Allow the user to set the CA cert for SSL option for contacting the
remote Heat in the properties of an OS::Heat::Stack resource.
Story: #1702645
Task: #17270
Change-Id: I37528bb2b881a196216a7e6e23af871ab0f313d6
Allow OS::Heat::Stack to access remote stack from another OpenStack
provider. Also enable functional tests for multi-cloud.
Implement multi-cloud support as an extension to the existing multi-region
support. Allow operate a remote stack (from another OpenStack cloud) as a
resource in stack from local OpenStack cloud.
I propose we add multi cloud support into ``OS::Heat::Stack`` and change the
property schema for ``context``. Within context, we should adding
following properties:
* credential_secret_id: ID of Barbican Secret. Which stores authN
information for remote cloud.
Service will use auth information from Barbican Secret to access
Orchestration service in another OpenStack.
Must make sure you're able toget that secret from Barbican service when
provide `credential_secret_id` property.
Story: #2002126
Task: #26907
Depends-On: https://review.openstack.org/579750
Change-Id: I2f3de3e7c29cf7debb1474228c8a9a81725a72ed
Provide tools to grep credential from payload
context in Barbican secret.
Change-Id: Ib638cfe25c35ef002088d52c729238f2aba737e6
Story: #2002126
Task: #26906
With directly provide auth string(with contain a json formate
with auth_type and auth info), we can release context to specific
auth_type and give user the ability to provide other Keystone
(or their own) authentication method (like using
`v3applicationcredential` or others).
The format for `auth` and `auth_type` follows exactly Keystone
plugins like in clouds.yaml file [1].
[1] https://docs.openstack.org/keystoneauth/latest/
plugin-options.html#additional-loaders
Change-Id: Ic4dc2292a82860b9bb54ecb9e3b1a4dc806dab2c
Story: #2002126
Task: #26904
We cannot run this test in the gate because the volume backup feature is
enabled. However, with a change to the Heat tempest plugin to allow this
feature to be automatically skipped based on the tempest config, we no
longer need this test to be explicitly included in the skip list.
Change-Id: Iaefa5c272c4322498330307ea9bd6843d276ef1b
Depends-On: https://review.openstack.org/632989
Switch all Ubuntu Xenial integration test jobs to Bionic (by depending
on the patch that changes them globally.
Change-Id: I5b6c870a12892950c3e8d3aeadffe23ffbf8219e
Depends-On: https://review.openstack.org/639096
The Neutron extension for layer2 gateway (networking-l2gw) provides a API to
manage L2GW components. The proposed change is to implement two new Heat
resources to allow management of the L2GW and L2GW-connection resources.
This change implements the first of the two resources,
OS::Neutron::L2Gateway
Change-Id: Ib850f027833106cb39d3d1f6e644bbb1f79f1aac
Task: #19995
Story: #2002150
The Neutron extension for layer2 gateway (networking-l2gw) provides a API to
manage L2GW components. The proposed change is to implement two new Heat
resources to allow management of the L2GW and L2GW-connection resources.
This change implements the 2nd of two resources,
OS::Neutron::L2GatewayConnection
Change-Id: I2295acafa652ace7180d1250c85f8ee079351628
Task: #23118
Story: #2002150
Setting RUN_HEAT_INTEGRATION_TESTS=False disables the Heat
integration tests which are normally executed by Grenade
after the deployment of the base environment and after the upgrade.
This is useful when Heat is used in a Grenade job of another
component, where the focus of the testing is not Heat itself,
thus shortening the run-time of the overall Grenade job.
The default behavior is unchanged.
Change-Id: I47b258fecd45ebc08c82df179625bcfb57a32894
Add a OS::Blazar::Host resource plugin to support Blazar which is a
resource reservation services in OpenStack.
Co-author: Asmita Singh <Asmita.Singh@nttdata.com>
Change-Id: Ie5b9373681943222268eb9144740f5733ffef750
Task: 22881
Story: 2002085
Add a OS::Blazar::Lease resource plugin to support Blazar which is a
resource reservation services in OpenStack.
Co-author: Asmita Singh <Asmita.Singh@nttdata.com>
Change-Id: I7683599d9e9443372d1f585985cee7c10fd08581
Task: 22882
Story: 2002085
We don't seem to do it anywhere else. TripleO uses hook
reason string comparsion which does not work if
internationalized.
Story: #2005035
Task: 29524
Change-Id: I3e8f4587966969084cbf1e38406cd3cff23eb9a6
Nova has added a default policy
os_compute_api:servers:create:zero_disk_flavor to admin-only,
that will prevent non-admins from creating image-backed servers
with a flavor that has disk=0 which is potential a security
exposure.
Add appropriate disk size to flavors we use in tests.
Change-Id: I9c0af0b40fc5b5c33de7f0c690d156ed2bac2f15
Rename the client routines used for SFC resources to a generic
name so that other plugins/extensions can reusee those routines
Change-Id: Iaddec21014ff8c70fa11f17d52f53e5d7d4e3578
Zones are a concept of the Designate v2 API. Since v1 is still the
default, we need to explicitly use v2 when doing anything to do with
Zones. We were doing this when looking up a zone directly, but not when
falling back to listing all zones and going through them by name. This
meant that designate.zone constraint validation would fail (including on
the 'zone' property of OS::Designate::RecordSet) when the zone was
specified by name rather than UUID.
Change-Id: Id4194a74398488813f901b255f312f7ac962a426
Task: #29162
Rank all existing versions of a resource in a convergence stack to improve
the likelihood that we find the best one to update.
This allows us to roll back to the original version of a resource (or
even attempt an in-place update of it) when replacing it has failed.
Previously this only worked during automatic rollback; on subsequent
updates we would always work on the failed replacement (which inevitably
meant attempting another replacement in almost all cases).
Change-Id: Ia231fae85d1ddb9fc7b7de4e82cec0c0e0fd06b7
Story: #2003579
Task: 24881
The convergence prototype ignored checks of resources that had previously
been replaced by another resource. However, it turns out that this was
unnecessary in the final version of the prototype:
e9d2f833a5
Keeping this limitation prevents us from allowing users to roll back to a
previously-existing resource if creating the replacement fails, other than
by using the automated rollback mechanism (which is special-cased).
Since the graph for the traversal is calculated at the start of the update,
there's no need to limit which nodes are allowed to be checked. Only the
selected resource will have an is_update=True node in the traversal graph.
Removing this additional restriction allows us to improve the algorithm
that chooses which resource to update. Since a new traversal ID is stored
before we calculate the traversal graph, we can guarantee that no new
resource checks will start (though some may still be happening) while the
algorithm is choosing, so there's no danger of it picking a resource that
later gets replaced.
Since we're no longer treating automatic rollback as a special case, reset
the replaced_by field whenever we update a previously-replaced resource.
Change-Id: I04e7ad90944c2d03ce0e59ba16af9d60d6e01222
Story: #2003579
Task: 26197
