmp -j ACCEPT &>/dev/null && \\\n  iptables -D INPUT -p icmp -j ACCEPT\niptables -C INPUT -i lo -j ACCEPT &>/dev/null && \\\n  iptables -D INPUT -i lo -j ACCEPT\niptables -C INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT &>/dev/null && \\\n  iptables -D INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT\niptables -C INPUT -j REJECT --reject-with icmp-host-prohibited &>/dev/null && \\\n  iptables -D INPUT -j REJECT --reject-with icmp-host-prohibited\niptables -C FORWARD -j REJECT --reject-with icmp-host-prohibited &>/dev/null && \\\n  iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited\n\nsed -i '/^-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT$/d' /etc/sysconfig/iptables\nsed -i '/^-A INPUT -p icmp -j ACCEPT$/d' /etc/sysconfig/iptables\nsed -i '/^-A INPUT -i lo -j ACCEPT$/d' /etc/sysconfig/iptables\nsed -i '/^-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT$/d' /etc/sysconfig/iptables\nsed -i '/^-A INPUT -j REJECT --reject-with icmp-host-prohibited$/d' /etc/sysconfig/iptables\nsed -i '/^-A FORWARD -j REJECT --reject-with icmp-host-prohibited$/d' /etc/sysconfig/iptables\n\nip6tables -C INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT &>/dev/null && \\\n  ip6tables -D INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\nip6tables -C INPUT -p ipv6-icmp -j ACCEPT &>/dev/null && \\\n  ip6tables -D INPUT -p ipv6-icmp -j ACCEPT\nip6tables -C INPUT -i lo -j ACCEPT &>/dev/null && \\\n  ip6tables -D INPUT -i lo -j ACCEPT\nip6tables -C INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT &>/dev/null && \\\n  ip6tables -D INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT\nip6tables -C INPUT -d fe80::/64 -p udp -m udp --dport 546 -m state --state NEW -j ACCEPT &>/dev/null && \\\n  ip6tables -D INPUT -d fe80::/64 -p udp -m udp --dport 546 -m state --state NEW -j ACCEPT\nip6tables -C INPUT -j REJECT --reject-with icmp6-adm-prohibited &>/dev/null && \\\n  ip6tables -D INPUT -j REJECT --reject-with icmp6-adm-prohibited\nip6tables -C FORWARD -j REJECT --reject-with icmp6-adm-prohibited &>/dev/null && \\\n  ip6tables -D FORWARD -j REJECT --reject-with icmp6-adm-prohibited\n\nsed -i '/^-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT$/d' /etc/sysconfig/ip6tables\nsed -i '/^-A INPUT -p ipv6-icmp -j ACCEPT$/d' /etc/sysconfig/ip6tables\nsed -i '/^-A INPUT -i lo -j ACCEPT$/d' /etc/sysconfig/ip6tables\nsed -i '/^-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT$/d' /etc/sysconfig/ip6tables\nsed -i '/^-A INPUT -d fe80::\\/64 -p udp -m udp --dport 546 -m state --state NEW -j ACCEPT$/d' /etc/sysconfig/ip6tables\nsed -i '/^-A INPUT -j REJECT --reject-with icmp6-adm-prohibited$/d' /etc/sysconfig/ip6tables\nsed -i '/^-A FORWARD -j REJECT --reject-with icmp6-adm-prohibited$/d' /etc/sysconfig/ip6tables"}]}, {"name": "Gather missing facts", "setup": {"gather_subset": ["!all", "!min", "distribution"]}, "tags": ["always"]}, {"name": "Set leapp facts", "set_fact": {"upgrade_leapp_enabled": "{{ _upgradeLeappEnabled | bool and\n   ansible_facts['distribution'] == 'RedHat' and\n   ansible_facts['distribution_major_version'] is version('8', '==') }}", "upgrade_leapp_debug": false, "upgrade_leapp_devel_skip": "", "upgrade_leapp_command_options": "", "upgrade_leapp_reboot_timeout": 3600, "upgrade_leapp_post_reboot_delay": 120}, "vars": {"_upgradeLeappEnabled": false}, "tags": ["always"]}, {"name": "system_upgrade_prepare step 3", "tags": ["never", "system_upgrade", "system_upgrade_prepare"], "when": ["step|int == 3", "upgrade_leapp_enabled"], "block": [{"name": "Run LeappRepoInitCommand", "shell": "#!/bin/bash\n\n"}, {"name": "Remove firewalld bindings", "package": {"name": "python3-firewall", "state": "absent"}}, {"name": "install leapp", "package": {"name": "leapp-repository-openstack", "state": "latest"}}, {"name": "Run LeappInitCommand", "shell": "#!/bin/bash\n\n"}, {"name": "Remove vdo", "package": {"name": "vdo", "state": "absent"}}, {"name": "add packages into Leapp's to_remove file", "vars": {"pkg_to_remove": []}, "lineinfile": {"path": "/etc/leapp/transaction/to_remove", "line": "{{ item }}"}, "loop": "{{ pkg_to_remove }}"}, {"name": "add packages into Leapp's to_install file", "vars": {"pkg_to_install": []}, "lineinfile": {"path": "/etc/leapp/transaction/to_install", "line": "{{ item }}"}, "loop": "{{ pkg_to_install }}"}, {"name": "check sshd_config file", "stat": {"path": "/etc/ssh/sshd_config"}, "register": "sshd_config_result"}, {"name": "add PermitRootLogin option for leapp", "lineinfile": {"path": "/etc/ssh/sshd_config", "regexp": "^(# *)?PermitRootLogin", "line": "PermitRootLogin without-password"}}, {"name": "Remove paunch-services", "package": {"name": "paunch-services", "state": "absent"}}, {"name": "tripleo_container_manage reconfiguration", "import_role": {"name": "tripleo_container_manage", "tasks_from": "shutdown.yml"}}]}, {"name": "system_upgrade_prepare step 4", "tags": ["never", "system_upgrade", "system_upgrade_prepare"], "when": ["step|int == 4", "upgrade_leapp_enabled"], "block": [{"name": "Delete the kernel modules in Leapp database (device_driver_deprecation_data.json)", "vars": {"modules_to_unload": []}, "shell": "set -o pipefail && jq '. | del(.data[] | select(.driver_name == \"{{ item }}\"))' /etc/leapp/files/device_driver_deprecation_data.json > /etc/leapp/files/device_driver_deprecation_data.json_modified && mv /etc/leapp/files/device_driver_deprecation_data.json_modified /etc/leapp/files/device_driver_deprecation_data.json\n", "loop": "{{ modules_to_unload }}"}, {"name": "Remove leapp actors to prevent them inhibiting the upgrade", "vars": {"actors_to_remove": []}, "command": {"cmd": "find /usr/share/leapp-repository/repositories/ -name {{ item }} -type d -print -exec rm -rf \"{}\" +"}, "loop": "{{ actors_to_remove }}"}, {"name": "set leapp required answers", "shell": "leapp answer --add --section check_vdo.confirm=True\n"}, {"name": "Replace EFI grub.cfg with redirect to /boot/grub2/grub.cfg", "import_role": {"name": "tripleo_kernel", "tasks_from": "efigrub.yml"}}, {"name": "Keep nics with prefix in NICsPrefixesToUdev from renaming", "vars": {"nics_prefixes_to_keep": []}, "shell": "ip -j link show | \\ jq -r --arg prefix \"{{ item }}\" '.[] |\n  select((.ifname | startswith($prefix)) and\n  (.ifname | test(\"^.*v[0-9]*$\") | not) and\n  (.ifname | test(\"^.*_[0-9]*$\") | not) and\n  (.ifname | test(\"^.*\\\\..*$\") | not)) |\n  if .permaddr? then .address=.permaddr else . end |\n  \"SUBSYSTEM==\\\"net\\\",ACTION==\\\"add\\\",DRIVERS==\\\"?*\\\",\" + \"NAME=\\\"\" + .ifname +\"\\\" ,ATTR{address}==\\\"\" + .address + \"\\\"\"' >> /etc/udev/rules.d/70-rhosp-persistent-net.rules\n", "loop": "{{ nics_prefixes_to_keep|list }}"}, {"name": "run leapp upgrade (download packages)", "shell": "{% if upgrade_leapp_devel_skip|default(false) %}{{ upgrade_leapp_devel_skip }}{% endif %} leapp upgrade {% if upgrade_leapp_debug|default(true) %}--debug{% endif %} {% if upgrade_leapp_command_options|default(false) %}{{ upgrade_leapp_command_options }}{% endif %}\n", "when": "upgrade_leapp_enabled"}]}, {"name": "system_upgrade_run step 4", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_reboot"], "when": ["step|int == 4", "upgrade_leapp_enabled", "'Undercloud' not in group_names"], "block": [{"name": "Run LeappPreRebootCommand", "shell": "#!/bin/bash\n\n"}, {"name": "Check that nova_libvirt is running", "shell": "podman ps --filter name=^nova_virtlogd$ --format \"{% raw %}{{ .Image }}{% endraw %}\"\n", "register": "is_virtlogd_image_running"}, {"name": "Remove systemd files to disable them", "file": {"path": "/etc/systemd/system/{{ item }}", "state": "absent"}, "with_items": ["tripleo_nova_libvirt.service", "tripleo_nova_virtlogd_wrapper.service", "tripleo_nova_libvirt.target"], "when": "is_virtlogd_image_running.stdout != ''"}, {"name": "reboot to perform the upgrade", "reboot": {"reboot_timeout": "{{upgrade_leapp_reboot_timeout}}", "test_command": "source /etc/os-release; [ \"${VERSION_ID%.*}\" -ge \"8\" ] && systemctl is-system-running | grep -qE \"running|degraded\" || exit 1", "post_reboot_delay": "{{ upgrade_leapp_post_reboot_delay }}"}}, {"name": "Set selinux back to enforcing after leapp reboot", "selinux": {"policy": "targeted", "state": "enforcing"}}, {"name": "Run LeappPostRebootCommand", "shell": "#!/bin/bash\n\n"}]}, {"name": "Host packages setup step0", "tags": "setup_packages", "when": "step|int == 0", "block": [{"name": "Package and repo update tasks", "block": [{"name": "Run UpgradeInitCommand", "shell": "#!/bin/bash\n\nif [[ -f /etc/resolv.conf.save ]] ; then rm /etc/resolv.conf.save; fi\n\n"}, {"name": "Run UpgradeInitCommonCommand", "shell": "#!/bin/bash\n\n"}, {"name": "Ensure DNF modules have the right stream", "vars": {"dnf_module_list": []}, "dnf": {"name": "@{{ item.module }}:{{ item.stream }}/{{ item.profile|default('common') }}", "state": "present"}, "loop": "{{ dnf_module_list|list }}", "when": ["dnf_module_list|length > 0", "item.distribution_version is defined", "ansible_facts['distribution_major_version'] is version(item.distribution_version, '==')"]}, {"name": "Ensure TripleO prerequisite packages are installed", "package": {"name": ["jq", "lvm2", "openstack-selinux", "os-net-config", "puppet-tripleo", "python3-heat-agent*", "rsync"], "state": "present"}, "when": "ansible_facts['distribution_major_version'] is version('8', '==')"}, {"name": "Ensure TripleO prerequisite packages are installed and use role based heat variable to provide specific list of packages", "vars": {"base_tripleo_packages": []}, "package": {"name": "{{ base_tripleo_packages }}", "state": "present"}, "when": ["ansible_facts['distribution_major_version'] is version('8', '==')", "base_tripleo_packages|length > 0"]}, {"name": "WA for 2240185 - If the image is schema 1 and lacks signatures than add empty signatures", "shell": "for manifest_file in `find /var/lib/containers/storage/overlay-images/ -name 'manifest'`\ndo\n    cat <<< $( jq  'if .schemaVersion == 1 then if has(\"signatures\") then . else .signatures=[] end else . end' $manifest_file ) > $manifest_file\ndone\n", "when": "ansible_facts['distribution_major_version'] is version('8', '==')"}]}, {"name": "check if libvirt is installed", "command": "/usr/bin/rpm -q libvirt-daemon", "failed_when": false, "register": "libvirt_installed", "check_mode": false}, {"name": "make sure libvirt services are disabled and masked", "service": {"name": "{{ item }}", "state": "stopped", "enabled": false, "masked": true, "daemon_reload": true}, "loop": ["libvirtd.service", "virtlogd.socket"], "when": ["libvirt_installed.rc == 0"]}]}, {"name": "Host packages setup step2", "tags": "setup_packages", "when": "step|int == 2", "block": [{"name": "Special treatment for OpenvSwitch", "tripleo_ovs_upgrade": null, "register": "ovs_upgrade"}, {"name": "Always ensure the openvswitch service is enabled and running after upgrades", "service": {"name": "openvswitch", "enabled": true, "state": "started"}, "when": ["ovs_upgrade.changed|bool"]}]}, {"name": "Host packages setup step3", "tags": "setup_packages", "when": "step|int == 3", "block": [{"name": "Check for os-net-config upgrade", "shell": "yum check-upgrade | awk '/os-net-config/{print}'", "register": "os_net_config_need_upgrade"}, {"name": "Check that os-net-config has legacy configuration", "stat": {"path": "/etc/os-net-config/config.json", "get_attributes": false, "get_checksum": false, "get_mime": false}, "register": "stat_config_json"}, {"name": "Check that os-net-config has new configuration", "stat": {"path": "/etc/os-net-config/config.yaml", "get_attributes": false, "get_checksum": false, "get_mime": false}, "register": "stat_config_yaml"}, {"name": "Slurp the os-net-config config.json", "slurp": {"src": "/etc/os-net-config/config.json"}, "register": "os_config_json", "when": ["stat_config_json.stat.exists", "not stat_config_yaml.stat.exists"]}, {"name": "Write updated /etc/os-net-config/config.yaml", "copy": {"content": "{{ os_config_json.content | b64decode | from_json | to_yaml }}", "dest": "/etc/os-net-config/config.yaml"}, "when": ["stat_config_json.stat.exists", "not stat_config_yaml.stat.exists"]}, {"name": "Remove legacy os-net-config configuration", "command": "mv /etc/os-net-config/config.json /etc/os-net-config/deprecated_config.json", "when": ["stat_config_json.stat.exists"]}, {"block": [{"name": "Upgrade os-net-config", "package": "name=os-net-config state=latest"}, {"name": "take new os-net-config parameters into account now", "command": "os-net-config --no-activate -c /etc/os-net-config/config.yaml -v --detailed-exit-codes", "register": "os_net_config_upgrade", "failed_when": "os_net_config_upgrade.rc not in [0,2]", "changed_when": "os_net_config_upgrade.rc == 2"}], "when": ["os_net_config_need_upgrade.stdout", "stat_config_yaml.stat.exists or stat_config_json.stat.exists"]}, {"name": "Update all packages", "when": ["not skip_package_update|bool"], "yum": {"name": "*", "state": "latest", "exclude": "ansible-core"}, "vars": {"skip_package_update": false}}, {"name": "Always ensure the openvswitch service is enabled and running after upgrades rhbz#2329821", "service": {"name": "openvswitch", "enabled": true, "state": "started"}}]}]}


created_at: 2025-10-10 07:31:50.723809
data:
  {"value": [{"config_volume": "barbican", "puppet_tags": "barbican_api_paste_ini,barbican_config", "step_config": "include tripleo::profile::base::barbican::api\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-barbican-api:17.1"}, {"config_volume": "cinder", "puppet_tags": "cinder_config,file,concat,file_line,cinder_api_paste_ini", "step_config": "include tripleo::profile::base::cinder::api\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-api:17.1"}, {"config_volume": "cinder", "puppet_tags": "cinder_config,file,concat,file_line", "step_config": "\ninclude tripleo::profile::base::cinder::backup::swift\ninclude tripleo::profile::base::database::mysql::client\ninclude tripleo::profile::pacemaker::cinder::backup_bundle", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-api:17.1"}, {"config_volume": "cinder", "puppet_tags": "cinder_config,file,concat,file_line", "step_config": "include tripleo::profile::base::cinder::scheduler\n\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-api:17.1"}, {"config_volume": "cinder", "puppet_tags": "cinder_config,file,concat,file_line", "step_config": "include tripleo::profile::base::lvm\ninclude tripleo::profile::pacemaker::cinder::volume_bundle\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-api:17.1"}, {"config_volume": "clustercheck", "puppet_tags": "file", "step_config": "include tripleo::profile::pacemaker::clustercheck", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1"}, {"config_volume": "crond", "step_config": "include tripleo::profile::base::logging::logrotate", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-cron:17.1"}, {"config_volume": "glance_api", "puppet_tags": "glance_api_config,glance_api_paste_ini,glance_swift_config,glance_cache_config,glance_image_import_config", "step_config": "include tripleo::profile::base::glance::api\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1"}, {"config_volume": "glance_api_internal", "puppet_tags": "glance_api_config,glance_api_paste_ini,glance_swift_config,glance_cache_config,glance_image_import_config", "step_config": "class { 'tripleo::profile::base::glance::api':\n  bind_port => 9293,\n  tls_proxy_port => 9293,\n  log_file => '/var/log/glance/api_internal.log',\n  show_image_direct_url => true,\n  show_multiple_locations => true,\n}\n\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1"}, {"config_volume": "haproxy", "puppet_tags": "haproxy_config", "step_config": "exec {'wait-for-settle': command => '/bin/true' }\nclass tripleo::firewall(){}; define tripleo::firewall::rule( $port = undef, $dport = undef, $sport = undef, $proto = undef, $action = undef, $state = undef, $source = undef, $iniface = undef, $chain = undef, $destination = undef, $extras = undef){}\n['pcmk_bundle', 'pcmk_resource', 'pcmk_property', 'pcmk_constraint', 'pcmk_resource_default'].each |String $val| { noop_resource($val) }\ninclude tripleo::profile::pacemaker::haproxy_bundle", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-haproxy:17.1", "volumes": ["/etc/pki/tls/private/overcloud_endpoint.pem:/etc/pki/tls/private/overcloud_endpoint.pem:ro", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/pki/tls/private/haproxy:/etc/pki/tls/private/haproxy:ro", "/etc/pki/tls/certs/haproxy:/etc/pki/tls/certs/haproxy:ro"]}, {"config_volume": "heat_api", "puppet_tags": "heat_config,file,concat,file_line,heat_api_paste_ini", "step_config": "include tripleo::profile::base::heat::api\n", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-heat-api:17.1"}, {"config_volume": "heat_api_cfn", "puppet_tags": "heat_config,file,concat,file_line", "step_config": "include tripleo::profile::base::heat::api_cfn\n", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-heat-api-cfn:17.1"}, {"config_volume": "heat", "puppet_tags": "heat_config,file,concat,file_line", "step_config": "include tripleo::profile::base::heat::engine\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-heat-api:17.1"}, {"config_volume": "horizon", "puppet_tags": "horizon_config", "step_config": "include tripleo::profile::base::horizon\n", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-horizon:17.1"}, {"config_volume": "iscsid", "puppet_tags": "iscsid_config", "step_config": "include tripleo::profile::base::iscsid\n", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-iscsid:17.1", "volumes": ["/etc/iscsi:/tmp/iscsi.host:z"]}, {"config_volume": "keystone", "puppet_tags": "keystone_config,keystone_domain_config", "step_config": "['Keystone_user', 'Keystone_endpoint', 'Keystone_domain', 'Keystone_tenant', 'Keystone_user_role', 'Keystone_role', 'Keystone_service'].each |String $val| { noop_resource($val) }\ninclude tripleo::profile::base::keystone\n\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1"}, {"config_volume": "manila", "puppet_tags": "manila_config,manila_api_paste_ini", "step_config": "include tripleo::profile::base::manila::api\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-manila-api:17.1"}, {"config_volume": "manila", "puppet_tags": "manila_config,manila_scheduler_paste_ini", "step_config": "include tripleo::profile::base::manila::scheduler\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-manila-api:17.1"}, {"config_volume": "manila", "puppet_tags": "manila_config,file,concat,file_line", "step_config": "include tripleo::profile::pacemaker::manila::share_bundle\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-manila-api:17.1"}, {"config_volume": "memcached", "puppet_tags": "file", "step_config": "include tripleo::profile::base::memcached\n", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-memcached:17.1"}, {"config_volume": "mysql", "puppet_tags": "file", "step_config": "['Mysql_datadir', 'Mysql_user', 'Mysql_database', 'Mysql_grant', 'Mysql_plugin'].each |String $val| { noop_resource($val) }\nexec {'wait-for-settle': command => '/bin/true' }\ninclude tripleo::profile::pacemaker::database::mysql_bundle", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1"}, {"config_volume": "neutron", "puppet_tags": "neutron_config,neutron_api_paste_ini", "step_config": "include tripleo::profile::base::neutron::server\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-neutron-server:17.1"}, {"config_volume": "neutron", "puppet_tags": "neutron_plugin_ml2", "step_config": "include tripleo::profile::base::neutron::plugins::ml2\n", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-neutron-server:17.1"}, {"config_volume": "neutron", "puppet_tags": "neutron_config,neutron_agent_sriov_numvfs,neutron_sriov_agent_config", "step_config": "include tripleo::profile::base::neutron::sriov\n", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-neutron-server:17.1"}, {"config_volume": "neutron", "puppet_tags": "neutron_config,neutron_dhcp_agent_config", "step_config": "include tripleo::profile::base::neutron::dhcp\n", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-neutron-server:17.1"}, {"config_volume": "nova", "puppet_tags": "nova_config,nova_api_paste_ini", "step_config": "['Nova_cell_v2'].each |String $val| { noop_resource($val) }\ninclude tripleo::profile::base::nova::api\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-nova-api:17.1"}, {"config_volume": "nova", "puppet_tags": "nova_config", "step_config": "include tripleo::profile::base::nova::conductor\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-nova-api:17.1"}, {"config_volume": "nova_metadata", "puppet_tags": "nova_config,nova_api_paste_ini", "step_config": "include tripleo::profile::base::nova::metadata\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-nova-api:17.1"}, {"config_volume": "nova", "puppet_tags": "nova_config", "step_config": "include tripleo::profile::base::nova::scheduler\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-nova-api:17.1"}, {"config_volume": "nova_libvirt", "puppet_tags": "nova_config", "step_config": "# TODO(emilien): figure how to deal with libvirt profile.\n# We'll probably treat it like we do with Neutron plugins.\n# Until then, just include it in the default nova-compute role.\ninclude tripleo::profile::base::nova::compute::libvirt\n", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-nova-libvirt:17.1"}, {"config_volume": "nova_libvirt", "puppet_tags": "libvirtd_config,virtlogd_config,virtproxyd_config,virtqemud_config,virtnodedevd_config,virtsecretd_config,virtstoraged_config,nova_config,file,libvirt_tls_password", "step_config": "include tripleo::profile::base::nova::libvirt\n", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-nova-libvirt:17.1"}, {"config_volume": "nova_libvirt", "step_config": "include tripleo::profile::base::sshd\ninclude tripleo::profile::base::nova::migration::target", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-nova-libvirt:17.1"}, {"config_volume": "nova", "puppet_tags": "nova_config", "step_config": "include tripleo::profile::base::nova::vncproxy\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-nova-api:17.1"}, {"puppet_tags": "vs_config,exec", "config_volume": "ovn_controller", "step_config": "include tripleo::profile::base::neutron::agents::ovn\n", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-ovn-controller:17.1", "volumes": ["/lib/modules:/lib/modules:ro", "/run/openvswitch:/run/openvswitch:shared,z", "/etc/sysconfig/modules:/etc/sysconfig/modules"]}, {"puppet_tags": "neutron_config,ovn_metadata_agent_config", "config_volume": "neutron", "step_config": "include tripleo::profile::base::neutron::ovn_metadata\n", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-neutron-server:17.1", "volumes": ["/lib/modules:/lib/modules:ro", "/run/openvswitch:/run/openvswitch:shared,z"]}, {"config_volume": "rabbitmq", "puppet_tags": "file,file_line", "step_config": "['Rabbitmq_policy', 'Rabbitmq_user'].each |String $val| { noop_resource($val) }\ninclude tripleo::profile::pacemaker::rabbitmq_bundle", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1"}, {"config_volume": "placement", "puppet_tags": "placement_config", "step_config": "include tripleo::profile::base::database::mysql::client\ninclude tripleo::profile::base::placement::api", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1"}, {}, {"config_volume": "swift", "puppet_tags": "swift_config,swift_proxy_config,swift_keymaster_config", "step_config": "include tripleo::profile::base::swift::proxy\n", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-swift-proxy-server:17.1"}, {"config_volume": "swift_ringbuilder", "puppet_tags": "swift_config,exec,fetch_swift_ring_tarball,extract_swift_ring_tarball,ring_object_device,swift::ringbuilder::create,tripleo::profile::base::swift::add_devices,swift::ringbuilder::rebalance,create_swift_ring_tarball,upload_swift_ring_tarball", "step_config": "include tripleo::profile::base::swift::ringbuilder\n", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-swift-proxy-server:17.1"}, {"config_volume": "swift", "puppet_tags": "swift_config,swift_container_config,swift_container_sync_realms_config,swift_account_config,swift_object_config,swift_object_expirer_config,rsync::server", "step_config": "class xinetd() {}\ndefine xinetd::service($bind='',$port='',$server='',$server_args='') {}\nnoop_resource('service')\ninclude tripleo::profile::base::swift::storage", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-swift-proxy-server:17.1"}]}


created_at: 2025-10-10 07:31:50.726703
data:
  {"value": [{"name": "Start cinder_volume service (pacemaker)", "become": true, "when": "step|int == 1", "pacemaker_resource": {"resource": "openstack-cinder-volume", "state": "enable"}}, {"name": "Ensure instanceha directory is purged", "when": "step|int == 1", "become": true, "file": {"path": "/var/lib/nova/instanceha", "state": "absent"}}, {"when": ["step|int == 3"], "become": true, "environment": {"OS_CLOUD": "standalone"}, "block": [{"name": "Get nova-consoleauth service ID", "command": "openstack compute service list --service nova-consoleauth --column ID  --column Host --format yaml", "register": "nova_compute_service_result", "check_mode": false, "run_once": true, "changed_when": false, "failed_when": false, "delegate_to": "{{ groups['Undercloud'] | first }}"}, {"name": "Deleting nova-consoleauth", "command": "openstack compute service delete {{ item.ID }}", "loop": "{{ nova_compute_service_result.stdout | from_yaml | default([]) }}", "run_once": true, "delegate_to": "{{ groups['Undercloud'] | first }}", "failed_when": false}]}, {"name": "Purge Podman", "when": ["(step | int) == 3", "container_cli == 'podman'", "deployment_source_hosts not in group_names"], "include_role": {"name": "tripleo_podman", "tasks_from": "tripleo_podman_purge.yml"}, "vars": {"deployment_source_hosts": "Undercloud"}}]}


created_at: 2025-10-10 07:31:50.731516
data:
  {"value": [{"when": "step|int == 1", "block": [{"name": "Online data migration for Cinder", "command": "{{ container_cli }} exec cinder_api cinder-manage db online_data_migrations", "delegate_to": "{{ (groups['cinder_api'] | difference(groups['excluded_overcloud']))[0] }}", "become": true, "tags": ["online_upgrade", "online_upgrade_cinder"]}]}, {"when": "step|int == 1", "tags": "ha_image_update", "block": [{"block": [{"name": "Get cinder_backup image from pacemaker", "become": true, "register": "xmllint_pcmk_cinder_backup_image", "shell": "xmllint --xpath \"string(//bundle[@id='openstack-cinder-backup']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container cinder_backup image", "set_fact": {"cinder_backup_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-backup:17.1", "cinder_backup_image_latest": "cluster.common.tag/cinder-backup:pcmklatest", "pcmk_cinder_backup_image": "{{xmllint_pcmk_cinder_backup_image.stdout}}"}}], "delegate_to": "{{ (groups[\"cinder_backup\"] | difference(groups[\"excluded_overcloud\"]))[0] }}"}, {"name": "cinder-backup temporary pacemaker container tag in case of image switch", "become": true, "import_role": {"name": "tripleo_ha_image_update"}, "vars": {"tripleo_ha_image_update_node_names": "{{ groups[\"cinder_backup\"] | difference(groups[\"excluded_overcloud\"]) }}", "tripleo_ha_image_update_bundle": "openstack-cinder-backup", "tripleo_ha_image_update_new_image": "{{cinder_backup_image_latest}}", "tripleo_ha_image_update_old_image": "{{pcmk_cinder_backup_image}}"}, "when": ["(pcmk_cinder_backup_image != \"\")", "(pcmk_cinder_backup_image != cinder_backup_image_latest)"]}]}, {"when": "step|int == 1", "tags": "ha_image_update", "block": [{"block": [{"name": "Get cinder_volume image from pacemaker", "become": true, "register": "xmllint_pcmk_cinder_volume_image", "shell": "xmllint --xpath \"string(//bundle[@id='openstack-cinder-volume']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container cinder_volume image", "set_fact": {"cinder_volume_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-volume:17.1", "cinder_volume_image_latest": "cluster.common.tag/cinder-volume:pcmklatest", "pcmk_cinder_volume_image": "{{xmllint_pcmk_cinder_volume_image.stdout}}"}}], "delegate_to": "{{ (groups[\"cinder_volume\"] | difference(groups[\"excluded_overcloud\"]))[0] }}"}, {"name": "cinder-volume temporary pacemaker container tag in case of image switch", "become": true, "import_role": {"name": "tripleo_ha_image_update"}, "vars": {"tripleo_ha_image_update_node_names": "{{ groups[\"cinder_volume\"] | difference(groups[\"excluded_overcloud\"]) }}", "tripleo_ha_image_update_bundle": "openstack-cinder-volume", "tripleo_ha_image_update_new_image": "{{cinder_volume_image_latest}}", "tripleo_ha_image_update_old_image": "{{pcmk_cinder_volume_image}}"}, "when": ["(pcmk_cinder_volume_image != \"\")", "(pcmk_cinder_volume_image != cinder_volume_image_latest)"]}]}, {"when": "step|int == 1", "tags": "ha_image_update", "block": [{"block": [{"name": "Get haproxy image from pacemaker", "become": true, "register": "xmllint_pcmk_haproxy_image", "shell": "xmllint --xpath \"string(//bundle[@id='haproxy-bundle']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container haproxy image", "set_fact": {"haproxy_image": "registry.redhat.io/rhosp-rhel9/openstack-haproxy:17.1", "haproxy_image_latest": "cluster.common.tag/haproxy:pcmklatest", "pcmk_haproxy_image": "{{xmllint_pcmk_haproxy_image.stdout}}"}}], "delegate_to": "{{ (groups[\"haproxy\"] | difference(groups[\"excluded_overcloud\"]))[0] }}"}, {"name": "haproxy temporary pacemaker container tag in case of image switch", "become": true, "import_role": {"name": "tripleo_ha_image_update"}, "vars": {"tripleo_ha_image_update_node_names": "{{ groups[\"haproxy\"] | difference(groups[\"excluded_overcloud\"]) }}", "tripleo_ha_image_update_bundle": "haproxy-bundle", "tripleo_ha_image_update_new_image": "{{haproxy_image_latest}}", "tripleo_ha_image_update_old_image": "{{pcmk_haproxy_image}}"}, "when": ["(pcmk_haproxy_image != \"\")", "(pcmk_haproxy_image != haproxy_image_latest)"]}]}, {"when": "step|int == 1", "tags": "ha_image_update", "block": [{"block": [{"name": "Get manila_share image from pacemaker", "become": true, "register": "xmllint_pcmk_manila_share_image", "shell": "xmllint --xpath \"string(//bundle[@id='openstack-manila-share']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container manila_share image", "set_fact": {"manila_share_image": "registry.redhat.io/rhosp-rhel9/openstack-manila-share:17.1", "manila_share_image_latest": "cluster.common.tag/manila-share:pcmklatest", "pcmk_manila_share_image": "{{xmllint_pcmk_manila_share_image.stdout}}"}}], "delegate_to": "{{ (groups[\"manila_share\"] | difference(groups[\"excluded_overcloud\"]))[0] }}"}, {"name": "manila-share temporary pacemaker container tag in case of image switch", "become": true, "import_role": {"name": "tripleo_ha_image_update"}, "vars": {"tripleo_ha_image_update_node_names": "{{ groups[\"manila_share\"] | difference(groups[\"excluded_overcloud\"]) }}", "tripleo_ha_image_update_bundle": "openstack-manila-share", "tripleo_ha_image_update_new_image": "{{manila_share_image_latest}}", "tripleo_ha_image_update_old_image": "{{pcmk_manila_share_image}}"}, "when": ["(pcmk_manila_share_image != \"\")", "(pcmk_manila_share_image != manila_share_image_latest)"]}]}, {"when": "step|int == 1", "tags": "ha_image_update", "block": [{"block": [{"name": "Get galera image from pacemaker", "become": true, "register": "xmllint_pcmk_galera_image", "shell": "xmllint --xpath \"string(//bundle[@id='galera-bundle']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container galera image", "set_fact": {"galera_image": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1", "galera_image_latest": "cluster.common.tag/mariadb:pcmklatest", "pcmk_galera_image": "{{xmllint_pcmk_galera_image.stdout}}"}}], "delegate_to": "{{ (groups[\"mysql\"] | difference(groups[\"excluded_overcloud\"]))[0] }}"}, {"name": "MySQL temporary pacemaker container tag in case of image switch", "become": true, "import_role": {"name": "tripleo_ha_image_update"}, "vars": {"tripleo_ha_image_update_node_names": "{{ groups[\"mysql\"] | difference(groups[\"excluded_overcloud\"]) }}", "tripleo_ha_image_update_bundle": "galera-bundle", "tripleo_ha_image_update_new_image": "{{galera_image_latest}}", "tripleo_ha_image_update_old_image": "{{pcmk_galera_image}}"}, "when": ["(pcmk_galera_image != \"\")", "(pcmk_galera_image != galera_image_latest)"]}]}, {"name": "Check if python3-openvswitch3.1 workaround is needed", "delegate_to": "{{groups['neutron_api'][0]}}", "become": true, "tags": ["ovn", "ovn_image"], "when": "step|int == 1", "shell": "podman exec neutron_api rpm -q python3-openvswitch3.1\n", "register": "neutron_python_ovs_3_1", "failed_when": false}, {"name": "Update neutron_api first everywhere", "become": true, "tags": ["ovn", "ovn_image"], "when": ["step|int == 1", "neutron_python_ovs_3_1.rc == 0"], "block": [{"name": "Move virtual IPs to another node before stopping pacemaker", "delegate_to": "{{groups['neutron_api'][0]}}", "when": ["hostvars[groups['neutron_api'][0]][\"haproxy_node_names\"]|default([])|length > 1"], "shell": "CLUSTER_NODE=$(crm_node -n)\necho \"Retrieving all the VIPs which are hosted on this node\"\nVIPS_TO_MOVE=$(crm_mon --as-xml | xmllint --xpath '//resource[@resource_agent=\"ocf:heartbeat:IPaddr2\" and @role = \"Started\" and @managed = \"true\" and ./node[@name = \"'${CLUSTER_NODE}'\"]]/@id' - | sed -e 's/id=//g' -e 's/\"//g')\nfor v in ${VIPS_TO_MOVE}; do\n    echo \"Moving VIP $v on another node\"\n    pcs resource ban $v ${CLUSTER_NODE} --wait=300\ndone\necho \"Removing the location constraints that were created to move the VIPs\"\nfor v in ${VIPS_TO_MOVE}; do\n    echo \"Removing location ban for VIP $v\"\n    ban_id=$(cibadmin --query | xmllint --xpath 'string(//rsc_location[@rsc=\"'${v}'\" and @node=\"'${CLUSTER_NODE}'\" and @score=\"-INFINITY\"]/@id)' -)\n    if [ -n \"$ban_id\" ]; then\n        pcs constraint remove ${ban_id}\n    else\n        echo \"Could not retrieve and clear location constraint for VIP $v\" 2>&1\n    fi\ndone\n"}, {"name": "Create firewall nat prerouting and postrouting", "delegate_to": "{{groups['neutron_api'][0]}}", "shell": "set -o pipefail\nLOCAL_BACKEND=$(grep {{groups['neutron_api'][0]}} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\n  grep \":9696 \" | awk '{print $3}')\nIP=${LOCAL_BACKEND%:*}\nif [[ $IP =~ .*:.* ]]\n  then\n       PROTOCOL=\"ip6\"\n       # we need to temporarly allow ipv6 forwarding, this will get reset by deployment run\n       sysctl -w net.ipv6.conf.all.forwarding=1\n  else PROTOCOL=\"ip\"\nfi\nnft add table $PROTOCOL nat\nnft -- add chain $PROTOCOL nat prerouting { type nat hook prerouting priority -100 \\; }\nnft add chain $PROTOCOL nat postrouting { type nat hook postrouting priority 100 \\; }\n"}, {"name": "Redirect neutron backend traffic for 60s to other host", "delegate_to": "{{groups['neutron_api'][0]}}", "shell": "set -o pipefail\nsource /etc/os-release; test  \"${VERSION_ID%*}\" = \"9.0\" && exit 0\nLOCAL_BACKEND=$(grep {{groups['neutron_api'][0]}} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\n  grep \":9696 \" | awk '{print $3}')\nREMOTE_BACKEND=$(grep \":9696 \" /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\n  grep server | grep -v {{groups['neutron_api'][0]}} | head -n1 | awk '{print $3}')\nIP=${LOCAL_BACKEND%:*}\nPORT=9696\nif [[ $IP =~ .*:.* ]]\n  then PROTOCOL=\"ip6\"\n  else PROTOCOL=\"ip\"\nfi\nREMOTE_IP=${REMOTE_BACKEND%:*}\nnft add rule $PROTOCOL nat postrouting $PROTOCOL daddr $REMOTE_IP tcp dport 9696 counter meta time $(date +%s)-$(date -d'+60 seconds' +%s) masquerade comment neutron_api\nnft add rule $PROTOCOL nat prerouting $PROTOCOL daddr $IP tcp dport 9696 counter meta time $(date +%s)-$(date -d'+60 seconds' +%s) dnat to $REMOTE_IP comment neutron_api\n"}, {"name": "Insanity neutron update first", "delegate_to": "{{groups['neutron_api'][0]}}", "become": true, "tripleo_container_manage": {"config_dir": "/var/lib/tripleo-config/container-startup-config/step_4", "config_id": ["neutron_api"], "config_patterns": "*neutron_api.json", "config_overrides": {".*neutron_api": {"image": "registry.redhat.io/rhosp-rhel9/openstack-neutron-server:17.1", "name": "neutron_api"}}}}, {"wait_for": {"timeout": 50}}, {"name": "Delete redirect rules", "delegate_to": "{{groups['neutron_api'][0]}}", "shell": "set -o pipefail\nLOCAL_BACKEND=$(grep {{groups['neutron_api'][0]}} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\n  grep \":9696 \" | awk '{print $3}')\nIP=${LOCAL_BACKEND%:*}\nif [[ $IP =~ .*:.* ]]\n  then\n       PROTOCOL=\"ip6\"\n  else PROTOCOL=\"ip\"\nfi\nnft -a list chain $PROTOCOL nat postrouting | grep neutron_api | awk -F# '{print \"nat postrouting \"$2}' | \\\nwhile read i; do bash -c \"nft delete rule $PROTOCOL $i\"; done\nnft -a list chain $PROTOCOL nat prerouting | grep neutron_api | awk -F# '{print \"nat prerouting \"$2}' | \\\nwhile read i; do bash -c \"nft delete rule $PROTOCOL $i\"; done\n"}, {"name": "Move virtual IPs to another node before stopping pacemaker", "delegate_to": "{{groups['neutron_api'][1]}}", "when": ["hostvars[groups['neutron_api'][1]][\"haproxy_node_names\"]|default([])|length > 1", "groups['neutron_api'] | default([]) | length > 1"], "shell": "CLUSTER_NODE=$(crm_node -n)\necho \"Retrieving all the VIPs which are hosted on this node\"\nVIPS_TO_MOVE=$(crm_mon --as-xml | xmllint --xpath '//resource[@resource_agent=\"ocf:heartbeat:IPaddr2\" and @role = \"Started\" and @managed = \"true\" and ./node[@name = \"'${CLUSTER_NODE}'\"]]/@id' - | sed -e 's/id=//g' -e 's/\"//g')\nfor v in ${VIPS_TO_MOVE}; do\n    echo \"Moving VIP $v on another node\"\n    pcs resource ban $v ${CLUSTER_NODE} --wait=300\ndone\necho \"Removing the location constraints that were created to move the VIPs\"\nfor v in ${VIPS_TO_MOVE}; do\n    echo \"Removing location ban for VIP $v\"\n    ban_id=$(cibadmin --query | xmllint --xpath 'string(//rsc_location[@rsc=\"'${v}'\" and @node=\"'${CLUSTER_NODE}'\" and @score=\"-INFINITY\"]/@id)' -)\n    if [ -n \"$ban_id\" ]; then\n        pcs constraint remove ${ban_id}\n    else\n        echo \"Could not retrieve and clear location constraint for VIP $v\" 2>&1\n    fi\ndone\n"}, {"name": "Create firewall nat prerouting and postrouting", "delegate_to": "{{groups['neutron_api'][1]}}", "when": ["groups['neutron_api'] | default([]) | length > 1"], "shell": "set -o pipefail\nLOCAL_BACKEND=$(grep {{groups['neutron_api'][1]}} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\n  grep \":9696 \" | awk '{print $3}')\nIP=${LOCAL_BACKEND%:*}\nif [[ $IP =~ .*:.* ]]\n  then\n       PROTOCOL=\"ip6\"\n       # we need to temporarly allow ipv6 forwarding, this will get reset by deployment run\n       sysctl -w net.ipv6.conf.all.forwarding=1\n  else PROTOCOL=\"ip\"\nfi\nnft add table $PROTOCOL nat\nnft -- add chain $PROTOCOL nat prerouting { type nat hook prerouting priority -100 \\; }\nnft add chain $PROTOCOL nat postrouting { type nat hook postrouting priority 100 \\; }\n"}, {"name": "Redirect neutron backend traffic for 60s to other host", "delegate_to": "{{groups['neutron_api'][1]}}", "when": ["groups['neutron_api'] | default([]) | length > 1"], "shell": "set -o pipefail\nsource /etc/os-release; test  \"${VERSION_ID%*}\" = \"9.0\" && exit 0\nLOCAL_BACKEND=$(grep {{groups['neutron_api'][1]}} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\n  grep \":9696 \" | awk '{print $3}')\nREMOTE_BACKEND=$(grep \":9696 \" /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\n  grep server | grep -v {{groups['neutron_api'][1]}} | head -n1 | awk '{print $3}')\nIP=${LOCAL_BACKEND%:*}\nPORT=9696\nif [[ $IP =~ .*:.* ]]\n  then PROTOCOL=\"ip6\"\n  else PROTOCOL=\"ip\"\nfi\nREMOTE_IP=${REMOTE_BACKEND%:*}\nnft add rule $PROTOCOL nat postrouting $PROTOCOL daddr $REMOTE_IP tcp dport 9696 counter meta time $(date +%s)-$(date -d'+60 seconds' +%s) masquerade comment neutron_api\nnft add rule $PROTOCOL nat prerouting $PROTOCOL daddr $IP tcp dport 9696 counter meta time $(date +%s)-$(date -d'+60 seconds' +%s) dnat to $REMOTE_IP comment neutron_api\n"}, {"name": "Insanity neutron update first", "delegate_to": "{{groups['neutron_api'][1]}}", "become": true, "tripleo_container_manage": {"config_dir": "/var/lib/tripleo-config/container-startup-config/step_4", "config_id": ["neutron_api"], "config_patterns": "*neutron_api.json", "config_overrides": {".*neutron_api": {"image": "registry.redhat.io/rhosp-rhel9/openstack-neutron-server:17.1", "name": "neutron_api"}}}, "when": ["groups['neutron_api'] | default([]) | length > 1"]}, {"wait_for": {"timeout": 50}, "when": ["groups['neutron_api'] | default([]) | length > 1"]}, {"name": "Delete redirect rules", "delegate_to": "{{groups['neutron_api'][1]}}", "when": ["groups['neutron_api'] | default([]) | length > 1"], "shell": "set -o pipefail\nLOCAL_BACKEND=$(grep {{groups['neutron_api'][1]}} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\n  grep \":9696 \" | awk '{print $3}')\nIP=${LOCAL_BACKEND%:*}\nif [[ $IP =~ .*:.* ]]\n  then PROTOCOL=\"ip6\"\n  else PROTOCOL=\"ip\"\nfi\nnft -a list chain $PROTOCOL nat postrouting | grep neutron_api | awk -F# '{print \"nat postrouting \"$2}' | \\\nwhile read i; do bash -c \"nft delete rule $PROTOCOL $i\"; done\nnft -a list chain $PROTOCOL nat prerouting | grep neutron_api | awk -F# '{print \"nat prerouting \"$2}' | \\\nwhile read i; do bash -c \"nft delete rule $PROTOCOL $i\"; done\n"}, {"name": "Move virtual IPs to another node before stopping pacemaker", "delegate_to": "{{groups['neutron_api'][2]}}", "when": ["hostvars[groups['neutron_api'][2]][\"haproxy_node_names\"]|default([])|length > 1", "groups['neutron_api'] | default([]) | length > 2"], "shell": "CLUSTER_NODE=$(crm_node -n)\necho \"Retrieving all the VIPs which are hosted on this node\"\nVIPS_TO_MOVE=$(crm_mon --as-xml | xmllint --xpath '//resource[@resource_agent=\"ocf:heartbeat:IPaddr2\" and @role = \"Started\" and @managed = \"true\" and ./node[@name = \"'${CLUSTER_NODE}'\"]]/@id' - | sed -e 's/id=//g' -e 's/\"//g')\nfor v in ${VIPS_TO_MOVE}; do\n    echo \"Moving VIP $v on another node\"\n    pcs resource ban $v ${CLUSTER_NODE} --wait=300\ndone\necho \"Removing the location constraints that were created to move the VIPs\"\nfor v in ${VIPS_TO_MOVE}; do\n    echo \"Removing location ban for VIP $v\"\n    ban_id=$(cibadmin --query | xmllint --xpath 'string(//rsc_location[@rsc=\"'${v}'\" and @node=\"'${CLUSTER_NODE}'\" and @score=\"-INFINITY\"]/@id)' -)\n    if [ -n \"$ban_id\" ]; then\n        pcs constraint remove ${ban_id}\n    else\n        echo \"Could not retrieve and clear location constraint for VIP $v\" 2>&1\n    fi\ndone\n"}, {"name": "Create firewall nat prerouting and postrouting", "delegate_to": "{{groups['neutron_api'][2]}}", "when": ["groups['neutron_api'] | default([]) | length > 2"], "shell": "set -o pipefail\nLOCAL_BACKEND=$(grep {{groups['neutron_api'][2]}} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\n  grep \":9696 \" | awk '{print $3}')\nIP=${LOCAL_BACKEND%:*}\nif [[ $IP =~ .*:.* ]]\n  then\n       PROTOCOL=\"ip6\"\n       # we need to temporarly allow ipv6 forwarding, this will get reset by deployment run\n       sysctl -w net.ipv6.conf.all.forwarding=1\n  else PROTOCOL=\"ip\"\nfi\nnft add table $PROTOCOL nat\nnft -- add chain $PROTOCOL nat prerouting { type nat hook prerouting priority -100 \\; }\nnft add chain $PROTOCOL nat postrouting { type nat hook postrouting priority 100 \\; }\n"}, {"name": "Redirect neutron backend traffic for 60s to other host", "delegate_to": "{{groups['neutron_api'][2]}}", "when": ["groups['neutron_api'] | default([]) | length > 2"], "shell": "set -o pipefail\nsource /etc/os-release; test  \"${VERSION_ID%*}\" = \"9.0\" && exit 0\nLOCAL_BACKEND=$(grep {{groups['neutron_api'][2]}} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\n  grep \":9696 \" | awk '{print $3}')\nREMOTE_BACKEND=$(grep \":9696 \" /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\n  grep server | grep -v {{groups['neutron_api'][2]}} | head -n1 | awk '{print $3}')\nIP=${LOCAL_BACKEND%:*}\nPORT=9696\nif [[ $IP =~ .*:.* ]]\n  then PROTOCOL=\"ip6\"\n  else PROTOCOL=\"ip\"\nfi\nREMOTE_IP=${REMOTE_BACKEND%:*}\nnft add rule $PROTOCOL nat postrouting $PROTOCOL daddr $REMOTE_IP tcp dport 9696 counter meta time $(date +%s)-$(date -d'+60 seconds' +%s) masquerade comment neutron_api\nnft add rule $PROTOCOL nat prerouting $PROTOCOL daddr $IP tcp dport 9696 counter meta time $(date +%s)-$(date -d'+60 seconds' +%s) dnat to $REMOTE_IP comment neutron_api\n"}, {"name": "Insanity neutron update first", "delegate_to": "{{groups['neutron_api'][2]}}", "become": true, "tripleo_container_manage": {"config_dir": "/var/lib/tripleo-config/container-startup-config/step_4", "config_id": ["neutron_api"], "config_patterns": "*neutron_api.json", "config_overrides": {".*neutron_api": {"image": "registry.redhat.io/rhosp-rhel9/openstack-neutron-server:17.1", "name": "neutron_api"}}}, "when": ["groups['neutron_api'] | default([]) | length > 2"]}, {"wait_for": {"timeout": 50}, "when": ["groups['neutron_api'] | default([]) | length > 2"]}, {"name": "Delete redirect rules", "delegate_to": "{{groups['neutron_api'][2]}}", "shell": "set -o pipefail\nLOCAL_BACKEND=$(grep {{groups['neutron_api'][2]}} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\n  grep \":9696 \" | awk '{print $3}')\nIP=${LOCAL_BACKEND%:*}\nif [[ $IP =~ .*:.* ]]\n  then PROTOCOL=\"ip6\"\n  else PROTOCOL=\"ip\"\nfi\nnft -a list chain $PROTOCOL nat postrouting | grep neutron_api | awk -F# '{print \"nat postrouting \"$2}' | \\\nwhile read i; do bash -c \"nft delete rule $PROTOCOL $i\"; done\nnft -a list chain $PROTOCOL nat prerouting | grep neutron_api | awk -F# '{print \"nat prerouting \"$2}' | \\\nwhile read i; do bash -c \"nft delete rule $PROTOCOL $i\"; done\n", "when": ["groups['neutron_api'] | default([]) | length > 2"]}]}, {"when": "step|int == 1", "block": [{"name": "Set facts for running online DB migrations", "set_fact": {"is_additional_cell": false}, "tags": ["online_upgrade", "online_upgrade_nova"]}, {"name": "Online data migration for Nova", "when": "not is_additional_cell|bool", "command": "{{ container_cli }} exec nova_conductor nova-manage db online_data_migrations", "delegate_to": "{{ (groups['nova_conductor'] | difference(groups['excluded_overcloud']))[0] }}", "become": true, "tags": ["online_upgrade", "online_upgrade_nova"]}]}, {"name": "Force pull image in case image name doesn't change.", "when": "step|int == 1", "tags": ["ovn", "ovn_image"], "become": true, "loop": "{{ groups['ovn_controller'] | difference(groups['excluded_overcloud']) }}", "delegate_to": "{{ item }}", "async": 600, "poll": 0, "register": "ovn_controller_image_update", "containers.podman.podman_image": {"name": "registry.redhat.io/rhosp-rhel9/openstack-ovn-controller:17.1", "validate_certs": false, "force": true}}, {"name": "Was the ovn_controller image pull successful.", "when": ["step|int == 1", "'results' in ovn_controller_image_update"], "tags": ["ovn", "ovn_image"], "become": true, "delegate_to": "{{ async_result_item.item }}", "async_status": {"jid": "{{ async_result_item.ansible_job_id }}"}, "loop": "{{ovn_controller_image_update.results }}", "loop_control": {"loop_var": "async_result_item"}, "register": "async_poll_results", "until": "async_poll_results.finished", "retries": 600, "delay": 1}, {"name": "OVN Container image used", "debug": {"msg": "ovn container will be using {{ image }}"}, "vars": {"image": "registry.redhat.io/rhosp-rhel9/openstack-ovn-controller:17.1"}, "when": "step|int == 1", "tags": "ovn"}, {"name": "Update OVN OVS related parameters before update.", "when": ["step|int == 1"], "tags": ["ovn"], "become": true, "vars": {"timeout": 8000}, "shell": "set -e\novs-vsctl set Open_vSwitch . external_ids:ovn-ofctrl-wait-before-clear={{ timeout }}\novs-vsctl set Open_vSwitch . external_ids:ovn-monitor-all=true\novs-vsctl set Open_vSwitch . external_ids:ovn-match-northd-version=false\n", "async": 600, "poll": 0, "register": "ovs_vsctl", "loop": "{{ groups['ovn_controller'] | difference(groups['excluded_overcloud']) }}", "delegate_to": "{{ item }}"}, {"name": "Was the update of OVN OVS related parameter successful.", "when": ["step|int == 1", "'results' in ovs_vsctl"], "become": true, "tags": ["ovn"], "delegate_to": "{{ async_result_item.item }}", "async_status": {"jid": "{{ async_result_item.ansible_job_id }}"}, "loop": "{{ovs_vsctl.results }}", "loop_control": {"loop_var": "async_result_item"}, "register": "async_poll_results", "until": "async_poll_results.finished", "retries": 600, "delay": 1}, {"set_fact": {"any_ovn_host": "{{groups['ovn_controller'] | difference(groups['excluded_overcloud']) | first }}"}, "tags": "ovn", "when": "step|int == 1"}, {"name": "Find ovn_controller configs in container-startup-configs", "find": {"paths": "/var/lib/tripleo-config/container-startup-config/", "patterns": "*ovn_controller.json", "recurse": true}, "register": "ovn_cont_17_0", "delegate_to": "{{ any_ovn_host }}", "when": "(step|int == 1) and (any_ovn_host is defined) and (any_ovn_host|length > 0)", "tags": ["ovn"], "become": true}, {"name": "get directory path from the ovn_cont_17_0", "set_fact": {"ovn_config_path": "{{ ovn_cont_17_0.files.0.path | dirname }}"}, "when": "step|int == 1", "tags": "ovn"}, {"name": "Get PIDfile used by systemd on each ovn node", "when": ["step|int == 1"], "tags": ["ovn"], "become": true, "shell": "set -e\ngrep PID /etc/systemd/system/tripleo_ovn_controller.service | cut -d= -f2\n", "register": "pidfile", "loop": "{{ groups['ovn_controller'] | difference(groups['excluded_overcloud']) }}", "delegate_to": "{{ item }}"}, {"name": "Update ovn_controller.", "vars": {"config_step": "{{ ('step_4' in ovn_config_path) | ternary('4', '3')}}", "query": "results[?item == '{{item}}'].stdout"}, "when": "step|int == 1", "tags": "ovn", "become": true, "loop": "{{ groups['ovn_controller'] | difference(groups['excluded_overcloud']) }}", "delegate_to": "{{ item }}", "async": 600, "poll": 0, "register": "ovn_controller_update", "tripleo_container_manage": {"config_dir": "{{ ovn_config_path }}", "config_patterns": "*ovn_controller.json", "config_id": ["tripleo_step{{config_step}}"], "log_base_path": "{{ container_log_stdout_path }}", "debug": "{{ enable_debug | bool }}", "config_overrides": {".*ovn_controller": {"image": "registry.redhat.io/rhosp-rhel9/openstack-ovn-controller:17.1", "conmon_pidfile": "{{ pidfile | json_query(query) | first }}", "name": "ovn_controller"}}}}, {"name": "Was the ovn_controller successful.", "when": ["step|int == 1", "'results' in ovn_controller_update"], "tags": "ovn", "become": true, "delegate_to": "{{ async_result_item.item }}", "async_status": {"jid": "{{ async_result_item.ansible_job_id }}"}, "loop": "{{ovn_controller_update.results }}", "loop_control": {"loop_var": "async_result_item"}, "register": "async_poll_results", "until": "async_poll_results.finished", "retries": 600, "delay": 1}, {"name": "Pause for 30s to give ovn_controllers time to reconnect to dbs", "when": ["step|int == 1"], "tags": "ovn", "wait_for": {"timeout": 30}}, {"name": "Run ovndbs update", "tags": ["ovn", "ovn_image"], "when": "step|int == 2", "block": [{"name": "Get OVN_Northbound cluster leader", "become": true, "shell": "podman exec -u root ovn_cluster_north_db_server ovs-appctl -t /var/run/ovn/ovnnb_db.ctl cluster/status OVN_Northbound | grep 'Leader: '\n", "register": "ovn_nb_dbs_cluster_leader", "loop": "{{groups['ovn_dbs'] | difference(groups['excluded_overcloud']) }}", "delegate_to": "{{ item }}"}, {"set_fact": {"ovn_nb_leader": "{{ ovn_nb_dbs_cluster_leader| json_query(\"results[?contains(stdout,'Leader: self')].item\") }}"}}, {"name": "Graceful stop OVN NB leader container", "delegate_to": "{{ ovn_nb_leader[0] }}", "become": true, "shell": "podman exec -u root ovn_cluster_north_db_server ovs-appctl -t /var/run/ovn/ovnnb_db.ctl exit\n"}, {"name": "Start OVN NB leader container", "delegate_to": "{{ ovn_nb_leader[0] }}", "become": true, "tripleo_container_manage": {"config_dir": "/var/lib/tripleo-config/container-startup-config/step_0", "config_id": ["ovn_cluster_north_db_server"], "config_patterns": "*ovn_cluster_north_db_server.json", "config_overrides": {".*ovn_cluster_north_db_server": {"image": "registry.redhat.io/rhosp-rhel9/openstack-ovn-nb-db-server:17.1", "name": "ovn_cluster_north_db_server"}}}}, {"name": "Get OVN_Southbound cluster leader", "become": true, "shell": "sudo podman exec -u root ovn_cluster_south_db_server ovs-appctl -t /var/run/ovn/ovnsb_db.ctl cluster/status OVN_Southbound | grep 'Leader: '\n", "register": "ovn_sb_dbs_cluster_leader", "loop": "{{groups['ovn_dbs'] | difference(groups['excluded_overcloud']) }}", "delegate_to": "{{ item }}"}, {"set_fact": {"ovn_sb_leader": "{{ ovn_sb_dbs_cluster_leader | json_query(\"results[?contains(stdout,'Leader: self')].item\") }}"}}, {"name": "Graceful stop OVN SB leader container", "delegate_to": "{{ ovn_sb_leader[0] }}", "become": true, "shell": "sudo podman exec -u root ovn_cluster_south_db_server ovs-appctl -t /var/run/ovn/ovnsb_db.ctl exit\n"}, {"name": "Start OVN SB leader container", "delegate_to": "{{ ovn_sb_leader[0] }}", "become": true, "tripleo_container_manage": {"config_dir": "/var/lib/tripleo-config/container-startup-config/step_0", "config_id": ["ovn_cluster_south_db_server"], "config_patterns": "*ovn_cluster_south_db_server.json", "config_overrides": {".*ovn_cluster_south_db_server": {"image": "registry.redhat.io/rhosp-rhel9/openstack-ovn-sb-db-server:17.1", "name": "ovn_cluster_south_db_server"}}}}, {"name": "Loop on OVN_Northbound cluster for leader election", "become": true, "shell": "podman exec -u root ovn_cluster_north_db_server ovs-appctl -t /var/run/ovn/ovnnb_db.ctl cluster/status OVN_Northbound | grep 'Leader: '\n", "register": "wait_leader", "delegate_to": "{{ groups['ovn_dbs'] | difference(groups['excluded_overcloud']) |  difference(ovn_nb_leader[0]) | first }}", "failed_when": "'Leader: unknown' in wait_leader.stdout or wait_leader.stderr != ''", "until": "'Leader: unknown' not in wait_leader.stdout and wait_leader.stderr == ''", "retries": 10, "delay": 5}, {"name": "Loop on OVN_Southbound cluster for leader election", "become": true, "shell": "podman exec -u root ovn_cluster_south_db_server ovs-appctl -t /var/run/ovn/ovnsb_db.ctl cluster/status OVN_Southbound | grep 'Leader: '\n", "register": "wait_leader", "delegate_to": "{{ groups['ovn_dbs'] | difference(groups['excluded_overcloud']) |  difference(ovn_nb_leader[0]) | first }}", "failed_when": "'Leader: unknown' in wait_leader.stdout or wait_leader.stderr != ''", "until": "'Leader: unknown' not in wait_leader.stdout and wait_leader.stderr == ''", "retries": 10, "delay": 5}, {"name": "Pause for 30 seconds to ensure ovn db leader knows it was elected and clients reconnect", "wait_for": {"timeout": 30}}, {"name": "Get OVN_Northbound cluster new leader", "become": true, "shell": "podman exec -u root ovn_cluster_north_db_server ovs-appctl -t /var/run/ovn/ovnnb_db.ctl cluster/status OVN_Northbound | grep 'Leader: '\n", "register": "ovn_nb_dbs_cluster_leader_new", "loop": "{{groups['ovn_dbs'] | difference(groups['excluded_overcloud']) }}", "until": "'Leader: unknown' not in ovn_nb_dbs_cluster_leader_new.stdout", "retries": 10, "delay": 5, "delegate_to": "{{ item }}"}, {"set_fact": {"ovn_nb_leader_new": "{{ ovn_nb_dbs_cluster_leader_new| json_query(\"results[?contains(stdout,'Leader: self')].item\") }}"}}, {"name": "Get OVN_Southbound cluster new leader", "become": true, "shell": "sudo podman exec -u root ovn_cluster_south_db_server ovs-appctl -t /var/run/ovn/ovnsb_db.ctl cluster/status OVN_Southbound | grep 'Leader: '\n", "register": "ovn_sb_dbs_cluster_leader_new", "loop": "{{groups['ovn_dbs'] | difference(groups['excluded_overcloud']) }}", "until": "'Leader: unknown' not in ovn_sb_dbs_cluster_leader_new.stdout", "retries": 10, "delay": 5, "delegate_to": "{{ item }}"}, {"set_fact": {"ovn_sb_leader_new": "{{ ovn_sb_dbs_cluster_leader_new | json_query(\"results[?contains(stdout,'Leader: self')].item\") }}"}}, {"name": "Start OVN NB containers (non-leader nodes)", "delegate_to": "{{ item }}", "become": true, "tripleo_container_manage": {"config_dir": "/var/lib/tripleo-config/container-startup-config/step_0", "config_id": ["ovn_cluster_north_db_server"], "config_patterns": "*ovn_cluster_north_db_server.json", "config_overrides": {".*ovn_cluster_north_db_server": {"image": "registry.redhat.io/rhosp-rhel9/openstack-ovn-nb-db-server:17.1", "name": "ovn_cluster_north_db_server"}}}, "loop": "{{groups['ovn_dbs'] | difference(groups['excluded_overcloud']) | difference(ovn_nb_leader[0])| difference(ovn_nb_leader_new[0])}}", "loop_control": {"pause": 15}}, {"name": "Start OVN SB containers (non-leader nodes)", "delegate_to": "{{ item }}", "become": true, "tripleo_container_manage": {"config_dir": "/var/lib/tripleo-config/container-startup-config/step_0", "config_id": ["ovn_cluster_south_db_server"], "config_patterns": "*ovn_cluster_south_db_server.json", "config_overrides": {".*ovn_cluster_south_db_server": {"image": "registry.redhat.io/rhosp-rhel9/openstack-ovn-sb-db-server:17.1", "name": "ovn_cluster_south_db_server"}}}, "loop": "{{groups['ovn_dbs'] | difference(groups['excluded_overcloud']) | difference(ovn_sb_leader[0])| difference(ovn_sb_leader_new[0])}}", "loop_control": {"pause": 15}}, {"name": "Pause for 50 seconds before restarting new leaders of OVN", "wait_for": {"timeout": 50}}, {"name": "Graceful stop OVN NB new-leader container", "delegate_to": "{{ ovn_nb_leader_new[0] }}", "become": true, "shell": "podman exec -u root ovn_cluster_north_db_server ovs-appctl -t /var/run/ovn/ovnnb_db.ctl exit\n", "when": "ovn_nb_leader_new[0] != ovn_nb_leader[0]"}, {"name": "Start OVN NB containers (new-leader nodes)", "delegate_to": "{{ ovn_nb_leader_new[0] }}", "become": true, "tripleo_container_manage": {"config_dir": "/var/lib/tripleo-config/container-startup-config/step_0", "config_id": ["ovn_cluster_north_db_server"], "config_patterns": "*ovn_cluster_north_db_server.json", "config_overrides": {".*ovn_cluster_north_db_server": {"image": "registry.redhat.io/rhosp-rhel9/openstack-ovn-nb-db-server:17.1", "name": "ovn_cluster_north_db_server"}}}, "when": "ovn_nb_leader_new[0] != ovn_nb_leader[0]"}, {"name": "Graceful stop OVN SB new-leader container", "delegate_to": "{{ ovn_sb_leader_new[0] }}", "become": true, "shell": "sudo podman exec -u root ovn_cluster_south_db_server ovs-appctl -t /var/run/ovn/ovnsb_db.ctl exit\n", "when": "ovn_sb_leader_new[0] != ovn_sb_leader[0]"}, {"name": "Start OVN SB containers (new-leader nodes)", "delegate_to": "{{ ovn_sb_leader_new[0] }}", "become": true, "tripleo_container_manage": {"config_dir": "/var/lib/tripleo-config/container-startup-config/step_0", "config_id": ["ovn_cluster_south_db_server"], "config_patterns": "*ovn_cluster_south_db_server.json", "config_overrides": {".*ovn_cluster_south_db_server": {"image": "registry.redhat.io/rhosp-rhel9/openstack-ovn-sb-db-server:17.1", "name": "ovn_cluster_south_db_server"}}}, "when": "ovn_sb_leader_new[0] != ovn_sb_leader[0]"}, {"name": "Start OVN northd container", "delegate_to": "{{ item }}", "become": true, "tripleo_container_manage": {"config_dir": "/var/lib/tripleo-config/container-startup-config/step_0", "config_id": ["ovn_cluster_northd"], "config_patterns": "*ovn_cluster_northd.json", "config_overrides": {".*ovn_cluster_northd": {"image": "registry.redhat.io/rhosp-rhel9/openstack-ovn-northd:17.1", "name": "ovn_cluster_northd"}}}, "loop": "{{groups['ovn_dbs'] | difference(groups['excluded_overcloud'])}}", "loop_control": {"pause": 15}}]}, {"name": "Check if python3-openvswitch3.1 workaround is needed", "delegate_to": "{{ groups['ovn_metadata'] | difference(groups['excluded_overcloud']) | first }}", "become": true, "tags": ["ovn", "ovn_image"], "when": "step|int == 1", "shell": "podman exec ovn_metadata_agent rpm -q python3-openvswitch3.1\n", "register": "metadata_python_ovs_3_1", "failed_when": false}, {"name": "Update ovn_metadata_agents first everywhere", "become": true, "tags": ["ovn", "ovn_image"], "when": ["step|int == 1", "metadata_python_ovs_3_1.rc == 0"], "block": [{"name": "Now rotate all ovn_metadata_agents", "delegate_to": "{{ item }}", "become": true, "tripleo_container_manage": {"config_dir": "/var/lib/tripleo-config/container-startup-config/step_4", "config_id": ["ovn_metadata_agent"], "config_patterns": "*ovn_metadata_agent.json", "config_overrides": {".*ovn_metadata_agent": {"image": "registry.redhat.io/rhosp-rhel9/openstack-neutron-metadata-agent-ovn:17.1", "name": "ovn_metadata_agent"}}}, "loop": "{{groups['ovn_metadata'] | difference(groups['excluded_overcloud']) }}", "loop_control": {"pause": 1}}]}, {"when": "step|int == 1", "tags": "ha_image_update", "block": [{"block": [{"name": "Get rabbitmq image from pacemaker", "become": true, "register": "xmllint_pcmk_rabbitmq_rpc_image", "shell": "xmllint --xpath \"string(//bundle[@id='rabbitmq-bundle']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container rabbitmq image", "set_fact": {"rabbitmq_rpc_image": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1", "rabbitmq_rpc_image_latest": "cluster.common.tag/rabbitmq:pcmklatest", "pcmk_rabbitmq_rpc_image": "{{xmllint_pcmk_rabbitmq_rpc_image.stdout}}"}}], "delegate_to": "{{ (groups[\"oslo_messaging_rpc\"] | difference(groups[\"excluded_overcloud\"]))[0] }}"}, {"name": "rabbitmq temporary pacemaker container tag in case of image switch", "become": true, "import_role": {"name": "tripleo_ha_image_update"}, "vars": {"tripleo_ha_image_update_node_names": "{{ groups[\"oslo_messaging_rpc\"] | difference(groups[\"excluded_overcloud\"]) }}", "tripleo_ha_image_update_bundle": "rabbitmq-bundle", "tripleo_ha_image_update_new_image": "{{rabbitmq_rpc_image_latest}}", "tripleo_ha_image_update_old_image": "{{pcmk_rabbitmq_rpc_image}}"}, "when": ["(pcmk_rabbitmq_rpc_image != \"\")", "(pcmk_rabbitmq_rpc_image != rabbitmq_rpc_image_latest)"]}]}]}


created_at: 2025-10-10 07:31:50.739793
data:
  {"value": {"step_2": {"barbican_init_log": {"image": "registry.redhat.io/rhosp-rhel9/openstack-barbican-api:17.1", "net": "none", "user": "root", "volumes": ["/var/log/containers/barbican:/var/log/barbican:z", "/var/log/containers/httpd/barbican-api:/var/log/httpd:z"], "command": ["/bin/bash", "-c", "chown -R barbican:barbican /var/log/barbican"]}, "cinder_api_init_logs": {"image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-api:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/cinder:/var/log/cinder:z", "/var/log/containers/httpd/cinder-api:/var/log/httpd:z"], "command": ["/bin/bash", "-c", "chown -R cinder:cinder /var/log/cinder"]}, "cinder_scheduler_init_logs": {"image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-scheduler:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/cinder:/var/log/cinder:z"], "command": ["/bin/bash", "-c", "chown -R cinder:cinder /var/log/cinder"]}, "clustercheck": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1", "restart": "always", "net": "host", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/clustercheck.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/clustercheck:/var/lib/kolla/config_files/src:ro", "/var/lib/mysql:/var/lib/mysql"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "glance_init_logs": {"image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z"], "command": ["/bin/bash", "-c", "chown -R glance:glance /var/log/glance"]}, "heat_init_log": {"image": "registry.redhat.io/rhosp-rhel9/openstack-heat-engine:17.1", "net": "none", "user": "root", "volumes": ["/var/log/containers/heat:/var/log/heat:z"], "command": ["/bin/bash", "-c", "chown -R heat:heat /var/log/heat"]}, "horizon_fix_perms": {"image": "registry.redhat.io/rhosp-rhel9/openstack-horizon:17.1", "net": "none", "user": "root", "command": ["/bin/bash", "-c", "touch /var/log/horizon/horizon.log ; chown -R apache:apache /var/log/horizon && chmod -R a+rx /etc/openstack-dashboard"], "volumes": ["/var/log/containers/horizon:/var/log/horizon:z", "/var/log/containers/httpd/horizon:/var/log/httpd:z", "/var/lib/config-data/puppet-generated/horizon/etc/openstack-dashboard:/etc/openstack-dashboard"]}, "keystone_init_log": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1", "net": "none", "user": "root", "command": ["/bin/bash", "-c", "chown -R keystone:keystone /var/log/keystone"], "volumes": ["/var/log/containers/keystone:/var/log/keystone:z", "/var/log/containers/httpd/keystone:/var/log/httpd:z"]}, "manila_init_logs": {"image": "registry.redhat.io/rhosp-rhel9/openstack-manila-api:17.1", "net": "none", "user": "root", "volumes": ["/var/log/containers/manila:/var/log/manila:z", "/var/log/containers/httpd/manila-api:/var/log/httpd:z"], "command": ["/bin/bash", "-c", "chown -R manila:manila /var/log/manila"]}, "mysql_wait_bundle": {"start_order": 0, "detach": false, "net": "host", "ipc": "host", "user": "root", "command": ["/container_puppet_apply.sh", "2", "file,file_line,concat,augeas,galera_ready,mysql_database,mysql_grant,mysql_user", "include tripleo::profile::pacemaker::database::mysql_bundle"], "image": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/var/lib/container-config-scripts/container_puppet_apply.sh:/container_puppet_apply.sh:ro", "/etc/puppet:/tmp/puppet-etc:ro", "/usr/share/openstack-puppet/modules:/usr/share/openstack-puppet/modules:ro", "/var/lib/mysql:/var/lib/mysql:rw,z", "/var/lib/config-data/puppet-generated/mysql/root:/root:rw"], "environment": {"TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}}, "neutron_init_logs": {"image": "registry.redhat.io/rhosp-rhel9/openstack-neutron-server:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/neutron:/var/log/neutron:z", "/var/log/containers/httpd/neutron-api:/var/log/httpd:z"], "command": ["/bin/bash", "-c", "chown -R neutron:neutron /var/log/neutron"]}, "create_dnsmasq_wrapper": {"start_order": 1, "detach": false, "net": "host", "pid": "host", "user": "root", "command": ["/container_puppet_apply.sh", "4", "file", "include ::tripleo::profile::base::neutron::dhcp_agent_wrappers"], "image": "registry.redhat.io/rhosp-rhel9/openstack-neutron-dhcp-agent:17.1", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/var/lib/container-config-scripts/container_puppet_apply.sh:/container_puppet_apply.sh:ro", "/etc/puppet:/tmp/puppet-etc:ro", "/usr/share/openstack-puppet/modules:/usr/share/openstack-puppet/modules:ro", "/run/openvswitch:/run/openvswitch:shared,z", "/var/lib/neutron:/var/lib/neutron:shared,z"]}, "nova_api_init_logs": {"image": "registry.redhat.io/rhosp-rhel9/openstack-nova-api:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/nova:/var/log/nova:z", "/var/log/containers/httpd/nova-api:/var/log/httpd:z"], "command": ["/bin/bash", "-c", "chown -R nova:nova /var/log/nova"], "environment": {"TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}}, "nova_conductor_init_log": {"image": "registry.redhat.io/rhosp-rhel9/openstack-nova-conductor:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/nova:/var/log/nova:z"], "command": ["/bin/bash", "-c", "chown -R nova:nova /var/log/nova"], "environment": {"TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}}, "nova_metadata_init_logs": {"image": "registry.redhat.io/rhosp-rhel9/openstack-nova-api:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/nova:/var/log/nova:z", "/var/log/containers/httpd/nova-metadata:/var/log/httpd:z"], "command": ["/bin/bash", "-c", "chown -R nova:nova /var/log/nova"]}, "nova_compute_init_log": {"image": "registry.redhat.io/rhosp-rhel9/openstack-nova-compute:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/nova:/var/log/nova:z"], "command": ["/bin/bash", "-c", "chown -R nova:nova /var/log/nova"], "environment": {"TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}}, "nova_virtqemud_init_logs": {"image": "registry.redhat.io/rhosp-rhel9/openstack-nova-libvirt:17.1", "net": "none", "privileged": true, "security_opt": ["label=level:s0", "label=type:spc_t", "label=filetype:container_file_t"], "user": "root", "volumes": ["/var/log/containers/libvirt/swtpm:/var/log/swtpm:shared,z"], "command": ["/bin/bash", "-c", "chown -R tss:tss /var/log/swtpm"], "environment": {"TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}}, "create_virtlogd_wrapper": {"start_order": 1, "detach": false, "cgroupns": "host", "net": "host", "pid": "host", "user": "root", "command": ["/container_puppet_apply.sh", "4", "file", "include ::tripleo::profile::base::nova::virtlogd_wrapper"], "image": "registry.redhat.io/rhosp-rhel9/openstack-nova-libvirt:17.1", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/var/lib/container-config-scripts/container_puppet_apply.sh:/container_puppet_apply.sh:ro", "/etc/puppet:/tmp/puppet-etc:ro", "/usr/share/openstack-puppet/modules:/usr/share/openstack-puppet/modules:ro", "/var/lib/container-config-scripts:/var/lib/container-config-scripts:shared,z"], "environment": {"TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}}, "create_haproxy_wrapper": {"start_order": 1, "detach": false, "net": "host", "pid": "host", "user": "root", "command": ["/container_puppet_apply.sh", "4", "file", "include ::tripleo::profile::base::neutron::ovn_metadata_agent_wrappers"], "image": "registry.redhat.io/rhosp-rhel9/openstack-neutron-metadata-agent-ovn:17.1", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/var/lib/container-config-scripts/container_puppet_apply.sh:/container_puppet_apply.sh:ro", "/etc/puppet:/tmp/puppet-etc:ro", "/usr/share/openstack-puppet/modules:/usr/share/openstack-puppet/modules:ro", "/run/openvswitch:/run/openvswitch:shared,z", "/var/lib/neutron:/var/lib/neutron:shared,z"]}, "rabbitmq_wait_bundle": {"start_order": 0, "detach": false, "net": "host", "ipc": "host", "user": "root", "command": ["/container_puppet_apply.sh", "2", "file,file_line,concat,augeas,rabbitmq_policy,rabbitmq_user,rabbitmq_ready", "include tripleo::profile::pacemaker::rabbitmq_bundle", ""], "image": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/var/lib/container-config-scripts/container_puppet_apply.sh:/container_puppet_apply.sh:ro", "/etc/puppet:/tmp/puppet-etc:ro", "/usr/share/openstack-puppet/modules:/usr/share/openstack-puppet/modules:ro", "/bin/true:/bin/epmd"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "KOLLA_BOOTSTRAP": true, "TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}}, "placement_init_log": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1", "net": "none", "user": "root", "command": ["/bin/bash", "-c", "chown -R placement:placement /var/log/placement"], "volumes": ["/var/log/containers/placement:/var/log/placement:z", "/var/log/containers/httpd/placement:/var/log/httpd:z"]}}, "step_3": {"barbican_api_db_sync": {"start_order": 3, "image": "registry.redhat.io/rhosp-rhel9/openstack-barbican-api:17.1", "cap_add": ["AUDIT_WRITE"], "net": "host", "detach": false, "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/barbican:/var/log/barbican:z", "/var/log/containers/httpd/barbican-api:/var/log/httpd:z", "/var/lib/config-data/puppet-generated/barbican:/var/lib/kolla/config_files/src:ro", "/var/lib/kolla/config_files/barbican_api_db_sync.json:/var/lib/kolla/config_files/config.json:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "barbican_api_secret_store_sync": {"start_order": 4, "image": "registry.redhat.io/rhosp-rhel9/openstack-barbican-api:17.1", "net": "host", "detach": false, "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/barbican:/var/log/barbican:z", "/var/log/containers/httpd/barbican-api:/var/log/httpd:z", "/var/lib/config-data/puppet-generated/barbican:/var/lib/kolla/config_files/src:ro", "/var/lib/kolla/config_files/barbican_api_secret_store_sync.json:/var/lib/kolla/config_files/config.json:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "barbican_api": {"start_order": 5, "image": "registry.redhat.io/rhosp-rhel9/openstack-barbican-api:17.1", "net": "host", "privileged": false, "restart": "always", "user": "root", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/barbican:/var/log/barbican:z", "/var/log/containers/httpd/barbican-api:/var/log/httpd:z", "/var/lib/kolla/config_files/barbican_api.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/barbican:/var/lib/kolla/config_files/src:ro", "/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro", "/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "barbican_keystone_listener": {"start_order": 6, "image": "registry.redhat.io/rhosp-rhel9/openstack-barbican-keystone-listener:17.1", "net": "host", "privileged": false, "restart": "always", "user": "barbican", "healthcheck": {"test": "/openstack/healthcheck 5672"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/barbican:/var/log/barbican:z", "/var/log/containers/httpd/barbican-api:/var/log/httpd:z", "/var/lib/kolla/config_files/barbican_keystone_listener.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/barbican:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "barbican_worker": {"start_order": 7, "image": "registry.redhat.io/rhosp-rhel9/openstack-barbican-worker:17.1", "net": "host", "privileged": false, "restart": "always", "user": "barbican", "healthcheck": {"test": "/openstack/healthcheck 5672"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/barbican:/var/log/barbican:z", "/var/log/containers/httpd/barbican-api:/var/log/httpd:z", "/var/lib/kolla/config_files/barbican_worker.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/barbican:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "cinder_api_db_sync": {"image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-api:17.1", "cap_add": ["AUDIT_WRITE"], "net": "host", "privileged": false, "detach": false, "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/cinder_api_db_sync.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro", "/var/log/containers/cinder:/var/log/cinder:z", "/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro", "/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}}, "cinder_backup_init_logs": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-backup:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/cinder:/var/log/cinder:z"], "command": ["/bin/bash", "-c", "chown -R cinder:cinder /var/log/cinder"]}, "cinder_volume_init_logs": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-volume:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/cinder:/var/log/cinder"], "command": ["/bin/bash", "-c", "chown -R cinder:cinder /var/log/cinder"]}, "glance_api_db_sync": {"image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "cap_add": ["AUDIT_WRITE"], "net": "host", "privileged": false, "detach": false, "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z", "/var/lib/kolla/config_files/glance_api.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/glance:/var/lib/glance:shared"], "environment": {"KOLLA_BOOTSTRAP": true, "KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}, "command": "/usr/bin/bootstrap_host_exec glance_api su glance -s /bin/bash -c '/usr/local/bin/kolla_start'"}, "heat_engine_db_sync": {"image": "registry.redhat.io/rhosp-rhel9/openstack-heat-engine:17.1", "cap_add": ["AUDIT_WRITE"], "net": "host", "privileged": false, "detach": false, "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/heat:/var/log/heat:z", "/var/lib/kolla/config_files/heat_engine_db_sync.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/heat:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}}, "horizon": {"image": "registry.redhat.io/rhosp-rhel9/openstack-horizon:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/horizon.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/horizon:/var/lib/kolla/config_files/src:ro", "/var/log/containers/horizon:/var/log/horizon:z", "/var/log/containers/httpd/horizon:/var/log/httpd:z", "/var/tmp/horizon:/var/tmp:z", "/var/www:/var/www:ro", "/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro", "/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "ENABLE_DESIGNATE": "yes", "ENABLE_HEAT": "yes", "ENABLE_IRONIC": "yes", "ENABLE_MANILA": "yes", "ENABLE_OCTAVIA": "yes"}}, "iscsid": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-iscsid:17.1", "net": "host", "privileged": true, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/iscsid.json:/var/lib/kolla/config_files/config.json:ro", "/dev:/dev", "/run:/run", "/sys:/sys", "/lib/modules:/lib/modules:ro", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/etc/target:/etc/target:z", "/var/lib/iscsi:/var/lib/iscsi:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "keystone_db_sync": {"image": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1", "net": "host", "user": "root", "privileged": false, "detach": false, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/keystone:/var/log/keystone:z", "/var/log/containers/httpd/keystone:/var/log/httpd:z", "/etc/openldap:/etc/openldap:ro", "/var/lib/kolla/config_files/keystone.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/keystone:/var/lib/kolla/config_files/src:ro", "/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro", "/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro"], "environment": {"KOLLA_BOOTSTRAP": true, "KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}, "command": ["/usr/bin/bootstrap_host_exec", "keystone", "/usr/local/bin/kolla_start"]}, "keystone": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/keystone:/var/log/keystone:z", "/var/log/containers/httpd/keystone:/var/log/httpd:z", "/etc/openldap:/etc/openldap:ro", "/var/lib/kolla/config_files/keystone.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/keystone:/var/lib/kolla/config_files/src:ro", "/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro", "/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "keystone_bootstrap": {"start_order": 3, "action": "exec", "user": "root", "command": ["keystone", "/usr/bin/bootstrap_host_exec", "keystone", "keystone-manage", "bootstrap"], "environment": {"KOLLA_BOOTSTRAP": true, "OS_BOOTSTRAP_PASSWORD": "BFsMxWENF4PjwoZZyxQdpbnKu", "OS_BOOTSTRAP_USERNAME": "admin", "OS_BOOTSTRAP_PROJECT_NAME": "admin", "OS_BOOTSTRAP_ROLE_NAME": "admin", "OS_BOOTSTRAP_SERVICE_NAME": "keystone", "OS_BOOTSTRAP_ADMIN_URL": "https://overcloud.ctlplane.ooo.test:35357", "OS_BOOTSTRAP_PUBLIC_URL": "https://standalone.ooo.test:13000", "OS_BOOTSTRAP_INTERNAL_URL": "https://overcloud.internalapi.ooo.test:5000", "OS_BOOTSTRAP_REGION_ID": "regionOne"}}, "keystone_cron": {"start_order": 4, "image": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1", "user": "root", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/usr/share/openstack-tripleo-common/healthcheck/cron keystone"}, "command": ["/bin/bash", "-c", "/usr/local/bin/kolla_set_configs && /usr/sbin/crond -n"], "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/keystone:/var/log/keystone:z", "/var/log/containers/httpd/keystone:/var/log/httpd:z", "/var/lib/kolla/config_files/keystone_cron.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/keystone:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "manila_api_db_sync": {"user": "root", "image": "registry.redhat.io/rhosp-rhel9/openstack-manila-api:17.1", "cap_add": ["AUDIT_WRITE"], "net": "host", "detach": false, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/manila_api_db_sync.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/manila:/var/lib/kolla/config_files/src:ro", "/var/log/containers/manila:/var/log/manila:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "manila_share_init_logs": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-manila-share:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/manila:/var/log/manila:z"], "command": ["/bin/bash", "-c", "chown -R manila:manila /var/log/manila"]}, "neutron_db_sync": {"image": "registry.redhat.io/rhosp-rhel9/openstack-neutron-server:17.1", "cap_add": ["AUDIT_WRITE"], "net": "host", "privileged": false, "detach": false, "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/neutron:/var/log/neutron:z", "/var/log/containers/httpd/neutron-api:/var/log/httpd:z", "/var/lib/kolla/config_files/neutron_api_db_sync.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/neutron:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}}, "nova_api_db_sync": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-nova-api:17.1", "cap_add": ["AUDIT_WRITE"], "net": "host", "detach": false, "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/nova:/var/log/nova:z", "/var/log/containers/httpd/nova-api:/var/log/httpd:z", "/var/lib/kolla/config_files/nova_api_db_sync.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/nova:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}}, "nova_api_ensure_default_cells": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-nova-api:17.1", "user": "root", "net": "host", "privileged": false, "detach": false, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/nova:/var/log/nova:z", "/var/log/containers/httpd/nova-api:/var/log/httpd:z", "/var/lib/kolla/config_files/nova_api_ensure_default_cells.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/nova:/var/lib/kolla/config_files/src:ro", "/var/lib/container-config-scripts:/container-config-scripts:z"], "environment": {"__OS_DEBUG": "true", "KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "nova_db_sync": {"image": "registry.redhat.io/rhosp-rhel9/openstack-nova-conductor:17.1", "cap_add": ["AUDIT_WRITE"], "start_order": 3, "net": "host", "detach": false, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/nova:/var/log/nova", "/var/lib/kolla/config_files/nova_conductor_db_sync.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/nova:/var/lib/kolla/config_files/src:ro"], "user": "root", "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}}, "nova_statedir_owner": {"image": "registry.redhat.io/rhosp-rhel9/openstack-nova-compute:17.1", "net": "none", "user": "root", "security_opt": ["label=disable"], "privileged": false, "detach": false, "volumes": ["/var/lib/nova:/var/lib/nova:shared", "/var/lib/_nova_secontext:/var/lib/_nova_secontext:shared,z", "/var/lib/container-config-scripts:/container-config-scripts:z"], "command": "/container-config-scripts/pyshim.sh /container-config-scripts/nova_statedir_ownership.py", "environment": {"TRIPLEO_DEPLOY_IDENTIFIER": "1760081186", "__OS_DEBUG": "true", "NOVA_STATEDIR_OWNERSHIP_SKIP": "triliovault-mounts"}}, "nova_virtlogd_wrapper": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-nova-libvirt:17.1", "ulimit": ["nofile=131072", "nproc=126960"], "cgroupns": "host", "net": "host", "pid": "host", "privileged": true, "security_opt": ["label=level:s0", "label=type:spc_t", "label=filetype:container_file_t"], "restart": "always", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/libvirt:/var/log/libvirt:shared,z", "/lib/modules:/lib/modules:ro", "/dev:/dev", "/run:/run", "/sys/fs/cgroup:/sys/fs/cgroup", "/sys/fs/selinux:/sys/fs/selinux", "/etc/selinux/config:/etc/selinux/config:ro", "/etc/libvirt:/etc/libvirt:shared", "/etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro", "/run/libvirt:/run/libvirt:shared,z", "/var/lib/nova:/var/lib/nova:shared", "/var/lib/libvirt:/var/lib/libvirt:shared", "/var/cache/libvirt:/var/cache/libvirt:shared", "/var/lib/vhost_sockets:/var/lib/vhost_sockets", "/var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/etc/pki/CA/cacert.pem:/etc/pki/CA/cacert.pem:ro", "/etc/pki/libvirt:/etc/pki/libvirt:ro", "/etc/pki/qemu:/etc/pki/qemu:ro", "/var/lib/kolla/config_files/nova_virtlogd.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/container-config-scripts/virtlogd_wrapper:/usr/local/bin/virtlogd_wrapper:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "nova_virtsecretd": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-nova-libvirt:17.1", "ulimit": ["nofile=131072", "nproc=126960"], "cgroupns": "host", "net": "host", "pid": "host", "pids_limit": 65536, "privileged": true, "security_opt": ["label=level:s0", "label=type:spc_t", "label=filetype:container_file_t"], "restart": "always", "depends_on": ["tripleo_nova_virtlogd_wrapper.service"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/libvirt:/var/log/libvirt:shared,z", "/lib/modules:/lib/modules:ro", "/dev:/dev", "/run:/run", "/sys/fs/cgroup:/sys/fs/cgroup", "/sys/fs/selinux:/sys/fs/selinux", "/etc/selinux/config:/etc/selinux/config:ro", "/etc/libvirt:/etc/libvirt:shared", "/etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro", "/run/libvirt:/run/libvirt:shared,z", "/var/lib/nova:/var/lib/nova:shared", "/var/lib/libvirt:/var/lib/libvirt:shared", "/var/cache/libvirt:/var/cache/libvirt:shared", "/var/lib/vhost_sockets:/var/lib/vhost_sockets", "/var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/etc/pki/CA/cacert.pem:/etc/pki/CA/cacert.pem:ro", "/etc/pki/libvirt:/etc/pki/libvirt:ro", "/etc/pki/qemu:/etc/pki/qemu:ro", "/var/lib/kolla/config_files/nova_virtsecretd.json:/var/lib/kolla/config_files/config.json:ro"]}, "nova_virtnodedevd": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-nova-libvirt:17.1", "ulimit": ["nofile=131072", "nproc=126960"], "cgroupns": "host", "net": "host", "pid": "host", "pids_limit": 65536, "privileged": true, "security_opt": ["label=level:s0", "label=type:spc_t", "label=filetype:container_file_t"], "restart": "always", "depends_on": ["tripleo_nova_virtlogd_wrapper.service"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/libvirt:/var/log/libvirt:shared,z", "/lib/modules:/lib/modules:ro", "/dev:/dev", "/run:/run", "/sys/fs/cgroup:/sys/fs/cgroup", "/sys/fs/selinux:/sys/fs/selinux", "/etc/selinux/config:/etc/selinux/config:ro", "/etc/libvirt:/etc/libvirt:shared", "/etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro", "/run/libvirt:/run/libvirt:shared,z", "/var/lib/nova:/var/lib/nova:shared", "/var/lib/libvirt:/var/lib/libvirt:shared", "/var/cache/libvirt:/var/cache/libvirt:shared", "/var/lib/vhost_sockets:/var/lib/vhost_sockets", "/var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/etc/pki/CA/cacert.pem:/etc/pki/CA/cacert.pem:ro", "/etc/pki/libvirt:/etc/pki/libvirt:ro", "/etc/pki/qemu:/etc/pki/qemu:ro", "/var/lib/kolla/config_files/nova_virtnodedevd.json:/var/lib/kolla/config_files/config.json:ro"]}, "nova_virtstoraged": {"start_order": 3, "image": "registry.redhat.io/rhosp-rhel9/openstack-nova-libvirt:17.1", "ulimit": ["nofile=131072", "nproc=126960"], "cgroupns": "host", "net": "host", "pid": "host", "pids_limit": 65536, "privileged": true, "security_opt": ["label=level:s0", "label=type:spc_t", "label=filetype:container_file_t"], "restart": "always", "depends_on": ["tripleo_nova_virtlogd_wrapper.service"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/libvirt:/var/log/libvirt:shared,z", "/lib/modules:/lib/modules:ro", "/dev:/dev", "/run:/run", "/sys/fs/cgroup:/sys/fs/cgroup", "/sys/fs/selinux:/sys/fs/selinux", "/etc/selinux/config:/etc/selinux/config:ro", "/etc/libvirt:/etc/libvirt:shared", "/etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro", "/run/libvirt:/run/libvirt:shared,z", "/var/lib/nova:/var/lib/nova:shared", "/var/lib/libvirt:/var/lib/libvirt:shared", "/var/cache/libvirt:/var/cache/libvirt:shared", "/var/lib/vhost_sockets:/var/lib/vhost_sockets", "/var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/etc/pki/CA/cacert.pem:/etc/pki/CA/cacert.pem:ro", "/etc/pki/libvirt:/etc/pki/libvirt:ro", "/etc/pki/qemu:/etc/pki/qemu:ro", "/var/lib/kolla/config_files/nova_virtstoraged.json:/var/lib/kolla/config_files/config.json:ro"]}, "nova_virtqemud": {"start_order": 4, "image": "registry.redhat.io/rhosp-rhel9/openstack-nova-libvirt:17.1", "ulimit": ["nofile=131072", "nproc=126960"], "cgroupns": "host", "net": "host", "pid": "host", "pids_limit": 65536, "privileged": true, "security_opt": ["label=level:s0", "label=type:spc_t", "label=filetype:container_file_t"], "restart": "always", "depends_on": ["tripleo_nova_virtlogd_wrapper.service"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/libvirt:/var/log/libvirt:shared,z", "/lib/modules:/lib/modules:ro", "/dev:/dev", "/run:/run", "/sys/fs/cgroup:/sys/fs/cgroup", "/sys/fs/selinux:/sys/fs/selinux", "/etc/selinux/config:/etc/selinux/config:ro", "/etc/libvirt:/etc/libvirt:shared", "/etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro", "/run/libvirt:/run/libvirt:shared,z", "/var/lib/nova:/var/lib/nova:shared", "/var/lib/libvirt:/var/lib/libvirt:shared", "/var/cache/libvirt:/var/cache/libvirt:shared", "/var/lib/vhost_sockets:/var/lib/vhost_sockets", "/var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/etc/pki/CA/cacert.pem:/etc/pki/CA/cacert.pem:ro", "/etc/pki/libvirt:/etc/pki/libvirt:ro", "/etc/pki/qemu:/etc/pki/qemu:ro", "/var/lib/kolla/config_files/nova_virtqemud.json:/var/lib/kolla/config_files/config.json:ro", "/var/log/containers/libvirt/swtpm:/var/log/swtpm:z"]}, "nova_virtproxyd": {"start_order": 5, "image": "registry.redhat.io/rhosp-rhel9/openstack-nova-libvirt:17.1", "ulimit": ["nofile=131072", "nproc=126960"], "cgroupns": "host", "net": "host", "pid": "host", "pids_limit": 65536, "privileged": true, "security_opt": ["label=level:s0", "label=type:spc_t", "label=filetype:container_file_t"], "restart": "always", "depends_on": ["tripleo_nova_virtlogd_wrapper.service"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/libvirt:/var/log/libvirt:shared,z", "/lib/modules:/lib/modules:ro", "/dev:/dev", "/run:/run", "/sys/fs/cgroup:/sys/fs/cgroup", "/sys/fs/selinux:/sys/fs/selinux", "/etc/selinux/config:/etc/selinux/config:ro", "/etc/libvirt:/etc/libvirt:shared", "/etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro", "/run/libvirt:/run/libvirt:shared,z", "/var/lib/nova:/var/lib/nova:shared", "/var/lib/libvirt:/var/lib/libvirt:shared", "/var/cache/libvirt:/var/cache/libvirt:shared", "/var/lib/vhost_sockets:/var/lib/vhost_sockets", "/var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/etc/pki/CA/cacert.pem:/etc/pki/CA/cacert.pem:ro", "/etc/pki/libvirt:/etc/pki/libvirt:ro", "/etc/pki/qemu:/etc/pki/qemu:ro", "/var/lib/kolla/config_files/nova_virtproxyd.json:/var/lib/kolla/config_files/config.json:ro"]}, "placement_api_db_sync": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1", "cap_add": ["AUDIT_WRITE"], "net": "host", "detach": false, "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/placement:/var/log/placement:z", "/var/log/containers/httpd/placement:/var/log/httpd:z", "/var/lib/kolla/config_files/placement_api_db_sync.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/placement:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}}, "swift_copy_rings": {"image": "registry.redhat.io/rhosp-rhel9/openstack-swift-proxy-server:17.1", "net": "none", "user": "root", "detach": false, "command": ["/bin/bash", "-c", "cp -v -dR --preserve -t /etc/swift /swift_ringbuilder/etc/swift/*.gz /swift_ringbuilder/etc/swift/*.builder /swift_ringbuilder/etc/swift/backups"], "volumes": ["/var/lib/config-data/puppet-generated/swift/etc/swift:/etc/swift:rw,z", "/var/lib/config-data/puppet-generated/swift_ringbuilder:/swift_ringbuilder:ro"], "environment": {"TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}}, "swift_setup_srv": {"image": "registry.redhat.io/rhosp-rhel9/openstack-swift-account:17.1", "net": "none", "user": "root", "command": ["find", "/srv/node", "-maxdepth", "1", "-type", "d", "-exec", "chown", "swift:", "{}", ";"], "volumes": ["/srv/node:/srv/node:z"], "environment": {"TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}}}, "step_4": {"cinder_api": {"image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-api:17.1", "net": "host", "privileged": false, "restart": "always", "user": "root", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/cinder_api.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro", "/var/log/containers/cinder:/var/log/cinder:z", "/var/log/containers/httpd/cinder-api:/var/log/httpd:z", "/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro", "/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "cinder_api_cron": {"image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-api:17.1", "net": "host", "user": "root", "privileged": false, "restart": "always", "healthcheck": {"test": "/usr/share/openstack-tripleo-common/healthcheck/cron cinder"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/cinder_api_cron.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro", "/var/log/containers/cinder:/var/log/cinder:z", "/var/log/containers/httpd/cinder-api:/var/log/httpd:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "cinder_scheduler": {"image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-scheduler:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck 5672"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro", "/var/log/containers/cinder:/var/log/cinder:z", "/var/lib/kolla/config_files/cinder_scheduler.json:/var/lib/kolla/config_files/config.json:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "logrotate_crond": {"image": "registry.redhat.io/rhosp-rhel9/openstack-cron:17.1", "net": "none", "pid": "host", "privileged": true, "user": "root", "restart": "always", "healthcheck": {"test": "/usr/share/openstack-tripleo-common/healthcheck/cron"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/logrotate-crond.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/crond:/var/lib/kolla/config_files/src:ro", "/var/log/containers:/var/log/containers:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "glance_api": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z", "/var/lib/kolla/config_files/glance_api.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/glance:/var/lib/glance:shared"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "glance_api_tls_proxy": {"start_order": 3, "image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "host", "user": "root", "restart": "always", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z", "/var/lib/kolla/config_files/glance_api_tls_proxy.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro", "/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro", "/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "glance_api_cron": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "host", "user": "root", "privileged": false, "restart": "always", "healthcheck": {"test": "/usr/share/openstack-tripleo-common/healthcheck/cron glance"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z", "/var/lib/kolla/config_files/glance_api_cron.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro", "/var/lib/glance:/var/lib/glance:shared"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "glance_api_internal": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z", "/var/lib/kolla/config_files/glance_api.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/glance_api_internal:/var/lib/kolla/config_files/src:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/glance:/var/lib/glance:shared"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "glance_api_internal_tls_proxy": {"start_order": 3, "image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "host", "user": "root", "restart": "always", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z", "/var/lib/kolla/config_files/glance_api_tls_proxy.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/glance_api_internal:/var/lib/kolla/config_files/src:ro", "/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro", "/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "heat_api": {"image": "registry.redhat.io/rhosp-rhel9/openstack-heat-api:17.1", "net": "host", "privileged": false, "restart": "always", "user": "root", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/heat:/var/log/heat:z", "/var/log/containers/httpd/heat-api:/var/log/httpd:z", "/var/lib/kolla/config_files/heat_api.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/heat_api:/var/lib/kolla/config_files/src:ro", "/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro", "/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "heat_api_cron": {"image": "registry.redhat.io/rhosp-rhel9/openstack-heat-api:17.1", "net": "host", "user": "root", "privileged": false, "restart": "always", "healthcheck": {"test": "/usr/share/openstack-tripleo-common/healthcheck/cron heat"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/heat:/var/log/heat:z", "/var/log/containers/httpd/heat-api:/var/log/httpd:z", "/var/lib/kolla/config_files/heat_api_cron.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/heat_api:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "heat_api_cfn": {"image": "registry.redhat.io/rhosp-rhel9/openstack-heat-api-cfn:17.1", "net": "host", "privileged": false, "restart": "always", "user": "root", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/heat:/var/log/heat:z", "/var/log/containers/httpd/heat-api-cfn:/var/log/httpd:z", "/var/lib/kolla/config_files/heat_api_cfn.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/heat_api_cfn:/var/lib/kolla/config_files/src:ro", "/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro", "/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "heat_engine": {"image": "registry.redhat.io/rhosp-rhel9/openstack-heat-engine:17.1", "net": "host", "privileged": false, "stop_grace_period": 60, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck 5672"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/heat:/var/log/heat:z", "/var/lib/kolla/config_files/heat_engine.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/heat:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "keystone_refresh": {"start_order": 1, "action": "exec", "user": "root", "command": ["keystone", "pkill", "--signal", "USR1", "httpd"]}, "manila_api": {"image": "registry.redhat.io/rhosp-rhel9/openstack-manila-api:17.1", "net": "host", "restart": "always", "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/manila_api.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/manila:/var/lib/kolla/config_files/src:ro", "/var/log/containers/manila:/var/log/manila:z", "/var/log/containers/httpd/manila-api:/var/log/httpd:z", "/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro", "/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "manila_api_cron": {"image": "registry.redhat.io/rhosp-rhel9/openstack-manila-api:17.1", "net": "host", "user": "root", "privileged": false, "restart": "always", "healthcheck": {"test": "/usr/share/openstack-tripleo-common/healthcheck/cron manila"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/manila_api_cron.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/manila:/var/lib/kolla/config_files/src:ro", "/var/log/containers/manila:/var/log/manila:z", "/var/log/containers/httpd/manila-api:/var/log/httpd:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "manila_scheduler": {"image": "registry.redhat.io/rhosp-rhel9/openstack-manila-scheduler:17.1", "net": "host", "restart": "always", "healthcheck": {"test": "/openstack/healthcheck 5672"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/manila_scheduler.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/manila:/var/lib/kolla/config_files/src:ro", "/var/log/containers/manila:/var/log/manila:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "neutron_api": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-neutron-server:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/neutron:/var/log/neutron:z", "/var/log/containers/httpd/neutron-api:/var/log/httpd:z", "/var/lib/kolla/config_files/neutron_api.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/neutron:/var/lib/kolla/config_files/src:ro", "/etc/pki/tls/certs/neutron_ovn.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/neutron_ovn.crt:ro", "/etc/pki/tls/private/neutron_ovn.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/neutron_ovn.key:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "neutron_server_tls_proxy": {"image": "registry.redhat.io/rhosp-rhel9/openstack-neutron-server:17.1", "net": "host", "user": "root", "restart": "always", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/neutron:/var/log/neutron:z", "/var/log/containers/httpd/neutron-api:/var/log/httpd:z", "/var/lib/kolla/config_files/neutron_server_tls_proxy.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/neutron:/var/lib/kolla/config_files/src:ro", "/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro", "/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "neutron_sriov_agent": {"start_order": 10, "image": "registry.redhat.io/rhosp-rhel9/openstack-neutron-sriov-agent:17.1", "net": "host", "pid": "host", "privileged": true, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck 5672"}, "ulimit": ["nofile=16384"], "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/neutron:/var/log/neutron:z", "/var/lib/kolla/config_files/neutron_sriov_agent.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/neutron:/var/lib/kolla/config_files/src:ro", "/lib/modules:/lib/modules:ro", "/run:/run", "/sys/class/net:/sys/class/net:rw"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "neutron_dhcp": {"start_order": 10, "image": "registry.redhat.io/rhosp-rhel9/openstack-neutron-dhcp-agent:17.1", "net": "host", "pid": "host", "cgroupns": "host", "privileged": true, "restart": "always", "security_opt": ["label=disable"], "depends_on": ["openvswitch.service"], "healthcheck": {"test": "/openstack/healthcheck 5672"}, "ulimit": ["nofile=16384"], "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/neutron:/var/log/neutron:z", "/var/lib/kolla/config_files/neutron_dhcp.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/neutron:/var/lib/kolla/config_files/src:ro", "/lib/modules:/lib/modules:ro", "/run/openvswitch:/run/openvswitch:shared,z", "/var/lib/neutron:/var/lib/neutron:shared,z", "/run/netns:/run/netns:shared", "/var/lib/neutron/kill_scripts:/etc/neutron/kill_scripts:shared,z", "/var/lib/neutron/dnsmasq_wrapper:/usr/local/bin/dnsmasq:ro", "/var/lib/neutron/dhcp_haproxy_wrapper:/usr/local/bin/haproxy:ro", "/etc/pki/tls/certs/neutron.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/neutron.crt:ro", "/etc/pki/tls/private/neutron.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/neutron.key:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "nova_api": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-nova-api:17.1", "net": "host", "user": "root", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/nova:/var/log/nova:z", "/var/log/containers/httpd/nova-api:/var/log/httpd:z", "/var/lib/kolla/config_files/nova_api.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/nova:/var/lib/kolla/config_files/src:ro", "/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro", "/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "nova_wait_for_api_service": {"start_order": 3, "image": "registry.redhat.io/rhosp-rhel9/openstack-nova-api:17.1", "user": "root", "net": "host", "privileged": false, "detach": false, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/nova:/var/log/nova:z", "/var/log/containers/httpd/nova-api:/var/log/httpd:z", "/var/lib/kolla/config_files/nova_wait_for_api_service.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/nova:/var/lib/kolla/config_files/src:ro", "/var/lib/container-config-scripts:/container-config-scripts:z"], "environment": {"__OS_DEBUG": "true", "KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "nova_api_cron": {"start_order": 4, "image": "registry.redhat.io/rhosp-rhel9/openstack-nova-api:17.1", "net": "host", "user": "root", "privileged": false, "restart": "always", "healthcheck": {"test": "/usr/share/openstack-tripleo-common/healthcheck/cron nova"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/nova:/var/log/nova:z", "/var/log/containers/httpd/nova-api:/var/log/httpd:z", "/var/lib/kolla/config_files/nova_api_cron.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/nova:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "nova_conductor": {"image": "registry.redhat.io/rhosp-rhel9/openstack-nova-conductor:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck 5672"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/nova:/var/log/nova", "/var/lib/kolla/config_files/nova_conductor.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/nova:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "nova_metadata": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-nova-api:17.1", "net": "host", "user": "root", "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/nova:/var/log/nova:z", "/var/log/containers/httpd/nova-metadata:/var/log/httpd:z", "/var/lib/kolla/config_files/nova_metadata.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/nova_metadata:/var/lib/kolla/config_files/src:ro", "/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro", "/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "nova_scheduler": {"image": "registry.redhat.io/rhosp-rhel9/openstack-nova-scheduler:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck 5672"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/nova:/var/log/nova", "/var/lib/kolla/config_files/nova_scheduler.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/nova:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "nova_migration_target": {"image": "registry.redhat.io/rhosp-rhel9/openstack-nova-compute:17.1", "net": "host", "privileged": true, "user": "root", "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/nova-migration-target.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro", "/etc/ssh:/host-ssh:ro", "/run/libvirt:/run/libvirt:shared,z", "/var/lib/nova:/var/lib/nova:shared"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "nova_vnc_proxy": {"image": "registry.redhat.io/rhosp-rhel9/openstack-nova-novncproxy:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/nova:/var/log/nova", "/var/lib/kolla/config_files/nova_vnc_proxy.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/nova:/var/lib/kolla/config_files/src:ro", "/etc/ipa/ca.crt:/etc/pki/CA/certs/vnc.crt:ro", "/etc/pki/tls/certs/libvirt-vnc-client-cert.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/libvirt-vnc-client-cert.crt:ro", "/etc/pki/tls/private/libvirt-vnc-client-cert.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/libvirt-vnc-client-cert.key:ro", "/etc/pki/tls/certs/novnc-proxy.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/novnc-proxy.crt:ro", "/etc/pki/tls/private/novnc-proxy.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/novnc-proxy.key:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "configure_cms_options": {"start_order": 0, "detach": false, "net": "host", "privileged": true, "user": "root", "command": ["/bin/bash", "-c", "CMS_OPTS=$(hiera ovn::controller::ovn_cms_options -c /etc/puppet/hiera.yaml);  if [ X\"$CMS_OPTS\" !=  X ]; then ovs-vsctl set open . external_ids:ovn-cms-options=$CMS_OPTS;else ovs-vsctl remove open . external_ids ovn-cms-options; fi"], "image": "registry.redhat.io/rhosp-rhel9/openstack-ovn-controller:17.1", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/lib/modules:/lib/modules:ro", "/run/openvswitch:/run/openvswitch:shared,z"], "environment": {"TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}}, "ovn_controller": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-ovn-controller:17.1", "net": "host", "privileged": true, "user": "root", "restart": "always", "depends_on": ["openvswitch.service"], "healthcheck": {"test": "/openstack/healthcheck 6642"}, "volumes": ["/var/lib/kolla/config_files/ovn_controller.json:/var/lib/kolla/config_files/config.json:ro", "/lib/modules:/lib/modules:ro", "/run:/run", "/var/lib/openvswitch/ovn:/run/ovn:shared,z", "/var/log/containers/openvswitch:/var/log/openvswitch:z", "/var/log/containers/openvswitch:/var/log/ovn:z", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/pki/tls/certs/ovn_controller.crt:/etc/pki/tls/certs/ovn_controller.crt", "/etc/pki/tls/private/ovn_controller.key:/etc/pki/tls/private/ovn_controller.key"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "setup_ovs_manager": {"start_order": 0, "detach": false, "net": "host", "privileged": true, "user": "root", "command": ["/container_puppet_apply.sh", "4", "exec", "include tripleo::profile::base::neutron::ovn_metadata"], "image": "registry.redhat.io/rhosp-rhel9/openstack-neutron-metadata-agent-ovn:17.1", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/var/lib/container-config-scripts/container_puppet_apply.sh:/container_puppet_apply.sh:ro", "/etc/puppet:/tmp/puppet-etc:ro", "/usr/share/openstack-puppet/modules:/usr/share/openstack-puppet/modules:ro", "/lib/modules:/lib/modules:ro", "/run/openvswitch:/run/openvswitch:shared,z"], "environment": {"TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}}, "ovn_metadata_agent": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-neutron-metadata-agent-ovn:17.1", "net": "host", "pid": "host", "cgroupns": "host", "privileged": true, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/neutron:/var/log/neutron:z", "/var/lib/kolla/config_files/ovn_metadata_agent.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/neutron:/var/lib/kolla/config_files/src:ro", "/lib/modules:/lib/modules:ro", "/run/openvswitch:/run/openvswitch:shared,z", "/var/lib/neutron:/var/lib/neutron:shared,z", "/run/netns:/run/netns:shared", "/var/lib/neutron/kill_scripts:/etc/neutron/kill_scripts:shared,z", "/var/lib/neutron/ovn_metadata_haproxy_wrapper:/usr/local/bin/haproxy:ro", "/etc/pki/tls/certs/ovn_metadata.crt:/etc/pki/tls/certs/ovn_metadata.crt", "/etc/pki/tls/private/ovn_metadata.key:/etc/pki/tls/private/ovn_metadata.key"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "placement_api": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1", "net": "host", "user": "root", "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/placement:/var/log/placement:z", "/var/log/containers/httpd/placement:/var/log/httpd:z", "/var/lib/kolla/config_files/placement_api.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/placement:/var/lib/kolla/config_files/src:ro", "/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro", "/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "placement_wait_for_service": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-placement-api:17.1", "user": "root", "net": "host", "privileged": false, "detach": false, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/placement:/var/log/placement:z", "/var/log/containers/httpd/placement:/var/log/httpd:z", "/var/lib/kolla/config_files/placement_api_wait_for_service.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/placement:/var/lib/kolla/config_files/src:ro", "/var/lib/container-config-scripts:/container-config-scripts:z"], "environment": {"__OS_DEBUG": "true", "KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "swift_proxy": {"image": "registry.redhat.io/rhosp-rhel9/openstack-swift-proxy-server:17.1", "start_order": 2, "net": "host", "user": "swift", "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/swift_proxy.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro", "/srv/node:/srv/node", "/dev:/dev", "/var/log/containers/swift:/var/log/swift:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "swift_proxy_tls_proxy": {"start_order": 3, "image": "registry.redhat.io/rhosp-rhel9/openstack-swift-proxy-server:17.1", "net": "host", "user": "root", "restart": "always", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/swift_proxy_tls_proxy.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro", "/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro", "/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "swift_account_reaper": {"image": "registry.redhat.io/rhosp-rhel9/openstack-swift-account:17.1", "net": "host", "user": "swift", "restart": "always", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/swift_account_reaper.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro", "/srv/node:/srv/node", "/dev:/dev", "/var/cache/swift:/var/cache/swift:z", "/var/log/containers/swift:/var/log/swift:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "swift_account_server": {"image": "registry.redhat.io/rhosp-rhel9/openstack-swift-account:17.1", "net": "host", "user": "swift", "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/swift_account_server.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro", "/srv/node:/srv/node", "/dev:/dev", "/var/cache/swift:/var/cache/swift", "/var/log/containers/swift:/var/log/swift:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "swift_container_updater": {"image": "registry.redhat.io/rhosp-rhel9/openstack-swift-container:17.1", "net": "host", "user": "swift", "restart": "always", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/swift_container_updater.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro", "/srv/node:/srv/node", "/dev:/dev", "/var/cache/swift:/var/cache/swift", "/var/log/containers/swift:/var/log/swift:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "swift_container_server": {"image": "registry.redhat.io/rhosp-rhel9/openstack-swift-container:17.1", "net": "host", "user": "swift", "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/swift_container_server.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro", "/srv/node:/srv/node", "/dev:/dev", "/var/cache/swift:/var/cache/swift", "/var/log/containers/swift:/var/log/swift:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "swift_object_expirer": {"image": "registry.redhat.io/rhosp-rhel9/openstack-swift-proxy-server:17.1", "net": "host", "user": "swift", "restart": "always", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/swift_object_expirer.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro", "/srv/node:/srv/node", "/dev:/dev", "/var/cache/swift:/var/cache/swift", "/var/log/containers/swift:/var/log/swift:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "swift_object_updater": {"image": "registry.redhat.io/rhosp-rhel9/openstack-swift-object:17.1", "net": "host", "user": "swift", "restart": "always", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/swift_object_updater.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro", "/srv/node:/srv/node", "/dev:/dev", "/var/cache/swift:/var/cache/swift", "/var/log/containers/swift:/var/log/swift:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "swift_object_server": {"image": "registry.redhat.io/rhosp-rhel9/openstack-swift-object:17.1", "net": "host", "user": "swift", "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/swift_object_server.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro", "/srv/node:/srv/node", "/dev:/dev", "/var/cache/swift:/var/cache/swift", "/var/log/containers/swift:/var/log/swift:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}, "step_1": {"memcached": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-memcached:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/memcached.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/memcached:/var/lib/kolla/config_files/src:rw,z", "/var/log/containers/memcached:/var/log/memcached:rw", "/etc/pki/tls/certs/memcached.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/memcached.crt:ro", "/etc/pki/tls/private/memcached.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/memcached.key:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "mysql_data_ownership": {"start_order": 0, "detach": false, "image": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1", "net": "host", "user": "root", "command": ["chown", "-R", "mysql:", "/var/lib/mysql"], "volumes": ["/var/lib/mysql:/var/lib/mysql:z"]}, "mysql_bootstrap": {"start_order": 1, "detach": false, "image": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1", "net": "host", "user": "root", "command": ["bash", "-ec", "if [ -e /var/lib/mysql/mysql ]; then exit 0; fi\necho -e \"\\n[mysqld]\\nwsrep_provider=none\" >> /etc/my.cnf\nexport DB_ROOT_PASSWORD=$(hiera 'mysql::server::root_password')\nkolla_set_configs\nsudo -u mysql -E kolla_extend_start\ntimeout ${DB_MAX_TIMEOUT} /bin/bash -c 'while pgrep -af /usr/bin/mysqld_safe | grep -q -v grep; do sleep 1; done'\nmysqld_safe --skip-networking --wsrep-on=OFF &\ntimeout ${DB_MAX_TIMEOUT} /bin/bash -c 'until mysqladmin -uroot -p\"$(hiera 'mysql::server::root_password')\" ping 2>/dev/null; do sleep 1; done'\nmysql -uroot -p\"$(hiera 'mysql::server::root_password')\" -e \"CREATE USER 'clustercheck'@'localhost' IDENTIFIED BY '$(hiera mysql_clustercheck_password)';\"\nmysql -uroot -p\"$(hiera 'mysql::server::root_password')\" -e \"GRANT PROCESS ON *.* TO 'clustercheck'@'localhost' WITH GRANT OPTION;\"\nmysql -uroot -p\"$(hiera 'mysql::server::root_password')\" -e \"DELETE FROM mysql.user WHERE user = 'root' AND host NOT IN ('%','localhost');\"\ntimeout ${DB_MAX_TIMEOUT} mysqladmin -uroot -p\"$(hiera 'mysql::server::root_password')\" shutdown"], "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/mysql.json:/var/lib/kolla/config_files/config.json:rw,z", "/var/lib/config-data/puppet-generated/mysql:/var/lib/kolla/config_files/src:ro,z", "/var/lib/mysql:/var/lib/mysql:rw,z", "/etc/pki/tls/certs/mysql.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/mysql.crt:ro", "/etc/pki/tls/private/mysql.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/mysql.key:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "KOLLA_BOOTSTRAP": true, "DB_MAX_TIMEOUT": 60, "DB_MARIABACKUP_USER": "mariabackup", "DB_MARIABACKUP_PASSWORD": "1HGgCBppaAaEW15bOSgSe2uqr"}}, "rabbitmq_bootstrap": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1", "net": "host", "privileged": false, "user": "root", "command": ["bash", "-ec", "kolla_set_configs\nif [[ -e \"/var/lib/rabbitmq/.erlang.cookie\" ]]; then rm -f /var/lib/rabbitmq/.erlang.cookie; fi\nhiera 'rabbitmq::erlang_cookie' > /var/lib/rabbitmq/.erlang.cookie\nchown rabbitmq:rabbitmq /var/lib/rabbitmq/.erlang.cookie\nchmod 400 /var/lib/rabbitmq/.erlang.cookie"], "volumes": ["/var/lib/kolla/config_files/rabbitmq.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/rabbitmq:/var/lib/kolla/config_files/src:ro", "/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/var/lib/rabbitmq:/var/lib/rabbitmq:z", "/etc/puppet:/etc/puppet:ro,z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1760081186"}}}, "step_5": {"nova_compute": {"start_order": 3, "image": "registry.redhat.io/rhosp-rhel9/openstack-nova-compute:17.1", "ulimit": ["nofile=131072", "memlock=67108864"], "ipc": "host", "net": "host", "privileged": true, "user": "nova", "restart": "always", "depends_on": ["tripleo_nova_libvirt.target"], "healthcheck": {"test": "/openstack/healthcheck 5672"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/nova:/var/log/nova", "/etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro", "/var/lib/kolla/config_files/nova_compute.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/dev:/dev", "/lib/modules:/lib/modules:ro", "/run:/run", "/run/nova:/run/nova:z", "/var/lib/iscsi:/var/lib/iscsi:z", "/var/lib/libvirt:/var/lib/libvirt:shared", "/sys/class/net:/sys/class/net", "/sys/bus/pci:/sys/bus/pci", "/boot:/boot:ro", "/var/lib/nova:/var/lib/nova:shared"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "LIBGUESTFS_BACKEND": "direct"}}, "nova_wait_for_compute_service": {"start_order": 4, "image": "registry.redhat.io/rhosp-rhel9/openstack-nova-compute:17.1", "net": "host", "detach": false, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/nova_compute_wait_for_compute_service.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro", "/var/log/containers/nova:/var/log/nova", "/var/lib/container-config-scripts:/container-config-scripts"], "user": "nova", "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "__OS_DEBUG": "true"}}}, "step_0": {"ovn_cluster_north_db_server": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-ovn-nb-db-server:17.1", "net": "host", "privileged": false, "restart": "always", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/ovn_cluster_north_db_server.json:/var/lib/kolla/config_files/config.json:ro", "/lib/modules:/lib/modules:ro", "/var/lib/openvswitch/ovn:/var/lib/openvswitch:shared,z", "/var/lib/openvswitch/ovn:/run/openvswitch:shared,z", "/var/log/containers/openvswitch:/var/log/openvswitch:z", "/var/lib/openvswitch/ovn:/var/lib/ovn:shared,z", "/var/lib/openvswitch/ovn:/etc/openvswitch:shared,z", "/var/lib/openvswitch/ovn:/etc/ovn:shared,z", "/var/lib/openvswitch/ovn:/run/ovn:shared,z", "/var/log/containers/openvswitch:/var/log/ovn:z", "/var/lib/config-data/ansible-generated/ovn:/var/lib/kolla/config_files/src:ro", "/etc/pki/tls/private/ovn_dbs.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/ovn_dbs.key:ro", "/etc/pki/tls/certs/ovn_dbs.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/ovn_dbs.crt:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "ovn_cluster_south_db_server": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-ovn-sb-db-server:17.1", "net": "host", "privileged": false, "restart": "always", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/ovn_cluster_south_db_server.json:/var/lib/kolla/config_files/config.json:ro", "/lib/modules:/lib/modules:ro", "/var/lib/openvswitch/ovn:/var/lib/openvswitch:shared,z", "/var/lib/openvswitch/ovn:/run/openvswitch:shared,z", "/var/log/containers/openvswitch:/var/log/openvswitch:z", "/var/lib/openvswitch/ovn:/var/lib/ovn:shared,z", "/var/lib/openvswitch/ovn:/etc/openvswitch:shared,z", "/var/lib/openvswitch/ovn:/etc/ovn:shared,z", "/var/lib/openvswitch/ovn:/run/ovn:shared,z", "/var/log/containers/openvswitch:/var/log/ovn:z", "/var/lib/config-data/ansible-generated/ovn:/var/lib/kolla/config_files/src:ro", "/etc/pki/tls/private/ovn_dbs.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/ovn_dbs.key:ro", "/etc/pki/tls/certs/ovn_dbs.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/ovn_dbs.crt:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "ovn_cluster_northd": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-ovn-northd:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/ipa/ca.crt:/etc/ipa/ca.crt:ro", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/ovn_cluster_northd.json:/var/lib/kolla/config_files/config.json:ro", "/lib/modules:/lib/modules:ro", "/var/lib/openvswitch/ovn:/run/openvswitch:shared,z", "/var/log/containers/openvswitch:/var/log/openvswitch:z", "/var/lib/openvswitch/ovn:/run/ovn:shared,z", "/var/log/containers/openvswitch:/var/log/ovn:z", "/var/lib/config-data/ansible-generated/ovn:/var/lib/kolla/config_files/src:ro", "/etc/pki/tls/private/ovn_dbs.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/ovn_dbs.key:ro", "/etc/pki/tls/certs/ovn_dbs.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/ovn_dbs.crt:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}}


created_at: 2025-10-10 07:31:50.746218
data:
  {"value": [{"name": "Configure tuned before reboot", "when": "step|int == 0", "include_role": {"name": "tuned"}, "vars": {"tuned_profile": "throughput-performance", "tuned_isolated_cores": ""}}, {"name": "Configure kernel args and reboot", "when": "step|int == 0", "include_role": {"name": "tripleo_kernel", "tasks_from": "kernelargs.yml"}, "vars": {"tripleo_kernel_args": "", "tripleo_kernel_hugepages": {}, "tripleo_kernel_hugepages_remove": false, "tripleo_kernel_defer_reboot": false, "tripleo_kernel_reboot_timeout": 900}}, {"name": "Certificate generation", "when": ["step|int == 1", "enable_internal_tls"], "block": [{"name": "Create dirs for certificates and keys", "file": {"path": "{{ item }}", "state": "directory", "serole": "object_r", "setype": "cert_t", "seuser": "system_u"}, "with_items": ["/etc/pki/tls/certs/httpd", "/etc/pki/tls/private/httpd"]}, {"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "httpd-ctlplane", "dns": "{{ fqdn_ctlplane }}", "principal": "HTTP/{{ fqdn_ctlplane }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-ctlplane.crt /etc/pki/tls/certs/httpd/httpd-ctlplane.crt\ncp /etc/pki/tls/private/httpd-ctlplane.key /etc/pki/tls/private/httpd/httpd-ctlplane.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage", "dns": "{{ fqdn_storage }}", "principal": "HTTP/{{ fqdn_storage }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage.crt /etc/pki/tls/certs/httpd/httpd-storage.crt\ncp /etc/pki/tls/private/httpd-storage.key /etc/pki/tls/private/httpd/httpd-storage.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage_mgmt", "dns": "{{ fqdn_storage_mgmt }}", "principal": "HTTP/{{ fqdn_storage_mgmt }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage_mgmt.crt /etc/pki/tls/certs/httpd/httpd-storage_mgmt.crt\ncp /etc/pki/tls/private/httpd-storage_mgmt.key /etc/pki/tls/private/httpd/httpd-storage_mgmt.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-internal_api", "dns": "{{ fqdn_internal_api }}", "principal": "HTTP/{{ fqdn_internal_api }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-internal_api.crt /etc/pki/tls/certs/httpd/httpd-internal_api.crt\ncp /etc/pki/tls/private/httpd-internal_api.key /etc/pki/tls/private/httpd/httpd-internal_api.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-external", "dns": "{{ fqdn_external }}", "principal": "HTTP/{{ fqdn_external }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-external.crt /etc/pki/tls/certs/httpd/httpd-external.crt\ncp /etc/pki/tls/private/httpd-external.key /etc/pki/tls/private/httpd/httpd-external.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}]}}]}, {"name": "Cinder Backup tag container image for pacemaker", "when": "step|int == 1", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-backup:17.1", "container_image_latest": "cluster.common.tag/cinder-backup:pcmklatest"}}, {"name": "Cinder Backup HA Wrappers Step", "when": "step|int == 5", "block": [{"name": "Cinder backup puppet bundle", "import_role": {"name": "tripleo_ha_wrapper"}, "vars": {"tripleo_ha_wrapper_service_name": "cinder_backup", "tripleo_ha_wrapper_resource_name": "openstack-cinder-backup", "tripleo_ha_wrapper_bundle_name": "openstack-cinder-backup", "tripleo_ha_wrapper_resource_state": "_ Started", "tripleo_ha_wrapper_puppet_config_volume": "cinder", "tripleo_ha_wrapper_puppet_execute": "include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::cinder::backup_bundle", "tripleo_ha_wrapper_puppet_tags": "pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation", "tripleo_ha_wrapper_puppet_debug": false, "tripleo_ha_wrapper_config_suffix": ".cinder_backup_previous_run"}}]}, {"name": "Cinder Volume tag container image for pacemaker", "when": "step|int == 1", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "registry.redhat.io/rhosp-rhel9/openstack-cinder-volume:17.1", "container_image_latest": "cluster.common.tag/cinder-volume:pcmklatest"}}, {"name": "Cinder Volume HA Wrappers Step", "when": "step|int == 5", "block": [{"name": "Cinder volume puppet bundle", "import_role": {"name": "tripleo_ha_wrapper"}, "vars": {"tripleo_ha_wrapper_service_name": "cinder_volume", "tripleo_ha_wrapper_resource_name": "openstack-cinder-volume", "tripleo_ha_wrapper_bundle_name": "openstack-cinder-volume", "tripleo_ha_wrapper_resource_state": "_ Started", "tripleo_ha_wrapper_puppet_config_volume": "cinder", "tripleo_ha_wrapper_puppet_execute": "include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::cinder::volume_bundle", "tripleo_ha_wrapper_puppet_tags": "pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation", "tripleo_ha_wrapper_puppet_debug": false, "tripleo_ha_wrapper_config_suffix": ".cinder_volume_previous_run"}}]}, {"name": "configure tmpwatch on the host", "when": "step|int == 2", "block": [{"name": "Push script", "copy": {"dest": "/usr/local/sbin/containers-tmpwatch", "owner": "root", "group": "root", "mode": 493, "content": "#!/bin/sh\ntmpwatch --nodirs \\\n  -X \"/var/log/containers/*/*log\" \\\n  -X \"/var/log/containers/*/*/*log\" \\\n  -X \"/var/log/containers/*/*err\" \\\n  {{ LogrotatePurgeAfterDays|int +1 }}d \\\n  /var/log/containers/ 2>&1 | logger -t container-tmpwatch\n"}, "vars": {"LogrotatePurgeAfterDays": "14"}}, {"name": "Insert cronjob in root crontab", "cron": {"name": "Remove old logs", "special_time": "daily", "user": "root", "job": "/usr/local/sbin/containers-tmpwatch"}}]}, {"name": "Configure rsyslog for HAproxy container managed by Pacemaker", "when": "step|int == 1", "block": [{"name": "Check if rsyslog exists", "shell": "systemctl is-active rsyslog", "register": "rsyslog_config"}, {"when": ["rsyslog_config is changed", "rsyslog_config.rc == 0"], "block": [{"name": "Forward logging to haproxy.log file", "blockinfile": {"content": "if $syslogfacility-text == '{{facility}}' and $programname == 'haproxy' then -/var/log/containers/haproxy/haproxy.log\n& stop\n", "create": true, "path": "/etc/rsyslog.d/openstack-haproxy.conf"}, "vars": {"facility": "local0"}, "register": "logconfig"}, {"name": "restart rsyslog service after logging conf change", "service": {"name": "rsyslog", "state": "restarted"}, "when": "logconfig is changed"}]}]}, {"name": "HAproxy tag container image for pacemaker", "when": "step|int == 1", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "registry.redhat.io/rhosp-rhel9/openstack-haproxy:17.1", "container_image_latest": "cluster.common.tag/haproxy:pcmklatest"}}, {"name": "HAproxy HA Wrappers Step", "when": "step|int == 2", "block": [{"name": "HAproxy puppet bundle", "import_role": {"name": "tripleo_ha_wrapper"}, "vars": {"tripleo_ha_wrapper_service_name": "haproxy", "tripleo_ha_wrapper_resource_name": "haproxy-bundle", "tripleo_ha_wrapper_bundle_name": "haproxy-bundle", "tripleo_ha_wrapper_resource_state": "Started", "tripleo_ha_wrapper_puppet_config_volume": "haproxy", "tripleo_ha_wrapper_puppet_execute": "include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::haproxy_bundle", "tripleo_ha_wrapper_puppet_tags": "pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation", "tripleo_ha_wrapper_puppet_debug": false, "tripleo_ha_wrapper_config_suffix": ".previous_run"}}]}, {"name": "Certificate generation", "when": "step|int == 1", "vars": {"certmonger_ca": ""}, "block": [{"name": "make sure certmonger is installed", "package": {"name": "certmonger", "state": "present"}}, {"name": "make sure certmonger service is started", "systemd": {"state": "started", "enabled": true, "masked": false, "name": "certmonger.service"}}, {"name": "Create dirs for certificates and keys", "file": {"path": "{{ item }}", "state": "directory", "serole": "object_r", "setype": "cert_t", "seuser": "system_u"}, "with_items": ["/etc/pki/tls/certs/haproxy", "/etc/pki/tls/private/haproxy"]}, {"name": "Extract and trust certmonger's local CA", "shell": "set -e\nca_pem='/etc/pki/ca-trust/source/anchors/cm-local-ca.pem'\nopenssl pkcs12 -in /var/lib/certmonger/local/creds -out ${ca_pem} -nokeys -nodes -passin pass:''\nchmod 0644 ${ca_pem}\nupdate-ca-trust extract\ntest -e ${ca_pem} && openssl x509 -checkend 0 -noout -in ${ca_pem}\n", "retries": 5, "delay": 1, "register": "local_ca_extract_result", "until": "local_ca_extract_result.rc == 0", "when": "certmonger_ca != 'IPA' and (ipa_realm is not defined)"}, {"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "haproxy-external-cert", "dns": "{{cloud_names.cloud_name_external}}", "ip": "{{[cloud_names.cloud_name_external]|ipaddr}}", "principal": "haproxy/{{cloud_names.cloud_name_external}}@{{idm_realm|default('UNDERCLOUD')}}", "run_after": "# Copy crt and key for backward compatibility\ncp \"/etc/pki/tls/certs/haproxy-external-cert.crt\" \"/etc/pki/tls/certs/haproxy/overcloud-haproxy-external.crt\"\ncp \"/etc/pki/tls/private/haproxy-external-cert.key\" \"/etc/pki/tls/private/haproxy/overcloud-haproxy-external.key\"\n\nca_type={{ (certmonger_ca == 'IPA' or idm_realm is defined) | ternary('ipa', 'self-sign') }}\nif [ \"$ca_type\" = \"self-sign\" ]; then\n  # refresh the ca cert just in case the ca cert has been renewed\n  ca_pem='/etc/pki/ca-trust/source/anchors/cm-local-ca.pem'\n  openssl pkcs12 -in /var/lib/certmonger/local/creds -out ${ca_pem} -nokeys -nodes -passin pass:''\n  chmod 0644 ${ca_pem}\n  update-ca-trust extract\n  test -e ${ca_pem} && openssl x509 -checkend 0 -noout -in ${ca_pem}\n  openssl x509 -in ${ca_pem} -out /tmp/cm-local-ca.pem\n  ca_path=\"/tmp/cm-local-ca.pem\"\nelse\n  ca_path=\"/etc/ipa/ca.crt\"\nfi\n\nservice_crt=\"/etc/pki/tls/certs/haproxy/overcloud-haproxy-external.crt\"\nservice_key=\"/etc/pki/tls/private/haproxy/overcloud-haproxy-external.key\"\nservice_pem=\"/etc/pki/tls/private/overcloud_endpoint.pem\"\n\ncat \"$service_crt\" \"$ca_path\" \"$service_key\" > \"$service_pem\"\n\ncontainer_name=$({{container_cli}} ps --format=\\{\\{.Names\\}\\} | grep -w -E 'haproxy(-bundle-.*-[0-9]+)?')\n# Inject the new pem into the running container\nif echo \"$container_name\" | grep -q \"^haproxy-bundle\"; then\n  # lp#1917868: Do not use podman cp with HA containers as they get\n  # frozen temporarily and that can make pacemaker operation fail.\n  tar -c \"$service_pem\" | {{container_cli}} exec -i \"$container_name\" tar -C / -xv\n  # no need to update the mount point, because pacemaker\n  # recreates the container when it's restarted\nelse\n  # Refresh the pem at the mount-point\n  {{container_cli}} cp $service_pem \"$container_name:/var/lib/kolla/config_files/src-tls/$service_pem\"\n  # Copy the new pem from the mount-point to the real path\n  {{container_cli}} exec \"$container_name\" cp \"/var/lib/kolla/config_files/src-tls$service_pem\" \"$service_pem\"\nfi\n# Set appropriate permissions\n{{container_cli}} exec \"$container_name\" chown haproxy:haproxy \"$service_pem\"\n# Trigger a reload for HAProxy to read the new certificates\n{{container_cli}} kill --signal HUP \"$container_name\"\n", "key_size": "2048", "ca": "{{ (certmonger_ca == 'IPA' or idm_realm is defined) | ternary('ipa', 'self-sign') }}"}]}}]}, {"name": "Certificate generation", "when": "step|int == 1", "block": [{"name": "Create dirs for certificates and keys", "file": {"path": "{{ item }}", "state": "directory", "serole": "object_r", "setype": "cert_t", "seuser": "system_u"}, "with_items": ["/etc/pki/tls/certs/haproxy", "/etc/pki/tls/private/haproxy"]}, {"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "haproxy-ctlplane-cert", "dns": ["{{fqdn_ctlplane}}", "{{cloud_names.cloud_name_ctlplane}}"], "principal": "haproxy/{{fqdn_ctlplane}}@{{idm_realm}}", "run_after": "# Copy crt and key for backward compatibility\ncp \"/etc/pki/tls/certs/haproxy-ctlplane-cert.crt\" \"/etc/pki/tls/certs/haproxy/overcloud-haproxy-ctlplane.crt\"\ncp \"/etc/pki/tls/private/haproxy-ctlplane-cert.key\" \"/etc/pki/tls/private/haproxy/overcloud-haproxy-ctlplane.key\"\n\nca_path=\"/etc/ipa/ca.crt\"\nservice_crt=\"/etc/pki/tls/certs/haproxy/overcloud-haproxy-ctlplane.crt\"\nservice_key=\"/etc/pki/tls/private/haproxy/overcloud-haproxy-ctlplane.key\"\nservice_pem=\"/etc/pki/tls/certs/haproxy/overcloud-haproxy-ctlplane.pem\"\n\ncat \"$service_crt\" \"$ca_path\" \"$service_key\" > \"$service_pem\"\n\ncontainer_name=$({{container_cli}} ps --format=\\{\\{.Names\\}\\} | grep -w -E 'haproxy(-bundle-.*-[0-9]+)?')\n# Inject the new pem into the running container\nif echo \"$container_name\" | grep -q \"^haproxy-bundle\"; then\n  # lp#1917868: Do not use podman cp with HA containers as they get\n  # frozen temporarily and that can make pacemaker operation fail.\n  tar -c \"$service_pem\" | {{container_cli}} exec -i \"$container_name\" tar -C / -xv\n  # no need to update the mount point, because pacemaker\n  # recreates the container when it's restarted\nelse\n  # Refresh the pem at the mount-point\n  {{container_cli}} cp $service_pem \"$container_name:/var/lib/kolla/config_files/src-tls/$service_pem\"\n  # Copy the new pem from the mount-point to the real path\n  {{container_cli}} exec \"$container_name\" cp \"/var/lib/kolla/config_files/src-tls$service_pem\" \"$service_pem\"\nfi\n# Set appropriate permissions\n{{container_cli}} exec \"$container_name\" chown haproxy:haproxy \"$service_pem\"\n# Trigger a reload for HAProxy to read the new certificates\n{{container_cli}} kill --signal HUP \"$container_name\"\n", "key_size": "2048", "ca": "ipa"}, {"name": "haproxy-storage-cert", "dns": ["{{fqdn_storage}}", "{{cloud_names.cloud_name_storage}}"], "principal": "haproxy/{{fqdn_storage}}@{{idm_realm}}", "run_after": "# Copy crt and key for backward compatibility\ncp \"/etc/pki/tls/certs/haproxy-storage-cert.crt\" \"/etc/pki/tls/certs/haproxy/overcloud-haproxy-storage.crt\"\ncp \"/etc/pki/tls/private/haproxy-storage-cert.key\" \"/etc/pki/tls/private/haproxy/overcloud-haproxy-storage.key\"\n\nca_path=\"/etc/ipa/ca.crt\"\nservice_crt=\"/etc/pki/tls/certs/haproxy/overcloud-haproxy-storage.crt\"\nservice_key=\"/etc/pki/tls/private/haproxy/overcloud-haproxy-storage.key\"\nservice_pem=\"/etc/pki/tls/certs/haproxy/overcloud-haproxy-storage.pem\"\n\ncat \"$service_crt\" \"$ca_path\" \"$service_key\" > \"$service_pem\"\n\ncontainer_name=$({{container_cli}} ps --format=\\{\\{.Names\\}\\} | grep -w -E 'haproxy(-bundle-.*-[0-9]+)?')\n# Inject the new pem into the running container\nif echo \"$container_name\" | grep -q \"^haproxy-bundle\"; then\n  # lp#1917868: Do not use podman cp with HA containers as they get\n  # frozen temporarily and that can make pacemaker operation fail.\n  tar -c \"$service_pem\" | {{container_cli}} exec -i \"$container_name\" tar -C / -xv\n  # no need to update the mount point, because pacemaker\n  # recreates the container when it's restarted\nelse\n  # Refresh the pem at the mount-point\n  {{container_cli}} cp $service_pem \"$container_name:/var/lib/kolla/config_files/src-tls/$service_pem\"\n  # Copy the new pem from the mount-point to the real path\n  {{container_cli}} exec \"$container_name\" cp \"/var/lib/kolla/config_files/src-tls$service_pem\" \"$service_pem\"\nfi\n# Set appropriate permissions\n{{container_cli}} exec \"$container_name\" chown haproxy:haproxy \"$service_pem\"\n# Trigger a reload for HAProxy to read the new certificates\n{{container_cli}} kill --signal HUP \"$container_name\"\n", "key_size": "2048", "ca": "ipa"}, {"name": "haproxy-storage_mgmt-cert", "dns": ["{{fqdn_storage_mgmt}}", "{{cloud_names.cloud_name_storage_mgmt}}"], "principal": "haproxy/{{fqdn_storage_mgmt}}@{{idm_realm}}", "run_after": "# Copy crt and key for backward compatibility\ncp \"/etc/pki/tls/certs/haproxy-storage_mgmt-cert.crt\" \"/etc/pki/tls/certs/haproxy/overcloud-haproxy-storage_mgmt.crt\"\ncp \"/etc/pki/tls/private/haproxy-storage_mgmt-cert.key\" \"/etc/pki/tls/private/haproxy/overcloud-haproxy-storage_mgmt.key\"\n\nca_path=\"/etc/ipa/ca.crt\"\nservice_crt=\"/etc/pki/tls/certs/haproxy/overcloud-haproxy-storage_mgmt.crt\"\nservice_key=\"/etc/pki/tls/private/haproxy/overcloud-haproxy-storage_mgmt.key\"\nservice_pem=\"/etc/pki/tls/certs/haproxy/overcloud-haproxy-storage_mgmt.pem\"\n\ncat \"$service_crt\" \"$ca_path\" \"$service_key\" > \"$service_pem\"\n\ncontainer_name=$({{container_cli}} ps --format=\\{\\{.Names\\}\\} | grep -w -E 'haproxy(-bundle-.*-[0-9]+)?')\n# Inject the new pem into the running container\nif echo \"$container_name\" | grep -q \"^haproxy-bundle\"; then\n  # lp#1917868: Do not use podman cp with HA containers as they get\n  # frozen temporarily and that can make pacemaker operation fail.\n  tar -c \"$service_pem\" | {{container_cli}} exec -i \"$container_name\" tar -C / -xv\n  # no need to update the mount point, because pacemaker\n  # recreates the container when it's restarted\nelse\n  # Refresh the pem at the mount-point\n  {{container_cli}} cp $service_pem \"$container_name:/var/lib/kolla/config_files/src-tls/$service_pem\"\n  # Copy the new pem from the mount-point to the real path\n  {{container_cli}} exec \"$container_name\" cp \"/var/lib/kolla/config_files/src-tls$service_pem\" \"$service_pem\"\nfi\n# Set appropriate permissions\n{{container_cli}} exec \"$container_name\" chown haproxy:haproxy \"$service_pem\"\n# Trigger a reload for HAProxy to read the new certificates\n{{container_cli}} kill --signal HUP \"$container_name\"\n", "key_size": "2048", "ca": "ipa"}, {"name": "haproxy-internal_api-cert", "dns": ["{{fqdn_internal_api}}", "{{cloud_names.cloud_name_internal_api}}"], "principal": "haproxy/{{fqdn_internal_api}}@{{idm_realm}}", "run_after": "# Copy crt and key for backward compatibility\ncp \"/etc/pki/tls/certs/haproxy-internal_api-cert.crt\" \"/etc/pki/tls/certs/haproxy/overcloud-haproxy-internal_api.crt\"\ncp \"/etc/pki/tls/private/haproxy-internal_api-cert.key\" \"/etc/pki/tls/private/haproxy/overcloud-haproxy-internal_api.key\"\n\nca_path=\"/etc/ipa/ca.crt\"\nservice_crt=\"/etc/pki/tls/certs/haproxy/overcloud-haproxy-internal_api.crt\"\nservice_key=\"/etc/pki/tls/private/haproxy/overcloud-haproxy-internal_api.key\"\nservice_pem=\"/etc/pki/tls/certs/haproxy/overcloud-haproxy-internal_api.pem\"\n\ncat \"$service_crt\" \"$ca_path\" \"$service_key\" > \"$service_pem\"\n\ncontainer_name=$({{container_cli}} ps --format=\\{\\{.Names\\}\\} | grep -w -E 'haproxy(-bundle-.*-[0-9]+)?')\n# Inject the new pem into the running container\nif echo \"$container_name\" | grep -q \"^haproxy-bundle\"; then\n  # lp#1917868: Do not use podman cp with HA containers as they get\n  # frozen temporarily and that can make pacemaker operation fail.\n  tar -c \"$service_pem\" | {{container_cli}} exec -i \"$container_name\" tar -C / -xv\n  # no need to update the mount point, because pacemaker\n  # recreates the container when it's restarted\nelse\n  # Refresh the pem at the mount-point\n  {{container_cli}} cp $service_pem \"$container_name:/var/lib/kolla/config_files/src-tls/$service_pem\"\n  # Copy the new pem from the mount-point to the real path\n  {{container_cli}} exec \"$container_name\" cp \"/var/lib/kolla/config_files/src-tls$service_pem\" \"$service_pem\"\nfi\n# Set appropriate permissions\n{{container_cli}} exec \"$container_name\" chown haproxy:haproxy \"$service_pem\"\n# Trigger a reload for HAProxy to read the new certificates\n{{container_cli}} kill --signal HUP \"$container_name\"\n", "key_size": "2048", "ca": "ipa"}]}}]}, {"name": "Run lvmfilter role", "include_role": {"name": "tripleo_lvmfilter"}, "when": ["step|int == 1"]}, {"name": "validate keystone container state", "containers.podman.podman_container_info": {"name": "keystone"}, "register": "keystone_infos", "failed_when": ["keystone_infos.containers.0.Healthcheck.Status is defined", "'healthy' not in keystone_infos.containers.0.Healthcheck.Status"], "retries": 10, "delay": 30, "tags": ["opendev-validation", "opendev-validation-keystone"], "when": ["container_cli == 'podman'", "not container_healthcheck_disabled", "step|int == 4"]}, {"name": "Manila Share tag container image for pacemaker", "when": "step|int == 1", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "registry.redhat.io/rhosp-rhel9/openstack-manila-share:17.1", "container_image_latest": "cluster.common.tag/manila-share:pcmklatest"}}, {"name": "Manila-Share HA Wrappers Step", "when": "step|int == 5", "block": [{"name": "Manila-Share puppet bundle", "import_role": {"name": "tripleo_ha_wrapper"}, "vars": {"tripleo_ha_wrapper_service_name": "manila_share", "tripleo_ha_wrapper_resource_name": "openstack-manila-share", "tripleo_ha_wrapper_bundle_name": "openstack-manila-share", "tripleo_ha_wrapper_resource_state": "_ Started", "tripleo_ha_wrapper_puppet_config_volume": "manila", "tripleo_ha_wrapper_puppet_execute": "include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::manila::share_bundle", "tripleo_ha_wrapper_puppet_tags": "pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation", "tripleo_ha_wrapper_puppet_debug": false, "tripleo_ha_wrapper_config_suffix": ".previous_run"}}]}, {"name": "Certificate generation", "when": "step|int == 1", "block": [{"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "memcached", "dns": "{{fqdn_internal_api}}", "principal": "memcached/{{fqdn_internal_api}}@{{idm_realm}}", "run_after": "container_name=$({{container_cli}} ps --format=\\{\\{.Names\\}\\} | grep memcached)\nservice_crt=\"/etc/pki/tls/certs/memcached.crt\"\nservice_key=\"/etc/pki/tls/private/memcached.key\"\n# Copy the new cert from the mount-point to the real path\n{{container_cli}} exec -u root \"$container_name\" cp \"/var/lib/kolla/config_files/src-tls$service_crt\" \"$service_crt\"\n# Copy the new key from the mount-point to the real path\n{{container_cli}} exec -u root \"$container_name\" cp \"/var/lib/kolla/config_files/src-tls$service_key\" \"$service_key\"\n# Set appropriate permissions\n{{container_cli}} exec -u root \"$container_name\" chown memcached:memcached \"$service_crt\"\n{{container_cli}} exec -u root \"$container_name\" chown memcached:memcached \"$service_key\"\n# Send refresh_certs command to memcached to read the new certificate\nmemcached_ip=\"$(hiera -c /etc/puppet/hiera.yaml memcached::listen_ip.0 127.0.0.1)\"\nmemcached_port=\"$(hiera -c /etc/puppet/hiera.yaml memcached::tcp_port 11211)\"\necho refresh_certs | openssl s_client -connect $memcached_ip:$memcached_port\n", "key_size": "2048", "ca": "ipa"}]}}]}, {"name": "Certificate generation", "when": ["step|int == 1", "enable_internal_tls"], "block": [{"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "mysql", "dns": ["{{fqdn_internal_api}}", "{{cloud_names.cloud_name_internal_api}}"], "principal": "mysql/{{fqdn_internal_api}}@{{idm_realm}}", "key_size": "2048", "ca": "ipa"}]}}]}, {"name": "MySQL tag container image for pacemaker", "when": "step|int == 1", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "registry.redhat.io/rhosp-rhel9/openstack-mariadb:17.1", "container_image_latest": "cluster.common.tag/mariadb:pcmklatest"}}, {"name": "MySQL HA Wrappers Step", "when": "step|int == 2", "block": [{"name": "Mysql puppet bundle", "import_role": {"name": "tripleo_ha_wrapper"}, "vars": {"tripleo_ha_wrapper_service_name": "mysql", "tripleo_ha_wrapper_resource_name": "galera", "tripleo_ha_wrapper_bundle_name": "galera-bundle", "tripleo_ha_wrapper_resource_state": "Master", "tripleo_ha_wrapper_puppet_config_volume": "mysql", "tripleo_ha_wrapper_puppet_execute": "[\"Mysql_datadir\", \"Mysql_user\", \"Mysql_database\", \"Mysql_grant\", \"Mysql_plugin\"].each |String $val| { noop_resource($val) }; include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::database::mysql_bundle", "tripleo_ha_wrapper_puppet_tags": "pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation", "tripleo_ha_wrapper_puppet_debug": false, "tripleo_ha_wrapper_config_suffix": ".previous_run"}}]}, {"name": "Certificate generation", "when": "step|int == 1", "block": [{"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "neutron_ovn", "dns": "{{fqdn_internal_api}}", "principal": "neutron_ovn/{{fqdn_internal_api}}@{{idm_realm}}", "key_size": "2048", "ca": "ipa"}]}}]}, {"name": "Certificate generation", "when": ["step|int == 1", "enable_internal_tls"], "block": [{"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "neutron", "dns": "{{fqdn_internal_api}}", "principal": "neutron/{{fqdn_internal_api}}@{{idm_realm}}", "run_after": "container_name=$({{container_cli}} ps --format=\\{\\{.Names\\}\\} | grep neutron_dhcp)\n# The certificate is also installed on the computes, but neutron_dhcp is only\n# present on the controllers, so we exit if the container could not be found.\n[[ -z $container_name ]] && exit 0\n\nservice_crt=\"/etc/pki/tls/certs/neutron.crt\"\nservice_key=\"/etc/pki/tls/private/neutron.key\"\n# Copy the new cert from the mount-point to the real path\n{{container_cli}} exec -u root \"$container_name\" cp \"/var/lib/kolla/config_files/src-tls$service_crt\" \"$service_crt\"\n# Copy the new key from the mount-point to the real path\n{{container_cli}} exec -u root \"$container_name\" cp \"/var/lib/kolla/config_files/src-tls$service_key \"$service_key\"\n# No need to trigger a reload for neutron dhcpd since the cert is not cached\n", "key_size": "2048", "ca": "ipa"}]}}]}, {"name": "validate nova-api container state", "containers.podman.podman_container_info": {"name": "nova_api"}, "register": "nova_api_infos", "failed_when": ["nova_api_infos.containers.0.Healthcheck.Status is defined", "'healthy' not in nova_api_infos.containers.0.Healthcheck.Status"], "retries": 10, "delay": 30, "tags": ["opendev-validation", "opendev-validation-nova"], "when": ["container_cli == 'podman'", "not container_healthcheck_disabled", "step|int == 4"]}, {"name": "validate nova-conductor container state", "containers.podman.podman_container_info": {"name": "nova_conductor"}, "register": "nova_conductor_infos", "failed_when": ["nova_conductor_infos.containers.0.Healthcheck.Status is defined", "'healthy' not in nova_conductor_infos.containers.0.Healthcheck.Status"], "retries": 10, "delay": 30, "tags": ["opendev-validation", "opendev-validation-nova"], "when": ["container_cli == 'podman'", "not container_healthcheck_disabled", "step|int == 5"]}, {"name": "validate nova-metadata container state", "containers.podman.podman_container_info": {"name": "nova_metadata"}, "register": "nova_metadata_infos", "failed_when": ["nova_metadata_infos.containers.0.Healthcheck.Status is defined", "'healthy' not in nova_metadata_infos.containers.0.Healthcheck.Status"], "retries": 10, "delay": 30, "tags": ["opendev-validation", "opendev-validation-nova"], "when": ["container_cli == 'podman'", "not container_healthcheck_disabled", "step|int == 5"]}, {"name": "validate nova-scheduler container state", "containers.podman.podman_container_info": {"name": "nova_scheduler"}, "register": "nova_scheduler_infos", "failed_when": ["nova_scheduler_infos.containers.0.Healthcheck.Status is defined", "'healthy' not in nova_scheduler_infos.containers.0.Healthcheck.Status"], "retries": 10, "delay": 30, "tags": ["opendev-validation", "opendev-validation-nova"], "when": ["container_cli == 'podman'", "not container_healthcheck_disabled", "step|int == 5"]}, {"name": "install systemd-container for a greenfield", "when": ["step|int == 1", "not check_nova_instances_result.stat.exists"], "package": {"name": "systemd-container", "state": "present"}}, {"name": "validate nova-compute container state", "containers.podman.podman_container_info": {"name": "nova_compute"}, "register": "nova_compute_infos", "failed_when": ["nova_compute_infos.containers.0.Healthcheck.Status is defined", "'healthy' not in nova_compute_infos.containers.0.Healthcheck.Status"], "retries": 10, "delay": 30, "tags": ["opendev-validation", "opendev-validation-nova"], "when": ["container_cli == 'podman'", "not container_healthcheck_disabled", "step|int == 6"]}, {"name": "manage PMEM namespaces for vPMEM", "include_role": {"name": "tripleo_nvdimm"}, "vars": {"tripleo_nvdimm_pmem_namespaces": ""}, "when": ["step|int == 1", "tripleo_nvdimm_pmem_namespaces != ''"]}, {"name": "manage OS version 9 specific sysctls", "when": ["step|int == 1", "ansible_facts['os_family'] == 'RedHat'", "ansible_facts['distribution_major_version'] is version('9', '==')"], "block": [{"name": "Enable post-copy by setting unprivileged_userfaultfd", "sysctl": {"name": "vm.unprivileged_userfaultfd", "value": 1, "sysctl_set": true, "sysctl_file": "/etc/sysctl.d/99-tripleo-postcopy.conf", "state": "present", "reload": true}}]}, {"name": "enable/disable ksm", "when": ["step|int == 1"], "block": [{"name": "is KSM enabled", "set_fact": {"compute_ksm_enabled": false}}, {"name": "disable KSM on compute", "when": "not compute_ksm_enabled|bool", "block": [{"name": "Check for ksm", "shell": "systemctl is-active ksm.service || systemctl is-enabled ksm.service", "become": true, "failed_when": false, "register": "ksm_service_check"}, {"name": "disable KSM services", "service": {"name": "{{ item }}", "state": "stopped", "enabled": false}, "with_items": ["ksm.service", "ksmtuned.service"], "when": ["ksm_service_check.rc is defined", "ksm_service_check.rc == 0"], "register": "ksmdisabled"}, {"name": "delete PageKSM after disable ksm on compute", "command": "echo 2 >/sys/kernel/mm/ksm/run", "when": ["ksm_service_check.rc is defined", "ksm_service_check.rc == 0", "ksmdisabled is changed"]}]}, {"name": "enable KSM on compute", "when": "compute_ksm_enabled|bool", "block": [{"name": "make sure package providing ksmtuned is installed (RHEL8 or CentOS8)", "package": {"name": "qemu-kvm-common", "state": "present"}, "when": ["ansible_facts['distribution_major_version'] is version('8', '==')"]}, {"name": "make sure package providing ksmtuned is installed (RHEL9 or CentOS9)", "package": {"name": "ksmtuned", "state": "present"}, "when": ["ansible_facts['distribution_major_version'] is version('9', '==')"]}, {"name": "enable ksmtunded", "service": {"name": "{{ item }}", "state": "started", "enabled": true}, "with_items": ["ksm.service", "ksmtuned.service"]}]}]}, {"name": "Ensure recovery of containerized virtqemud", "when": "step|int == 4", "become": true, "block": [{"name": "Create virtqemud recovery script", "copy": {"dest": "/usr/libexec/recover_tripleo_nova_virtqemud.sh", "mode": "0755", "content": "#!/bin/bash\npgrep -f /sbin/virtqemud\n[ $? -eq 0 ] && exit 0\nkill -9 $(cat /run/nova_virtqemud.pid)\n"}}, {"name": "Create virtqemud recovery trigger service", "copy": {"dest": "/etc/systemd/system/tripleo_nova_virtqemud_recover.service", "mode": "0644", "content": "[Unit]\nDescription=Check and recover tripleo_nova_virtqemud\nAfter=tripleo_nova_virtqemud.service\nRequisite=tripleo_nova_virtqemud.service\n[Service]\nType=oneshot\nExecStart=bash /usr/libexec/recover_tripleo_nova_virtqemud.sh\nSyslogIdentifier=recover_tripleo_nova_virtqemud\n[Install]\nWantedBy=multi-user.target\n"}}, {"name": "Create virtqemud recovery trigger timer", "copy": {"dest": "/etc/systemd/system/tripleo_nova_virtqemud_recover.timer", "mode": "0644", "content": "[Unit]\nDescription=Check and recover tripleo_nova_virtqemud every 10m\nPartOf=tripleo_nova_virtqemud.service\n[Timer]\nOnCalendar=*:5/10\nOnActiveSec=120\nOnUnitActiveSec=60\nRandomizedDelaySec=1m\n[Install]\nWantedBy=timers.target\n"}}, {"name": "Enable virtqemud recovery trigger service", "systemd": {"name": "tripleo_nova_virtqemud_recover.service", "enabled": true, "daemon_reload": true}}, {"name": "Enable virtqemud recovery trigger timer", "systemd": {"name": "tripleo_nova_virtqemud_recover.timer", "enabled": true, "state": "restarted", "daemon_reload": true}, "register": "virtqemud_recover_timer_result"}, {"name": "Really enable virtqemud recovery trigger timer", "shell": {"cmd": "systemctl enable --now tripleo_nova_virtqemud_recover.timer"}, "when": "virtqemud_recover_timer_result.status.UnitFileState != \"enabled\""}]}, {"name": "Certificate generation", "when": "step|int == 1", "block": [{"name": "Create dirs for certificates and keys", "file": {"path": "{{ item }}", "state": "directory", "serole": "object_r", "setype": "cert_t", "seuser": "system_u"}, "with_items": ["/etc/pki/libvirt", "/etc/pki/libvirt/private", "/etc/pki/qemu"]}, {"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "libvirt-server-cert", "dns": "{{fqdn_internal_api}}", "principal": "libvirt/{{fqdn_internal_api}}@{{idm_realm}}", "run_after": "# Copy cert and key to libvirt dirs\ncp /etc/ipa/ca.crt /etc/pki/CA/cacert.pem\nchown root:root /etc/pki/CA/cacert.pem\nchmod 644 /etc/pki/CA/cacert.pem\ncp /etc/pki/tls/certs/libvirt-server-cert.crt /etc/pki/libvirt/servercert.pem\ncp /etc/pki/tls/private/libvirt-server-cert.key /etc/pki/libvirt/private/serverkey.pem\npodman exec nova_virtproxyd virt-admin server-update-tls virtproxyd || systemctl reload tripleo_nova_virtproxyd\n", "key_size": "2048", "ca": "ipa"}, {"name": "libvirt-client-cert", "dns": "{{fqdn_internal_api}}", "principal": "libvirt/{{fqdn_internal_api}}@{{idm_realm}}", "run_after": "# Copy cert and key to libvirt dirs\ncp /etc/pki/tls/certs/libvirt-client-cert.crt /etc/pki/libvirt/clientcert.pem\ncp /etc/pki/tls/private/libvirt-client-cert.key /etc/pki/libvirt/private/clientkey.pem\npodman exec nova_virtproxyd virt-admin server-update-tls virtproxyd || systemctl reload tripleo_nova_virtproxyd\n", "key_size": "2048", "ca": "ipa"}, {"name": "qemu-server-cert", "owner": "root", "group": "qemu", "dns": "{{fqdn_internal_api}}", "principal": "qemu/{{fqdn_internal_api}}@{{idm_realm}}", "run_after": "# Copy cert and key to qemu dir\ncp /etc/ipa/ca.crt /etc/pki/qemu/ca-cert.pem\nchown root:root /etc/pki/qemu/ca-cert.pem\nchmod 644 /etc/pki/qemu/ca-cert.pem\ncp -a /etc/pki/tls/certs/qemu-server-cert.crt /etc/pki/qemu/server-cert.pem\ncp -a /etc/pki/tls/private/qemu-server-cert.key /etc/pki/qemu/server-key.pem\nchgrp qemu /etc/pki/qemu/server-*\nchmod 0640 /etc/pki/qemu/server-cert.pem\nchmod 0640 /etc/pki/qemu/server-key.pem\n", "key_size": "2048", "ca": "ipa"}, {"name": "qemu-client-cert", "owner": "root", "group": "qemu", "dns": "{{fqdn_internal_api}}", "principal": "qemu/{{fqdn_internal_api}}@{{idm_realm}}", "run_after": "# Copy cert and key to qemu dir\ncp -a /etc/pki/tls/certs/qemu-client-cert.crt /etc/pki/qemu/client-cert.pem\ncp -a /etc/pki/tls/private/qemu-client-cert.key /etc/pki/qemu/client-key.pem\nchgrp qemu /etc/pki/qemu/client-*\nchmod 0640 /etc/pki/qemu/client-cert.pem\nchmod 0640 /etc/pki/qemu/client-key.pem\n", "key_size": "2048", "ca": "ipa"}]}}]}, {"name": "Set up systemd target for libvirt services", "when": "step|int == 4", "block": [{"name": "Create systemd file", "copy": {"dest": "/etc/systemd/system/tripleo_nova_libvirt.target", "mode": "0644", "owner": "root", "group": "root", "content": "[Unit]\nWants=tripleo_nova_virtsecretd.service\nWants=tripleo_nova_virtnodedevd.service\nWants=tripleo_nova_virtstoraged.service\nWants=tripleo_nova_virtproxyd.service\nWants=tripleo_nova_virtqemud.service\nAfter=tripleo_nova_virtsecretd.service\nAfter=tripleo_nova_virtnodedevd.service\nAfter=tripleo_nova_virtstoraged.service\nAfter=tripleo_nova_virtproxyd.service\nAfter=tripleo_nova_virtqemud.service\n"}, "become": true, "register": "libvirt_target_result"}, {"name": "Reload systemd", "systemd": {"name": "tripleo_nova_libvirt.target", "enabled": true, "state": "restarted", "daemon_reload": true}, "become": true, "when": "libvirt_target_result.changed"}]}, {"name": "validate nova-migration-target container state", "containers.podman.podman_container_info": {"name": "nova_migration_target"}, "register": "nova_migration_target_infos", "failed_when": ["nova_migration_target_infos.containers.0.Healthcheck.Status is defined", "'healthy' not in nova_migration_target_infos.containers.0.Healthcheck.Status"], "retries": 10, "delay": 30, "tags": ["opendev-validation", "opendev-validation-nova"], "when": ["container_cli == 'podman'", "not container_healthcheck_disabled", "step|int == 5"]}, {"name": "validate nova-vnc-proxy container state", "containers.podman.podman_container_info": {"name": "nova_vnc_proxy"}, "register": "nova_vnc_proxy_infos", "failed_when": ["nova_vnc_proxy_infos.containers.0.Healthcheck.Status is defined", "'healthy' not in nova_vnc_proxy_infos.containers.0.Healthcheck.Status"], "retries": 10, "delay": 30, "tags": ["opendev-validation", "opendev-validation-nova"], "when": ["container_cli == 'podman'", "not container_healthcheck_disabled", "step|int == 5"]}, {"name": "Certificate generation", "when": "step|int == 1", "vars": {"cert_key_size": "2048", "nova_vnc_key_size": "", "libvirt_vnc_key_size": "", "libvirt_network": "{{ fqdn_internal_api }}"}, "block": [{"name": "Execute system role for Nova/Libvirt VNC certs", "loop": [{"name": "libvirt-vnc-client-cert", "key_size": "{{ libvirt_vnc_key_size | default(cert_key_size, true) }}", "principal": "libvirt-vnc/{{ libvirt_network }}@{{ idm_realm }}"}, {"name": "novnc-proxy", "key_size": "{{ nova_vnc_key_size | default(cert_key_size, true) }}", "principal": "novnc-proxy/{{ libvirt_network }}@{{ idm_realm }}"}], "loop_control": {"loop_var": "cert"}, "include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "{{ cert.name }}", "dns": "{{ libvirt_network }}", "principal": "{{ cert.principal }}", "key_size": "{{ cert.key_size }}", "run_after": "container_name=$({{container_cli}} ps --format=\\{\\{.Names\\}\\} | grep nova_vnc_proxy)\nservice_crt=\"/etc/pki/tls/certs/{{ cert.name }}.crt\"\nservice_key=\"/etc/pki/tls/private/{{ cert.name }}.key\"\n# Copy the new cert from the mount-point to the real path\n{{container_cli}} exec -u root \"$container_name\" cp \"/var/lib/kolla/config_files/src-tls$service_crt\" \"$service_crt\"\n# Copy the new key from the mount-point to the real path\n{{container_cli}} exec -u root \"$container_name\" cp \"/var/lib/kolla/config_files/src-tls$service_key\" \"$service_key\"\n\n# Set permissions\n{{container_cli}} exec -u root \"$container_name\" chmod 0644 $service_crt\n{{container_cli}} exec -u root \"$container_name\" chmod 0640 $service_key\n{{container_cli}} exec -u root \"$container_name\" chgrp qemu $service_key\n\n# No need to trigger a reload for novnc proxy since the cert is not cached\n", "ca": "ipa"}]}}]}, {"name": "Certificate generation", "when": ["step|int == 1", "enable_internal_tls"], "block": [{"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "ovn_controller", "dns": "{{fqdn_internal_api}}", "principal": "ovn_controller/{{fqdn_internal_api}}@{{idm_realm}}", "key_size": "2048", "ca": "ipa"}]}}]}, {"name": "set is_ovn_dbs_bootstrap_node fact", "set_fact": "is_ovn_dbs_bootstrap_node={{ovn_dbs_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}", "when": ["step|int == 1"]}, {"name": "Populate ansible service facts so we can check for pacemaker service", "ansible.builtin.service_facts": null, "when": ["is_ovn_dbs_bootstrap_node | bool", "step|int == 1"]}, {"name": "Remove OVNDBs from Pacemaker", "when": ["step|int == 1", "is_ovn_dbs_bootstrap_node | bool", "ansible_facts['services']['pacemaker.service']['state']  | default('unknown') == 'running'"], "block": [{"name": "Fetch ovn-dbs-bundle", "shell": "pcs status |grep ovn-dbs-bundle ||true\n", "register": "ovn_dbs"}, {"name": "Fetch ovn VIP", "shell": "pcs constraint config |grep \"with ovn-dbs-bundle\" |awk '{print $1}'\n", "register": "ovn_vip"}, {"name": "Remove OVNDBs from pacemaker", "pacemaker_resource": {"resource": "ovn-dbs-bundle", "state": "delete"}, "when": "ovn_dbs.stdout |length  > 0"}, {"name": "Remove OVNDBs VIP from pacemaker", "pacemaker_resource": {"resource": "{{ ovn_vip.stdout }}", "state": "delete"}, "when": "ovn_vip.stdout |length > 0"}, {"name": "Clean up pacemaker remote nodes cache", "shell": "pcs cluster node clear ovn-dbs-bundle-0\npcs cluster node clear ovn-dbs-bundle-1\npcs cluster node clear ovn-dbs-bundle-2\ncrm_attribute --name OVN_REPL_INFO --delete\n"}, {"name": "Remove pacemaker attributes", "shell": "pcs node attribute \"{{ item }}\" ovn-dbs-role= || true\n", "loop": "{{ ovn_dbs_short_node_names }}"}]}, {"name": "Prepare OVN cluster", "when": "step|int == 1", "block": [{"name": "Certificate generation", "when": "enable_internal_tls | bool", "block": [{"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "ovn_dbs", "dns": "{{fqdn_internal_api}}", "principal": "ovn_dbs/{{fqdn_internal_api}}@{{idm_realm}}", "key_size": "2048", "ca": "ipa"}]}}]}, {"block": [{"name": "Configure OVN DBs and northd", "include_role": {"name": "tripleo_ovn_cluster"}, "vars": {"tripleo_ovn_cluster_dbs_protocol": "{{ enable_internal_tls | ternary('ssl', 'tcp', 'tcp') }}", "tripleo_ovn_cluster_network": "internal_api", "tripleo_ovn_cluster_nb_db_port": 6641, "tripleo_ovn_cluster_sb_db_port": 6642, "tripleo_ovn_cluster_nb_local_port": 6643, "tripleo_ovn_cluster_nb_remote_port": 6643, "tripleo_ovn_cluster_sb_local_port": 6644, "tripleo_ovn_cluster_sb_remote_port": 6644, "tripleo_ovn_cluster_northd_ssl_ca_cert": "/etc/ipa/ca.crt", "tripleo_ovn_cluster_sb_ssl_ca_cert": "/etc/ipa/ca.crt", "tripleo_ovn_cluster_nb_ssl_ca_cert": "/etc/ipa/ca.crt"}}]}]}, {"name": "Start OVN DBs and northd containers (bootstrap node)", "when": ["step|int == 3", "is_ovn_dbs_bootstrap_node | bool"], "block": [{"block": [{"name": "Start OVN container", "include_role": {"name": "tripleo_container_manage"}, "vars": {"tripleo_container_manage_config": "/var/lib/tripleo-config/container-startup-config/step_0", "tripleo_container_manage_config_id": "{{ ovn_container }}", "tripleo_container_manage_config_patterns": "{{ ovn_container }}.json"}, "loop": ["ovn_cluster_north_db_server", "ovn_cluster_south_db_server", "ovn_cluster_northd"], "loop_control": {"loop_var": "ovn_container"}}]}, {"name": "Set NB connection", "become": true, "shell": "podman exec ovn_cluster_north_db_server bash -c \"ovn-nbctl --no-leader-only --inactivity-probe={{ tripleo_ovn_cluster_probe_interval }} set-connection p{{ tripleo_ovn_cluster_dbs_protocol }}:{{ tripleo_ovn_cluster_nb_db_port }}:{{ tripleo_ovn_cluster_dbs_addr }}\"\n", "register": "nb_result", "retries": 20, "delay": 5, "until": "nb_result.rc == 0", "when": ["is_ovn_dbs_bootstrap_node | bool"], "vars": {"tripleo_ovn_cluster_network": "internal_api", "tripleo_ovn_cluster_nb_db_port": 6641, "tripleo_ovn_cluster_dbs_protocol": "{{ enable_internal_tls | ternary('ssl', 'tcp', 'tcp') }}", "tripleo_ovn_cluster_dbs_addr": "0.0.0.0", "tripleo_ovn_cluster_probe_interval": 60000}}, {"name": "Set SB connection", "become": true, "shell": "podman exec ovn_cluster_south_db_server bash -c \"ovn-sbctl --no-leader-only --inactivity-probe={{ tripleo_ovn_cluster_probe_interval }} set-connection p{{ tripleo_ovn_cluster_dbs_protocol }}:{{ tripleo_ovn_cluster_sb_db_port }}:{{ tripleo_ovn_cluster_dbs_addr }}\"\n", "register": "sb_result", "retries": 20, "delay": 5, "until": "sb_result.rc == 0", "when": ["is_ovn_dbs_bootstrap_node | bool"], "vars": {"tripleo_ovn_cluster_network": "internal_api", "tripleo_ovn_cluster_sb_db_port": 6642, "tripleo_ovn_cluster_dbs_protocol": "{{ enable_internal_tls | ternary('ssl', 'tcp', 'tcp') }}", "tripleo_ovn_cluster_dbs_addr": "0.0.0.0", "tripleo_ovn_cluster_probe_interval": 60000}}]}, {"name": "Start OVN DBs and northd containers (non-bootstrap nodes)", "when": ["step|int == 4", "not is_ovn_dbs_bootstrap_node | bool"], "block": [{"block": [{"name": "Start OVN container", "include_role": {"name": "tripleo_container_manage"}, "vars": {"tripleo_container_manage_config": "/var/lib/tripleo-config/container-startup-config/step_0", "tripleo_container_manage_config_id": "{{ ovn_container }}", "tripleo_container_manage_config_patterns": "{{ ovn_container }}.json"}, "loop": ["ovn_cluster_north_db_server", "ovn_cluster_south_db_server", "ovn_cluster_northd"], "loop_control": {"loop_var": "ovn_container"}}]}, {"name": "Set NB connection", "become": true, "shell": "podman exec ovn_cluster_north_db_server bash -c \"ovn-nbctl --no-leader-only --inactivity-probe={{ tripleo_ovn_cluster_probe_interval }} set-connection p{{ tripleo_ovn_cluster_dbs_protocol }}:{{ tripleo_ovn_cluster_nb_db_port }}:{{ tripleo_ovn_cluster_dbs_addr }}\"\n", "register": "nb_result", "retries": 20, "delay": 5, "until": "nb_result.rc == 0", "when": ["is_ovn_dbs_bootstrap_node | bool"], "vars": {"tripleo_ovn_cluster_network": "internal_api", "tripleo_ovn_cluster_nb_db_port": 6641, "tripleo_ovn_cluster_dbs_protocol": "{{ enable_internal_tls | ternary('ssl', 'tcp', 'tcp') }}", "tripleo_ovn_cluster_dbs_addr": "0.0.0.0", "tripleo_ovn_cluster_probe_interval": 60000}}, {"name": "Set SB connection", "become": true, "shell": "podman exec ovn_cluster_south_db_server bash -c \"ovn-sbctl --no-leader-only --inactivity-probe={{ tripleo_ovn_cluster_probe_interval }} set-connection p{{ tripleo_ovn_cluster_dbs_protocol }}:{{ tripleo_ovn_cluster_sb_db_port }}:{{ tripleo_ovn_cluster_dbs_addr }}\"\n", "register": "sb_result", "retries": 20, "delay": 5, "until": "sb_result.rc == 0", "when": ["is_ovn_dbs_bootstrap_node | bool"], "vars": {"tripleo_ovn_cluster_network": "internal_api", "tripleo_ovn_cluster_sb_db_port": 6642, "tripleo_ovn_cluster_dbs_protocol": "{{ enable_internal_tls | ternary('ssl', 'tcp', 'tcp') }}", "tripleo_ovn_cluster_dbs_addr": "0.0.0.0", "tripleo_ovn_cluster_probe_interval": 60000}}]}, {"name": "Certificate generation", "when": ["step|int == 1", "enable_internal_tls"], "block": [{"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "ovn_metadata", "dns": "{{fqdn_internal_api}}", "principal": "ovn_metadata/{{fqdn_internal_api}}@{{idm_realm}}", "key_size": "2048", "ca": "ipa"}]}}]}, {"name": "Certificate generation", "when": ["step|int == 1", "enable_internal_tls"], "block": [{"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "rabbitmq", "dns": "{{fqdn_internal_api}}", "principal": "rabbitmq/{{fqdn_internal_api}}@{{idm_realm}}", "run_after": "container_name=$({{container_cli}} ps --format=\\{\\{.Names\\}\\} | grep -w -E 'rabbitmq(-bundle-.*-[0-9]+)?')\nservice_crt=\"/etc/pki/tls/certs/rabbitmq.crt\"\nservice_key=\"/etc/pki/tls/private/rabbitmq.key\"\nif echo \"$container_name\" | grep -q \"^rabbitmq-bundle\"; then\n  # lp#1917868: Do not use podman cp with HA containers as they get\n  # frozen temporarily and that can make pacemaker operation fail.\n  tar -c \"$service_crt\" \"$service_key\" | {{container_cli}} exec -i \"$container_name\" tar -C / -xv\n  # no need to update the mount point, because pacemaker\n  # recreates the container when it's restarted\nelse\n  # Refresh the cert at the mount-point\n  {{container_cli}} cp $service_crt \"$container_name:/var/lib/kolla/config_files/src-tls/$service_crt\"\n  # Refresh the key at the mount-point\n  {{container_cli}} cp $service_key \"$container_name:/var/lib/kolla/config_files/src-tls/$service_key\"\n  # Copy the new cert from the mount-point to the real path\n  {{container_cli}} exec -u root \"$container_name\" cp \"/var/lib/kolla/config_files/src-tls$service_crt\" \"$service_crt\"\n  # Copy the new key from the mount-point to the real path\n  {{container_cli}} exec -u root \"$container_name\" cp \"/var/lib/kolla/config_files/src-tls$service_key\" \"$service_key\"\nfi\n# Set appropriate permissions\n{{container_cli}} exec -u root \"$container_name\" chown rabbitmq:rabbitmq \"$service_crt\"\n{{container_cli}} exec -u root \"$container_name\" chown rabbitmq:rabbitmq \"$service_key\"\n# Trigger a pem cache clear in RabbitMQ to read the new certificates\n{{container_cli}} exec \"$container_name\" rabbitmqctl eval \"ssl:clear_pem_cache().\"\n", "key_size": "2048", "ca": "ipa"}]}}]}, {"name": "RabbitMQ tag container image for pacemaker", "when": "step|int == 1", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "registry.redhat.io/rhosp-rhel9/openstack-rabbitmq:17.1", "container_image_latest": "cluster.common.tag/rabbitmq:pcmklatest"}}, {"name": "RabbitMQ RPC HA Wrappers Step", "when": "step|int == 2", "block": [{"name": "Rabbitmq rpc puppet bundle", "import_role": {"name": "tripleo_ha_wrapper"}, "vars": {"tripleo_ha_wrapper_service_name": "oslo_messaging_rpc", "tripleo_ha_wrapper_resource_name": "rabbitmq", "tripleo_ha_wrapper_bundle_name": "rabbitmq-bundle", "tripleo_ha_wrapper_resource_state": "Started", "tripleo_ha_wrapper_puppet_config_volume": "rabbitmq", "tripleo_ha_wrapper_puppet_execute": "[\"Rabbitmq_policy\", \"Rabbitmq_user\"].each |String $val| { noop_resource($val) }; include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::rabbitmq_bundle", "tripleo_ha_wrapper_puppet_tags": "pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation", "tripleo_ha_wrapper_puppet_debug": false, "tripleo_ha_wrapper_config_suffix": ".previous_run"}}]}, {"when": ["(step|int) == 1"], "block": [{"name": "Pre-fetch all the containers", "become": true, "containers.podman.podman_image": {"name": "{{ prefetch_image }}", "validate_certs": false, "force": true}, "register": "result", "until": "result is succeeded", "retries": 5, "delay": 5, "loop_control": {"loop_var": "prefetch_image"}, "loop": "{{ lookup('template', tripleo_role_name + '/docker_config.yaml', errors='ignore') | default('{}', True) | from_yaml | recursive_get_key_from_dict(key='image') | unique }}"}]}, {"name": "Configure rsyslog for swift", "when": ["step|int == 1"], "block": [{"name": "Check if rsyslog exists", "shell": "systemctl is-active rsyslog", "register": "swift_rsyslog_config"}, {"name": "Forward logging to swift.log file", "copy": {"content": "# Fix for https://bugs.launchpad.net/tripleo/+bug/1776180\nlocal2.*                 /var/log/containers/swift/swift.log\n&                        stop\n", "dest": "/etc/rsyslog.d/openstack-swift.conf"}, "register": "swift_logconfig", "when": ["swift_rsyslog_config is defined", "swift_rsyslog_config.rc == 0"]}, {"name": "Restart rsyslogd service after logging conf change", "service": {"name": "rsyslog", "state": "restarted"}, "when": ["swift_logconfig is defined", "swift_logconfig is changed"]}]}, {"name": "Run kolla_set_configs to copy ring files", "when": "step|int == 5", "shell": "{{ container_cli }} exec -u root {{ item }} /usr/local/bin/kolla_set_configs ", "become": true, "register": "kolla_set_configs_result", "failed_when": ["kolla_set_configs_result.rc is defined", "kolla_set_configs_result.rc not in [0, 125]"], "with_items": ["swift_proxy"]}, {"name": "Run kolla_set_configs to copy ring files", "when": "step|int == 5", "shell": "{{ container_cli }} exec -u root {{ item }} /usr/local/bin/kolla_set_configs", "become": true, "register": "kolla_set_configs_result", "failed_when": ["kolla_set_configs_result.rc is defined", "kolla_set_configs_result.rc not in [0, 125]"], "with_items": ["swift_account_auditor", "swift_account_reaper", "swift_account_replicator", "swift_account_server", "swift_container_auditor", "swift_container_replicator", "swift_container_server", "swift_container_updater", "swift_object_auditor", "swift_object_expirer", "swift_object_replicator", "swift_object_server", "swift_object_updater"]}]}


created_at: 2025-10-10 07:31:50.753231
data:
  {"value": {"/var/lib/kolla/config_files/barbican_api.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/barbican_keystone_listener.json": {"command": "/usr/bin/barbican-keystone-listener", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/barbican_worker.json": {"command": "/usr/bin/barbican-worker", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/barbican_api_db_sync.json": {"command": "/usr/bin/bootstrap_host_exec barbican_api su barbican -s /bin/bash -c '/usr/bin/barbican-manage  db upgrade '", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/barbican_api_create_mkek.json": {"command": "/usr/bin/bootstrap_host_exec barbican_api su barbican -s /bin/bash -c '/usr/bin/barbican-manage  hsm check_mkek --label  || /usr/bin/barbican-manage  hsm gen_mkek --label  '", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/barbican_api_create_hmac.json": {"command": "/usr/bin/bootstrap_host_exec barbican_api su barbican -s /bin/bash -c '/usr/bin/barbican-manage  hsm check_hmac --label  || /usr/bin/barbican-manage hsm gen_hmac --label  '", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/barbican_api_update_rfs_server.json": {"command": "/usr/bin/bootstrap_host_exec barbican_api /opt/nfast/bin/rfs-sync --commit", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/barbican_api_get_from_rfs.json": {"command": "/opt/nfast/bin/rfs-sync --update", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/barbican_api_secret_store_sync.json": {"command": "/usr/bin/bootstrap_host_exec barbican_api su barbican -s /bin/bash -c '/usr/bin/barbican-manage  db sync_secret_stores --verbose '", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/barbican_api_rewrap_pkeks.json": {"command": "/usr/bin/bootstrap_host_exec barbican_api su barbican -s /bin/bash -c '/usr/bin/barbican-manage  hsm rewrap_pkek '", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/cinder_api.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}], "permissions": [{"path": "/var/log/cinder", "owner": "cinder:cinder", "recurse": true}, {"path": "/etc/pki/tls/certs/etcd.crt", "owner": "cinder:cinder"}, {"path": "/etc/pki/tls/private/etcd.key", "owner": "cinder:cinder"}]}, "/var/lib/kolla/config_files/cinder_api_db_sync.json": {"command": "/usr/bin/bootstrap_host_exec cinder_api su cinder -s /bin/bash -c 'cinder-manage db sync --bump-versions'", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}], "permissions": [{"path": "/var/log/cinder", "owner": "cinder:cinder", "recurse": true}, {"path": "/etc/pki/tls/certs/etcd.crt", "owner": "cinder:cinder"}, {"path": "/etc/pki/tls/private/etcd.key", "owner": "cinder:cinder"}]}, "/var/lib/kolla/config_files/cinder_api_cron.json": {"command": "/usr/sbin/crond -n", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/cinder", "owner": "cinder:cinder", "recurse": true}]}, "/var/lib/kolla/config_files/cinder_backup.json": {"command": "/usr/bin/cinder-backup --config-file /usr/share/cinder/cinder-dist.conf --config-file /etc/cinder/cinder.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-iscsid/*", "dest": "/etc/iscsi/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}], "permissions": [{"path": "/var/log/cinder", "owner": "cinder:cinder", "recurse": true}, {"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "cinder:cinder", "perm": "0600"}, {"path": "/etc/pki/tls/certs/etcd.crt", "owner": "cinder:cinder"}, {"path": "/etc/pki/tls/private/etcd.key", "owner": "cinder:cinder"}]}, "/var/lib/kolla/config_files/cinder_scheduler.json": {"command": "/usr/bin/cinder-scheduler --config-file /usr/share/cinder/cinder-dist.conf --config-file /etc/cinder/cinder.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}], "permissions": [{"path": "/var/log/cinder", "owner": "cinder:cinder", "recurse": true}, {"path": "/etc/pki/tls/certs/etcd.crt", "owner": "cinder:cinder"}, {"path": "/etc/pki/tls/private/etcd.key", "owner": "cinder:cinder"}]}, "/var/lib/kolla/config_files/cinder_volume.json": {"command": "/usr/bin/cinder-volume --config-file /usr/share/cinder/cinder-dist.conf --config-file /etc/cinder/cinder.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-iscsid/*", "dest": "/etc/iscsi/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}], "permissions": [{"path": "/var/log/cinder", "owner": "cinder:cinder", "recurse": true}, {"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "cinder:cinder", "perm": "0600"}, {"path": "/etc/pki/tls/certs/etcd.crt", "owner": "cinder:cinder"}, {"path": "/etc/pki/tls/private/etcd.key", "owner": "cinder:cinder"}]}, "/var/lib/kolla/config_files/clustercheck.json": {"command": "bash -c $* -- eval source /etc/sysconfig/clustercheck; exec socat -T\"${TRIPLEO_HEALTHCHECK_TIMEOUT:-2}\" \"$TRIPLEO_SOCAT_BIND\" system:\"grep -qPe \\\"^\\\\r\\$\\\" && /usr/bin/clustercheck\"", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/logrotate-crond.json": {"command": "/usr/sbin/crond -s -n", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/glance_api.json": {"command": "/usr/bin/glance-api --config-file /usr/share/glance/glance-api-dist.conf --config-file /etc/glance/glance-api.conf --config-file /etc/glance/glance-image-import.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-iscsid/*", "dest": "/etc/iscsi/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/lib/glance", "owner": "glance:glance", "recurse": true}, {"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "glance:glance", "perm": "0600"}]}, "/var/lib/kolla/config_files/glance_api_tls_proxy.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/glance_api_cron.json": {"command": "/usr/sbin/crond -n", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/glance", "owner": "glance:glance", "recurse": true}]}, "/var/lib/kolla/config_files/haproxy.json": {"command": "bash -c $* -- eval if [ -f /usr/sbin/haproxy-systemd-wrapper ]; then exec /usr/sbin/haproxy-systemd-wrapper -f /etc/haproxy/haproxy.cfg; else exec /usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -Ws; fi", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "optional": true, "preserve_properties": true}], "permissions": [{"path": "/var/lib/haproxy", "owner": "haproxy:haproxy", "recurse": true}, {"path": "/etc/pki/tls/certs/haproxy/*", "owner": "haproxy:haproxy", "perm": "0600", "optional": true}, {"path": "/etc/pki/tls/private/haproxy/*", "owner": "haproxy:haproxy", "perm": "0600", "optional": true}]}, "/var/lib/kolla/config_files/heat_api.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/heat", "owner": "heat:heat", "recurse": true}]}, "/var/lib/kolla/config_files/heat_api_cron.json": {"command": "/usr/sbin/crond -n", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/heat", "owner": "heat:heat", "recurse": true}]}, "/var/lib/kolla/config_files/heat_api_cfn.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/heat", "owner": "heat:heat", "recurse": true}]}, "/var/lib/kolla/config_files/heat_engine.json": {"command": "/usr/bin/heat-engine --config-file /usr/share/heat/heat-dist.conf --config-file /etc/heat/heat.conf ", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/heat", "owner": "heat:heat", "recurse": true}]}, "/var/lib/kolla/config_files/heat_engine_db_sync.json": {"command": "/usr/bin/bootstrap_host_exec heat_engine su heat -s /bin/bash -c 'heat-manage db_sync'", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/heat", "owner": "heat:heat", "recurse": true}]}, "/var/lib/kolla/config_files/horizon.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/horizon/", "owner": "apache:apache", "recurse": true}, {"path": "/etc/openstack-dashboard/", "owner": "apache:apache", "recurse": true}, {"path": "/usr/share/openstack-dashboard/openstack_dashboard/local/", "owner": "apache:apache", "recurse": false}, {"path": "/usr/share/openstack-dashboard/openstack_dashboard/local/local_settings.d/", "owner": "apache:apache", "recurse": false}]}, "/var/lib/kolla/config_files/iscsid.json": {"command": "/usr/sbin/iscsid -f", "config_files": [{"source": "/var/lib/kolla/config_files/src-iscsid/", "dest": "/etc/iscsi/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/keystone.json": {"command": "/usr/sbin/httpd", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/keystone/fernet-keys", "dest": "/etc/keystone/fernet-keys", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/keystone_cron.json": {"command": "/usr/sbin/crond -n", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/manila_api.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/manila", "owner": "manila:manila", "recurse": true}]}, "/var/lib/kolla/config_files/manila_api_db_sync.json": {"command": "/usr/bin/bootstrap_host_exec manila_api su manila -s /bin/bash -c '/usr/bin/manila-manage db sync'", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/manila", "owner": "manila:manila", "recurse": true}]}, "/var/lib/kolla/config_files/manila_api_cron.json": {"command": "/usr/sbin/crond -n", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/manila", "owner": "manila:manila", "recurse": true}]}, "/var/lib/kolla/config_files/manila_scheduler.json": {"command": "/usr/bin/manila-scheduler --config-file /usr/share/manila/manila-dist.conf --config-file /etc/manila/manila.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/manila", "owner": "manila:manila", "recurse": true}]}, "/var/lib/kolla/config_files/manila_share.json": {"command": "/usr/bin/manila-share --config-file /usr/share/manila/manila-dist.conf --config-file /etc/manila/manila.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/manila", "owner": "manila:manila", "recurse": true}]}, "/var/lib/kolla/config_files/memcached.json": {"command": "bash -c $* -- eval source /etc/sysconfig/memcached; exec /usr/bin/memcached -p ${PORT} -u ${USER} -m ${CACHESIZE} -c ${MAXCONN} $OPTIONS >> /var/log/memcached/memcached.log 2>&1", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}], "permissions": [{"path": "/var/log/memcached", "owner": "memcached:memcached", "recurse": true}, {"path": "/etc/pki/tls/certs/memcached.crt", "owner": "memcached:memcached", "optional": true}, {"path": "/etc/pki/tls/private/memcached.key", "owner": "memcached:memcached", "optional": true}]}, "/var/lib/kolla/config_files/mysql.json": {"command": "/usr/sbin/pacemaker_remoted", "config_files": [{"dest": "/etc/libqb/force-filesystem-sockets", "source": "/dev/null", "owner": "root", "perm": "0644"}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "optional": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/mysql", "owner": "mysql:mysql", "recurse": true}, {"path": "/etc/pki/tls/certs/mysql.crt", "owner": "mysql:mysql", "perm": "0600", "optional": true}, {"path": "/etc/pki/tls/private/mysql.key", "owner": "mysql:mysql", "perm": "0600", "optional": true}]}, "/var/lib/kolla/config_files/neutron_api.json": {"command": "/usr/bin/neutron-server --config-file /usr/share/neutron/neutron-dist.conf --config-dir /usr/share/neutron/server --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugin.ini --config-dir /etc/neutron/conf.d/common --config-dir /etc/neutron/conf.d/neutron-server --log-file=/var/log/neutron/server.log", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "optional": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/neutron", "owner": "neutron:neutron", "recurse": true}, {"path": "/etc/pki/tls/certs/neutron_ovn.crt", "owner": "neutron:neutron", "optional": true, "perm": "0644"}, {"path": "/etc/pki/tls/private/neutron_ovn.key", "owner": "neutron:neutron", "optional": true, "perm": "0644"}]}, "/var/lib/kolla/config_files/neutron_api_db_sync.json": {"command": "/usr/bin/bootstrap_host_exec neutron_api neutron-db-manage upgrade heads", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "optional": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/neutron", "owner": "neutron:neutron", "recurse": true}, {"path": "/etc/pki/tls/certs/neutron_ovn.crt", "owner": "neutron:neutron", "optional": true, "perm": "0644"}, {"path": "/etc/pki/tls/private/neutron_ovn.key", "owner": "neutron:neutron", "optional": true, "perm": "0644"}]}, "/var/lib/kolla/config_files/neutron_server_tls_proxy.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}]}, "/var/lib/kolla/config_files/neutron_sriov_agent.json": {"command": "/usr/bin/neutron-sriov-nic-agent --config-file /usr/share/neutron/neutron-dist.conf --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/sriov_agent.ini --config-dir /etc/neutron/conf.d/common --log-file=/var/log/neutron/sriov-nic-agent.log", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/neutron", "owner": "neutron:neutron", "recurse": true}]}, "/var/lib/kolla/config_files/neutron_dhcp.json": {"command": "/usr/bin/neutron-dhcp-agent --config-file /usr/share/neutron/neutron-dist.conf --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/dhcp_agent.ini --config-dir /etc/neutron/conf.d/common --config-dir /etc/neutron/conf.d/neutron-dhcp-agent --log-file=/var/log/neutron/dhcp-agent.log", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}], "permissions": [{"path": "/var/log/neutron", "owner": "neutron:neutron", "recurse": true}, {"path": "/var/lib/neutron", "owner": "neutron:neutron", "recurse": true}, {"path": "/etc/pki/tls/certs/neutron.crt", "owner": "neutron:neutron"}, {"path": "/etc/pki/tls/private/neutron.key", "owner": "neutron:neutron"}]}, "/var/lib/kolla/config_files/nova_api.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/nova", "owner": "nova:nova", "recurse": true}]}, "/var/lib/kolla/config_files/nova_api_db_sync.json": {"command": "/usr/bin/bootstrap_host_exec nova_api su nova -s /bin/bash -c '/usr/bin/nova-manage api_db sync'", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/nova", "owner": "nova:nova", "recurse": true}]}, "/var/lib/kolla/config_files/nova_api_ensure_default_cells.json": {"command": "/usr/bin/bootstrap_host_exec nova_api su nova -s /bin/bash -c '/container-config-scripts/pyshim.sh /container-config-scripts/nova_api_ensure_default_cells.py'", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/nova", "owner": "nova:nova", "recurse": true}]}, "/var/lib/kolla/config_files/nova_api_cron.json": {"command": "/usr/sbin/crond -n", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/nova", "owner": "nova:nova", "recurse": true}]}, "/var/lib/kolla/config_files/nova_wait_for_api_service.json": {"command": "/usr/bin/bootstrap_host_exec nova_api su nova -s /bin/bash -c '/container-config-scripts/pyshim.sh /container-config-scripts/nova_wait_for_api_service.py'", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/nova", "owner": "nova:nova", "recurse": true}]}, "/var/lib/kolla/config_files/nova_conductor.json": {"command": "/usr/bin/nova-conductor ", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/nova", "owner": "nova:nova", "recurse": true}]}, "/var/lib/kolla/config_files/nova_conductor_db_sync.json": {"command": "/usr/bin/bootstrap_host_exec nova_conductor su nova -s /bin/bash -c '/usr/bin/nova-manage db sync '", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/nova", "owner": "nova:nova", "recurse": true}]}, "/var/lib/kolla/config_files/nova_metadata.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/nova", "owner": "nova:nova", "recurse": true}]}, "/var/lib/kolla/config_files/nova_scheduler.json": {"command": "/usr/bin/nova-scheduler ", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/nova", "owner": "nova:nova", "recurse": true}]}, "/var/lib/kolla/config_files/nova_compute.json": {"command": "/usr/bin/nova-compute ", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-iscsid/*", "dest": "/etc/iscsi/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/nova", "owner": "nova:nova", "recurse": true}, {"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "nova:nova", "perm": "0600"}]}, "/var/lib/kolla/config_files/nova_compute_wait_for_compute_service.json": {"command": "/container-config-scripts/pyshim.sh /container-config-scripts/nova_wait_for_compute_service.py", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/nova", "owner": "nova:nova", "recurse": true}]}, "/var/lib/kolla/config_files/nova_virtlogd.json": {"command": "/usr/local/bin/virtlogd_wrapper", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "nova:nova", "perm": "0600"}]}, "/var/lib/kolla/config_files/nova_virtsecretd.json": {"command": "/usr/sbin/virtsecretd --config /etc/libvirt/virtsecretd.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "nova:nova", "perm": "0600"}]}, "/var/lib/kolla/config_files/nova_virtnodedevd.json": {"command": "/usr/sbin/virtnodedevd --config /etc/libvirt/virtnodedevd.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "nova:nova", "perm": "0600"}]}, "/var/lib/kolla/config_files/nova_virtstoraged.json": {"command": "/usr/sbin/virtstoraged --config /etc/libvirt/virtstoraged.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "nova:nova", "perm": "0600"}]}, "/var/lib/kolla/config_files/nova_virtqemud.json": {"command": "/usr/sbin/virtqemud --config /etc/libvirt/virtqemud.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "nova:nova", "perm": "0600"}]}, "/var/lib/kolla/config_files/nova_virtproxyd.json": {"command": "/usr/sbin/virtproxyd --config /etc/libvirt/virtproxyd.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "nova:nova", "perm": "0600"}]}, "/var/lib/kolla/config_files/nova-migration-target.json": {"command": "dumb-init --single-child -- /usr/sbin/sshd -D -p 2022", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/host-ssh/ssh_host_*_key", "dest": "/etc/ssh/", "owner": "root", "perm": "0600"}]}, "/var/lib/kolla/config_files/nova_vnc_proxy.json": {"command": "/usr/bin/nova-novncproxy --web /usr/share/novnc/ ", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}], "permissions": [{"path": "/var/log/nova", "owner": "nova:nova", "recurse": true}, {"path": "/etc/pki/tls/certs/novnc-proxy.crt", "owner": "root:root", "perm": "0644"}, {"path": "/etc/pki/tls/private/novnc-proxy.key", "owner": "root:qemu", "perm": "0640"}, {"path": "/etc/pki/tls/certs/libvirt-vnc-client-cert.crt", "owner": "root:root", "perm": "0644"}, {"path": "/etc/pki/tls/private/libvirt-vnc-client-cert.key", "owner": "root:qemu", "perm": "0640"}]}, "/var/lib/kolla/config_files/ovn_controller.json": {"command": "/usr/bin/ovn-controller --pidfile --log-file unix:/run/openvswitch/db.sock -p /etc/pki/tls/private/ovn_controller.key -c /etc/pki/tls/certs/ovn_controller.crt -C /etc/ipa/ca.crt", "permissions": [{"path": "/var/log/openvswitch", "owner": "root:root", "recurse": true}, {"path": "/var/log/ovn", "owner": "root:root", "recurse": true}]}, "/var/lib/kolla/config_files/ovn_cluster_north_db_server.json": {"command": "bash -c $* -- eval source /etc/sysconfig/ovn_cluster; exec /usr/local/bin/start-nb-db-server ${OVN_NB_DB_OPTS}", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}], "permissions": [{"path": "/var/log/openvswitch", "owner": "root:root", "recurse": true}, {"path": "/var/log/ovn", "owner": "root:root", "recurse": true}]}, "/var/lib/kolla/config_files/ovn_cluster_south_db_server.json": {"command": "bash -c $* -- eval source /etc/sysconfig/ovn_cluster; exec /usr/local/bin/start-sb-db-server ${OVN_SB_DB_OPTS}", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}], "permissions": [{"path": "/var/log/openvswitch", "owner": "root:root", "recurse": true}, {"path": "/var/log/ovn", "owner": "root:root", "recurse": true}]}, "/var/lib/kolla/config_files/ovn_cluster_northd.json": {"command": "bash -c $* -- eval source /etc/sysconfig/ovn_cluster; exec /usr/bin/ovn-northd ${OVN_NORTHD_OPTS}", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}], "permissions": [{"path": "/var/log/openvswitch", "owner": "root:root", "recurse": true}, {"path": "/var/log/ovn", "owner": "root:root", "recurse": true}]}, "/var/lib/kolla/config_files/ovn_metadata_agent.json": {"command": "/usr/bin/networking-ovn-metadata-agent --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/networking-ovn/networking-ovn-metadata-agent.ini --log-file=/var/log/neutron/ovn-metadata-agent.log", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/neutron", "owner": "neutron:neutron", "recurse": true}, {"path": "/var/lib/neutron", "owner": "neutron:neutron", "recurse": true}, {"path": "/etc/pki/tls/certs/ovn_metadata.crt", "owner": "neutron:neutron", "optional": true, "perm": "0644"}, {"path": "/etc/pki/tls/private/ovn_metadata.key", "owner": "neutron:neutron", "optional": true, "perm": "0644"}]}, "/var/lib/kolla/config_files/rabbitmq.json": {"command": "/usr/sbin/pacemaker_remoted", "config_files": [{"dest": "/etc/libqb/force-filesystem-sockets", "source": "/dev/null", "owner": "root", "perm": "0644"}, {"dest": "/var/log/btmp", "source": "/dev/null", "owner": "root:utmp", "perm": "0600"}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "optional": true, "preserve_properties": true}], "permissions": [{"path": "/var/lib/rabbitmq", "owner": "rabbitmq:rabbitmq", "recurse": true}, {"path": "/var/log/rabbitmq", "owner": "rabbitmq:rabbitmq", "recurse": true}, {"path": "/etc/pki/tls/certs/rabbitmq.crt", "owner": "rabbitmq:rabbitmq", "perm": "0600", "optional": true}, {"path": "/etc/pki/tls/private/rabbitmq.key", "owner": "rabbitmq:rabbitmq", "perm": "0600", "optional": true}]}, "/var/lib/kolla/config_files/placement_api.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/placement", "owner": "placement:placement", "recurse": true}]}, "/var/lib/kolla/config_files/placement_api_db_sync.json": {"command": "/usr/bin/bootstrap_host_exec placement su placement -s /bin/bash -c '/usr/bin/placement-manage db sync'", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/placement", "owner": "placement:placement", "recurse": true}]}, "/var/lib/kolla/config_files/placement_api_wait_for_service.json": {"command": "/usr/bin/bootstrap_host_exec placement su placement -s /bin/bash -c '/container-config-scripts/pyshim.sh /container-config-scripts/placement_wait_for_service.py'", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/placement", "owner": "placement:placement", "recurse": true}]}, "/var/lib/kolla/config_files/swift_proxy.json": {"command": "/usr/bin/swift-proxy-server /etc/swift/proxy-server.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/swift_proxy_tls_proxy.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/swift_account_auditor.json": {"command": "/usr/bin/swift-account-auditor /etc/swift/account-server.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/swift_account_reaper.json": {"command": "/usr/bin/swift-account-reaper /etc/swift/account-server.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/swift_account_replicator.json": {"command": "/usr/bin/swift-account-replicator /etc/swift/account-server.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/swift_account_server.json": {"command": "/usr/bin/swift-account-server /etc/swift/account-server.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/swift_container_auditor.json": {"command": "/usr/bin/swift-container-auditor /etc/swift/container-server.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/swift_container_replicator.json": {"command": "/usr/bin/swift-container-replicator /etc/swift/container-server.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/swift_container_updater.json": {"command": "/usr/bin/swift-container-updater /etc/swift/container-server.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/swift_container_server.json": {"command": "/usr/bin/swift-container-server /etc/swift/container-server.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/swift_container_sharder.json": {"command": "/usr/bin/swift-container-sharder /etc/swift/container-server.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/swift_object_auditor.json": {"command": "/usr/bin/swift-object-auditor /etc/swift/object-server.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/swift_object_expirer.json": {"command": "/usr/bin/swift-object-expirer /etc/swift/object-expirer.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/swift_object_replicator.json": {"command": "/usr/bin/swift-object-replicator /etc/swift/object-server.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/swift_object_updater.json": {"command": "/usr/bin/swift-object-updater /etc/swift/object-server.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/swift_object_server.json": {"command": "/usr/bin/swift-object-server /etc/swift/object-server.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/cache/swift", "owner": "swift:swift", "recurse": true}]}, "/var/lib/kolla/config_files/swift_rsync.json": {"command": "/usr/bin/rsync --daemon --no-detach --config=/etc/rsyncd.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}}}


created_at: 2025-10-10 07:31:50.756474
data:
  {"value": [{"block": [{"name": "is additonal Cell?", "set_fact": {"nova_additional_cell": false}}, {"name": "check if discover hosts is required", "when": ["not nova_additional_cell|bool", "nova_cellv2_discovery_done is not defined"], "block": [{"name": "discover via nova_manager?", "set_fact": {"nova_cellv2_discovery_delegate_host": "{{ groups['nova_manager'][0] }}", "nova_cellv2_discovery_container": "nova_manager"}, "when": ["groups['nova_manager'] is defined and (groups['nova_manager']|length>0)"]}, {"name": "discover via nova_api?", "set_fact": {"nova_cellv2_discovery_delegate_host": "{{ groups['nova_api'][0] }}", "nova_cellv2_discovery_container": "nova_api"}, "when": ["nova_cellv2_discovery_delegate_host is not defined", "groups['nova_api'] is defined and (groups['nova_api']|length>0)"]}, {"name": "Warn if no discovery host available", "fail": {"msg": "No hosts available to run nova cell_v2 host discovery."}, "ignore_errors": true, "when": ["nova_cellv2_discovery_delegate_host is not defined"]}, {"name": "Discovering nova hosts", "command": "{{ container_cli }} exec {{ nova_cellv2_discovery_container }} nova-manage cell_v2 discover_hosts --by-service", "become": true, "changed_when": false, "delegate_to": "{{ nova_cellv2_discovery_delegate_host }}", "when": ["nova_cellv2_discovery_delegate_host is defined"]}, {"set_fact": {"nova_cellv2_discovery_done": true}}]}]}]}


created_at: 2025-10-10 07:31:50.765144
data:
  {"value": [{"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/barbican", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/barbican-api", "setype": "container_file_t", "mode": "0750"}]}, {"name": "enable virt_sandbox_use_netlink for healthcheck", "seboolean": {"name": "virt_sandbox_use_netlink", "persistent": true, "state": true}, "when": ["ansible_facts.selinux is defined", "ansible_facts.selinux.status == \"enabled\""]}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/log/containers/cinder", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/cinder-api", "setype": "container_file_t", "mode": "0750"}]}, {"name": "create fcontext entry for cinder data", "community.general.sefcontext": {"target": "/var/lib/cinder(/.*)?", "setype": "container_file_t", "state": "present"}}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/log/containers/cinder", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/lib/cinder", "setype": "container_file_t"}]}, {"name": "ensure ceph configurations exist", "file": {"path": "/var/lib/tripleo-config/ceph", "state": "directory"}}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/cinder", "setype": "container_file_t", "mode": "0750"}]}, {"name": "Support using an NFS share for cinder image conversion", "vars": {"image_conversion_nfs_enabled": false}, "when": ["image_conversion_nfs_enabled|bool"], "block": [{"name": "Create cinder image conversion directory", "file": {"path": "/var/lib/cinder_image_conversion", "state": "directory"}}, {"name": "Mount cinder's image conversion NFS share", "vars": {"image_conversion_nfs_share": "", "image_conversion_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"path": "/var/lib/cinder_image_conversion", "state": "mounted", "fstype": "nfs4", "src": "{{ image_conversion_nfs_share }}", "opts": "{{ image_conversion_nfs_options }}"}}]}, {"name": "cinder_configure_lvm fact", "set_fact": {"cinder_configure_lvm": true}}, {"when": "cinder_configure_lvm|bool", "block": [{"name": "ensure LVM rpm dependencies are installed", "package": {"name": "lvm2", "state": "latest"}}, {"name": "cinder create LVM volume group dd", "command": "dd if=/dev/zero of=/var/lib/cinder/cinder-volumes bs=1 count=0 seek=10280M", "args": {"creates": "/var/lib/cinder/cinder-volumes"}}, {"name": "Get or create LVM loopback device", "shell": "exit_code=0\nexisting_device=$(losetup -j /var/lib/cinder/cinder-volumes -l -n -O NAME)\nif [[ -z \"${existing_device}\" ]]; then\n    losetup -f /var/lib/cinder/cinder-volumes --show\n    exit_code=2\nelse\n    echo ${existing_device%$'\\n'*}\nfi\nexit ${exit_code}", "args": {"executable": "/bin/bash"}, "register": "_loopback_device", "changed_when": "_loopback_device.rc == 2", "failed_when": "_loopback_device.rc not in [0,2]"}, {"name": "Create LVM volume group", "community.general.lvg": {"vg": "cinder-volumes", "pvs": "{{ _loopback_device.stdout }}", "state": "present"}, "when": ["not (ansible_check_mode | bool)"]}, {"name": "cinder create service to run losetup for LVM on startup", "copy": {"dest": "/etc/systemd/system/cinder-lvm-losetup.service", "content": "[Unit]\nDescription=Cinder LVM losetup\nDefaultDependencies=no\nConflicts=umount.target\nRequires=lvm2-monitor.service systemd-udev-settle.service\nBefore=local-fs.target umount.target\nAfter=var.mount lvm2-monitor.service systemd-udev-settle.service\n\n[Service]\nType=oneshot\nExecStart=/sbin/losetup {{ _loopback_device.stdout }} /var/lib/cinder/cinder-volumes\nExecStop=/sbin/losetup -d {{ _loopback_device.stdout }}\nRemainAfterExit=yes\n\n[Install]\nWantedBy=local-fs-pre.target\n"}, "when": ["not (ansible_check_mode | bool)"]}, {"name": "cinder enable the LVM losetup service", "systemd": {"name": "cinder-lvm-losetup", "enabled": true, "daemon_reload": true}}]}, {"name": "allow logrotate to read inside containers", "seboolean": {"name": "logrotate_read_inside_containers", "persistent": true, "state": true}, "when": ["ansible_facts.selinux is defined", "ansible_facts.selinux.status == \"enabled\""]}, {"name": "authorize httpd to listen on registry ports", "community.general.seport": {"ports": ["8787", "13787"], "proto": "tcp", "setype": "http_port_t", "state": "present"}}, {"name": "Install, Configure and Run Apache to serve container images", "block": [{"set_fact": {"container_registry_host": "192.168.24.1", "container_registry_port": "8787"}}, {"include_role": {"name": "tripleo_image_serve"}}]}, {"name": "create persistent logs directory", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/glance", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/glance", "setype": "container_file_t", "mode": "0750"}]}, {"name": "Mount NFS on host", "vars": {"nfs_backend_enabled": false, "glance_netapp_nfs_enabled": false, "glance_nfs_share": "", "netapp_share_location": "", "nfs_share": "{{ glance_nfs_share if (glance_nfs_share) else netapp_share_location }}", "nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"name": "/var/lib/glance/images", "state": "mounted", "fstype": "nfs", "src": "{{nfs_share}}", "opts": "{{nfs_options}}"}, "when": "nfs_backend_enabled or glance_netapp_nfs_enabled"}, {"name": "Mount Node Staging Location", "vars": {"glance_node_staging_uri": "file:///var/lib/glance/staging", "glance_staging_nfs_share": "", "glance_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"name": "{{glance_node_staging_uri[7:]}}", "state": "mounted", "fstype": "nfs", "src": "{{glance_staging_nfs_share}}", "opts": "{{glance_nfs_options}}"}, "when": "glance_staging_nfs_share != ''"}, {"name": "ensure /var/lib/glance exists", "file": {"path": "/var/lib/glance", "state": "directory", "setype": "container_file_t"}}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/log/containers/haproxy", "setype": "var_log_t", "mode": "0750"}, {"path": "/var/lib/haproxy", "setype": "container_file_t"}]}, {"name": "Run puppet on the host to apply IPtables rules", "no_log": true, "shell": "puppet apply {{ (puppet_debug|bool) | ternary('--debug --verbose', '') }} --detailed-exitcodes --summarize --color=false \\\n    --modulepath '{{ puppet_modulepath }}' --tags '{{ puppet_tags }}' -e '{{ puppet_execute }}'\n", "register": "puppet_host_outputs", "changed_when": "puppet_host_outputs.rc == 2", "failed_when": false, "vars": {"puppet_execute": "if hiera('enable_load_balancer', true) { class {'::tripleo::haproxy': use_internal_certificates => false, manage_firewall => hiera('tripleo::firewall::manage_firewall', true), }}", "puppet_tags": "tripleo::firewall::rule", "puppet_modulepath": "/etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules", "puppet_debug": false}}, {"name": "Debug output for task: Run puppet on the host to apply IPtables rules", "debug": {"var": "puppet_host_outputs.stdout_lines | default([]) | union(puppet_host_outputs.stderr_lines | default([]))"}, "when": ["not (ansible_check_mode | bool)", "puppet_host_outputs.rc is defined"], "failed_when": "puppet_host_outputs.rc not in [0, 2]"}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/heat", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/heat-api", "setype": "container_file_t", "mode": "0750"}]}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/heat", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/heat-api-cfn", "setype": "container_file_t", "mode": "0750"}]}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/heat", "setype": "container_file_t", "mode": "0750"}]}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/log/containers/horizon", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/horizon", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/www", "setype": "container_file_t"}, {"path": "/var/tmp/horizon", "setype": "container_file_t", "mode": "01777"}]}, {"name": "ensure /var/tmp/horizon exists on boot", "copy": {"dest": "/etc/tmpfiles.d/var-tmp-horizon.conf", "content": "d /var/tmp/horizon 01777 root root - -\n"}}, {"name": "create fcontext entry for iscsi", "community.general.sefcontext": {"target": "{{ item.path }}(/.*)?", "setype": "{{ item.setype }}", "state": "present"}, "with_items": [{"path": "/etc/iscsi", "setype": "container_file_t"}, {"path": "/etc/target", "setype": "container_file_t"}, {"path": "/var/lib/iscsi", "setype": "container_file_t"}]}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}"}, "with_items": [{"path": "/etc/iscsi", "setype": "container_file_t"}, {"path": "/etc/target", "setype": "container_file_t"}, {"path": "/var/lib/iscsi", "setype": "container_file_t"}]}, {"name": "stat /lib/systemd/system/iscsid.socket", "stat": "path=/lib/systemd/system/iscsid.socket", "register": "stat_iscsid_socket"}, {"name": "Stop and disable iscsid.socket service", "service": "name=iscsid.socket state=stopped enabled=no", "when": "stat_iscsid_socket.stat.exists"}, {"name": "Check if iscsi.service is enabled", "command": "systemctl is-enabled --quiet iscsi.service", "failed_when": false, "register": "iscsi_service_enabled_result"}, {"name": "Stop iscsi.service", "service": "name=iscsi.service state=stopped enabled=no", "when": ["iscsi_service_enabled_result is changed", "iscsi_service_enabled_result.rc == 0"]}, {"include_role": {"name": "tripleo_kernel"}}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/keystone", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/keystone", "setype": "container_file_t", "mode": "0750"}]}, {"name": "Check if file certs_valid exist", "stat": {"path": "/etc/openldap/certs/certs_valid"}, "register": "certs_valid_stat"}, {"name": "Check if file cert9.db exist", "stat": {"path": "/etc/openldap/certs/cert9.db"}, "register": "cert9_stat", "when": "not certs_valid_stat.stat.exists"}, {"name": "Check if file key4.db exist", "stat": {"path": "/etc/openldap/certs/key4.db"}, "register": "key4_stat", "when": "not certs_valid_stat.stat.exists"}, {"fail": {"msg": "Keys and/or certificates were found in /etc/openldap/certs but these conflicts with keystone python LDAP calls.  If you know those certificates are valid and not causing any conflicts, you can touch /etc/openldap/certs/certs_valid in order to skip this failure and retry or you can delete the files located in /etc/openldap/certs and retry.\n"}, "when": "( cert9_stat.stat.exists or key4_stat.stat.exists ) and not certs_valid_stat.stat.exists"}, {"name": "Create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/log/containers/manila", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/manila-api", "setype": "container_file_t", "mode": "0750"}]}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/manila", "setype": "container_file_t", "mode": "0750"}]}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/log/containers/manila", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/lib/manila", "setype": "container_file_t"}]}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/memcached", "setype": "container_file_t", "mode": "0750"}]}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/log/containers/mysql", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/lib/mysql", "setype": "container_file_t"}, {"path": "/var/log/mariadb", "setype": "container_file_t", "mode": "0750"}]}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/neutron", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/neutron-api", "setype": "container_file_t", "mode": "0750"}]}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/neutron", "setype": "container_file_t", "mode": "0750"}]}, {"name": "creating directory", "file": {"state": "directory", "path": "/var/lib/pci_passthrough_whitelist_scripts", "owner": "root", "group": "root", "mode": 488}}, {"name": "derive pci passthrough whitelist", "copy": {"src": "/usr/share/openstack-tripleo-heat-templates/deployment/neutron/derive_pci_passthrough_whitelist.py", "dest": "/var/lib/pci_passthrough_whitelist_scripts/derive_pci_passthrough_whitelist.py", "mode": 448}}, {"name": "run derive_pci_passthrough_whitelist.py", "command": "/var/lib/pci_passthrough_whitelist_scripts/derive_pci_passthrough_whitelist.py"}, {"name": "create /run/netns with temp namespace", "command": "ip netns add ns_temp", "register": "ipnetns_add_result", "failed_when": false}, {"name": "remove temp namespace", "command": "ip netns delete ns_temp", "failed_when": false, "when": ["ipnetns_add_result.rc is defined", "ipnetns_add_result.rc == 0"]}, {"name": "create /var/lib/neutron", "file": {"path": "/var/lib/neutron", "state": "directory", "setype": "container_file_t"}}, {"name": "set conditions", "set_fact": {"dnsmasq_wrapper_enabled": true, "haproxy_wrapper_enabled": true, "debug_enabled": true, "docker_additional_sockets": ["/var/lib/openstack/docker.sock"]}}, {"name": "create kill_scripts directory within /var/lib/neutron", "file": {"state": "directory", "path": "/var/lib/neutron/kill_scripts"}}, {"name": "create dnsmasq dhcp kill script", "when": "dnsmasq_wrapper_enabled|bool", "copy": {"dest": "/var/lib/neutron/kill_scripts/dnsmasq-kill", "mode": 493, "content": "#!/bin/bash\n{% if debug_enabled|bool -%}\nset -x\n{% endif -%}\nadd_date() {\n  echo \"$(date) $@\"\n}\n\n# Set up script logging for debugging purpose.\n# It will be taken care of by logrotate since there is the .log\n# suffix.\nexec 3>&1 4>&2\ntrap 'exec 2>&4 1>&3' 0 1 2 3\nexec 1>>/var/log/neutron/kill-script.log 2>&1\n\nSIG=$1\nPID=$2\nNETNS=$(ip netns identify ${PID})\n\nif [ \"x${NETNS}\" == \"x\" ]; then\n  CLI=\"nsenter --all --preserve-credentials -t 1 podman\"\n  SIG=9\nelse\n  CLI=\"nsenter --net=/run/netns/${NETNS} --preserve-credentials -m -t 1 podman\"\nfi\n\nkill_container() {\n  add_date \"Killing container $1 ($2)\"\n  signal_container $1 $2 9\n}\n\nstop_container() {\n  add_date \"Stopping container $1 ($2)\"\n  $CLI stop $2\n}\n\nsignal_container() {\n  SIGNAL=$3\n  if [ -z \"$SIGNAL\" ]; then\n      SIGNAL=\"HUP\"\n  fi\n  add_date \"Sending signal '$SIGNAL' to $1 ($2)\"\n  $CLI kill --signal $SIGNAL $2\n}\n\ndelete_container() {\n  add_date \"Deleting container $1 ($2)\"\n  $CLI rm $2 || echo \"Deleting container $1 ($2) failed\"\n}\n\n\n{% raw -%}\nif [ -f /proc/$PID/cgroup ]; then\n  # Get container ID based on process cgroups\n  CT_ID=$(awk 'BEGIN {FS=\".scope|-\"} /\\/libpod-/ {if ($(NF-1)) print $(NF-1);exit}' /proc/$PID/cgroup)\n  CT_NAME=$($CLI inspect -f '{{.Name}}' $CT_ID)\n\n  case $SIG in\n    HUP)\n      signal_container $CT_NAME $CT_ID\n      ;;\n    9)\n      kill_container $CT_NAME $CT_ID\n      delete_container $CT_NAME $CT_ID\n      ;;\n    15)\n      stop_container $CT_NAME $CT_ID\n      delete_container $CT_NAME $CT_ID\n      ;;\n    *)\n      add_date \"Unknown action ${SIG} for ${CT_NAME} ${CT_ID}\"\n      exit 1\n      ;;\n  esac\n\nelse\n  add_date \"No such PID: ${PID}\"\n  exit 1\nfi\n{% endraw %}\n"}}, {"name": "create haproxy kill script", "when": "haproxy_wrapper_enabled|bool", "copy": {"dest": "/var/lib/neutron/kill_scripts/haproxy-kill", "mode": 493, "content": "#!/bin/bash\n{% if debug_enabled|bool -%}\nset -x\n{% endif -%}\nadd_date() {\n  echo \"$(date) $@\"\n}\n\n# Set up script logging for debugging purpose.\n# It will be taken care of by logrotate since there is the .log\n# suffix.\nexec 3>&1 4>&2\ntrap 'exec 2>&4 1>&3' 0 1 2 3\nexec 1>>/var/log/neutron/kill-script.log 2>&1\n\nSIG=$1\nPID=$2\nNETNS=$(ip netns identify ${PID})\n\nif [ \"x${NETNS}\" == \"x\" ]; then\n  CLI=\"nsenter --all --preserve-credentials -t 1 podman\"\n  SIG=9\nelse\n  CLI=\"nsenter --net=/run/netns/${NETNS} --preserve-credentials -m -t 1 podman\"\nfi\n\nkill_container() {\n  add_date \"Killing container $1 ($2)\"\n  signal_container $1 $2 9\n}\n\nstop_container() {\n  add_date \"Stopping container $1 ($2)\"\n  $CLI stop $2\n}\n\nsignal_container() {\n  SIGNAL=$3\n  if [ -z \"$SIGNAL\" ]; then\n      SIGNAL=\"HUP\"\n  fi\n  add_date \"Sending signal '$SIGNAL' to $1 ($2)\"\n  $CLI kill --signal $SIGNAL $2\n}\n\ndelete_container() {\n  add_date \"Deleting container $1 ($2)\"\n  $CLI rm $2 || echo \"Deleting container $1 ($2) failed\"\n}\n\n\n{% raw -%}\nif [ -f /proc/$PID/cgroup ]; then\n  # Get container ID based on process cgroups\n  CT_ID=$(awk 'BEGIN {FS=\".scope|-\"} /\\/libpod-/ {if ($(NF-1)) print $(NF-1);exit}' /proc/$PID/cgroup)\n  CT_NAME=$($CLI inspect -f '{{.Name}}' $CT_ID)\n\n  case $SIG in\n    HUP)\n      signal_container $CT_NAME $CT_ID\n      ;;\n    9)\n      kill_container $CT_NAME $CT_ID\n      delete_container $CT_NAME $CT_ID\n      ;;\n    15)\n      stop_container $CT_NAME $CT_ID\n      delete_container $CT_NAME $CT_ID\n      ;;\n    *)\n      add_date \"Unknown action ${SIG} for ${CT_NAME} ${CT_ID}\"\n      exit 1\n      ;;\n  esac\n\nelse\n  add_date \"No such PID: ${PID}\"\n  exit 1\nfi\n{% endraw %}\n"}}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "setype": "{{ item.setype }}", "state": "directory", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/nova", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/nova-api", "setype": "container_file_t", "mode": "0750"}]}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "setype": "{{ item.setype }}", "state": "directory", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/nova", "setype": "container_file_t", "mode": "0750"}]}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/nova", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/nova-metadata", "setype": "container_file_t", "mode": "0750"}]}, {"name": "Check for /var/lib/nova/instances directory exitance", "stat": {"path": "/var/lib/nova/instances"}, "register": "check_nova_instances_result"}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype | default(omit) }}"}, "with_items": [{"path": "/var/lib/nova", "setype": "container_file_t"}, {"path": "/var/lib/_nova_secontext", "setype": "container_file_t"}, {"path": "/var/lib/nova/instances", "setype": "container_file_t"}, {"path": "/var/lib/libvirt", "setype": "container_file_t"}, {"path": "/etc/tmpfiles.d"}]}, {"name": "ensure /run/nova is present upon reboot", "copy": {"dest": "/etc/tmpfiles.d/run-nova.conf", "content": "d /run/nova 0777 root root - -\n"}}, {"name": "create tempfiles", "command": "systemd-tmpfiles --create"}, {"name": "Mount Nova NFS Share", "vars": {"nfs_backend_enable": false, "nfs_share": "", "nfs_options": "context=system_u:object_r:nfs_t:s0", "nfs_vers": "4.2"}, "mount": {"name": "/var/lib/nova/instances", "state": "mounted", "fstype": "nfs4", "src": "{{nfs_share}}", "opts": "_netdev,bg,{{nfs_options}},nfsvers={{nfs_vers}}"}, "when": "nfs_backend_enable|bool"}, {"name": "delay installation of systemd-container", "when": "check_nova_instances_result.stat.exists", "block": [{"name": "check systemd-container package installed or not", "package": {"name": "systemd-container", "state": "present"}, "check_mode": true, "register": "is_systemd_container_package", "failed_when": false}, {"name": "get latest package from downloaded package versions", "shell": "ls -1t /var/tmp/systemd-container* | head -1", "register": "latest_systemd_container_package", "when": ["is_systemd_container_package is defined", "('changed' in is_systemd_container_package)", "is_systemd_container_package.changed"], "failed_when": false}, {"name": "Install systemd-container package on boot", "copy": {"dest": "/etc/systemd/system/install-systemd-container.service", "content": "[Unit]\nDescription=Install systemd container package on system boot\nBefore=tripleo_nova_virtqemud.service\n\n[Service]\nType=oneshot\nExecStart=/usr/bin/rpm -ivh {{ latest_systemd_container_package.stdout }}\nExecStartPost=rm -f /var/tmp/systemd-container*\n\n[Install]\nWantedBy=multi-user.target\n"}, "when": ["latest_systemd_container_package is defined", "('stdout' in latest_systemd_container_package)", "is_systemd_container_package is defined", "('changed' in is_systemd_container_package)", "is_systemd_container_package.changed"]}, {"name": "enable install-systemd-container on compute boot", "systemd": {"name": "install-systemd-container", "state": "stopped", "enabled": true, "daemon_reload": true}, "when": ["is_systemd_container_package is defined", "('changed' in is_systemd_container_package)", "is_systemd_container_package.changed"]}, {"name": "check if install-systemd-container service exists", "stat": {"path": "/etc/systemd/system/install-systemd-container.service"}, "register": "install_systemd_container_result"}, {"name": "disable and mask install-systemd-container on compute boot", "systemd": {"name": "install-systemd-container", "enabled": false, "masked": true, "daemon_reload": true}, "when": ["is_systemd_container_package is defined", "('changed' in is_systemd_container_package)", "not is_systemd_container_package.changed", "install_systemd_container_result.stat.exists"]}]}, {"name": "is Nova Resume Guests State On Host Boot enabled", "set_fact": {"resume_guests_state_on_host_boot_enabled": false}}, {"name": "install libvirt-guests systemd unit file (docker)", "when": ["resume_guests_state_on_host_boot_enabled|bool", "container_cli == 'docker'"], "block": [{"name": "libvirt-guests unit to stop nova_compute container before shutdown VMs", "copy": {"dest": "/etc/systemd/system/libvirt-guests.service", "content": "[Unit]\nDescription=Suspend/Resume Running libvirt Guests\nAfter=network.target\nAfter=time-sync.target\nAfter=virt-guest-shutdown.target\nAfter=docker.service\nAfter=tripleo-container-shutdown.service\nAfter=rhel-push-plugin.service\nDocumentation=man:libvirtd(8)\nDocumentation=https://libvirt.org\n\n[Service]\nEnvironmentFile=-/var/lib/config-data/puppet-generated/nova_libvirt/etc/sysconfig/libvirt-guests\n# Hack just call traditional service until we factor\n# out the code\nExecStart=/bin/{{container_cli}} exec nova_libvirt /bin/sh -x /usr/libexec/libvirt-guests.sh start\nExecStop=/bin/{{container_cli}} stop nova_compute\nExecStop=/bin/{{container_cli}}  exec nova_libvirt /bin/sh -x /usr/libexec/libvirt-guests.sh stop\nType=oneshot\nRemainAfterExit=yes\nStandardOutput=journal+console\nTimeoutStopSec=0\n\n[Install]\nWantedBy=multi-user.target\n"}}, {"name": "Making sure virt-guest-shutdown.target is present", "copy": {"dest": "/etc/systemd/system/virt-guest-shutdown.target", "content": "[Unit]\nDescription=Libvirt guests shutdown\nDocumentation=https://libvirt.org\nAfter=systemd-machined.service\nAfter=network-online.target\nAfter=tripleo_nova_libvirt.target\nBefore=tripleo_nova_compute.service\n"}}, {"name": "libvirt-guests enable VM shutdown on compute reboot/shutdown", "systemd": {"name": "libvirt-guests", "enabled": true, "daemon_reload": true}}]}, {"name": "install tripleo_nova_libvirt_guests systemd unit file (podman)", "when": ["resume_guests_state_on_host_boot_enabled|bool", "container_cli == 'podman'"], "block": [{"name": "libvirt-guests unit to stop nova_compute container before shutdown VMs (monolithic libvirt)", "copy": {"dest": "/etc/systemd/system/tripleo_nova_libvirt_guests.service", "content": "[Unit]\nDescription=Suspend libvirt Guests in tripleo\nRequires=virt-guest-shutdown.target\nAfter=systemd-machined.service\nAfter=network-online.target\nAfter=tripleo_nova_libvirt.target\nBefore=tripleo_nova_compute.service\nDocumentation=man:libvirtd(8)\nDocumentation=https://libvirt.org\n\n[Service]\nEnvironmentFile=-/etc/sysconfig/libvirt-guests\nExecStart=/bin/podman exec nova_libvirt /bin/rm -f /var/lib/libvirt/libvirt-guests\nExecStop=/bin/podman exec nova_libvirt /bin/sh -x /usr/libexec/libvirt-guests.sh shutdown\nType=oneshot\nRemainAfterExit=yes\nStandardOutput=journal+console\nTimeoutStopSec=0\n\n[Install]\nWantedBy=multi-user.target\n"}, "when": "tripleo_nova_libvirt_virsh_container | default('nova_libvirt') == 'nova_libvirt'"}, {"name": "libvirt-guests unit to stop nova_compute container before shutdown VMs (modular libvirt)", "copy": {"dest": "/etc/systemd/system/tripleo_nova_libvirt_guests.service", "content": "[Unit]\nDescription=Suspend libvirt Guests in tripleo\nRequires=virt-guest-shutdown.target\nAfter=systemd-machined.service\nAfter=network-online.target\nAfter=tripleo_nova_libvirt.target\nBefore=tripleo_nova_compute.service\nDocumentation=man:libvirtd(8)\nDocumentation=https://libvirt.org\n\n[Service]\nEnvironmentFile=-/etc/sysconfig/libvirt-guests\nExecStart=/bin/podman exec nova_virtproxyd /bin/rm -f /var/lib/libvirt/libvirt-guests\nExecStop=/bin/podman exec nova_virtproxyd /bin/sh -x /usr/libexec/libvirt-guests.sh shutdown\nType=oneshot\nRemainAfterExit=yes\nStandardOutput=journal+console\nTimeoutStopSec=0\n\n[Install]\nWantedBy=multi-user.target\n"}, "when": "tripleo_nova_libvirt_virsh_container | default('nova_libvirt') != 'nova_libvirt'"}, {"name": "Making sure virt-guest-shutdown.target is present", "copy": {"dest": "/etc/systemd/system/virt-guest-shutdown.target", "content": "[Unit]\nDescription=Libvirt guests shutdown\nDocumentation=https://libvirt.org\nAfter=systemd-machined.service\nAfter=network-online.target\nAfter=tripleo_nova_libvirt.target\nBefore=tripleo_nova_compute.service\n"}}, {"name": "tripleo_nova_libvirt_guests enable VM shutdown on compute reboot/shutdown", "systemd": {"name": "tripleo_nova_libvirt_guests", "enabled": true, "daemon_reload": true}}]}, {"name": "Do we prepend nova startup with a delay", "set_fact": {"nova_compute_delay": 0}}, {"name": "install nova-compute delay wrapper script", "copy": {"content": "#!/usr/libexec/platform-python\n\"\"\"\nThis wrapper was created to add an optional delay to the startup of nova-compute.\nWe know that instances will fail to boot, after a compute reboot, if ceph is not\nhealthy.\n\nIdeally, we would poll ceph to get its health, but it's not guaranteed that the\ncompute node will have access to the keys.\n\"\"\"\n\nimport os\nimport sys\nimport time\nimport logging\nimport argparse\n\nparser = argparse.ArgumentParser(description='Process some integers.')\nparser.add_argument('--config-file', dest='nova_config', action='store',\n                    default=\"/etc/nova/nova.conf\",\n                    help='path to nova configuration (default: /etc/nova/nova.conf)')\nparser.add_argument('--nova-binary', dest='nova_binary', action='store',\n                    default=\"/usr/bin/nova-compute\",\n                    help='path to nova compute binary (default: /usr/bin/nova-compute)')\nparser.add_argument('--delay', dest='delay', action='store',\n                    default=120, type=int,\n                    help='Number of seconds to wait until nova-compute is started')\nparser.add_argument('--state-dir', dest='state_dir', action='store',\n                    default=\"/run/nova/startup\", help='state-file directory')\nparser.add_argument('--state-file', dest='state_file', action='store',\n                    default=\"nova-compute-delayed\",\n                    help='file exists if we already delayed nova-compute startup')\n\n\nsections = {}\n(args, remaining) = parser.parse_known_args(sys.argv)\n\nreal_args = [args.nova_binary, '--config-file', args.nova_config]\nreal_args.extend(remaining[1:])\n\nif not os.path.isdir(args.state_dir):\n  os.makedirs(args.state_dir, mode = 0o751)\n\nstate_file_name = os.path.join(args.state_dir, args.state_file)\n\nif not os.path.isfile(state_file_name):\n    logging.info(\"Delaying nova-compute startup by %s seconds\" % args.delay)\n    time.sleep(args.delay)\n    open(state_file_name, 'a').close()\n\nlogging.info(\"Executing %s\" % real_args)\nos.execv(args.nova_binary, real_args)\n", "dest": "/var/lib/nova/delay-nova-compute", "mode": 493}, "when": "nova_compute_delay|int > 0"}, {"name": "Is irqbalance enabled", "set_fact": {"compute_irqbalance_disabled": false}}, {"name": "disable irqbalance service on compute", "when": "compute_irqbalance_disabled|bool", "service": {"name": "irqbalance.service", "state": "stopped", "enabled": false}}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "setype": "{{ item.setype }}", "state": "directory", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/libvirt", "setype": "container_file_t", "mode": "0750"}]}, {"name": "create libvirt persistent data directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype | default(omit) }}", "mode": "{{ item.mode | default(omit) }}"}, "with_items": [{"path": "/etc/libvirt", "setype": "container_file_t"}, {"path": "/etc/libvirt/secrets", "setype": "container_file_t"}, {"path": "/etc/libvirt/qemu", "setype": "container_file_t"}, {"path": "/var/lib/libvirt", "setype": "container_file_t"}, {"path": "/var/cache/libvirt"}, {"path": "/var/lib/nova", "setype": "container_file_t"}, {"path": "/run/libvirt"}, {"path": "/var/log/containers/libvirt/swtpm", "setype": "container_file_t", "mode": "0770"}]}, {"name": "ensure qemu group is present on the host", "group": {"name": "qemu", "gid": 107, "state": "present"}}, {"name": "ensure qemu user is present on the host", "user": {"name": "qemu", "uid": 107, "group": "qemu", "state": "present", "shell": "/sbin/nologin", "comment": "qemu user"}}, {"name": "create directory for vhost-user sockets with qemu ownership", "file": {"path": "/var/lib/vhost_sockets", "state": "directory", "owner": "qemu", "group": "qemu", "setype": "virt_cache_t", "seuser": "system_u"}}, {"name": "check if libvirt is installed", "command": "/usr/bin/rpm -q libvirt-daemon", "failed_when": false, "register": "libvirt_installed", "check_mode": false}, {"name": "make sure libvirt services are disabled and masked", "service": {"name": "{{ item }}", "state": "stopped", "enabled": false, "masked": true, "daemon_reload": true}, "with_items": ["libvirtd.service", "virtlogd.socket"], "when": "libvirt_installed.rc == 0"}, {"name": "ensure /run/libvirt is present upon reboot", "copy": {"dest": "/etc/tmpfiles.d/run-libvirt.conf", "content": "d /run/libvirt 0755 root root - -\n"}}, {"name": "Enable os_enable_vtpm SELinux boolean for vTPM", "seboolean": {"name": "os_enable_vtpm", "persistent": true, "state": true}, "when": ["ansible_facts.selinux is defined", "ansible_facts.selinux.status == \"enabled\""]}, {"name": "Create libvirt persistent data directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}"}, "loop": [{"path": "/run/libvirt", "setype": "virt_var_run_t"}]}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/log/containers/openvswitch", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/lib/openvswitch/ovn", "setype": "container_file_t"}]}, {"name": "Copy in cleanup script", "copy": {"content": "#!/usr/bin/bash\n# Cleanup neutron OVS bridges. To be called on startup to avoid\n# \"difficult-to-debug\" issues with partially configured resources.\n\nNEUTRON_OVS_CONF=/var/lib/config-data/puppet-generated/neutron/etc/neutron/plugins/ml2/openvswitch_agent.ini\n\nif [ -e ${NEUTRON_OVS_CONF} ];\nthen\n    INT_BRIDGE=`crudini --get ${NEUTRON_OVS_CONF} ovs integration_bridge`\n    TUN_BRIDGE=`crudini --get ${NEUTRON_OVS_CONF} ovs tunnel_bridge`\nfi\n\nfor port in `ovs-vsctl list-ports ${INT_BRIDGE:-\"br-int\"}`;\ndo\n    skip_cleanup=`ovs-vsctl --if-exists get Interface $port external_ids:skip_cleanup`\n    if ! [[ \"x$skip_cleanup\" == \"x\\\"true\\\"\" ]];\n    then\n        ovs-vsctl del-port ${INT_BRIDGE:-\"br-int\"} $port\n    fi\ndone\n\novs-vsctl --if-exists del-br ${TUN_BRIDGE:-\"br-tun\"}\n\n# Clean up trunk port bridges\nfor br in $(ovs-vsctl list-br | egrep 'tbr-[0-9a-f\\-]+'); do\n    ovs-vsctl --if-exists del-br $br\ndone\n", "dest": "/usr/libexec/neutron-cleanup", "force": true, "mode": "0755"}}, {"name": "Copy in cleanup service", "copy": {"content": "[Unit]\nDescription=Neutron cleanup on startup\nAfter=openvswitch.service network.target\nBefore=tripleo_neutron_ovs_agent.service tripleo_neutron_dhcp.service tripleo_neutron_l3_agent.service tripleo_nova_compute.service\nRefuseManualStop=yes\n\n[Service]\nType=oneshot\nExecStart=/usr/libexec/neutron-cleanup\n\n[Install]\nWantedBy=multi-user.target\n", "dest": "/usr/lib/systemd/system/neutron-cleanup.service", "force": true}}, {"name": "Enabling the cleanup service", "service": {"name": "neutron-cleanup", "enabled": true}, "when": "not (ansible_check_mode|bool)"}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "loop": [{"path": "/var/log/containers/openvswitch", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/lib/openvswitch/ovn", "setype": "container_file_t"}]}, {"name": "set conditions", "set_fact": {"haproxy_wrapper_enabled": true, "debug_enabled": true, "docker_additional_sockets": ["/var/lib/openstack/docker.sock"]}}, {"include_role": {"name": "tripleo_clients_install"}}, {"name": "create fcontext for rabbitmq data", "community.general.sefcontext": {"target": "/var/lib/rabbitmq(/.*)?", "setype": "container_file_t", "state": "present"}}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/lib/rabbitmq", "setype": "container_file_t"}, {"path": "/var/log/containers/rabbitmq", "setype": "container_file_t", "mode": "0750"}]}, {"name": "stop the Erlang port mapper on the host and make sure it cannot bind to the port used by container", "shell": "echo 'export ERL_EPMD_ADDRESS=127.0.0.1' > /etc/rabbitmq/rabbitmq-env.conf\necho 'export ERL_EPMD_PORT=4370' >> /etc/rabbitmq/rabbitmq-env.conf\nfor pid in $(pgrep epmd --ns 1 --nslist pid); do kill $pid; done\n"}, {"name": "Make sure python3-novaclient is installed when IHA is enabled", "package": {"name": "python3-novaclient", "state": "present"}, "when": false}, {"name": "Remove existing entries from logind conf", "ansible.builtin.lineinfile": {"path": "/etc/systemd/logind.conf", "regexp": "^\\s*#?\\s*HandlePowerKey\\s*=.*", "state": "absent"}}, {"name": "Make sure systemd-logind ignores power off", "ansible.builtin.lineinfile": {"path": "/etc/systemd/logind.conf", "regexp": "^#?HandlePowerKey", "line": "HandlePowerKey=ignore"}}, {"name": "Restart systemd-logind", "ansible.builtin.service": {"name": "systemd-logind", "state": "restarted"}}, {"name": "Gather service_facts on pacemaker_bootstrap_node", "ansible.builtin.service_facts": null, "when": ["{{(pacemaker_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower)|bool}}", false]}, {"name": "Check and eventually delete duplicate constraints (bootstrap node)", "become": true, "shell": "COUNT=$(cibadmin --query | xmllint --xpath '//rsc_location[@rsc=\"stonith-fence_compute-fence-nova\"]/@id' - |grep -oP '(?<=[\"])[^\"]*' -c)\nif [[ $COUNT > 1 ]]; then\n    echo \"Detected $COUNT duplicate constraints, deleting them\"\n    # assemble string with current list of computes\n    GOOD=$(echo location-stonith-fence_compute-fence-nova-$(hiera pacemaker_remote_short_node_names |grep -oP '\".*?\"' |tr -d '\"'|tr -d '\\n' )--10000)\n    # delete old constraints\n    for i in $(cibadmin --query | xmllint --xpath '//rsc_location[@rsc=\"stonith-fence_compute-fence-nova\"]/@id' - |grep -oP '(?<=[\"])[^\"]*' |grep -v $GOOD ); do pcs constraint delete $i ; done\nelse\n    echo \"No duplicate constraint found\"\nfi\n", "when": ["{{(pacemaker_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower)|bool}}", false, "ansible_facts['services']['pacemaker.service']['state'] == 'running'"]}, {"name": "create persistent logs directory", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/placement", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/placement", "setype": "container_file_t", "mode": "0750"}]}, {"name": "Install and configure Podman", "block": [{"name": "Set login facts", "no_log": true, "set_fact": {"container_registry_insecure_registries": ["192.168.122.100:8787"], "container_registry_login": false, "container_registry_logins": {}, "container_registry_logins_json": {}, "container_default_pids_limit": 4096, "container_events_logger_mechanism": "journald"}}, {"name": "Convert logins json to dict", "no_log": true, "set_fact": {"container_registry_logins": "{{ container_registry_logins_json | from_json }}"}, "when": ["container_registry_logins_json is string", "container_registry_login | bool", "(container_registry_logins_json | length) > 0"]}, {"name": "Set registry logins", "no_log": true, "set_fact": {"container_registry_logins": "{{ container_registry_logins_json }}"}, "when": ["container_registry_logins_json is mapping", "container_registry_login | bool", "(container_registry_logins_json | length) > 0"]}, {"name": "Run podman install", "include_role": {"name": "tripleo_podman", "tasks_from": "tripleo_podman_install.yml"}, "vars": {"tripleo_container_registry_insecure_registries": "{{ container_registry_insecure_registries }}", "tripleo_container_default_pids_limit": "{{ container_default_pids_limit }}", "tripleo_container_events_logger_mechanism": "{{ container_events_logger_mechanism }}"}}, {"name": "Run podman login", "include_role": {"name": "tripleo_podman", "tasks_from": "tripleo_podman_login.yml"}, "vars": {"tripleo_container_registry_logins": "{{ container_registry_logins }}", "tripleo_container_registry_login": "{{ container_registry_login | bool }}"}}]}, {"name": "Configure tripleo_container_manage to generate systemd drop-in dependencies", "copy": {"dest": "/etc/sysconfig/podman_drop_in", "content": "This file makes tripleo_container_manage generate additional systemd\ndependencies for containers that have special\nstart/stop ordering constraints. It ensures that\nthose constraints are enforced on reboot/shutdown.\n"}}, {"name": "Ensure rsyslog is installed", "package": {"name": "rsyslog", "state": "installed"}}, {"name": "Ensure rsyslog is enabled and started", "systemd": {"state": "started", "name": "rsyslog", "enabled": true}}, {"include_role": {"name": "tripleo_sshd"}, "vars": {"tripleo_sshd_server_options": {"HostKey": ["/etc/ssh/ssh_host_rsa_key", "/etc/ssh/ssh_host_ecdsa_key", "/etc/ssh/ssh_host_ed25519_key"], "SyslogFacility": "AUTHPRIV", "AuthorizedKeysFile": ".ssh/authorized_keys", "ChallengeResponseAuthentication": "no", "GSSAPIAuthentication": "no", "GSSAPICleanupCredentials": "no", "UsePAM": "yes", "UseDNS": "no", "PrintMotd": "no", "X11Forwarding": "yes", "AcceptEnv": ["LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES", "LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT", "LC_IDENTIFICATION LC_ALL LANGUAGE", "XMODIFIERS"], "Subsystem": "sftp  /usr/libexec/openssh/sftp-server"}, "tripleo_sshd_password_authentication": "yes", "tripleo_sshd_banner_enabled": false, "tripleo_sshd_banner_text": "", "tripleo_sshd_motd_enabled": false, "tripleo_sshd_message_of_the_day": ""}}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/srv/node", "setype": "container_file_t"}, {"path": "/var/log/swift", "setype": "container_file_t"}, {"path": "/var/log/containers/swift", "setype": "container_file_t", "mode": "0750"}]}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/srv/node", "setype": "container_file_t"}, {"path": "/var/cache/swift", "setype": "container_file_t"}, {"path": "/var/log/containers/swift", "setype": "container_file_t", "mode": "0750"}]}, {"name": "Set swift_use_local_disks fact", "set_fact": {"swift_use_local_disks": true}}, {"name": "Set use_node_data_lookup fact", "set_fact": {"use_node_data_lookup": false}}, {"name": "Create Swift d1 directory if needed", "file": {"path": "/srv/node/d1", "state": "directory"}, "when": "swift_use_local_disks"}, {"name": "Set fact for SwiftRawDisks", "set_fact": {"swift_raw_disks": {}}, "when": "not use_node_data_lookup|bool"}, {"name": "Get hiera swift::storage::disks::args", "shell": "hiera -c /etc/puppet/hiera.yaml swift::storage::disks::args | sed =e 's/=>/:/g'", "register": "hiera_output", "when": "use_node_data_lookup|bool"}, {"name": "Set fact for swift_raw_disks", "set_fact": {"swift_raw_disks": "{{ hiera_output.stdout | from_json }}"}, "when": "use_node_data_lookup|bool"}, {"name": "Format SwiftRawDisks", "community.general.filesystem": {"fstype": "xfs", "dev": "{{ swift_raw_disks[item]['base_dir']|default('/dev') }}/{{ item }}", "opts": "-f -i size=1024"}, "with_items": "{{ swift_raw_disks }}", "when": "swift_raw_disks|length > 0"}, {"name": "Refresh facts if SwiftRawDisks is set to get uuids if newly created partitions", "setup": {"gather_subset": ["!all", "!min", "hardware"], "filter": "ansible_device_links"}, "when": "swift_raw_disks|length > 0"}, {"name": "Mount devices defined in SwiftRawDisks", "mount": {"name": "/srv/node/{{ item }}", "src": "{% if lsblk.results['uuids'][item] is defined %}UUID={{ ansible_facts['device_links']['uuids'][item][0] }}{% else %}{{ swift_raw_disks[item]['base_dir']|default('/dev') }}/{{ item }}{% endif %}", "fstype": "xfs", "opts": "noatime", "state": "mounted"}, "with_items": "{{ swift_raw_disks }}", "when": "swift_raw_disks|length > 0"}, {"name": "Check for NTP service", "shell": "systemctl is-active ntpd.service || systemctl is-enabled ntpd.service", "failed_when": false, "become": true, "register": "ntp_service_check"}, {"name": "Disable NTP before configuring Chrony", "service": {"name": "ntpd", "state": "stopped", "enabled": false}, "when": ["ntp_service_check.rc is defined", "ntp_service_check.rc == 0"]}, {"name": "Install, Configure and Run Chrony", "include_role": {"name": "chrony"}}, {"name": "Force NTP sync", "command": "chronyc makestep"}, {"name": "Ensure system is NTP time synced", "command": "chronyc waitsync 30"}, {"name": "Run timezone role", "include_role": {"name": "tripleo_timezone"}, "vars": {"tripleo_timezone": "UTC"}}, {"name": "install tmpwatch on the host", "package": {"name": "tmpwatch", "state": "installed"}}, {"name": "Notice - ctlplane subnet is set", "debug": {"msg": "CIDRs found in the ctlplane network tags.\n"}}, {"include_role": {"name": "tuned"}}]}


