Merge branch 'rackerlabs:main' into development

.github/workflows/image-pull-and-tag.yaml

@@ -0,0 +1,80 @@
+name: Migrate Images to GHCR
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '.original-images.json'
+  workflow_dispatch:
+
+env:
+  REGISTRY: "quay.io"
+  IMAGE_ORG: "rackspace"
+
+jobs:
+  setup-matrix:
+    runs-on: ubuntu-22.04
+    outputs:
+      matrix: ${{ steps.parse-json.outputs.matrix }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Ensure jq is installed
+        run: |
+          if ! command -v jq &> /dev/null; then
+            echo "jq is not installed. Installing now..."
+            sudo apt-get update && sudo apt-get install -y jq
+          else
+            echo "jq is already installed."
+          fi
+
+      - name: Read images from .original-images.json
+        id: parse-json
+        run: |
+          IMAGES=$(jq -c '.' < .original-images.json)
+          echo "Images: $IMAGES"
+          echo "matrix=$IMAGES" >> $GITHUB_OUTPUT
+
+  migrate-images:
+    needs: setup-matrix
+    runs-on: ubuntu-22.04
+
+    strategy:
+      fail-fast: false
+      max-parallel: 10
+      matrix:
+        image: ${{ fromJson(needs.setup-matrix.outputs.matrix) }}
+
+    steps:
+      - name: Pull image from Source Registry
+        run: |
+          echo "Pulling image: ${{ matrix.image }}"
+          docker pull ${{ matrix.image }}
+
+      - name: Login to Quay Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.QUAY_USER }}
+          password: ${{ secrets.QUAY_TOKEN }}
+
+      - name: Retag Image for quay
+        id: retag
+        run: |
+          IMAGE_FULL="${{ matrix.image }}"
+          IMAGE_NAME_WITH_TAG=$(basename $IMAGE_FULL)  # Remove registry prefix
+          IMAGE_NAME_ONLY="$(echo $IMAGE_NAME_WITH_TAG | cut -d: -f1)"  # Extract image name
+          IMAGE_TAG="$(echo $IMAGE_NAME_WITH_TAG | cut -d: -f2)"  # Extract tag
+          QUAY_IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_ORG }}/rackerlabs-$IMAGE_NAME_ONLY:$IMAGE_TAG"
+          echo $QUAY_IMAGE
+
+          echo "Retagging ${{ matrix.image }} to $QUAY_IMAGE"
+          docker tag ${{ matrix.image }} $QUAY_IMAGE
+          echo "QUAY_IMAGE=$QUAY_IMAGE" >> $GITHUB_OUTPUT
+
+      - name: Push to Quay
+        run: |
+          docker push ${{ steps.retag.outputs.QUAY_IMAGE }}

.original-images.json

@@ -0,0 +1,9 @@
+[
+  "docker.io/openstackhelm/heat:2024.1-ubuntu_jammy",
+  "ghcr.io/rackerlabs/genestack/octavia-ovn:master-ubuntu_jammy-1733266356",
+  "docker.io/openstackhelm/glance:2024.1-ubuntu_jammy",
+  "ghcr.io/rackerlabs/genestack/keystone-rxt:2024.1-ubuntu_jammy-1735886895",
+  "docker.io/openstackhelm/barbican:2023.1-ubuntu_jammy",
+  "ghcr.io/rackerlabs/genestack/nova-efi:2024.1-ubuntu_jammy-1723129048",
+  "docker.io/openstackhelm/ceph-config-helper:latest-ubuntu_jammy"
+]

ansible/roles/host_setup/tasks/CPU_frequency.yml

@@ -0,0 +1,39 @@
+---
+# Copyright 2024, Rackspace Technology, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Ensure TuneD is installed
+  ansible.builtin.apt:
+    name: tuned
+    state: present
+
+- name: Ensure TuneD service is enabled and started
+  ansible.builtin.systemd:
+    name: tuned
+    enabled: true
+    state: started
+
+- name: Apply throughput-performance profile using tuned-adm
+  ansible.builtin.command:
+    cmd: "/usr/sbin/tuned-adm profile throughput-performance"
+  changed_when: true
+
+- name: Verify active TuneD profile
+  ansible.builtin.command:
+    cmd: "/usr/sbin/tuned-adm active"
+  register: tuned_active
+
+- name: Show active TuneD profile
+  ansible.builtin.debug:
+    msg: "{{ tuned_active.stdout }}"

ansible/roles/host_setup/tasks/main.yml

@@ -82,12 +82,22 @@
   tags:
     - always
 
+- name: Pin kernel version and disable unattended-upgrades
+  include_tasks: pin_kernel.yml
+  when: ansible_facts['os_family'] | lower == 'debian'
+  tags:
+    - always
+
 - name: Update package cache
   apt:
     update_cache: true
     cache_valid_time: 600
   when: ansible_facts['os_family'] | lower == 'debian'
 
+- name: Set CPU frequency governor to performance
+  include_tasks: CPU_frequency.yml
+  when: ansible_facts['os_family'] | lower == 'debian'
+
 - name: Install distro packages
   package:
     name: "{{ host_distro_packages }}"
@@ -109,4 +119,3 @@
   until: install_packages is success
   retries: 5
   delay: 2
-

ansible/roles/host_setup/tasks/pin_kernel.yml

@@ -0,0 +1,77 @@
+---
+# Copyright 2024, Rackspace Technology, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Refresh specific kernel facts
+  ansible.builtin.setup:
+    filter: "ansible_kernel"
+
+- name: Check Kernel Version
+  fail:
+    msg: >
+      Wrong kernel Version found
+      [ {{ ansible_facts['kernel'] }} < {{ host_required_kernel }} ]
+      Resolve this issue before continuing.
+  when:
+    - ansible_facts['kernel'] is version(host_required_kernel, '<')
+
+- name: Pin kernel packages version
+  copy:
+    dest: "{{ apt_preferences }}/pin-kernel"
+    content: |
+      Package: linux-image-{{ ansible_facts['kernel'] }}
+      Pin: release *
+      Pin-Priority: 1001
+
+      Package: linux-headers-{{ ansible_facts['kernel'] }}
+      Pin: release *
+      Pin-Priority: 1001
+
+      Package: linux-modules-{{ ansible_facts['kernel'] }}
+      Pin: release *
+      Pin-Priority: 1001
+
+      Package: linux-image-*
+      Pin: release *
+      Pin-Priority: -1
+
+      Package: linux-headers-*
+      Pin: release *
+      Pin-Priority: -1
+
+      Package: linux-modules-*
+      Pin: release *
+      Pin-Priority: -1
+    mode: '0644'
+  when:
+    - ansible_facts['kernel'] is version(host_required_kernel, '<')
+
+- name: Disable unattended-upgrades
+  ansible.builtin.lineinfile:
+    path: "{{ apt_config_dir }}/20auto-upgrades"
+    regexp: "^APT::Periodic::{{ item.key }}"
+    line: "APT::Periodic::{{ item.key }} \"{{ item.value }}\";"
+    create: true
+    mode: '0644'
+  loop:
+    - { key: "Update-Package-Lists", value: "0" }
+    - { key: "Download-Upgradeable-Packages", value: "0" }
+    - { key: "AutocleanInterval", value: "0" }
+    - { key: "Unattended-Upgrade", value: "0" }
+
+
+- name: Ensure unattended-upgrades package is removed
+  ansible.builtin.apt:
+    name: unattended-upgrades
+    state: absent

ansible/roles/host_setup/vars/debian.yml

@@ -6,6 +6,8 @@ host_sysstat_file: /etc/default/sysstat
 host_sysstat_cron_file: /etc/cron.d/sysstat
 host_cron_template: sysstat.cron.debian.j2
 host_module_file: /etc/modules
+apt_preferences: /etc/apt/preferences.d
+apt_config_dir: /etc/apt/apt.conf.d
 
 ## Kernel modules loaded on hosts
 host_kernel_modules:

ansible/roles/host_setup/vars/ubuntu.yml

@@ -6,6 +6,8 @@ host_sysstat_file: /etc/default/sysstat
 host_sysstat_cron_file: /etc/cron.d/sysstat
 host_cron_template: sysstat.cron.debian.j2
 host_module_file: /etc/modules
+apt_preferences: /etc/apt/preferences.d
+apt_config_dir: /etc/apt/apt.conf.d
 
 ## Kernel modules loaded on hosts
 host_kernel_modules:

base-kustomize/octavia/base/kustomization.yaml

@@ -49,6 +49,11 @@ patches:
               scheme: HTTP
               path: /
               port: 9876
+          livenessProbe:
+            httpGet:
+              scheme: HTTP
+              path: /
+              port: 9876
           volumeMounts:
             - name: pod-etc-octavia
               mountPath: /etc/octavia
@@ -88,6 +93,11 @@ patches:
               scheme: HTTP
               path: /
               port: 9876
+          livenessProbe:
+            httpGet:
+              scheme: HTTP
+              path: /
+              port: 9876
           volumeMounts:
             - name: pod-etc-octavia
               mountPath: /etc/octavia

base-kustomize/octavia/base/octavia-agent.yaml

@@ -119,6 +119,11 @@ spec:
               scheme: HTTP
               path: /
               port: 9876
+          livenessProbe:
+            httpGet:
+              scheme: HTTP
+              path: /
+              port: 9876
           volumeMounts:
             - name: pod-etc-octavia
               mountPath: /etc/octavia
@@ -158,6 +163,11 @@ spec:
               scheme: HTTP
               path: /
               port: 9876
+          livenessProbe:
+            httpGet:
+              scheme: HTTP
+              path: /
+              port: 9876
           volumeMounts:
             - name: pod-etc-octavia
               mountPath: /etc/octavia

bin/install-mariadb-operator.sh

@@ -34,12 +34,11 @@ helm repo add mariadb-operator https://helm.mariadb.com/mariadb-operator
 helm repo update
 
 # Install the CRDs that match the version defined
-helm upgrade --install mariadb-operator-crds mariadb-operator/mariadb-operator-crds --version "${VERSION}"
+helm upgrade --install --namespace=mariadb-system --create-namespace mariadb-operator-crds mariadb-operator/mariadb-operator-crds --version "${VERSION}"
 
 # Helm command setup
-HELM_CMD="helm upgrade --install mariadb-operator mariadb-operator \
+HELM_CMD="helm upgrade --install mariadb-operator mariadb-operator/mariadb-operator \
     --namespace=mariadb-system \
-    --create-namespace \
     --timeout 120m \
     --version ${VERSION} \
     --post-renderer /etc/genestack/kustomize/kustomize.sh \