- Add "octavia" as one of the "ingress_controller" options.
- Add label "octavia_ingress_controller_tag".
- Use external network ID in the heat templates.

Story: 2004838
Change-Id: I7d889a054cd5feb2eeef523b20607a6c7630d777
(cherry picked from commit a941822c)

When user creates LoadBalancer type service in k8s cluster, a floating
ip may be created and associated with the load balancer VIP. Magnum
now could delete the load balancers automatically in the cluster
pre-delete method, should also remove the floating ip as needed.

This patch depends on the github PR for cloud-provider-openstack:
https://github.com/kubernetes/cloud-provider-openstack/pull/433

Story: 2004836
Change-Id: Ia553aff4e66033346c6bfe120a72992bec79e136
(cherry picked from commit f63761a8)

Now cloud-provider-openstack of Kubernetes has a webhook to support
Keystone authorization and authentication. With this feature, user
can use a new label 'keystone-auth-enabled' to enable the keystone
authN and authZ.

DocImpact
Task: 21637
Story: 1755770

Change-Id: I3d21ad8f55c0d7308a302f62db9e9af147a604f8
(cherry picked from commit 59da4e25)

Add heat_container_agent_tag label to allow users select the
heat-agent tag. Stein default: stein-dev

story: 2003992
task: 26936

Change-Id: I6a8d8dbb2ec7bd4b7d01fa7cd790a8966ea88f73
Signed-off-by: Spyros Trigazis <spyridon.trigazis@cern.ch>
(cherry picked from commit c98e9525)

There are 2 changes included in this patch:

1. Using cluster ip instead of fixed ip for grafana service to
make sure the address is reachable.

2. Move node exporter to prometheus-monitoring namespace and
make it as a DaemonSet to collect metrics from master node.

Task: 28468
Story: 2004590

Change-Id: I9090c6dc4b38e1a1466c4c3a6a827d95c089fb41
(cherry picked from commit b6936894)

HTTP(S) proxy can be specified when creating the template.

https://docs.openstack.org/magnum/latest/admin/magnum-proxy.html

However, it is not being utilized when talking to a public etcd discovery
service, which result in failed cluster creation. We need to be able to
use HTTP(S) proxy when services are running behind a firewall.

Change-Id: I13d86b0dc7c232a51149107f0412219388d8c2cd
(cherry picked from commit ffc61816)

Change-Id: I77f46ac03cfd3f1e86db6e3327b37c27d8f0edab
(cherry picked from commit 6390e0db)

* Use the external cloud-provider [0]
* Label master nodes
* Make the script the deploys the cloud-provider and clusterroles
  for the apiserver a SoftwareDeployment
* Rename kube_openstack_config to cloud-config,
  for cinder to workm the kubelet expects the cloud config name only
  like this. Keep a copy of kube_openstack_config for backwards
  compatibility.

Change-Id: Ife5558f1db4e581b64cc4a8ffead151f7b405702
Task: 22361
Story: 2002652
Co-Authored-By: Spyros Trigazis <spyridon.trigazis@cern.ch>
(cherry picked from commit 6c61a1a9)

- Start workers as soon as the master VM is created, rather than
  waiting all the services ready.
- Move all the SoftwareDeployment outside of kubemaster stack.
- Tweak the scripts in SoftwareDeployment so that they can be combined
  into a single script.

Story: 2004573
Task: 28347
Change-Id: Ie48861253615c8f60b34a2c1e9ad6b91d3ae685e
Co-Authored-By: Lingxian Kong <anlin.kong@gmail.com>
(cherry picked from commit cae7fa21)

For k8s cluster, the loadbalancers created for LoadBalancer type
services should be deleted before the cluster deletion.

Change-Id: I75f44187b7be7d0ffb6a8f195f755de4b1564335
Closes-Bug: #1712062
(cherry picked from commit e18ced4d)
Depends-On:  https://review.openstack.org/#/c/625766/

Adding the client enables the manipulation of Octavia
resources with Magnum such as during cluster deletion,
being able to clean up non-heat created resouces.

Change-Id: I976ab136e24b98d447d61028ce07d0f5dd9d255a
story: 2004259
task: 27795
(cherry picked from commit 9a6698fb)

The functional jobs are currently deploying with an empty list of
admission control list which means that the service token controller
does not go up resulting in the cluster failing to go up.

This patch drops that so it uses the default values of the admission
controllers in order to get the cluster to go up cleanly.

Change-Id: I0fdd65a9859f34e202016c37620f553623ef8a3e
(cherry picked from commit 3646a59e)

The API for delete_namespaced_service requires a body which when
missing will fail the functional tests.

This patch addresses that issue by adding an empty body in order
for the delete to work properly.

Change-Id: I3b4a4bb08f60d9d18368dd3faa84ab1348acb543
Story: #2002589
Task: #28341
(cherry picked from commit e0fd3f9e)

This patch changes the intergration jobs to use nodes which are
at VEXXHOST that come with supported nested virtualization in
order to allow for the functional jobs to finish on-time.

Change-Id: Ie275caac1a40fb3f10a0653b66611d2ba9d1c470
Story: #2002589
Task: #28341
(cherry picked from commit 2e2ebaf6)

At the moment, if a cluster fails to be created, we fall back to
getting the node information from Heat directly.  However, this
behaviour doesn't work at the moment because `self.cluster` is
a copy of the API record on-create which does not have the stack
ID yet.

This patch makes an extra HTTP request to get the `stack_id` in
order to get the server IPs and be able to pull down the correct
information.

Story: #2002589
Task: #28341
Change-Id: I3fb3542f8ab63f38a23094d579d3df1fcb99a497
(cherry picked from commit d6cc77b1)

* Added support for www_authenticate_uri in ContextHook.
* Made code path consistent with keystone.py impl.

Story: 2004271
Task: 28073

Change-Id: I7e3f23964a55be3255e87a4c4af7bae0a1415676
(cherry picked from commit f27bde71)

We do currently not support www_authentication_uri at all, which
is the new standard, as auth_uri has long been deprecated.

* Make sure we support both auth_uri and www_authenticate_uri.
* Switched to www_authenticate_uri for devstack.
* Fixed a bug where a bad exception would be thrown if auth_uri
  was not set.
  
Story: 2004271
Task: 27819

Change-Id: Ibc932d35f3d6ba2ac7ffb6193aa37bd4a3d4422e
(cherry picked from commit 718cb9c9)

Switch to systemd logging to take advantage of some of the newer
logging features.

Story: 2004272
Task: 27820

Change-Id: I475bf26e24b3a725f68c7da355807374bf1e189b
(cherry picked from commit daa7d049)

The cluster name is useful to identify resources created in different
k8s clusters, especially in the cloud environment, the cluster name is
always injected into the name of the cloud resources(e.g. the load
balancer, volume, etc.), which is helpful for the cluster resource
clean up.

The magnum cluster UUID is used as the value of '--cluster-name' option.

Story: 2004242
Task: 27766
Change-Id: I245a8869948a0b8bfa8d5cc32e7fb9277477026a
(cherry picked from commit 5d1eab9d)

When using 'prometheus_monitoring=true' in the label option,
'kube-enable-monitoring.service' in the master node has stuck in
'Wait for Grafana pod and then inject data source'.
It caused the 'prometheus-monitoring' namespace doesn't exist,
so scripts don't create pods about Prometheus and Grafana.

To fix the error, I added codes in 'magnum/drivers/common/templates/
kubernetes/fragments/enable-prometheus-monitoring.sh' to make
'prometheus-monitoring' namespace.

We could put codes in a new file like 'magnum/magnum/drivers/
k8s_coreos_v1/templates/fragments/create-kube-namespace.yaml',
but I think it's ok.

Change-Id: I23395b41919c6f39cfcc2b4480bcd4b040cae031
Task: 26347
Story: 2003697
(cherry picked from commit bc36ef8f)

--register-with-taints take no effect when --register-schedulable=false
configured. It's better to drop --register-schedulable and
leave --register-with-taints to make master schedulable

add --pod-infra-container-image=CONTAINER_INFRA_PREFIX
for kubelet on master nodes.

Change-Id: Ia2ce59841d823ba02a65224088e5af1a8c9610b1
(cherry picked from commit 05f0cddc)

Ensure the --live-restore is not in the Docker daemon OPTIONS.

Some images has this option by default which will cause the node
not being able to perform it swarm init process.

Change-Id: I287a5274143903fad5d4476e9d1640b26bdb46d4
Story: 2004095
Task: 27497
(cherry picked from commit 095b49e6)

Update heat-container-agent version tag to include the multi region
fix.

Task: 27051
Story: 2003992

Change-Id: Ided337dafa52cce771126e96ef41a62a3358fda1
(cherry picked from commit 48e2e774)

Manuel Rodriguez authored Sep 05, 2018 and Spyridon Trigazis committed Oct 02, 2018

USER_TOKEN variable is empty because the grep expression
is not ignoring case and certs are not created.

Change-Id: I175cb2d4c64d5f7024b13ce11c1184029f63c317
Task: 26189
Story: 2003671
(cherry picked from commit d3bf6a49)

Sergey Filatov authored Jul 31, 2018 and Spyridon Trigazis committed Oct 02, 2018

To upgrade cluster we need to be able to set image tags
so this change adds to labels for corresponding containers

Task: 23314
Story: 2003171

Change-Id: I4cd0270a69fb889c59bdb28966821adb11fd0292
(cherry picked from commit 0cf61dfb)

Add kubelet on the master nodes. This work was
done already for calico, this patch applies the
same config when calico is used as well.

story: 2003521
task: 24797

Change-Id: Id33fb59ef23da740712d9a9b7ec4205bd6579b35
(cherry picked from commit 6390e0db)

Chuck Short authored Aug 27, 2018 and Spyridon Trigazis committed Oct 02, 2018

Since python3.6 os.path.join can be either bytes or
a str. So mock os.path.join in order for the unit tests to
pass.

Change-Id: I82c793875d888092e5c814727a6c4ad4053e76fb
Signed-off-by: Chuck Short <chucks@redhat.com>
(cherry picked from commit 72f7e5f7)

Rick Cano authored Jun 28, 2018 and Spyridon Trigazis committed Oct 02, 2018

Decoding ca on nodes

Change-Id: I4a30a348c1c0a62cb1a7b429b05878f321db92ed
(cherry picked from commit 419a2285)

1. pods with host network can not reach coredns or any svc or resolve
their own hostname
2. If webhooks are deployed in the cluster, the apiserver needs to
contact them, which means kube-proxy is required in the master node with
the cluster-cidr set.

Change-Id: Icb8e7c3b8c75a3ab087c818c8580c0c8a9111d30
story: 2003460
task: 24719
(cherry picked from commit 4f121e50)

Jangwon Lee authored Jul 30, 2018 and Spyridon Trigazis committed Oct 02, 2018

When create a cluster in Openstack, a master-node has failed during
cloud-init scripts. It failed in 'make-cert.sh' because it couldn't get
a right token. The extra_params['auth_url'] has a slash at the end so
the requested url was wrong.

Returend url of url_for() has a slash at the end.
Just add rstrip('/') to fix this error.

Change-Id: I1f2f0e07a913268b2ba821a8b85b8a3973cb59dc
Task: 23277
Story: 2003144
(cherry picked from commit 4bb16422)