Merge branch 'stackhpc/2024.1' into 2024.1-ansible-lint-alex

.github/cherry-pick-bot.yml

@@ -0,0 +1,3 @@
+---
+enabled: true
+preservePullRequestTitle: true

doc/source/operations/tempest.rst

@@ -132,7 +132,7 @@ The most common variables to override are:
 - ``TEMPEST_CONCURRENCY`` - The maximum number of tests to run in parallel at
   one time. Higher values are faster but increase the risk of timeouts. 1-2 is
   safest in CI/Tenks/Multinode/AIO etc. 8-32 is typical in production. Default
-  value is 2.
+  value is 16.
 - ``KAYOBE_AUTOMATION_TEMPEST_LOADLIST``: the filename of a load list in the
   ``load-lists`` directory. Default value is ``default`` (symlink to refstack).
 - ``KAYOBE_AUTOMATION_TEMPEST_SKIPLIST``: the filename of a load list in the

doc/source/operations/upgrading-openstack.rst

@@ -52,7 +52,44 @@ driver. Instructions for enabling the driver can be found `here
 <../configuration/magnum-capi.rst>`_. Enable the driver, recreate any clusters
 using Heat, and disable the service.
 
-TODO: guide for disabling Heat
+After the upgrade (so that alerts don't fire) you can remove Heat with the
+following:
+
+.. code-block:: console
+
+   kayobe overcloud host command run --command "rm /etc/kolla/haproxy/services.d/heat-api.cfg" -l network -b
+   kayobe overcloud host command run --command "rm /etc/kolla/haproxy/services.d/heat-api-cfn.cfg" -l network -b
+
+   kayobe overcloud host command run --command "systemctl restart kolla-haproxy-container.service" -l network[0] -b
+   kayobe overcloud host command run --command "systemctl restart kolla-haproxy-container.service" -l network[1] -b
+   kayobe overcloud host command run --command "systemctl restart kolla-haproxy-container.service" -l network[2] -b
+
+   kayobe overcloud host command run --command "systemctl stop kolla-heat_api-container.service kolla-heat_api_cfn-container.service kolla-heat_engine-container.service" -l controllers -b
+   kayobe overcloud host command run --command "systemctl disable kolla-heat_api-container.service kolla-heat_api_cfn-container.service kolla-heat_engine-container.service" -l controllers -b
+   kayobe overcloud host command run --command "rm /etc/systemd/system/kolla-heat_api-container.service" -l controllers -b
+   kayobe overcloud host command run --command "rm /etc/systemd/system/kolla-heat_api_cfn-container.service" -l controllers -b
+   kayobe overcloud host command run --command "rm /etc/systemd/system/kolla-heat_engine-container.service" -l controllers -b
+
+   kayobe overcloud host command run --command "docker rm heat_api heat_api_cfn heat_engine" -l controllers
+
+   kayobe overcloud host command run --command "rm -rf /etc/kolla/heat-api /etc/kolla/heat-api-cfn /etc/kolla/heat-engine" --limit controllers -b
+
+Then from the OpenStack CLI:
+
+.. code-block:: console
+
+   openstack service delete heat
+   openstack user delete heat
+   openstack domain set --disable heat_user_domain
+   openstack domain delete heat_user_domain
+
+You can drop the ``heat`` database too, unless you want to keep historical content.
+
+.. code-block:: console
+
+   docker exec -it mariadb mysql -u root -p
+   Enter the database password when prompted.
+   drop database heat;
 
 Designate sink disabled by default
 ----------------------------------

etc/kayobe/kolla-image-tags.yml

@@ -42,3 +42,6 @@ kolla_image_tags:
   ironic_neutron_agent:
     rocky-9: 2024.1-rocky-9-20241023T143407
     ubuntu-jammy: 2024.1-ubuntu-jammy-20241023T143407
+  letsencrypt:
+    rocky-9: 2024.1-rocky-9-20241206T090120
+    ubuntu-jammy: 2024.1-ubuntu-jammy-20241206T090120

etc/kayobe/kolla/inventory/group_vars/prometheus-blackbox-exporter

@@ -167,7 +167,7 @@ prometheus_blackbox_exporter_endpoints_default:
     enabled: "{{ enable_placement | bool }}"
   - endpoints: "{% set ironic_endpoints = [] %}{% for host in groups.get('ironic-api', []) %}{{ ironic_endpoints.append('ironic_backend_' + host.replace('-', '') + ':os_endpoint:' + ('https' if kolla_enable_tls_backend | bool else 'http') + '://' + ('api' | kolla_address(host) | put_address_in_context('url')) + ':' + hostvars[host]['ironic_api_port']) }}{% endfor %}{{ ironic_endpoints }}"
     enabled: "{{ enable_ironic | bool }}"
-  - endpoints: "{% set ironic_inspector_endpoints = [] %}{% for host in groups.get('ironic-inspector', []) %}{{ ironic_inspector_endpoints.append('ironic_inspector_backend_' + host.replace('-', '') + ':os_endpoint:' + ('https' if kolla_enable_tls_backend | bool else 'http') + '://' + ('api' | kolla_address(host) | put_address_in_context('url')) + ':' + hostvars[host]['ironic_inspector_port']) }}{% endfor %}{{ ironic_inspector_endpoints }}"
+  - endpoints: "{% set ironic_inspector_endpoints = [] %}{% for host in groups.get('ironic-inspector', []) %}{{ ironic_inspector_endpoints.append('ironic_inspector_backend_' + host.replace('-', '') + ':os_endpoint:' + 'http://' + ('api' | kolla_address(host) | put_address_in_context('url')) + ':' + hostvars[host]['ironic_inspector_port']) }}{% endfor %}{{ ironic_inspector_endpoints }}"
     enabled: "{{ enable_ironic | bool }}"
   - endpoints: "{% set swift_endpoints = [] %}{% for host in groups.get('swift-api', []) %}{{ swift_endpoints.append('swift_backend_' + host.replace('-', '') + ':os_endpoint:' + 'http://' + ('api' | kolla_address(host) | put_address_in_context('url')) + ':' + hostvars[host]['swift_api_port']) }}{% endfor %}{{ swift_endpoints }}"
     enabled: "{{ enable_swift | bool }}"

releasenotes/notes/add-letsencrypt-eab-support-807bdc4078d3114d.yaml

@@ -0,0 +1,4 @@
+---
+features:
+  - |
+    Adds support for Let's Encrypt external account binding (EAB).

releasenotes/notes/ironic-inspector-blackbox-backend-ff1bd68297435a36.yaml

@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    Fixes the Prometheus Blackbox Exporter backend endpoint for
+    ironic-inspector, as this service does not support backend TLS.