# resource_properties_data

created_at: 2026-06-14 08:53:30.542317
data:
  {"type": "json", "value": {"ContainerCrondImage": "registry.redhat.io/rhosp-rhel9/openstack-cron:17.1", "ContainerCrondConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-cron:17.1"}}


created_at: 2026-06-14 08:53:33.774766
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-22-lfcj5b35awz5-ContainersCommon-klvbm255gc6m/597653ae-391d-4c2f-a74c-cafa3b24ef3f"}


created_at: 2026-06-14 08:53:33.777678
data:
  {"value": {"ContainerCrondImage": "registry.redhat.io/rhosp-rhel9/openstack-cron:17.1", "ContainerCrondConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-cron:17.1"}}


created_at: 2026-06-14 08:53:33.785988
data:
  {"tuple:('role_data', 'docker_config')": {"step_4": {"logrotate_crond": {"image": "registry.redhat.io/rhosp-rhel9/openstack-cron:17.1", "net": "none", "pid": "host", "privileged": true, "user": "root", "restart": "always", "healthcheck": {"test": "/usr/share/openstack-tripleo-common/healthcheck/cron"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/logrotate-crond.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/crond:/var/lib/kolla/config_files/src:ro", "/var/log/containers:/var/log/containers:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "role_data": {"service_name": "logrotate_crond", "config_settings": {"tripleo::profile::base::logging::logrotate::maxsize": "10M", "tripleo::profile::base::logging::logrotate::rotation": "daily", "tripleo::profile::base::logging::logrotate::rotate": "14", "tripleo::profile::base::logging::logrotate::purge_after_days": "14", "tripleo::profile::base::logging::logrotate::dateext": false}, "host_prep_tasks": [{"name": "allow logrotate to read inside containers", "seboolean": {"name": "logrotate_read_inside_containers", "persistent": true, "state": true}, "when": ["ansible_facts.selinux is defined", "ansible_facts.selinux.status == \"enabled\""]}], "deploy_steps_tasks": [{"name": "configure tmpwatch on the host", "when": "step|int == 2", "block": [{"name": "Push script", "copy": {"dest": "/usr/local/sbin/containers-tmpwatch", "owner": "root", "group": "root", "mode": 493, "content": "#!/bin/sh\ntmpwatch --nodirs \\\n  -X \"/var/log/containers/*/*log\" \\\n  -X \"/var/log/containers/*/*/*log\" \\\n  -X \"/var/log/containers/*/*err\" \\\n  {{ LogrotatePurgeAfterDays|int +1 }}d \\\n  /var/log/containers/ 2>&1 | logger -t container-tmpwatch\n"}, "vars": {"LogrotatePurgeAfterDays": "14"}}, {"name": "Insert cronjob in root crontab", "cron": {"name": "Remove old logs", "special_time": "daily", "user": "root", "job": "/usr/local/sbin/containers-tmpwatch"}}]}], "update_tasks": [{"name": "Ensure old cron.daily is absent", "when": "step|int == 1", "file": {"path": "/etc/cron.daily/containers-tmpwatch", "state": "absent"}}], "upgrade_tasks": [{"name": "Ensure old cron.daily is absent", "when": "step|int == 1", "file": {"path": "/etc/cron.daily/containers-tmpwatch", "state": "absent"}}], "puppet_config": {"config_volume": "crond", "step_config": "include tripleo::profile::base::logging::logrotate", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-cron:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/logrotate-crond.json": {"command": "/usr/sbin/crond -s -n", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}}, "docker_config": {"step_4": {"logrotate_crond": {"image": "registry.redhat.io/rhosp-rhel9/openstack-cron:17.1", "net": "none", "pid": "host", "privileged": true, "user": "root", "restart": "always", "healthcheck": {"test": "/usr/share/openstack-tripleo-common/healthcheck/cron"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/logrotate-crond.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/crond:/var/lib/kolla/config_files/src:ro", "/var/log/containers:/var/log/containers:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "external_upgrade_tasks": [{"when": ["step|int == 1"], "tags": ["never", "system_upgrade_transfer_data", "system_upgrade_stop_services"], "block": [{"name": "Stop logrotate container", "import_role": {"name": "tripleo_container_stop"}, "vars": {"tripleo_containers_to_stop": ["logrotate_crond"], "tripleo_delegate_to": "{{ groups['logrotate_crond'] | difference(groups['excluded_overcloud']) }}"}}]}]}, "tuple:('role_data', 'config_settings')": {"tripleo::profile::base::logging::logrotate::maxsize": "10M", "tripleo::profile::base::logging::logrotate::rotation": "daily", "tripleo::profile::base::logging::logrotate::rotate": "14", "tripleo::profile::base::logging::logrotate::purge_after_days": "14", "tripleo::profile::base::logging::logrotate::dateext": false}, "tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'step_config')": null, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "logrotate_crond", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-22-lfcj5b35awz5/4c6bd56b-b4b0-48ac-a3f6-a51078b5ba38"}


created_at: 2026-06-14 08:53:35.229200
data:
  {"tuple:('role_data', 'docker_config')": null, "role_data": {"service_name": "docker_registry", "firewall_rules": {"155 docker-registry": {"dport": [8787]}}, "firewall_frontend_rules": {"100 docker_registry_haproxy_frontend": {"dport": [8787]}}, "firewall_ssl_frontend_rules": {"100 docker_registry_haproxy_frontend_ssl": {"dport": [13787]}}, "host_prep_tasks": [{"name": "authorize httpd to listen on registry ports", "community.general.seport": {"ports": ["8787", "13787"], "proto": "tcp", "setype": "http_port_t", "state": "present"}}, {"name": "Install, Configure and Run Apache to serve container images", "block": [{"set_fact": {"container_registry_host": "192.168.122.99", "container_registry_port": "8787"}}, {"include_role": {"name": "tripleo_image_serve"}}]}], "upgrade_tasks": [{"name": "Uninstall docker-distribution", "when": "step|int == 3", "block": [{"name": "check if docker-distribution is installed", "command": "/usr/bin/rpm -q docker-distribution", "failed_when": false, "register": "docker_distribution_installed", "check_mode": false}, {"name": "Stop, disable docker-distribution", "systemd": {"enabled": false, "state": "stopped", "name": "docker-distribution"}, "when": "docker_distribution_installed.rc == 0"}, {"name": "Uninstall docker-distribution", "package": "name=docker-distribution state=absent", "when": "docker_distribution_installed.rc == 0"}]}]}, "tuple:('role_data', 'config_settings')": null, "tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'step_config')": null, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "docker_registry", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-23-t7umsa6oxh4m/3e287dcf-1cad-4d52-ac5d-bc4a60d565ac"}


created_at: 2026-06-14 08:53:37.652611
data:
  {"type": "json", "value": {"ContainerGlanceApiImage": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "ContainerGlanceApiConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1"}}


created_at: 2026-06-14 08:53:40.835247
data:
  {"type": "json", "value": {"ContainerGlanceApiImage": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1"}}


created_at: 2026-06-14 08:53:42.693445
data:
  {"value": {"ContainerGlanceApiImage": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "ContainerGlanceApiConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1"}}


created_at: 2026-06-14 08:53:42.735778
data:
  {"cinder_nvmeof_host_prep_tasks": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-24-cj2ydjakr4xi-CinderNVMeOF-5hbfm34fzhsn/58daba03-ecde-4740-b396-7145a72c383b"}


created_at: 2026-06-14 08:53:42.794283
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-24-cj2ydjakr4xi-ContainersCommon-cvqdre3en44r/57fb58bd-4e21-4e9a-a6c6-193524bec9b3"}


created_at: 2026-06-14 08:53:42.845390
data:
  {"tuple:('docker_config', 'step_2')": {"glance_init_logs": {"image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z"], "command": ["/bin/bash", "-c", "chown -R glance:glance /var/log/glance"]}}, "host_prep_tasks": [{"name": "create persistent logs directory", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/glance", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/glance", "setype": "container_file_t", "mode": "0750"}]}], "volumes": ["/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-24-cj2ydjakr4xi-GlanceLogging-ypec7gdl5tsx/0881ce1a-1f90-4abb-992f-017a27ef6909"}


created_at: 2026-06-14 08:53:42.850349
data:
  {"tuple:('role_data', 'metadata_settings')": null, "tuple:('role_data', 'config_settings')": null, "tuple:('role_data', 'deploy_steps_tasks')": null}


created_at: 2026-06-14 08:53:42.886557
data:
  {"tuple:('role_data', 'step_config')": "include tripleo::profile::base::database::mysql::client", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-24-cj2ydjakr4xi-MySQLClient-brkjuzui54ih/38ed729b-3436-4821-bed5-a7bd15eb8108"}


created_at: 2026-06-14 08:53:42.904649
data:
  {"tuple:('role_data', 'docker_config')": {"step_2": {"glance_init_logs": {"image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z"], "command": ["/bin/bash", "-c", "chown -R glance:glance /var/log/glance"]}}, "step_3": {"glance_api_db_sync": {"image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "cap_add": ["AUDIT_WRITE"], "net": "host", "privileged": false, "detach": false, "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z", "/var/lib/kolla/config_files/glance_api.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/glance:/var/lib/glance:shared"], "environment": {"KOLLA_BOOTSTRAP": true, "KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1781427082"}, "command": "/usr/bin/bootstrap_host_exec glance_api su glance -s /bin/bash -c '/usr/local/bin/kolla_start'"}}, "step_4": {"glance_api": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z", "/var/lib/kolla/config_files/glance_api.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/glance:/var/lib/glance:shared"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "glance_api_cron": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "host", "user": "root", "privileged": false, "restart": "always", "healthcheck": {"test": "/usr/share/openstack-tripleo-common/healthcheck/cron glance"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z", "/var/lib/kolla/config_files/glance_api_cron.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro", "/var/lib/glance:/var/lib/glance:shared"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "role_data": {"service_name": "glance_api", "firewall_rules": {"112 glance_api": {"dport": [9292]}}, "firewall_frontend_rules": {"100 glance_api_haproxy_frontend": {"dport": [9292]}}, "firewall_ssl_frontend_rules": {"100 glance_api_haproxy_frontend_ssl": {"dport": [13292]}}, "keystone_resources": {"glance": {"endpoints": {"public": "http://172.21.0.2:9292", "internal": "http://172.17.0.2:9293", "admin": "http://172.17.0.2:9293"}, "users": {"glance": {"password": "FHTdjgb7Sf493vaTSHmpZCdwV"}}, "region": "regionOne", "service": "image"}}, "monitoring_subscription": "overcloud-glance-api", "config_settings": {"glance::api::db::database_connection": "mysql+pymysql://glance:FHTdjgb7Sf493vaTSHmpZCdwV@172.17.0.2/glance?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "glance::api::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "glance::api::authtoken::auth_url": "http://172.17.0.2:5000", "glance::api::enable_v1_api": false, "glance::api::enable_v2_api": true, "glance::api::authtoken::password": "FHTdjgb7Sf493vaTSHmpZCdwV", "glance::api::enable_proxy_headers_parsing": true, "glance::api::logging::debug": true, "glance::policy::policies": {}, "glance::api::authtoken::project_name": "service", "glance::api::authtoken::region_name": "regionOne", "glance::api::authtoken::user_domain_name": "Default", "glance::api::authtoken::project_domain_name": "Default", "glance::api::authtoken::interface": "internal", "glance::api::authtoken::memcache_use_advanced_pool": true, "glance::api::pipeline": "keystone", "glance::api::os_region_name": "regionOne", "glance::api::image_member_quota": 128, "glance::api::enabled_import_methods": ["web-download"], "glance::api::node_staging_uri": "file:///var/lib/glance/staging", "glance::api::image_import_plugins": ["no_op", "image_conversion"], "glance::api::image_conversion_output_format": "raw", "glance::api::inject_metadata_properties": [], "glance::api::ignore_user_roles": ["admin"], "tripleo::profile::base::glance::api::tls_proxy_bind_ip": "%{hiera('internal_api')}", "tripleo::profile::base::glance::api::tls_proxy_fqdn": "%{hiera('fqdn_internal_api')}", "tripleo::profile::base::glance::api::tls_proxy_port": 9292, "glance::api::bind_host": "%{hiera('internal_api')}", "glance_notifier_strategy": "noop", "glance_log_file": "", "glance::backend::rbd::rbd_thin_provisioning": false, "glance::backend::file::filesystem_thin_provisioning": false, "glance::backend::swift::swift_store_auth_address": "http://172.17.0.2:5000/v3", "glance::backend::swift::swift_store_user": "service:glance", "glance::backend::swift::swift_store_key": "FHTdjgb7Sf493vaTSHmpZCdwV", "glance::backend::swift::swift_store_create_container_on_put": true, "glance::backend::swift::swift_store_auth_version": 3, "glance::backend::rbd::rbd_store_ceph_conf": "/etc/ceph/ceph.conf", "glance::backend::rbd::rbd_store_pool": "images", "glance::backend::rbd::rbd_store_user": "openstack", "glance_backend": "rbd", "tripleo::profile::base::glance::api::glance_backend_id": "default_backend", "tripleo::profile::base::glance::api::glance_store_description": "Default glance store backend.", "tripleo::profile::base::glance::api::multistore_config": {}, "tripleo::profile::base::glance::backend::rbd::glance_rbd_ceph_conf_path": "/var/lib/tripleo-config/ceph", "glance::notify::rabbitmq::notification_driver": ["messagingv2"], "glance::notify::rabbitmq::rabbit_heartbeat_in_pthread": false, "glance::cron::db_purge::minute": "1", "glance::cron::db_purge::hour": "0", "glance::cron::db_purge::monthday": "*", "glance::cron::db_purge::month": "*", "glance::cron::db_purge::weekday": "*", "glance::cron::db_purge::user": "glance", "glance::cron::db_purge::age": "30", "glance::cron::db_purge::max_rows": "100", "glance::cron::db_purge::destination": "/var/log/glance/glance-rowsflush.log", "glance::cron::db_purge::maxdelay": "3600", "glance::api::workers": "1"}, "service_config_settings": {"mysql": {"glance::db::mysql::password": "FHTdjgb7Sf493vaTSHmpZCdwV", "glance::db::mysql::user": "glance", "glance::db::mysql::host": "%", "glance::db::mysql::dbname": "glance"}, "rsyslog": {"tripleo_logging_sources_glance_api": [{"tag": "openstack.glance.api", "file": "/var/log/containers/glance/api.log"}]}}, "puppet_config": {"config_volume": "glance_api", "puppet_tags": "glance_api_config,glance_api_paste_ini,glance_swift_config,glance_cache_config,glance_image_import_config", "step_config": "include tripleo::profile::base::glance::api\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/glance_api.json": {"command": "/usr/bin/glance-api --config-file /usr/share/glance/glance-api-dist.conf --config-file /etc/glance/glance-api.conf --config-file /etc/glance/glance-image-import.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-iscsid/*", "dest": "/etc/iscsi/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/lib/glance", "owner": "glance:glance", "recurse": true}, {"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "glance:glance", "perm": "0600"}]}, "/var/lib/kolla/config_files/glance_api_tls_proxy.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/glance_api_cron.json": {"command": "/usr/sbin/crond -n", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/glance", "owner": "glance:glance", "recurse": true}]}}, "docker_config": {"step_2": {"glance_init_logs": {"image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z"], "command": ["/bin/bash", "-c", "chown -R glance:glance /var/log/glance"]}}, "step_3": {"glance_api_db_sync": {"image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "cap_add": ["AUDIT_WRITE"], "net": "host", "privileged": false, "detach": false, "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z", "/var/lib/kolla/config_files/glance_api.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/glance:/var/lib/glance:shared"], "environment": {"KOLLA_BOOTSTRAP": true, "KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1781427082"}, "command": "/usr/bin/bootstrap_host_exec glance_api su glance -s /bin/bash -c '/usr/local/bin/kolla_start'"}}, "step_4": {"glance_api": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z", "/var/lib/kolla/config_files/glance_api.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/glance:/var/lib/glance:shared"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "glance_api_cron": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "host", "user": "root", "privileged": false, "restart": "always", "healthcheck": {"test": "/usr/share/openstack-tripleo-common/healthcheck/cron glance"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z", "/var/lib/kolla/config_files/glance_api_cron.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro", "/var/lib/glance:/var/lib/glance:shared"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "host_prep_tasks": [{"name": "create persistent logs directory", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/glance", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/glance", "setype": "container_file_t", "mode": "0750"}]}, {"name": "Mount NFS on host", "vars": {"nfs_backend_enabled": false, "glance_netapp_nfs_enabled": false, "glance_nfs_share": "", "netapp_share_location": "", "nfs_share": "{{ glance_nfs_share if (glance_nfs_share) else netapp_share_location }}", "nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"name": "/var/lib/glance/images", "state": "mounted", "fstype": "nfs", "src": "{{nfs_share}}", "opts": "{{nfs_options}}"}, "when": "nfs_backend_enabled or glance_netapp_nfs_enabled"}, {"name": "Mount Node Staging Location", "vars": {"glance_node_staging_uri": "file:///var/lib/glance/staging", "glance_staging_nfs_share": "", "glance_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"name": "{{glance_node_staging_uri[7:]}}", "state": "mounted", "fstype": "nfs", "src": "{{glance_staging_nfs_share}}", "opts": "{{glance_nfs_options}}"}, "when": "glance_staging_nfs_share != ''"}, {"name": "ensure ceph configurations exist", "file": {"path": "/var/lib/tripleo-config/ceph", "state": "directory"}}, {"name": "ensure /var/lib/glance exists", "file": {"path": "/var/lib/glance", "state": "directory", "setype": "container_file_t"}}], "upgrade_tasks": [{"name": "glance-api pre system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 3", "upgrade_leapp_enabled"], "block": [{"name": "Unmount and remove NFS glance entry", "vars": {"nfs_backend_enabled": false, "glance_netapp_nfs_enabled": false}, "mount": {"name": "/var/lib/glance/images", "fstype": "nfs", "state": "absent"}, "when": "nfs_backend_enabled or glance_netapp_nfs_enabled"}, {"name": "Unmount and remove NFS glance-staging entry", "vars": {"glance_node_staging_uri": "file:///var/lib/glance/staging", "glance_staging_nfs_share": ""}, "mount": {"name": "{{glance_node_staging_uri[7:]}}", "fstype": "nfs", "state": "absent"}, "when": "glance_staging_nfs_share != ''"}]}, {"name": "glance-api post system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 5", "upgrade_leapp_enabled"], "block": [{"name": "Mount NFS on host", "vars": {"nfs_backend_enabled": false, "glance_netapp_nfs_enabled": false, "glance_nfs_share": "", "netapp_share_location": "", "nfs_share": "{{ glance_nfs_share if (glance_nfs_share) else netapp_share_location }}", "nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"name": "/var/lib/glance/images", "state": "mounted", "fstype": "nfs", "src": "{{nfs_share}}", "opts": "{{nfs_options}}"}, "when": "nfs_backend_enabled or glance_netapp_nfs_enabled"}, {"name": "Mount Node Staging Location", "vars": {"glance_node_staging_uri": "file:///var/lib/glance/staging", "glance_staging_nfs_share": "", "glance_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"name": "{{glance_node_staging_uri[7:]}}", "state": "mounted", "fstype": "nfs", "src": "{{glance_staging_nfs_share}}", "opts": "{{glance_nfs_options}}"}, "when": "glance_staging_nfs_share != ''"}]}], "metadata_settings": null, "external_upgrade_tasks": [{"when": ["step|int == 1"], "tags": ["never", "system_upgrade_transfer_data", "system_upgrade_stop_services"], "block": [{"name": "Stop glance api container", "import_role": {"name": "tripleo_container_stop"}, "vars": {"tripleo_containers_to_stop": ["glance_api", "glance_api_cron"], "tripleo_delegate_to": "{{ groups['glance_api'] | difference(groups['excluded_overcloud']) }}"}}]}], "deploy_steps_tasks": null}, "tuple:('role_data', 'config_settings')": {"glance::api::db::database_connection": "mysql+pymysql://glance:FHTdjgb7Sf493vaTSHmpZCdwV@172.17.0.2/glance?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "glance::api::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "glance::api::authtoken::auth_url": "http://172.17.0.2:5000", "glance::api::enable_v1_api": false, "glance::api::enable_v2_api": true, "glance::api::authtoken::password": "FHTdjgb7Sf493vaTSHmpZCdwV", "glance::api::enable_proxy_headers_parsing": true, "glance::api::logging::debug": true, "glance::policy::policies": {}, "glance::api::authtoken::project_name": "service", "glance::api::authtoken::region_name": "regionOne", "glance::api::authtoken::user_domain_name": "Default", "glance::api::authtoken::project_domain_name": "Default", "glance::api::authtoken::interface": "internal", "glance::api::authtoken::memcache_use_advanced_pool": true, "glance::api::pipeline": "keystone", "glance::api::os_region_name": "regionOne", "glance::api::image_member_quota": 128, "glance::api::enabled_import_methods": ["web-download"], "glance::api::node_staging_uri": "file:///var/lib/glance/staging", "glance::api::image_import_plugins": ["no_op", "image_conversion"], "glance::api::image_conversion_output_format": "raw", "glance::api::inject_metadata_properties": [], "glance::api::ignore_user_roles": ["admin"], "tripleo::profile::base::glance::api::tls_proxy_bind_ip": "%{hiera('internal_api')}", "tripleo::profile::base::glance::api::tls_proxy_fqdn": "%{hiera('fqdn_internal_api')}", "tripleo::profile::base::glance::api::tls_proxy_port": 9292, "glance::api::bind_host": "%{hiera('internal_api')}", "glance_notifier_strategy": "noop", "glance_log_file": "", "glance::backend::rbd::rbd_thin_provisioning": false, "glance::backend::file::filesystem_thin_provisioning": false, "glance::backend::swift::swift_store_auth_address": "http://172.17.0.2:5000/v3", "glance::backend::swift::swift_store_user": "service:glance", "glance::backend::swift::swift_store_key": "FHTdjgb7Sf493vaTSHmpZCdwV", "glance::backend::swift::swift_store_create_container_on_put": true, "glance::backend::swift::swift_store_auth_version": 3, "glance::backend::rbd::rbd_store_ceph_conf": "/etc/ceph/ceph.conf", "glance::backend::rbd::rbd_store_pool": "images", "glance::backend::rbd::rbd_store_user": "openstack", "glance_backend": "rbd", "tripleo::profile::base::glance::api::glance_backend_id": "default_backend", "tripleo::profile::base::glance::api::glance_store_description": "Default glance store backend.", "tripleo::profile::base::glance::api::multistore_config": {}, "tripleo::profile::base::glance::backend::rbd::glance_rbd_ceph_conf_path": "/var/lib/tripleo-config/ceph", "glance::notify::rabbitmq::notification_driver": ["messagingv2"], "glance::notify::rabbitmq::rabbit_heartbeat_in_pthread": false, "glance::cron::db_purge::minute": "1", "glance::cron::db_purge::hour": "0", "glance::cron::db_purge::monthday": "*", "glance::cron::db_purge::month": "*", "glance::cron::db_purge::weekday": "*", "glance::cron::db_purge::user": "glance", "glance::cron::db_purge::age": "30", "glance::cron::db_purge::max_rows": "100", "glance::cron::db_purge::destination": "/var/log/glance/glance-rowsflush.log", "glance::cron::db_purge::maxdelay": "3600", "glance::api::workers": "1"}, "tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'step_config')": null, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "glance_api", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-24-cj2ydjakr4xi/2a25f3c0-245c-4317-a4d7-a817d9b454ca"}


created_at: 2026-06-14 08:53:43.293355
data:
  {"type": "json", "value": {"ContainerGlanceApiImage": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "ContainerGlanceApiInternalConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1"}}


created_at: 2026-06-14 08:53:52.347600
data:
  {"value": {"ContainerGlanceApiImage": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "ContainerGlanceApiInternalConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1"}}


created_at: 2026-06-14 08:53:52.397038
data:
  {"tuple:('docker_config', 'step_2')": {"glance_init_logs": {"image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z"], "command": ["/bin/bash", "-c", "chown -R glance:glance /var/log/glance"]}}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-25-4low76ojytyq-GlanceLogging-h6ukgnkujltx/2a2429fd-75bf-4004-a0e2-57756ed884d8"}


created_at: 2026-06-14 08:53:52.444783
data:
  {"tuple:('role_data', 'step_config')": "include tripleo::profile::base::database::mysql::client", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-25-4low76ojytyq-MySQLClient-vzczect75ro6/b33a2c22-de10-4c6b-b9c3-16cfea497c68"}


created_at: 2026-06-14 08:53:52.546155
data:
  {"cinder_nvmeof_host_prep_tasks": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-25-4low76ojytyq-GlanceApi-ny5qdfsj2mdm-CinderNVMeOF-2utcgapmnqb5/d793f921-542b-4e31-9345-455c3d7c1d7d"}


created_at: 2026-06-14 08:53:52.604240
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-25-4low76ojytyq-GlanceApi-ny5qdfsj2mdm-ContainersCommon-nmnzrcx6diw7/d67dd643-c899-4945-9c2a-ee2b5a9a23a0"}


created_at: 2026-06-14 08:53:52.664891
data:
  {"tuple:('docker_config', 'step_2')": {"glance_init_logs": {"image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z"], "command": ["/bin/bash", "-c", "chown -R glance:glance /var/log/glance"]}}, "host_prep_tasks": [{"name": "create persistent logs directory", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/glance", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/glance", "setype": "container_file_t", "mode": "0750"}]}], "volumes": ["/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-25-4low76ojytyq-GlanceApi-ny5qdfsj2mdm-GlanceLogging-p55niohohvih/d6fa4b26-87df-4df0-9d8d-5c83c1fc8334"}


created_at: 2026-06-14 08:53:52.697813
data:
  {"tuple:('role_data', 'step_config')": "include tripleo::profile::base::database::mysql::client", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-25-4low76ojytyq-GlanceApi-ny5qdfsj2mdm-MySQLClient-mt7k6ppu46gr/718d5c1d-14ce-476f-b7d5-11d4f589db42"}


created_at: 2026-06-14 08:53:52.710595
data:
  {"tuple:('role_data', 'docker_config', 'step_4', 'glance_api', 'volumes')": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z", "/var/lib/kolla/config_files/glance_api.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/glance:/var/lib/glance:shared"], "role_data": {"service_name": "glance_api", "firewall_rules": {"112 glance_api": {"dport": [9292]}}, "firewall_frontend_rules": {"100 glance_api_haproxy_frontend": {"dport": [9292]}}, "firewall_ssl_frontend_rules": {"100 glance_api_haproxy_frontend_ssl": {"dport": [13292]}}, "keystone_resources": {"glance": {"endpoints": {"public": "http://172.21.0.2:9292", "internal": "http://172.17.0.2:9293", "admin": "http://172.17.0.2:9293"}, "users": {"glance": {"password": "FHTdjgb7Sf493vaTSHmpZCdwV"}}, "region": "regionOne", "service": "image"}}, "monitoring_subscription": "overcloud-glance-api", "config_settings": {"glance::api::db::database_connection": "mysql+pymysql://glance:FHTdjgb7Sf493vaTSHmpZCdwV@172.17.0.2/glance?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "glance::api::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "glance::api::authtoken::auth_url": "http://172.17.0.2:5000", "glance::api::enable_v1_api": false, "glance::api::enable_v2_api": true, "glance::api::authtoken::password": "FHTdjgb7Sf493vaTSHmpZCdwV", "glance::api::enable_proxy_headers_parsing": true, "glance::api::logging::debug": true, "glance::policy::policies": {}, "glance::api::authtoken::project_name": "service", "glance::api::authtoken::region_name": "regionOne", "glance::api::authtoken::user_domain_name": "Default", "glance::api::authtoken::project_domain_name": "Default", "glance::api::authtoken::interface": "internal", "glance::api::authtoken::memcache_use_advanced_pool": true, "glance::api::pipeline": "keystone", "glance::api::os_region_name": "regionOne", "glance::api::image_member_quota": 128, "glance::api::enabled_import_methods": ["web-download"], "glance::api::node_staging_uri": "file:///var/lib/glance/staging", "glance::api::image_import_plugins": ["no_op", "image_conversion"], "glance::api::image_conversion_output_format": "raw", "glance::api::inject_metadata_properties": [], "glance::api::ignore_user_roles": ["admin"], "tripleo::profile::base::glance::api::tls_proxy_bind_ip": "%{hiera('internal_api')}", "tripleo::profile::base::glance::api::tls_proxy_fqdn": "%{hiera('fqdn_internal_api')}", "tripleo::profile::base::glance::api::tls_proxy_port": 9292, "glance::api::bind_host": "%{hiera('internal_api')}", "glance_notifier_strategy": "noop", "glance_log_file": "", "glance::backend::rbd::rbd_thin_provisioning": false, "glance::backend::file::filesystem_thin_provisioning": false, "glance::backend::swift::swift_store_auth_address": "http://172.17.0.2:5000/v3", "glance::backend::swift::swift_store_user": "service:glance", "glance::backend::swift::swift_store_key": "FHTdjgb7Sf493vaTSHmpZCdwV", "glance::backend::swift::swift_store_create_container_on_put": true, "glance::backend::swift::swift_store_auth_version": 3, "glance::backend::rbd::rbd_store_ceph_conf": "/etc/ceph/ceph.conf", "glance::backend::rbd::rbd_store_pool": "images", "glance::backend::rbd::rbd_store_user": "openstack", "glance_backend": "rbd", "tripleo::profile::base::glance::api::glance_backend_id": "default_backend", "tripleo::profile::base::glance::api::glance_store_description": "Default glance store backend.", "tripleo::profile::base::glance::api::multistore_config": {}, "tripleo::profile::base::glance::backend::rbd::glance_rbd_ceph_conf_path": "/var/lib/tripleo-config/ceph", "glance::notify::rabbitmq::notification_driver": ["messagingv2"], "glance::notify::rabbitmq::rabbit_heartbeat_in_pthread": false, "glance::cron::db_purge::minute": "1", "glance::cron::db_purge::hour": "0", "glance::cron::db_purge::monthday": "*", "glance::cron::db_purge::month": "*", "glance::cron::db_purge::weekday": "*", "glance::cron::db_purge::user": "glance", "glance::cron::db_purge::age": "30", "glance::cron::db_purge::max_rows": "100", "glance::cron::db_purge::destination": "/var/log/glance/glance-rowsflush.log", "glance::cron::db_purge::maxdelay": "3600", "glance::api::workers": "1"}, "service_config_settings": {"mysql": {"glance::db::mysql::password": "FHTdjgb7Sf493vaTSHmpZCdwV", "glance::db::mysql::user": "glance", "glance::db::mysql::host": "%", "glance::db::mysql::dbname": "glance"}, "rsyslog": {"tripleo_logging_sources_glance_api": [{"tag": "openstack.glance.api", "file": "/var/log/containers/glance/api.log"}]}}, "puppet_config": {"config_volume": "glance_api", "puppet_tags": "glance_api_config,glance_api_paste_ini,glance_swift_config,glance_cache_config,glance_image_import_config", "step_config": "include tripleo::profile::base::glance::api\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/glance_api.json": {"command": "/usr/bin/glance-api --config-file /usr/share/glance/glance-api-dist.conf --config-file /etc/glance/glance-api.conf --config-file /etc/glance/glance-image-import.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-iscsid/*", "dest": "/etc/iscsi/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/lib/glance", "owner": "glance:glance", "recurse": true}, {"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "glance:glance", "perm": "0600"}]}, "/var/lib/kolla/config_files/glance_api_tls_proxy.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/glance_api_cron.json": {"command": "/usr/sbin/crond -n", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/glance", "owner": "glance:glance", "recurse": true}]}}, "docker_config": {"step_2": {"glance_init_logs": {"image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z"], "command": ["/bin/bash", "-c", "chown -R glance:glance /var/log/glance"]}}, "step_3": {"glance_api_db_sync": {"image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "cap_add": ["AUDIT_WRITE"], "net": "host", "privileged": false, "detach": false, "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z", "/var/lib/kolla/config_files/glance_api.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/glance:/var/lib/glance:shared"], "environment": {"KOLLA_BOOTSTRAP": true, "KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1781427082"}, "command": "/usr/bin/bootstrap_host_exec glance_api su glance -s /bin/bash -c '/usr/local/bin/kolla_start'"}}, "step_4": {"glance_api": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z", "/var/lib/kolla/config_files/glance_api.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/glance:/var/lib/glance:shared"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "glance_api_cron": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "host", "user": "root", "privileged": false, "restart": "always", "healthcheck": {"test": "/usr/share/openstack-tripleo-common/healthcheck/cron glance"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z", "/var/lib/kolla/config_files/glance_api_cron.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro", "/var/lib/glance:/var/lib/glance:shared"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "host_prep_tasks": [{"name": "create persistent logs directory", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/glance", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/glance", "setype": "container_file_t", "mode": "0750"}]}, {"name": "Mount NFS on host", "vars": {"nfs_backend_enabled": false, "glance_netapp_nfs_enabled": false, "glance_nfs_share": "", "netapp_share_location": "", "nfs_share": "{{ glance_nfs_share if (glance_nfs_share) else netapp_share_location }}", "nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"name": "/var/lib/glance/images", "state": "mounted", "fstype": "nfs", "src": "{{nfs_share}}", "opts": "{{nfs_options}}"}, "when": "nfs_backend_enabled or glance_netapp_nfs_enabled"}, {"name": "Mount Node Staging Location", "vars": {"glance_node_staging_uri": "file:///var/lib/glance/staging", "glance_staging_nfs_share": "", "glance_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"name": "{{glance_node_staging_uri[7:]}}", "state": "mounted", "fstype": "nfs", "src": "{{glance_staging_nfs_share}}", "opts": "{{glance_nfs_options}}"}, "when": "glance_staging_nfs_share != ''"}, {"name": "ensure ceph configurations exist", "file": {"path": "/var/lib/tripleo-config/ceph", "state": "directory"}}, {"name": "ensure /var/lib/glance exists", "file": {"path": "/var/lib/glance", "state": "directory", "setype": "container_file_t"}}], "upgrade_tasks": [{"name": "glance-api pre system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 3", "upgrade_leapp_enabled"], "block": [{"name": "Unmount and remove NFS glance entry", "vars": {"nfs_backend_enabled": false, "glance_netapp_nfs_enabled": false}, "mount": {"name": "/var/lib/glance/images", "fstype": "nfs", "state": "absent"}, "when": "nfs_backend_enabled or glance_netapp_nfs_enabled"}, {"name": "Unmount and remove NFS glance-staging entry", "vars": {"glance_node_staging_uri": "file:///var/lib/glance/staging", "glance_staging_nfs_share": ""}, "mount": {"name": "{{glance_node_staging_uri[7:]}}", "fstype": "nfs", "state": "absent"}, "when": "glance_staging_nfs_share != ''"}]}, {"name": "glance-api post system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 5", "upgrade_leapp_enabled"], "block": [{"name": "Mount NFS on host", "vars": {"nfs_backend_enabled": false, "glance_netapp_nfs_enabled": false, "glance_nfs_share": "", "netapp_share_location": "", "nfs_share": "{{ glance_nfs_share if (glance_nfs_share) else netapp_share_location }}", "nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"name": "/var/lib/glance/images", "state": "mounted", "fstype": "nfs", "src": "{{nfs_share}}", "opts": "{{nfs_options}}"}, "when": "nfs_backend_enabled or glance_netapp_nfs_enabled"}, {"name": "Mount Node Staging Location", "vars": {"glance_node_staging_uri": "file:///var/lib/glance/staging", "glance_staging_nfs_share": "", "glance_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"name": "{{glance_node_staging_uri[7:]}}", "state": "mounted", "fstype": "nfs", "src": "{{glance_staging_nfs_share}}", "opts": "{{glance_nfs_options}}"}, "when": "glance_staging_nfs_share != ''"}]}], "metadata_settings": null, "external_upgrade_tasks": [{"when": ["step|int == 1"], "tags": ["never", "system_upgrade_transfer_data", "system_upgrade_stop_services"], "block": [{"name": "Stop glance api container", "import_role": {"name": "tripleo_container_stop"}, "vars": {"tripleo_containers_to_stop": ["glance_api", "glance_api_cron"], "tripleo_delegate_to": "{{ groups['glance_api'] | difference(groups['excluded_overcloud']) }}"}}]}], "deploy_steps_tasks": null}, "tuple:('role_data', 'docker_config', 'step_4', 'glance_api')": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z", "/var/lib/kolla/config_files/glance_api.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/glance:/var/lib/glance:shared"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "tuple:('role_data', 'config_settings')": {"glance::api::db::database_connection": "mysql+pymysql://glance:FHTdjgb7Sf493vaTSHmpZCdwV@172.17.0.2/glance?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "glance::api::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "glance::api::authtoken::auth_url": "http://172.17.0.2:5000", "glance::api::enable_v1_api": false, "glance::api::enable_v2_api": true, "glance::api::authtoken::password": "FHTdjgb7Sf493vaTSHmpZCdwV", "glance::api::enable_proxy_headers_parsing": true, "glance::api::logging::debug": true, "glance::policy::policies": {}, "glance::api::authtoken::project_name": "service", "glance::api::authtoken::region_name": "regionOne", "glance::api::authtoken::user_domain_name": "Default", "glance::api::authtoken::project_domain_name": "Default", "glance::api::authtoken::interface": "internal", "glance::api::authtoken::memcache_use_advanced_pool": true, "glance::api::pipeline": "keystone", "glance::api::os_region_name": "regionOne", "glance::api::image_member_quota": 128, "glance::api::enabled_import_methods": ["web-download"], "glance::api::node_staging_uri": "file:///var/lib/glance/staging", "glance::api::image_import_plugins": ["no_op", "image_conversion"], "glance::api::image_conversion_output_format": "raw", "glance::api::inject_metadata_properties": [], "glance::api::ignore_user_roles": ["admin"], "tripleo::profile::base::glance::api::tls_proxy_bind_ip": "%{hiera('internal_api')}", "tripleo::profile::base::glance::api::tls_proxy_fqdn": "%{hiera('fqdn_internal_api')}", "tripleo::profile::base::glance::api::tls_proxy_port": 9292, "glance::api::bind_host": "%{hiera('internal_api')}", "glance_notifier_strategy": "noop", "glance_log_file": "", "glance::backend::rbd::rbd_thin_provisioning": false, "glance::backend::file::filesystem_thin_provisioning": false, "glance::backend::swift::swift_store_auth_address": "http://172.17.0.2:5000/v3", "glance::backend::swift::swift_store_user": "service:glance", "glance::backend::swift::swift_store_key": "FHTdjgb7Sf493vaTSHmpZCdwV", "glance::backend::swift::swift_store_create_container_on_put": true, "glance::backend::swift::swift_store_auth_version": 3, "glance::backend::rbd::rbd_store_ceph_conf": "/etc/ceph/ceph.conf", "glance::backend::rbd::rbd_store_pool": "images", "glance::backend::rbd::rbd_store_user": "openstack", "glance_backend": "rbd", "tripleo::profile::base::glance::api::glance_backend_id": "default_backend", "tripleo::profile::base::glance::api::glance_store_description": "Default glance store backend.", "tripleo::profile::base::glance::api::multistore_config": {}, "tripleo::profile::base::glance::backend::rbd::glance_rbd_ceph_conf_path": "/var/lib/tripleo-config/ceph", "glance::notify::rabbitmq::notification_driver": ["messagingv2"], "glance::notify::rabbitmq::rabbit_heartbeat_in_pthread": false, "glance::cron::db_purge::minute": "1", "glance::cron::db_purge::hour": "0", "glance::cron::db_purge::monthday": "*", "glance::cron::db_purge::month": "*", "glance::cron::db_purge::weekday": "*", "glance::cron::db_purge::user": "glance", "glance::cron::db_purge::age": "30", "glance::cron::db_purge::max_rows": "100", "glance::cron::db_purge::destination": "/var/log/glance/glance-rowsflush.log", "glance::cron::db_purge::maxdelay": "3600", "glance::api::workers": "1"}, "tuple:('role_data', 'service_config_settings')": {"mysql": {"glance::db::mysql::password": "FHTdjgb7Sf493vaTSHmpZCdwV", "glance::db::mysql::user": "glance", "glance::db::mysql::host": "%", "glance::db::mysql::dbname": "glance"}, "rsyslog": {"tripleo_logging_sources_glance_api": [{"tag": "openstack.glance.api", "file": "/var/log/containers/glance/api.log"}]}}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-25-4low76ojytyq-GlanceApi-ny5qdfsj2mdm/1375ba9f-02f0-45f3-b46c-857733ea2fcd"}


created_at: 2026-06-14 08:53:52.731123
data:
  {"tuple:('role_data', 'docker_config')": {"step_2": {"glance_init_logs": {"image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z"], "command": ["/bin/bash", "-c", "chown -R glance:glance /var/log/glance"]}}, "step_4": {"glance_api_internal": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z", "/var/lib/kolla/config_files/glance_api.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/glance_api_internal:/var/lib/kolla/config_files/src:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/glance:/var/lib/glance:shared"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "role_data": {"service_name": "glance_api_internal", "firewall_rules": {"112 glance_api_internal": {"dport": ["9293"]}}, "firewall_frontend_rules": {"100 glance_api_internal_haproxy_frontend": {"dport": ["9293"]}}, "firewall_ssl_frontend_rules": {"100 glance_api_haproxy_frontend_ssl": {"dport": [13292]}}, "keystone_resources": {}, "monitoring_subscription": "overcloud-glance-api", "config_settings": {"glance::api::db::database_connection": "mysql+pymysql://glance:FHTdjgb7Sf493vaTSHmpZCdwV@172.17.0.2/glance?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "glance::api::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "glance::api::authtoken::auth_url": "http://172.17.0.2:5000", "glance::api::enable_v1_api": false, "glance::api::enable_v2_api": true, "glance::api::authtoken::password": "FHTdjgb7Sf493vaTSHmpZCdwV", "glance::api::enable_proxy_headers_parsing": true, "glance::api::logging::debug": true, "glance::policy::policies": {}, "glance::api::authtoken::project_name": "service", "glance::api::authtoken::region_name": "regionOne", "glance::api::authtoken::user_domain_name": "Default", "glance::api::authtoken::project_domain_name": "Default", "glance::api::authtoken::interface": "internal", "glance::api::authtoken::memcache_use_advanced_pool": true, "glance::api::pipeline": "keystone", "glance::api::os_region_name": "regionOne", "glance::api::image_member_quota": 128, "glance::api::enabled_import_methods": ["web-download"], "glance::api::node_staging_uri": "file:///var/lib/glance/staging", "glance::api::image_import_plugins": ["no_op", "image_conversion"], "glance::api::image_conversion_output_format": "raw", "glance::api::inject_metadata_properties": [], "glance::api::ignore_user_roles": ["admin"], "tripleo::profile::base::glance::api::tls_proxy_bind_ip": "%{hiera('internal_api')}", "tripleo::profile::base::glance::api::tls_proxy_fqdn": "%{hiera('fqdn_internal_api')}", "tripleo::profile::base::glance::api::tls_proxy_port": 9292, "glance::api::bind_host": "%{hiera('internal_api')}", "glance_notifier_strategy": "noop", "glance_log_file": "", "glance::backend::rbd::rbd_thin_provisioning": false, "glance::backend::file::filesystem_thin_provisioning": false, "glance::backend::swift::swift_store_auth_address": "http://172.17.0.2:5000/v3", "glance::backend::swift::swift_store_user": "service:glance", "glance::backend::swift::swift_store_key": "FHTdjgb7Sf493vaTSHmpZCdwV", "glance::backend::swift::swift_store_create_container_on_put": true, "glance::backend::swift::swift_store_auth_version": 3, "glance::backend::rbd::rbd_store_ceph_conf": "/etc/ceph/ceph.conf", "glance::backend::rbd::rbd_store_pool": "images", "glance::backend::rbd::rbd_store_user": "openstack", "glance_backend": "rbd", "tripleo::profile::base::glance::api::glance_backend_id": "default_backend", "tripleo::profile::base::glance::api::glance_store_description": "Default glance store backend.", "tripleo::profile::base::glance::api::multistore_config": {}, "tripleo::profile::base::glance::backend::rbd::glance_rbd_ceph_conf_path": "/var/lib/tripleo-config/ceph", "glance::notify::rabbitmq::notification_driver": ["messagingv2"], "glance::notify::rabbitmq::rabbit_heartbeat_in_pthread": false, "glance::cron::db_purge::minute": "1", "glance::cron::db_purge::hour": "0", "glance::cron::db_purge::monthday": "*", "glance::cron::db_purge::month": "*", "glance::cron::db_purge::weekday": "*", "glance::cron::db_purge::user": "glance", "glance::cron::db_purge::age": "30", "glance::cron::db_purge::max_rows": "100", "glance::cron::db_purge::destination": "/var/log/glance/glance-rowsflush.log", "glance::cron::db_purge::maxdelay": "3600", "glance::api::workers": "1"}, "service_config_settings": {"mysql": {"glance::db::mysql::password": "FHTdjgb7Sf493vaTSHmpZCdwV", "glance::db::mysql::user": "glance", "glance::db::mysql::host": "%", "glance::db::mysql::dbname": "glance"}, "rsyslog": {"tripleo_logging_sources_glance_api_internal": [{"tag": "openstack.glance.api", "file": "/var/log/containers/glance/api_internal.log"}]}}, "puppet_config": {"config_volume": "glance_api_internal", "puppet_tags": "glance_api_config,glance_api_paste_ini,glance_swift_config,glance_cache_config,glance_image_import_config", "step_config": "class { 'tripleo::profile::base::glance::api':\n  bind_port => 9293,\n  tls_proxy_port => 9293,\n  log_file => '/var/log/glance/api_internal.log',\n  show_image_direct_url => true,\n  show_multiple_locations => true,\n}\n\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/glance_api.json": {"command": "/usr/bin/glance-api --config-file /usr/share/glance/glance-api-dist.conf --config-file /etc/glance/glance-api.conf --config-file /etc/glance/glance-image-import.conf", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-iscsid/*", "dest": "/etc/iscsi/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/lib/glance", "owner": "glance:glance", "recurse": true}, {"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "glance:glance", "perm": "0600"}]}, "/var/lib/kolla/config_files/glance_api_tls_proxy.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/glance_api_cron.json": {"command": "/usr/sbin/crond -n", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/glance", "owner": "glance:glance", "recurse": true}]}}, "docker_config": {"step_2": {"glance_init_logs": {"image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "none", "privileged": false, "user": "root", "volumes": ["/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z"], "command": ["/bin/bash", "-c", "chown -R glance:glance /var/log/glance"]}}, "step_4": {"glance_api_internal": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-glance-api:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/glance:/var/log/glance:z", "/var/log/containers/httpd/glance:/var/log/httpd:z", "/var/lib/kolla/config_files/glance_api.json:/var/lib/kolla/config_files/config.json", "/var/lib/config-data/puppet-generated/glance_api_internal:/var/lib/kolla/config_files/src:ro", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/var/lib/glance:/var/lib/glance:shared"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "host_prep_tasks": [{"name": "create persistent logs directory", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/glance", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/glance", "setype": "container_file_t", "mode": "0750"}]}, {"name": "Mount NFS on host", "vars": {"nfs_backend_enabled": false, "glance_netapp_nfs_enabled": false, "glance_nfs_share": "", "netapp_share_location": "", "nfs_share": "{{ glance_nfs_share if (glance_nfs_share) else netapp_share_location }}", "nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"name": "/var/lib/glance/images", "state": "mounted", "fstype": "nfs", "src": "{{nfs_share}}", "opts": "{{nfs_options}}"}, "when": "nfs_backend_enabled or glance_netapp_nfs_enabled"}, {"name": "Mount Node Staging Location", "vars": {"glance_node_staging_uri": "file:///var/lib/glance/staging", "glance_staging_nfs_share": "", "glance_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"name": "{{glance_node_staging_uri[7:]}}", "state": "mounted", "fstype": "nfs", "src": "{{glance_staging_nfs_share}}", "opts": "{{glance_nfs_options}}"}, "when": "glance_staging_nfs_share != ''"}, {"name": "ensure ceph configurations exist", "file": {"path": "/var/lib/tripleo-config/ceph", "state": "directory"}}, {"name": "ensure /var/lib/glance exists", "file": {"path": "/var/lib/glance", "state": "directory", "setype": "container_file_t"}}], "upgrade_tasks": [{"name": "glance-api pre system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 3", "upgrade_leapp_enabled"], "block": [{"name": "Unmount and remove NFS glance entry", "vars": {"nfs_backend_enabled": false, "glance_netapp_nfs_enabled": false}, "mount": {"name": "/var/lib/glance/images", "fstype": "nfs", "state": "absent"}, "when": "nfs_backend_enabled or glance_netapp_nfs_enabled"}, {"name": "Unmount and remove NFS glance-staging entry", "vars": {"glance_node_staging_uri": "file:///var/lib/glance/staging", "glance_staging_nfs_share": ""}, "mount": {"name": "{{glance_node_staging_uri[7:]}}", "fstype": "nfs", "state": "absent"}, "when": "glance_staging_nfs_share != ''"}]}, {"name": "glance-api post system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 5", "upgrade_leapp_enabled"], "block": [{"name": "Mount NFS on host", "vars": {"nfs_backend_enabled": false, "glance_netapp_nfs_enabled": false, "glance_nfs_share": "", "netapp_share_location": "", "nfs_share": "{{ glance_nfs_share if (glance_nfs_share) else netapp_share_location }}", "nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"name": "/var/lib/glance/images", "state": "mounted", "fstype": "nfs", "src": "{{nfs_share}}", "opts": "{{nfs_options}}"}, "when": "nfs_backend_enabled or glance_netapp_nfs_enabled"}, {"name": "Mount Node Staging Location", "vars": {"glance_node_staging_uri": "file:///var/lib/glance/staging", "glance_staging_nfs_share": "", "glance_nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0"}, "mount": {"name": "{{glance_node_staging_uri[7:]}}", "state": "mounted", "fstype": "nfs", "src": "{{glance_staging_nfs_share}}", "opts": "{{glance_nfs_options}}"}, "when": "glance_staging_nfs_share != ''"}]}], "metadata_settings": null, "external_upgrade_tasks": [{"when": ["step|int == 1"], "tags": ["never", "system_upgrade_transfer_data", "system_upgrade_stop_services"], "block": [{"name": "Stop glance api internal container", "import_role": {"name": "tripleo_container_stop"}, "vars": {"tripleo_containers_to_stop": ["glance_api_internal"], "tripleo_delegate_to": "{{ groups['glance_api_internal'] | default([]) }}"}}]}], "deploy_steps_tasks": null}, "tuple:('role_data', 'config_settings')": {"glance::api::db::database_connection": "mysql+pymysql://glance:FHTdjgb7Sf493vaTSHmpZCdwV@172.17.0.2/glance?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "glance::api::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "glance::api::authtoken::auth_url": "http://172.17.0.2:5000", "glance::api::enable_v1_api": false, "glance::api::enable_v2_api": true, "glance::api::authtoken::password": "FHTdjgb7Sf493vaTSHmpZCdwV", "glance::api::enable_proxy_headers_parsing": true, "glance::api::logging::debug": true, "glance::policy::policies": {}, "glance::api::authtoken::project_name": "service", "glance::api::authtoken::region_name": "regionOne", "glance::api::authtoken::user_domain_name": "Default", "glance::api::authtoken::project_domain_name": "Default", "glance::api::authtoken::interface": "internal", "glance::api::authtoken::memcache_use_advanced_pool": true, "glance::api::pipeline": "keystone", "glance::api::os_region_name": "regionOne", "glance::api::image_member_quota": 128, "glance::api::enabled_import_methods": ["web-download"], "glance::api::node_staging_uri": "file:///var/lib/glance/staging", "glance::api::image_import_plugins": ["no_op", "image_conversion"], "glance::api::image_conversion_output_format": "raw", "glance::api::inject_metadata_properties": [], "glance::api::ignore_user_roles": ["admin"], "tripleo::profile::base::glance::api::tls_proxy_bind_ip": "%{hiera('internal_api')}", "tripleo::profile::base::glance::api::tls_proxy_fqdn": "%{hiera('fqdn_internal_api')}", "tripleo::profile::base::glance::api::tls_proxy_port": 9292, "glance::api::bind_host": "%{hiera('internal_api')}", "glance_notifier_strategy": "noop", "glance_log_file": "", "glance::backend::rbd::rbd_thin_provisioning": false, "glance::backend::file::filesystem_thin_provisioning": false, "glance::backend::swift::swift_store_auth_address": "http://172.17.0.2:5000/v3", "glance::backend::swift::swift_store_user": "service:glance", "glance::backend::swift::swift_store_key": "FHTdjgb7Sf493vaTSHmpZCdwV", "glance::backend::swift::swift_store_create_container_on_put": true, "glance::backend::swift::swift_store_auth_version": 3, "glance::backend::rbd::rbd_store_ceph_conf": "/etc/ceph/ceph.conf", "glance::backend::rbd::rbd_store_pool": "images", "glance::backend::rbd::rbd_store_user": "openstack", "glance_backend": "rbd", "tripleo::profile::base::glance::api::glance_backend_id": "default_backend", "tripleo::profile::base::glance::api::glance_store_description": "Default glance store backend.", "tripleo::profile::base::glance::api::multistore_config": {}, "tripleo::profile::base::glance::backend::rbd::glance_rbd_ceph_conf_path": "/var/lib/tripleo-config/ceph", "glance::notify::rabbitmq::notification_driver": ["messagingv2"], "glance::notify::rabbitmq::rabbit_heartbeat_in_pthread": false, "glance::cron::db_purge::minute": "1", "glance::cron::db_purge::hour": "0", "glance::cron::db_purge::monthday": "*", "glance::cron::db_purge::month": "*", "glance::cron::db_purge::weekday": "*", "glance::cron::db_purge::user": "glance", "glance::cron::db_purge::age": "30", "glance::cron::db_purge::max_rows": "100", "glance::cron::db_purge::destination": "/var/log/glance/glance-rowsflush.log", "glance::cron::db_purge::maxdelay": "3600", "glance::api::workers": "1"}, "tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'step_config')": null, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "glance_api_internal", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-25-4low76ojytyq/bfbf3068-60ae-4c44-833b-d879fca5fc60"}


created_at: 2026-06-14 08:53:57.080434
data:
  {"type": "json", "value": {"ContainerGnocchiApiImage": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-api:17.1", "ContainerGnocchiConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-api:17.1"}}


created_at: 2026-06-14 08:53:58.152845
data:
  {"value": {"ContainerGnocchiApiImage": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-api:17.1", "ContainerGnocchiConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-api:17.1"}}


created_at: 2026-06-14 08:53:58.216038
data:
  {"tuple:('role_data', 'metadata_settings')": null, "tuple:('role_data', 'config_settings')": {"apache::ip": "%{hiera('internal_api')}", "apache::default_vhost": false, "apache::trace_enable": "Off", "apache::server_signature": "Off", "apache::server_tokens": "Prod", "apache::timeout": 90, "apache::default_mods": false, "apache::mod::prefork::maxrequestworkers": 100, "apache::mod::prefork::serverlimit": 100, "apache::mod::remoteip::proxy_ips": ["172.17.0.0/24"], "apache::mod::alias::icons_options": "None"}, "tuple:('role_data', 'deploy_steps_tasks')": [{"name": "Certificate generation", "when": ["step|int == 1", "enable_internal_tls"], "block": [{"name": "Create dirs for certificates and keys", "file": {"path": "{{ item }}", "state": "directory", "serole": "object_r", "setype": "cert_t", "seuser": "system_u"}, "with_items": ["/etc/pki/tls/certs/httpd", "/etc/pki/tls/private/httpd"]}, {"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "httpd-ctlplane", "dns": "{{ fqdn_ctlplane }}", "principal": "HTTP/{{ fqdn_ctlplane }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-ctlplane.crt /etc/pki/tls/certs/httpd/httpd-ctlplane.crt\ncp /etc/pki/tls/private/httpd-ctlplane.key /etc/pki/tls/private/httpd/httpd-ctlplane.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage", "dns": "{{ fqdn_storage }}", "principal": "HTTP/{{ fqdn_storage }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage.crt /etc/pki/tls/certs/httpd/httpd-storage.crt\ncp /etc/pki/tls/private/httpd-storage.key /etc/pki/tls/private/httpd/httpd-storage.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage_mgmt", "dns": "{{ fqdn_storage_mgmt }}", "principal": "HTTP/{{ fqdn_storage_mgmt }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage_mgmt.crt /etc/pki/tls/certs/httpd/httpd-storage_mgmt.crt\ncp /etc/pki/tls/private/httpd-storage_mgmt.key /etc/pki/tls/private/httpd/httpd-storage_mgmt.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-internal_api", "dns": "{{ fqdn_internal_api }}", "principal": "HTTP/{{ fqdn_internal_api }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-internal_api.crt /etc/pki/tls/certs/httpd/httpd-internal_api.crt\ncp /etc/pki/tls/private/httpd-internal_api.key /etc/pki/tls/private/httpd/httpd-internal_api.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-external", "dns": "{{ fqdn_external }}", "principal": "HTTP/{{ fqdn_external }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-external.crt /etc/pki/tls/certs/httpd/httpd-external.crt\ncp /etc/pki/tls/private/httpd-external.key /etc/pki/tls/private/httpd/httpd-external.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}]}}]}], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-26-v3qum5izerbp-ApacheServiceBase-4bxiublylacz/60f5fed7-c472-41a7-bb5d-b3e1bffcba42"}


created_at: 2026-06-14 08:53:58.249540
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-26-v3qum5izerbp-ContainersCommon-6zbmtjnw7tpm/20904a44-3c2d-4ea5-927b-8fd8fb788098"}


created_at: 2026-06-14 08:53:58.307726
data:
  {"tuple:('role_data', 'config_settings')": {"gnocchi_redis_password": "49auApjwL72waJnu1huMAuwhk", "gnocchi::logging::debug": true, "gnocchi::db::database_connection": "mysql+pymysql://gnocchi:PiTWImWk332iLP85nlpSQAzNz@172.17.0.2/gnocchi?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "gnocchi::db::sync::extra_opts": " --sacks-number 128", "gnocchi::storage::file::file_basepath": "/var/lib/gnocchi", "gnocchi::storage::swift::swift_user": "service:gnocchi", "gnocchi::storage::swift::swift_auth_version": 3, "gnocchi::storage::swift::swift_key": "PiTWImWk332iLP85nlpSQAzNz", "gnocchi::storage::swift::swift_authurl": "http://172.17.0.2:5000/v3", "gnocchi::storage::swift::swift_endpoint_type": "internalURL", "gnocchi::storage::ceph::ceph_pool": "metrics", "gnocchi::storage::ceph::ceph_username": "openstack", "gnocchi::storage::ceph::ceph_conffile": "/etc/ceph/ceph.conf", "gnocchi::storage::ceph::ceph_keyring": "/etc/ceph/ceph.client.openstack.keyring", "gnocchi::storage::s3::s3_endpoint_url": "", "gnocchi::storage::s3::s3_region_name": "", "gnocchi::storage::s3::s3_access_key_id": "", "gnocchi::storage::s3::s3_secret_access_key": "", "gnocchi::storage::s3::s3_bucket_prefix": "", "gnocchi::statsd::resource_id": "0a8b55df-f90f-491c-8cb9-7cdecec6fc26", "gnocchi::statsd::flush_delay": 10, "gnocchi::statsd::archive_policy_name": "low"}, "tuple:('role_data', 'service_config_settings')": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-26-v3qum5izerbp-GnocchiServiceBase-wriszmlpo2zs/3f5ffaf2-d56b-41d5-97ce-3f7589acf3b8"}


created_at: 2026-06-14 08:53:58.353282
data:
  {"tuple:('role_data', 'step_config')": "include tripleo::profile::base::database::mysql::client", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-26-v3qum5izerbp-MySQLClient-aswwdhuwjgs4/109f6106-4633-4485-89fe-020363a12936"}


created_at: 2026-06-14 08:53:58.373849
data:
  {"tuple:('role_data', 'docker_config')": {"step_2": {"gnocchi_init_log": {"image": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-api:17.1", "net": "none", "user": "root", "volumes": ["/var/log/containers/gnocchi:/var/log/gnocchi:z", "/var/log/containers/httpd/gnocchi-api:/var/log/httpd:z"], "command": ["/bin/bash", "-c", "chown -R gnocchi:gnocchi /var/log/gnocchi"]}, "gnocchi_init_lib": {"image": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-api:17.1", "net": "none", "user": "root", "volumes": ["/var/lib/gnocchi:/var/lib/gnocchi:shared,z"], "command": ["/bin/bash", "-c", "chown -R gnocchi:gnocchi /var/lib/gnocchi"]}}, "step_5": {"gnocchi_db_sync": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-api:17.1", "cap_add": ["AUDIT_WRITE"], "net": "host", "detach": false, "privileged": false, "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/gnocchi_db_sync.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/gnocchi:/var/lib/kolla/config_files/src:ro", "/var/lib/gnocchi:/var/lib/gnocchi:shared,z", "/var/log/containers/gnocchi:/var/log/gnocchi:z", "/var/log/containers/httpd/gnocchi-api:/var/log/httpd:z", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1781427082"}}, "gnocchi_api": {"image": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-api:17.1", "start_order": 1, "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/gnocchi:/var/lib/gnocchi:shared,z", "/var/lib/kolla/config_files/gnocchi_api.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/gnocchi:/var/lib/kolla/config_files/src:ro", "/var/log/containers/gnocchi:/var/log/gnocchi:z", "/var/log/containers/httpd/gnocchi-api:/var/log/httpd:z", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "role_data": {"service_name": "gnocchi_api", "firewall_rules": {"129 gnocchi-api": {"dport": [8041]}}, "firewall_frontend_rules": {"100 gnocchi_haproxy_frontend": {"dport": [8041]}}, "firewall_ssl_frontend_rules": {"100 gnocchi_haproxy_frontend_ssl": {"dport": [13041]}}, "keystone_resources": {"gnocchi": {"endpoints": {"public": "http://172.21.0.2:8041", "internal": "http://172.17.0.2:8041", "admin": "http://172.17.0.2:8041"}, "users": {"gnocchi": {"password": "PiTWImWk332iLP85nlpSQAzNz"}}, "region": "regionOne", "service": "metric"}}, "monitoring_subscription": "overcloud-gnocchi-api", "config_settings": {"gnocchi_redis_password": "49auApjwL72waJnu1huMAuwhk", "gnocchi::logging::debug": true, "gnocchi::db::database_connection": "mysql+pymysql://gnocchi:PiTWImWk332iLP85nlpSQAzNz@172.17.0.2/gnocchi?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "gnocchi::db::sync::extra_opts": " --sacks-number 128", "gnocchi::storage::file::file_basepath": "/var/lib/gnocchi", "gnocchi::storage::swift::swift_user": "service:gnocchi", "gnocchi::storage::swift::swift_auth_version": 3, "gnocchi::storage::swift::swift_key": "PiTWImWk332iLP85nlpSQAzNz", "gnocchi::storage::swift::swift_authurl": "http://172.17.0.2:5000/v3", "gnocchi::storage::swift::swift_endpoint_type": "internalURL", "gnocchi::storage::ceph::ceph_pool": "metrics", "gnocchi::storage::ceph::ceph_username": "openstack", "gnocchi::storage::ceph::ceph_conffile": "/etc/ceph/ceph.conf", "gnocchi::storage::ceph::ceph_keyring": "/etc/ceph/ceph.client.openstack.keyring", "gnocchi::storage::s3::s3_endpoint_url": "", "gnocchi::storage::s3::s3_region_name": "", "gnocchi::storage::s3::s3_access_key_id": "", "gnocchi::storage::s3::s3_secret_access_key": "", "gnocchi::storage::s3::s3_bucket_prefix": "", "gnocchi::statsd::resource_id": "0a8b55df-f90f-491c-8cb9-7cdecec6fc26", "gnocchi::statsd::flush_delay": 10, "gnocchi::statsd::archive_policy_name": "low", "apache::ip": "%{hiera('internal_api')}", "apache::default_vhost": false, "apache::trace_enable": "Off", "apache::server_signature": "Off", "apache::server_tokens": "Prod", "apache::timeout": 90, "apache::default_mods": false, "apache::mod::prefork::maxrequestworkers": 100, "apache::mod::prefork::serverlimit": 100, "apache::mod::remoteip::proxy_ips": ["172.17.0.0/24"], "apache::mod::alias::icons_options": "None", "gnocchi::api::enabled": true, "gnocchi::api::enable_proxy_headers_parsing": true, "gnocchi::api::service_name": "httpd", "gnocchi::policy::policies": {}, "gnocchi::cors::max_age": 3600, "gnocchi::cors::allow_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma,X-Auth-Token", "gnocchi::cors::expose_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma", "gnocchi::cors::allow_methods": "GET,POST,PUT,DELETE,OPTIONS,PATCH", "gnocchi::keystone::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "gnocchi::keystone::authtoken::auth_url": "http://172.17.0.2:5000", "gnocchi::keystone::authtoken::password": "PiTWImWk332iLP85nlpSQAzNz", "gnocchi::keystone::authtoken::project_name": "service", "gnocchi::keystone::authtoken::user_domain_name": "Default", "gnocchi::keystone::authtoken::project_domain_name": "Default", "gnocchi::keystone::authtoken::region_name": "regionOne", "gnocchi::keystone::authtoken::interface": "internal", "gnocchi::keystone::authtoken::memcache_use_advanced_pool": true, "gnocchi::wsgi::apache::ssl": false, "gnocchi::wsgi::apache::servername": "%{hiera('fqdn_internal_api')}", "tripleo::profile::base::gnocchi::api::gnocchi_backend": "swift", "tripleo::profile::base::gnocchi::api::incoming_storage_driver": "redis", "tripleo::profile::base::gnocchi::api::gnocchi_rbd_ceph_conf_path": "/var/lib/tripleo-config/ceph", "gnocchi::wsgi::apache::bind_host": "%{hiera('internal_api')}", "gnocchi::wsgi::apache::wsgi_process_display_name": "gnocchi_wsgi"}, "service_config_settings": {"rsyslog": {"tripleo_logging_sources_gnocchi_api": [{"tag": "openstack.gnocchi.api", "file": "/var/log/containers/gnocchi/app.log"}]}, "mysql": {"gnocchi::db::mysql::password": "PiTWImWk332iLP85nlpSQAzNz", "gnocchi::db::mysql::user": "gnocchi", "gnocchi::db::mysql::host": "%", "gnocchi::db::mysql::dbname": "gnocchi"}}, "puppet_config": {"config_volume": "gnocchi", "puppet_tags": "gnocchi_api_paste_ini,gnocchi_config,exec", "step_config": "include tripleo::profile::base::gnocchi::api\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-api:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/gnocchi_api.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/gnocchi", "owner": "gnocchi:gnocchi", "recurse": true}, {"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "gnocchi:gnocchi", "perm": "0600"}, {"path": "/var/lib/gnocchi/tmp", "owner": "gnocchi:gnocchi", "perm": "0750", "recurse": true}]}, "/var/lib/kolla/config_files/gnocchi_db_sync.json": {"command": "/usr/bin/bootstrap_host_exec gnocchi_api /usr/bin/gnocchi-upgrade --sacks-number=128", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/gnocchi", "owner": "gnocchi:gnocchi", "recurse": true}, {"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "gnocchi:gnocchi", "perm": "0600"}, {"path": "/var/lib/gnocchi/tmp", "owner": "gnocchi:gnocchi", "perm": "0750", "recurse": true}]}}, "docker_config": {"step_2": {"gnocchi_init_log": {"image": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-api:17.1", "net": "none", "user": "root", "volumes": ["/var/log/containers/gnocchi:/var/log/gnocchi:z", "/var/log/containers/httpd/gnocchi-api:/var/log/httpd:z"], "command": ["/bin/bash", "-c", "chown -R gnocchi:gnocchi /var/log/gnocchi"]}, "gnocchi_init_lib": {"image": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-api:17.1", "net": "none", "user": "root", "volumes": ["/var/lib/gnocchi:/var/lib/gnocchi:shared,z"], "command": ["/bin/bash", "-c", "chown -R gnocchi:gnocchi /var/lib/gnocchi"]}}, "step_5": {"gnocchi_db_sync": {"start_order": 0, "image": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-api:17.1", "cap_add": ["AUDIT_WRITE"], "net": "host", "detach": false, "privileged": false, "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/gnocchi_db_sync.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/gnocchi:/var/lib/kolla/config_files/src:ro", "/var/lib/gnocchi:/var/lib/gnocchi:shared,z", "/var/log/containers/gnocchi:/var/log/gnocchi:z", "/var/log/containers/httpd/gnocchi-api:/var/log/httpd:z", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1781427082"}}, "gnocchi_api": {"image": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-api:17.1", "start_order": 1, "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/gnocchi:/var/lib/gnocchi:shared,z", "/var/lib/kolla/config_files/gnocchi_api.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/gnocchi:/var/lib/kolla/config_files/src:ro", "/var/log/containers/gnocchi:/var/log/gnocchi:z", "/var/log/containers/httpd/gnocchi-api:/var/log/httpd:z", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "host_prep_tasks": [{"name": "create logs directory", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/log/containers/gnocchi", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/gnocchi-api", "setype": "container_file_t", "mode": "0750"}]}, {"name": "Mount Gnocchi NFS on host", "vars": {"nfs_backend_enabled": false, "nfs_share": "", "nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0", "file_base_path": "/var/lib/gnocchi"}, "mount": {"name": "{{file_base_path}}", "state": "mounted", "src": "{{nfs_share}}", "fstype": "nfs", "opts": "{{nfs_options}}"}, "when": "nfs_backend_enabled"}, {"name": "ensure GnocchiFileBasePath exists", "file": {"path": "/var/lib/gnocchi", "state": "directory", "setype": "container_file_t"}}, {"name": "ensure ceph configurations exist", "file": {"path": "/var/lib/tripleo-config/ceph", "state": "directory"}}], "upgrade_tasks": [{"name": "gnocchi-api pre system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 3", "upgrade_leapp_enabled"], "block": [{"name": "Unmount Gnocchi NFS share", "vars": {"nfs_backend_enabled": false, "file_base_path": "/var/lib/gnocchi"}, "mount": {"name": "{{file_base_path}}", "state": "absent", "fstype": "nfs"}, "when": "nfs_backend_enabled"}]}, {"name": "gnocchi-api post system_upgrade tasks", "tags": ["never", "system_upgrade", "system_upgrade_run", "system_upgrade_nfsmounts"], "when": ["step|int == 5", "upgrade_leapp_enabled"], "block": [{"name": "Mount Gnocchi NFS on host", "vars": {"nfs_backend_enabled": false, "nfs_share": "", "nfs_options": "_netdev,bg,intr,context=system_u:object_r:container_file_t:s0", "file_base_path": "/var/lib/gnocchi"}, "mount": {"name": "{{file_base_path}}", "state": "mounted", "src": "{{nfs_share}}", "fstype": "nfs", "opts": "{{nfs_options}}"}, "when": "nfs_backend_enabled"}]}], "metadata_settings": null, "deploy_steps_tasks": [{"name": "Certificate generation", "when": ["step|int == 1", "enable_internal_tls"], "block": [{"name": "Create dirs for certificates and keys", "file": {"path": "{{ item }}", "state": "directory", "serole": "object_r", "setype": "cert_t", "seuser": "system_u"}, "with_items": ["/etc/pki/tls/certs/httpd", "/etc/pki/tls/private/httpd"]}, {"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "httpd-ctlplane", "dns": "{{ fqdn_ctlplane }}", "principal": "HTTP/{{ fqdn_ctlplane }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-ctlplane.crt /etc/pki/tls/certs/httpd/httpd-ctlplane.crt\ncp /etc/pki/tls/private/httpd-ctlplane.key /etc/pki/tls/private/httpd/httpd-ctlplane.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage", "dns": "{{ fqdn_storage }}", "principal": "HTTP/{{ fqdn_storage }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage.crt /etc/pki/tls/certs/httpd/httpd-storage.crt\ncp /etc/pki/tls/private/httpd-storage.key /etc/pki/tls/private/httpd/httpd-storage.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage_mgmt", "dns": "{{ fqdn_storage_mgmt }}", "principal": "HTTP/{{ fqdn_storage_mgmt }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage_mgmt.crt /etc/pki/tls/certs/httpd/httpd-storage_mgmt.crt\ncp /etc/pki/tls/private/httpd-storage_mgmt.key /etc/pki/tls/private/httpd/httpd-storage_mgmt.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-internal_api", "dns": "{{ fqdn_internal_api }}", "principal": "HTTP/{{ fqdn_internal_api }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-internal_api.crt /etc/pki/tls/certs/httpd/httpd-internal_api.crt\ncp /etc/pki/tls/private/httpd-internal_api.key /etc/pki/tls/private/httpd/httpd-internal_api.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-external", "dns": "{{ fqdn_external }}", "principal": "HTTP/{{ fqdn_external }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-external.crt /etc/pki/tls/certs/httpd/httpd-external.crt\ncp /etc/pki/tls/private/httpd-external.key /etc/pki/tls/private/httpd/httpd-external.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}]}}]}], "external_upgrade_tasks": [{"when": ["step|int == 1"], "tags": ["never", "system_upgrade_transfer_data", "system_upgrade_stop_services"], "block": [{"name": "Stop gnocchi container", "import_role": {"name": "tripleo_container_stop"}, "vars": {"tripleo_containers_to_stop": ["gnocchi_api"], "tripleo_delegate_to": "{{ groups['gnocchi_api'] | difference(groups['excluded_overcloud']) }}"}}]}]}, "tuple:('role_data', 'config_settings')": {"gnocchi_redis_password": "49auApjwL72waJnu1huMAuwhk", "gnocchi::logging::debug": true, "gnocchi::db::database_connection": "mysql+pymysql://gnocchi:PiTWImWk332iLP85nlpSQAzNz@172.17.0.2/gnocchi?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "gnocchi::db::sync::extra_opts": " --sacks-number 128", "gnocchi::storage::file::file_basepath": "/var/lib/gnocchi", "gnocchi::storage::swift::swift_user": "service:gnocchi", "gnocchi::storage::swift::swift_auth_version": 3, "gnocchi::storage::swift::swift_key": "PiTWImWk332iLP85nlpSQAzNz", "gnocchi::storage::swift::swift_authurl": "http://172.17.0.2:5000/v3", "gnocchi::storage::swift::swift_endpoint_type": "internalURL", "gnocchi::storage::ceph::ceph_pool": "metrics", "gnocchi::storage::ceph::ceph_username": "openstack", "gnocchi::storage::ceph::ceph_conffile": "/etc/ceph/ceph.conf", "gnocchi::storage::ceph::ceph_keyring": "/etc/ceph/ceph.client.openstack.keyring", "gnocchi::storage::s3::s3_endpoint_url": "", "gnocchi::storage::s3::s3_region_name": "", "gnocchi::storage::s3::s3_access_key_id": "", "gnocchi::storage::s3::s3_secret_access_key": "", "gnocchi::storage::s3::s3_bucket_prefix": "", "gnocchi::statsd::resource_id": "0a8b55df-f90f-491c-8cb9-7cdecec6fc26", "gnocchi::statsd::flush_delay": 10, "gnocchi::statsd::archive_policy_name": "low", "apache::ip": "%{hiera('internal_api')}", "apache::default_vhost": false, "apache::trace_enable": "Off", "apache::server_signature": "Off", "apache::server_tokens": "Prod", "apache::timeout": 90, "apache::default_mods": false, "apache::mod::prefork::maxrequestworkers": 100, "apache::mod::prefork::serverlimit": 100, "apache::mod::remoteip::proxy_ips": ["172.17.0.0/24"], "apache::mod::alias::icons_options": "None", "gnocchi::api::enabled": true, "gnocchi::api::enable_proxy_headers_parsing": true, "gnocchi::api::service_name": "httpd", "gnocchi::policy::policies": {}, "gnocchi::cors::max_age": 3600, "gnocchi::cors::allow_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma,X-Auth-Token", "gnocchi::cors::expose_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma", "gnocchi::cors::allow_methods": "GET,POST,PUT,DELETE,OPTIONS,PATCH", "gnocchi::keystone::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "gnocchi::keystone::authtoken::auth_url": "http://172.17.0.2:5000", "gnocchi::keystone::authtoken::password": "PiTWImWk332iLP85nlpSQAzNz", "gnocchi::keystone::authtoken::project_name": "service", "gnocchi::keystone::authtoken::user_domain_name": "Default", "gnocchi::keystone::authtoken::project_domain_name": "Default", "gnocchi::keystone::authtoken::region_name": "regionOne", "gnocchi::keystone::authtoken::interface": "internal", "gnocchi::keystone::authtoken::memcache_use_advanced_pool": true, "gnocchi::wsgi::apache::ssl": false, "gnocchi::wsgi::apache::servername": "%{hiera('fqdn_internal_api')}", "tripleo::profile::base::gnocchi::api::gnocchi_backend": "swift", "tripleo::profile::base::gnocchi::api::incoming_storage_driver": "redis", "tripleo::profile::base::gnocchi::api::gnocchi_rbd_ceph_conf_path": "/var/lib/tripleo-config/ceph", "gnocchi::wsgi::apache::bind_host": "%{hiera('internal_api')}", "gnocchi::wsgi::apache::wsgi_process_display_name": "gnocchi_wsgi"}, "tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'step_config')": null, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "gnocchi_api", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-26-v3qum5izerbp/f9475873-2528-4bc3-b136-ec3ac77713b1"}


created_at: 2026-06-14 08:53:58.734408
data:
  {"type": "json", "value": {"ContainerGnocchiMetricdImage": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-metricd:17.1", "ContainerGnocchiConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-api:17.1"}}


created_at: 2026-06-14 08:54:03.866885
data:
  {"tuple:('role_data', 'config_settings')": {"gnocchi_redis_password": "49auApjwL72waJnu1huMAuwhk", "gnocchi::logging::debug": true, "gnocchi::db::database_connection": "mysql+pymysql://gnocchi:PiTWImWk332iLP85nlpSQAzNz@172.17.0.2/gnocchi?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "gnocchi::db::sync::extra_opts": " --sacks-number 128", "gnocchi::storage::file::file_basepath": "/var/lib/gnocchi", "gnocchi::storage::swift::swift_user": "service:gnocchi", "gnocchi::storage::swift::swift_auth_version": 3, "gnocchi::storage::swift::swift_key": "PiTWImWk332iLP85nlpSQAzNz", "gnocchi::storage::swift::swift_authurl": "http://172.17.0.2:5000/v3", "gnocchi::storage::swift::swift_endpoint_type": "internalURL", "gnocchi::storage::ceph::ceph_pool": "metrics", "gnocchi::storage::ceph::ceph_username": "openstack", "gnocchi::storage::ceph::ceph_conffile": "/etc/ceph/ceph.conf", "gnocchi::storage::ceph::ceph_keyring": "/etc/ceph/ceph.client.openstack.keyring", "gnocchi::storage::s3::s3_endpoint_url": "", "gnocchi::storage::s3::s3_region_name": "", "gnocchi::storage::s3::s3_access_key_id": "", "gnocchi::storage::s3::s3_secret_access_key": "", "gnocchi::storage::s3::s3_bucket_prefix": "", "gnocchi::statsd::resource_id": "0a8b55df-f90f-491c-8cb9-7cdecec6fc26", "gnocchi::statsd::flush_delay": 10, "gnocchi::statsd::archive_policy_name": "low"}, "tuple:('role_data', 'service_config_settings')": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-27-toc6mteh2c3k-GnocchiServiceBase-zsckn4edaaqn/4b6a659a-72e8-491f-a632-1f1ef91868f0"}


created_at: 2026-06-14 08:54:03.870115
data:
  {"value": {"ContainerGnocchiMetricdImage": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-metricd:17.1", "ContainerGnocchiConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-api:17.1"}}


created_at: 2026-06-14 08:54:03.920383
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-27-toc6mteh2c3k-ContainersCommon-dqrk2keaq4ta/fefd75ee-191c-4961-acf2-7df58c89db14"}


created_at: 2026-06-14 08:54:03.975045
data:
  {"tuple:('role_data', 'step_config')": "include tripleo::profile::base::database::mysql::client", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-27-toc6mteh2c3k-MySQLClient-delgmlmnylhu/81136fc0-c7fa-4db3-b9a8-9c417d4ad326"}


created_at: 2026-06-14 08:54:03.988802
data:
  {"tuple:('role_data', 'docker_config')": {"step_5": {"gnocchi_metricd": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-metricd:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/gnocchi_metricd.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/gnocchi:/var/lib/kolla/config_files/src:ro", "/var/log/containers/gnocchi:/var/log/gnocchi:z", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/var/lib/gnocchi:/var/lib/gnocchi:shared,z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "role_data": {"service_name": "gnocchi_metricd", "config_settings": {"gnocchi_redis_password": "49auApjwL72waJnu1huMAuwhk", "gnocchi::logging::debug": true, "gnocchi::db::database_connection": "mysql+pymysql://gnocchi:PiTWImWk332iLP85nlpSQAzNz@172.17.0.2/gnocchi?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "gnocchi::db::sync::extra_opts": " --sacks-number 128", "gnocchi::storage::file::file_basepath": "/var/lib/gnocchi", "gnocchi::storage::swift::swift_user": "service:gnocchi", "gnocchi::storage::swift::swift_auth_version": 3, "gnocchi::storage::swift::swift_key": "PiTWImWk332iLP85nlpSQAzNz", "gnocchi::storage::swift::swift_authurl": "http://172.17.0.2:5000/v3", "gnocchi::storage::swift::swift_endpoint_type": "internalURL", "gnocchi::storage::ceph::ceph_pool": "metrics", "gnocchi::storage::ceph::ceph_username": "openstack", "gnocchi::storage::ceph::ceph_conffile": "/etc/ceph/ceph.conf", "gnocchi::storage::ceph::ceph_keyring": "/etc/ceph/ceph.client.openstack.keyring", "gnocchi::storage::s3::s3_endpoint_url": "", "gnocchi::storage::s3::s3_region_name": "", "gnocchi::storage::s3::s3_access_key_id": "", "gnocchi::storage::s3::s3_secret_access_key": "", "gnocchi::storage::s3::s3_bucket_prefix": "", "gnocchi::statsd::resource_id": "0a8b55df-f90f-491c-8cb9-7cdecec6fc26", "gnocchi::statsd::flush_delay": 10, "gnocchi::statsd::archive_policy_name": "low", "gnocchi::metricd::workers": "1", "gnocchi::metricd::metric_processing_delay": 30}, "monitoring_subscription": "overcloud-gnocchi-metricd", "service_config_settings": null, "puppet_config": {"config_volume": "gnocchi", "puppet_tags": "gnocchi_config", "step_config": "include tripleo::profile::base::gnocchi::metricd\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-api:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/gnocchi_metricd.json": {"command": "/usr/bin/gnocchi-metricd", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/gnocchi", "owner": "gnocchi:gnocchi", "recurse": true}, {"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "gnocchi:gnocchi", "perm": "0600"}]}}, "docker_config": {"step_5": {"gnocchi_metricd": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-metricd:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/gnocchi_metricd.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/gnocchi:/var/lib/kolla/config_files/src:ro", "/var/log/containers/gnocchi:/var/log/gnocchi:z", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/var/lib/gnocchi:/var/lib/gnocchi:shared,z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "host_prep_tasks": [{"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/gnocchi", "setype": "container_file_t", "mode": "0750"}]}, {"name": "create persistent data directory", "file": {"path": "/var/lib/gnocchi", "state": "directory", "setype": "container_file_t"}}, {"name": "ensure ceph configurations exist", "file": {"path": "/var/lib/tripleo-config/ceph", "state": "directory"}}], "upgrade_tasks": [], "external_upgrade_tasks": [{"when": ["step|int == 1"], "tags": ["never", "system_upgrade_transfer_data", "system_upgrade_stop_services"], "block": [{"name": "Stop gnocchi metricd container", "import_role": {"name": "tripleo_container_stop"}, "vars": {"tripleo_containers_to_stop": ["gnocchi_metricd"], "tripleo_delegate_to": "{{ groups['gnocchi_metricd'] | difference(groups['excluded_overcloud']) }}"}}]}]}, "tuple:('role_data', 'config_settings')": {"gnocchi_redis_password": "49auApjwL72waJnu1huMAuwhk", "gnocchi::logging::debug": true, "gnocchi::db::database_connection": "mysql+pymysql://gnocchi:PiTWImWk332iLP85nlpSQAzNz@172.17.0.2/gnocchi?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "gnocchi::db::sync::extra_opts": " --sacks-number 128", "gnocchi::storage::file::file_basepath": "/var/lib/gnocchi", "gnocchi::storage::swift::swift_user": "service:gnocchi", "gnocchi::storage::swift::swift_auth_version": 3, "gnocchi::storage::swift::swift_key": "PiTWImWk332iLP85nlpSQAzNz", "gnocchi::storage::swift::swift_authurl": "http://172.17.0.2:5000/v3", "gnocchi::storage::swift::swift_endpoint_type": "internalURL", "gnocchi::storage::ceph::ceph_pool": "metrics", "gnocchi::storage::ceph::ceph_username": "openstack", "gnocchi::storage::ceph::ceph_conffile": "/etc/ceph/ceph.conf", "gnocchi::storage::ceph::ceph_keyring": "/etc/ceph/ceph.client.openstack.keyring", "gnocchi::storage::s3::s3_endpoint_url": "", "gnocchi::storage::s3::s3_region_name": "", "gnocchi::storage::s3::s3_access_key_id": "", "gnocchi::storage::s3::s3_secret_access_key": "", "gnocchi::storage::s3::s3_bucket_prefix": "", "gnocchi::statsd::resource_id": "0a8b55df-f90f-491c-8cb9-7cdecec6fc26", "gnocchi::statsd::flush_delay": 10, "gnocchi::statsd::archive_policy_name": "low", "gnocchi::metricd::workers": "1", "gnocchi::metricd::metric_processing_delay": 30}, "tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'step_config')": null, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "gnocchi_metricd", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-27-toc6mteh2c3k/c48f8098-d21f-4467-9582-cd477e20db70"}


created_at: 2026-06-14 08:54:07.376289
data:
  {"type": "json", "value": {"ContainerGnocchiStatsdImage": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-statsd:17.1", "ContainerGnocchiConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-api:17.1"}}


created_at: 2026-06-14 08:54:08.479603
data:
  {"tuple:('role_data', 'config_settings')": {"gnocchi_redis_password": "49auApjwL72waJnu1huMAuwhk", "gnocchi::logging::debug": true, "gnocchi::db::database_connection": "mysql+pymysql://gnocchi:PiTWImWk332iLP85nlpSQAzNz@172.17.0.2/gnocchi?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "gnocchi::db::sync::extra_opts": " --sacks-number 128", "gnocchi::storage::file::file_basepath": "/var/lib/gnocchi", "gnocchi::storage::swift::swift_user": "service:gnocchi", "gnocchi::storage::swift::swift_auth_version": 3, "gnocchi::storage::swift::swift_key": "PiTWImWk332iLP85nlpSQAzNz", "gnocchi::storage::swift::swift_authurl": "http://172.17.0.2:5000/v3", "gnocchi::storage::swift::swift_endpoint_type": "internalURL", "gnocchi::storage::ceph::ceph_pool": "metrics", "gnocchi::storage::ceph::ceph_username": "openstack", "gnocchi::storage::ceph::ceph_conffile": "/etc/ceph/ceph.conf", "gnocchi::storage::ceph::ceph_keyring": "/etc/ceph/ceph.client.openstack.keyring", "gnocchi::storage::s3::s3_endpoint_url": "", "gnocchi::storage::s3::s3_region_name": "", "gnocchi::storage::s3::s3_access_key_id": "", "gnocchi::storage::s3::s3_secret_access_key": "", "gnocchi::storage::s3::s3_bucket_prefix": "", "gnocchi::statsd::resource_id": "0a8b55df-f90f-491c-8cb9-7cdecec6fc26", "gnocchi::statsd::flush_delay": 10, "gnocchi::statsd::archive_policy_name": "low"}, "tuple:('role_data', 'service_config_settings')": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-28-snogugokaozq-GnocchiServiceBase-4li4p565t5nf/d3347520-920f-47a9-b349-c246a9a96d47"}


created_at: 2026-06-14 08:54:08.483728
data:
  {"value": {"ContainerGnocchiStatsdImage": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-statsd:17.1", "ContainerGnocchiConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-api:17.1"}}


created_at: 2026-06-14 08:54:08.534749
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-28-snogugokaozq-ContainersCommon-rz777aywq5t7/27bafb89-1b6c-4b86-aa3a-2a5971aa7888"}


created_at: 2026-06-14 08:54:08.584261
data:
  {"tuple:('role_data', 'step_config')": "include tripleo::profile::base::database::mysql::client", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-28-snogugokaozq-MySQLClient-vgrrtqwuyyi6/e62f0afb-0e98-4b38-9e74-7bfd843d7d60"}


created_at: 2026-06-14 08:54:08.603114
data:
  {"tuple:('role_data', 'docker_config')": {"step_5": {"gnocchi_statsd": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-statsd:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/gnocchi_statsd.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/gnocchi:/var/lib/kolla/config_files/src:ro", "/var/log/containers/gnocchi:/var/log/gnocchi:z", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/var/lib/gnocchi:/var/lib/gnocchi:shared,z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "role_data": {"service_name": "gnocchi_statsd", "firewall_rules": {"140 gnocchi-statsd": {"dport": 8125, "proto": "udp"}}, "monitoring_subscription": "overcloud-gnocchi-statsd", "config_settings": {"gnocchi_redis_password": "49auApjwL72waJnu1huMAuwhk", "gnocchi::logging::debug": true, "gnocchi::db::database_connection": "mysql+pymysql://gnocchi:PiTWImWk332iLP85nlpSQAzNz@172.17.0.2/gnocchi?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "gnocchi::db::sync::extra_opts": " --sacks-number 128", "gnocchi::storage::file::file_basepath": "/var/lib/gnocchi", "gnocchi::storage::swift::swift_user": "service:gnocchi", "gnocchi::storage::swift::swift_auth_version": 3, "gnocchi::storage::swift::swift_key": "PiTWImWk332iLP85nlpSQAzNz", "gnocchi::storage::swift::swift_authurl": "http://172.17.0.2:5000/v3", "gnocchi::storage::swift::swift_endpoint_type": "internalURL", "gnocchi::storage::ceph::ceph_pool": "metrics", "gnocchi::storage::ceph::ceph_username": "openstack", "gnocchi::storage::ceph::ceph_conffile": "/etc/ceph/ceph.conf", "gnocchi::storage::ceph::ceph_keyring": "/etc/ceph/ceph.client.openstack.keyring", "gnocchi::storage::s3::s3_endpoint_url": "", "gnocchi::storage::s3::s3_region_name": "", "gnocchi::storage::s3::s3_access_key_id": "", "gnocchi::storage::s3::s3_secret_access_key": "", "gnocchi::storage::s3::s3_bucket_prefix": "", "gnocchi::statsd::resource_id": "0a8b55df-f90f-491c-8cb9-7cdecec6fc26", "gnocchi::statsd::flush_delay": 10, "gnocchi::statsd::archive_policy_name": "low"}, "service_config_settings": null, "puppet_config": {"config_volume": "gnocchi", "puppet_tags": "gnocchi_config", "step_config": "include tripleo::profile::base::gnocchi::statsd\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-api:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/gnocchi_statsd.json": {"command": "/usr/bin/gnocchi-statsd", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src-ceph/", "dest": "/etc/ceph/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/gnocchi", "owner": "gnocchi:gnocchi", "recurse": true}, {"path": "/etc/ceph/ceph.client.openstack.keyring", "owner": "gnocchi:gnocchi", "perm": "0600"}]}}, "docker_config": {"step_5": {"gnocchi_statsd": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-gnocchi-statsd:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/gnocchi_statsd.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/gnocchi:/var/lib/kolla/config_files/src:ro", "/var/log/containers/gnocchi:/var/log/gnocchi:z", "/var/lib/tripleo-config/ceph:/var/lib/kolla/config_files/src-ceph:z", "/var/lib/gnocchi:/var/lib/gnocchi:shared,z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "host_prep_tasks": [{"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/gnocchi", "setype": "container_file_t", "mode": "0750"}]}, {"name": "create persistent data directory", "file": {"path": "/var/lib/gnocchi", "state": "directory", "setype": "container_file_t"}}, {"name": "ensure ceph configurations exist", "file": {"path": "/var/lib/tripleo-config/ceph", "state": "directory"}}], "upgrade_tasks": [], "external_upgrade_tasks": [{"when": ["step|int == 1"], "tags": ["never", "system_upgrade_transfer_data", "system_upgrade_stop_services"], "block": [{"name": "Stop gnocchi statsd container", "import_role": {"name": "tripleo_container_stop"}, "vars": {"tripleo_containers_to_stop": ["gnocchi_statsd"], "tripleo_delegate_to": "{{ groups['gnocchi_statsd'] | difference(groups['excluded_overcloud']) }}"}}]}]}, "tuple:('role_data', 'config_settings')": {"gnocchi_redis_password": "49auApjwL72waJnu1huMAuwhk", "gnocchi::logging::debug": true, "gnocchi::db::database_connection": "mysql+pymysql://gnocchi:PiTWImWk332iLP85nlpSQAzNz@172.17.0.2/gnocchi?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "gnocchi::db::sync::extra_opts": " --sacks-number 128", "gnocchi::storage::file::file_basepath": "/var/lib/gnocchi", "gnocchi::storage::swift::swift_user": "service:gnocchi", "gnocchi::storage::swift::swift_auth_version": 3, "gnocchi::storage::swift::swift_key": "PiTWImWk332iLP85nlpSQAzNz", "gnocchi::storage::swift::swift_authurl": "http://172.17.0.2:5000/v3", "gnocchi::storage::swift::swift_endpoint_type": "internalURL", "gnocchi::storage::ceph::ceph_pool": "metrics", "gnocchi::storage::ceph::ceph_username": "openstack", "gnocchi::storage::ceph::ceph_conffile": "/etc/ceph/ceph.conf", "gnocchi::storage::ceph::ceph_keyring": "/etc/ceph/ceph.client.openstack.keyring", "gnocchi::storage::s3::s3_endpoint_url": "", "gnocchi::storage::s3::s3_region_name": "", "gnocchi::storage::s3::s3_access_key_id": "", "gnocchi::storage::s3::s3_secret_access_key": "", "gnocchi::storage::s3::s3_bucket_prefix": "", "gnocchi::statsd::resource_id": "0a8b55df-f90f-491c-8cb9-7cdecec6fc26", "gnocchi::statsd::flush_delay": 10, "gnocchi::statsd::archive_policy_name": "low"}, "tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'step_config')": null, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "gnocchi_statsd", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-28-snogugokaozq/f698db81-b5eb-4c67-aaba-e01409f6854f"}


created_at: 2026-06-14 08:54:08.973998
data:
  {"type": "json", "value": {"ContainerHAProxyImage": "registry.redhat.io/rhosp-rhel9/openstack-haproxy:17.1", "ContainerHAProxyConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-haproxy:17.1"}}


created_at: 2026-06-14 08:54:17.116219
data:
  {"container_config_scripts": {"container_puppet_apply.sh": {"mode": "0700", "content": "#!/bin/bash\nset -eux\nSTEP=$1\nTAGS=$2\nCONFIG=$3\nEXTRA_ARGS=${4:-''}\nif [ -d /tmp/puppet-etc ]; then\n  # ignore copy failures as these may be the same file depending on docker mounts\n  cp -a /tmp/puppet-etc/* /etc/puppet || true\nfi\necho \"{\\\"step\\\": ${STEP}}\" > /etc/puppet/hieradata/docker_puppet.json\n# $::deployment_type in puppet-tripleo\nexport FACTER_deployment_type=containers\nset +e\npuppet apply $EXTRA_ARGS \\\n    --verbose \\\n    --detailed-exitcodes \\\n    --summarize \\\n    --color=false \\\n    --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \\\n    --tags $TAGS \\\n    -e \"noop_resource('package'); ${CONFIG}\"\nrc=$?\nset -e\nset +ux\nif [ $rc -eq 2 -o $rc -eq 0 ]; then\n    exit 0\nfi\nexit $rc\n"}, "pyshim.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n#\n# Usage: pyshim.sh <script and/or arguments>\n#\n# Unfortunately THT doesn't know which version of python might be in a\n# container so we need this script to be able to try python3 or python2\n# depending on availability.  Since this is a temporary shim until we've\n# fully cut over to python3, we check for the existence of python3 first\n# before falling back to python2. This will help in the transition from\n# python2 based containers to python3.\n\nshow_usage() {\n    echo \"Usage: pyshim.sh <script and/or arguments>\"\n}\n\nif [ $# -lt 1 ]\nthen\n    show_usage\n    exit 1\nfi\n\nset -x\nif command -v python3 >/dev/null; then\n    python3 \"$@\"\nelif command -v python2 >/dev/null; then\n    python2 \"$@\"\nelif command -v python >/dev/null; then\n    python \"$@\"\nelse\n    echo \"ERROR: python is not available!\"\n    exit 1\nfi\n"}, "pacemaker_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nset -u\n\n# ./pacemaker_restart_bundle.sh mysql galera galera-bundle Master _\n# ./pacemaker_restart_bundle.sh redis redis redis-bundle Slave Master\n# ./pacemaker_restart_bundle.sh ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\nRESTART_SCRIPTS_DIR=$(dirname $0)\nTRIPLEO_SERVICE=$1\nRESOURCE_NAME=$2\nBUNDLE_NAME=$3\nWAIT_TARGET_LOCAL=$4\nWAIT_TARGET_ANYWHERE=${5:-_}\nTRIPLEO_MINOR_UPDATE=\"${TRIPLEO_MINOR_UPDATE:-false}\"\nTRIPLEO_HA_WRAPPER_RESOURCE_EXISTS=\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS:-false}\"\n\nbundle_can_be_restarted() {\n    local bundle=$1\n    # As long as the resource bundle is managed by pacemaker and is\n    # not meant to stay stopped, no matter the state of any inner\n    # pcmk_remote or ocf resource, we should restart it to give it a\n    # chance to read the new config.\n    [ \"$(crm_resource --meta -r $1 -g is-managed 2>/dev/null)\" != \"false\" ] && \\\n    [ \"$(crm_resource --meta -r $1 -g target-role 2>/dev/null)\" != \"Stopped\" ]\n}\n\nlog() {\n    local msg=$1\n    logger -t pcmkrestart \"$1\"\n}\n\nHOSTNAME=$(/bin/hostname -s)\nif [ x\"${TRIPLEO_MINOR_UPDATE,,}\" != x\"true\" ]; then\n    if [ x\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS,,}\" = x\"false\" ]; then\n        # Do not restart during initial deployment, as the resource\n        # has just been created.\n        SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n        if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n            log \"Initial deployment, skipping the restart of ${BUNDLE_NAME}\"\n\tfi\n        exit 0\n    else\n        # During a stack update, this script is called in parallel on\n        # every node the resource runs on, after the service's configs\n        # have been updated on all nodes. So we need to run pcs only\n        # once (e.g. on the service's boostrap node).\n        if bundle_can_be_restarted ${BUNDLE_NAME}; then\n            SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n            if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n                replicas_running=$(crm_resource -Q -r $BUNDLE_NAME --locate 2>&1 | wc -l)\n                if [ \"$replicas_running\" != \"0\" ]; then\n                    log \"Restarting ${BUNDLE_NAME} globally. Stopping:\"\n                    /sbin/pcs resource disable --wait=600 $BUNDLE_NAME\n                    log \"Restarting ${BUNDLE_NAME} globally. Starting:\"\n                    /sbin/pcs resource enable --wait=600 $BUNDLE_NAME\n                else\n                    log \"${BUNDLE_NAME} is not running anywhere,\" \\\n                         \"cleaning up to restart it globally if necessary\"\n                    /sbin/pcs resource cleanup $BUNDLE_NAME\n                fi\n            else\n                log \"Skipping global restart of ${BUNDLE_NAME} on ${HOSTNAME} it will be restarted by node ${SERVICE_NODEID}\"\n            fi\n\n        else\n            log \"No global restart needed for ${BUNDLE_NAME}.\"\n        fi\n    fi\nelse\n    # During a minor update workflow however, a host gets fully\n    # updated before updating the next one. So unlike stack\n    # update, at the time this script is called, the service's\n    # configs aren't updated on all nodes yet. So only restart the\n    # resource locally, where it's guaranteed that the config is\n    # up to date.\n    HOST=$(facter hostname)\n\n    if bundle_can_be_restarted ${BUNDLE_NAME}; then\n\t# if the resource is running locally, restart it\n\tif crm_resource -r $BUNDLE_NAME --locate 2>&1 | grep -w -q \"${HOST}\"; then\n            log \"Restarting ${BUNDLE_NAME} locally on '${HOST}'\"\n            /sbin/pcs resource restart $BUNDLE_NAME \"${HOST}\"\n\n\telse\n\t    # At this point, if no resource is running locally, it's\n\t    # either because a) it has failed previously, or b) because\n\t    # it's an A/P resource running elsewhere.\n\t    # By cleaning up resource, we ensure that a) it will try to\n\t    # restart, or b) it won't do anything if the resource is\n\t    # already running elsewhere.\n            log \"${BUNDLE_NAME} is currently not running on '${HOST}',\" \\\n                 \"cleaning up its state to restart it if necessary\"\n            /sbin/pcs resource cleanup $BUNDLE_NAME node=\"${HOST}\"\n\tfi\n\n\t# Wait until the resource is in the expected target state\n\t$RESTART_SCRIPTS_DIR/pacemaker_wait_bundle.sh \\\n            $RESOURCE_NAME $BUNDLE_NAME \\\n            \"$WAIT_TARGET_LOCAL\" \"$WAIT_TARGET_ANYWHERE\" \\\n\t    \"${HOST}\" 600\n    else\n        log \"No restart needed for ${BUNDLE_NAME}.\"\n    fi\nfi\n"}, "pacemaker_wait_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# ----\n# Wait for an OCF resource or a bundle to be restarted\n# ----\n# e.g.:\n# M/S OCF:      $0 galera galera-bundle Master\n# clone OCF:    $0 rabbitmq rabbitmq-bundle Started\n# A/P M/S OCF:  $0 redis redis-bundle Slave Master\n# A/P bundle:   $0 openstack-cinder-volume openstack-cinder-volume _ Started\n# clone bundle: $0 haproxy-bundle haproxy-bundle Started\n\n# design note 1:\n#  - this script is called during a minor update; it is called\n#    once per node that hosts a service replica.\n#  - the purpose of this script is to ensure that restarting the\n#    service replica locally won't disrupt the service availability\n#    for the end user. To reach that goal, the script waits until the\n#    service is restarted locally or globallu and reaches a given\n#    target state (i.e. Started, Slave or Master).\n# design note 2:\n#   - we don't want to track restart error: our only job is to ensure\n#     service restart synchronization, not service health.\n#   - In particular, we don't want to error out in case the resource\n#     cannot be restarted locally, because that would make the minor\n#     update fail, even if potentially other replicas still provide\n#     the service.\n# design note 3:\n#   - we can bail out early if we determine that the resource can't\n#     be restarted automatically by pacemaker (e.g. its \"blocked\",\n#     unmanaged or disabled).\n\nlog() {\n    local msg=$1\n    echo \"$(date -u): $1\"\n}\n\nusage() {\n    echo 2>&1 \"Usage: $0 NAME BUNDLE_NAME ROLE_LOCAL [ROLE_ANYWHERE] [HOST] [TIMEOUT]\"\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\n#\n# Utility functions to detect stuck resources\n#\n\nbundle_failures_locally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local replica_name\n    for i in $(seq 0 $last); do\n\treplica_name=${BUNDLE_NAME}-${engine}-${i}\n\tcrm_failcount -q -G -r $replica_name -N $HOST\n    done\n}\n\nbundle_failures_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    for i in $(seq 0 $last); do\n\tcrm_failcount -q -G -r ${BUNDLE_NAME}-${engine}-${i}\n    done\n}\n\nbundle_running_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    # return the number of running bundles replica, i.e. the number of\n    # docker/podman resource replicas currently running in the cluster\n    crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:heartbeat:${engine}']/node)\" -\n}\n\nocf_failures_globally() {\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local bundle_node\n    for i in $(seq 0 $last); do\n\tbundle_node=${BUNDLE_NAME}-${i}\n\tcrm_failcount -q -G -r $NAME -N $bundle_node\n    done\n}\n\ndid_resource_failed_locally() {\n    local failures\n    local running\n    local remotehost\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# if we're dealing with an ocf resource, it is running on a\n\t# pacemaker_remote rather that on the real host, and the\n\t# failcounts are thus associated to the pcmk remote. Replace\n\t# the host's name with the pcmk remote's name.\n        remotehost=$(crm_mon --as-xml | xmllint --xpath \"string(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource/node[@name='${HOST}']/../../resource[@resource_agent='${OCF}:pacemaker:remote']/@id)\" -)\n\tif [ -n \"${remotehost}\" ]; then\n\t    crm_failcount -q -G -r $NAME -N $remotehost | grep -q -w INFINITY\n\t    return $?\n\tfi\n\t# If no pcmk remote is currently running, the failcount from\n\t# the ocf resource is useless, compute the failcount from the\n\t# bundle case instead (computed below).\n    fi\n\n    # for bundles, pacemaker can run any bundle replica locally\n    # (e.g. galera-bundle-docker-{0,1,2}), and a failure happens when\n    # there are no more replica to try.\n    # That is, when _at least_ one replica failed locally, and all the\n    # others either failed or are currently running elsewhere.\n    failures=$(bundle_failures_locally $HOST | grep -c -w INFINITY)\n    running=$(bundle_running_globally)\n    test $failures -gt 0 && \\\n    test $(( $failures + $running )) -ge $BUNDLE_REPLICAS\n}\n\ndid_resource_failed_globally() {\n    local remotecount\n    local failures\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# we check the state of an ocf resource only if the\n\t# pcmkremotes are started\n        remotecount=$(crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node)\" -)\n\tif [ \"${remotecount}\" = \"0\" ]; then\n\t    # no pcmkremote is running, so check the bundle state\n\t    # instead of checking the ocf resource\n\t    # bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\t    failures=$(bundle_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\telse\n\t    # ocf resource failed if it failed to start on\n\t    # all $BUNDLE_REPLICAS bundle nodes\n\t    failures=$(ocf_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\tfi\n    else\n\t# bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\tfailures=$(bundle_failures_globally | grep -c -w INFINITY)\n\ttest $failures -eq $BUNDLE_REPLICAS\n    fi\n}\n\n\n# Input validation\n#\n\nNAME=$1\nif [ -z \"${NAME}\" ]; then\n    echo 2>&1 \"Error: argument NAME must not be empty\"\n    exit 1\nfi\n\nBUNDLE_NAME=$2\nif [ -z \"${BUNDLE_NAME}\" ]; then\n    echo 2>&1 \"Error: argument BUNDLE_NAME must not be empty\"\n    exit 1\nfi\n\nROLE_LOCAL=$3\nif [ \"${ROLE_LOCAL}\" = \"_\" ]; then\n    ROLE_LOCAL=\"\"\nfi\n\nROLE_ANYWHERE=$4\nif [ \"${ROLE_ANYWHERE}\" = \"_\" ]; then\n    ROLE_ANYWHERE=\"\"\nfi\n\nif [ -z \"${ROLE_LOCAL}\" ]; then\n    if [ -z \"${ROLE_ANYWHERE}\" ]; then\n        echo 2>&1 \"Error: either ROLE_LOCAL or ROLE_ANYWHERE must be non empty\"\n        exit 1\n    fi\nelse\n    if !(echo \"${ROLE_LOCAL}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n        echo 2>&1 \"Error: argument ROLE_LOCAL must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n        exit 1\n    fi\nfi\n\nif [ -n \"${ROLE_ANYWHERE}\" ] && !(echo \"${ROLE_ANYWHERE}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n    echo 2>&1 \"Error: argument ROLE_ANYWHERE must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n    exit 1\nfi\n\n# Ensure compatibility with pacemaker 2.1\nif pacemaker_supports_promoted; then\n    ROLE_LOCAL=$(echo \"$ROLE_LOCAL\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    ROLE_ANYWHERE=$(echo \"$ROLE_ANYWHERE\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    OCF=\"ocf\"\nelse\n    OCF=\"ocf:\"\nfi\n\nHOST=${5:-$(facter hostname)}\nTIMEOUT=${6:-600}\n\n\n# Configure the search\n# ----\n# Note: we can't use crm_resource in all searches because we can't\n# easily extract the host the OCF resources run on (crm_resource\n# returns the pcmk-remote nodes rather than the hosts)\n# So instead, we implement various searches with XPath directly.\n\nif [ \"${BUNDLE_NAME}\" != \"${NAME}\" ]; then\n# ocf resource\nlocal_resource_xpath=\"//bundle/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node[@name='${HOST}']/../../resource[@id='${NAME}']\"\nany_resource_xpath=\"//bundle//resource[@id='${NAME}']\"\nreplicas_xpath=\"//bundle/primitive[@id='${BUNDLE_NAME}']/../*[boolean(@image) and boolean(@replicas)]\"\nelse\n# bundle resource\nlocal_resource_xpath=\"//bundle[@id='${NAME}']/replica/resource/node[@name='${HOST}']/../../resource\"\nany_resource_xpath=\"//bundle[@id='${NAME}']//resource\"\nreplicas_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nfi\n\nbundle_def_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nBUNDLE_CONTAINER_ENGINE=$(cibadmin -Q | xmllint --xpath \"name(${bundle_def_xpath})\" -)\nBUNDLE_REPLICAS=$(cibadmin -Q | xmllint --xpath \"string(${bundle_def_xpath}/@replicas)\" -)\n\n\n# The wait algorithm follows a two-stage approach\n#  1. Depending on how the script is called, we first check whether\n#     the resource is restarted locally. An A/P resource may be\n#     restarted elsewhere in the cluster.\n#  2. If needed, check whether the A/P resource has restarted\n#     elsewhere. For A/P M/S resources, in case the resource is\n#     restarted as Slave locally, ensure a Master is available.\n\nsuccess=1\nbailout=1\ntimeout=$TIMEOUT\nrole=\"\"\n\n# Stage 1: local check\nif [ -n \"$ROLE_LOCAL\" ]; then\n    log \"Waiting until ${NAME} has restarted on ${HOST} and is in state ${ROLE_LOCAL}\"\n    log \"Will probe resource state with the following XPath pattern: ${local_resource_xpath}\"\n\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resource=$(crm_mon -r --as-xml | xmllint --xpath \"${local_resource_xpath}\" - 2>/dev/null)\n        role=$(echo \"${resource}\" | sed -ne 's/.*\\Wrole=\"\\([^\"]*\\)\".*/\\1/p')\n\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resource}\" | grep -q -w \"\\Wblocked=\\\"true\\\"\"; then\n            log \"${NAME} is blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_locally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif [ \"$role\" = \"$ROLE_LOCAL\" ]; then\n            success=0\n            continue\n        elif [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" = \"$ROLE_ANYWHERE\" ]; then\n            # A/P: we are restarted in the expected state\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_LOCAL} on ${HOST}\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\n# Stage 2: global check\nif [ $timeout -gt 0 ] && [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" != \"$ROLE_ANYWHERE\" ]; then\n    log \"Wait until ${NAME} is restarted anywhere in the cluster in state ${ROLE_ANYWHERE}\"\n    log \"Will probe resource state with the following XPath pattern: ${any_resource_xpath}\"\n\n    success=1\n    bailout=1\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resources=$(crm_mon -r --as-xml | xmllint --xpath \"${any_resource_xpath}\" - 2>/dev/null)\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif ! (echo \"${resources}\" | grep -q -w \"\\Wblocked=\\\"false\\\"\"); then\n            log \"${NAME} blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_globally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resources}\" | grep -q -w \"\\Wrole=\\\"${ROLE_ANYWHERE}\\\"\"; then\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_ANYWHERE} anywhere in the cluster\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\nif [ $timeout -le 0 ]; then\n    log \"Timeout reached after ${TIMEOUT}s while waiting for ${NAME} to be restarted\"\nelif [ $bailout -le 0 ]; then\n    log \"Restart monitoring for ${NAME} cancelled\"\nfi\n\nif [ $success -eq 0 ]; then\n    log \"${NAME} successfully restarted\"\nelse\n    log \"${NAME} was not restarted properly\"\nfi\n\n# Don't block minor update or stack update if the wait was unsuccessful\nexit 0\n"}, "wait-port-and-run.sh": {"mode": "0755", "content": "#!/usr/bin/bash\nset -eu\n\nHOST=$1\nPORT=$2\n\necho \"$(date -u): Checking whether we can bind to ${HOST}:${PORT}\"\nwhile (ss -Htnl src \"${HOST}\" \"sport = :${PORT}\" | grep -wq \"${PORT}\"); do\n    echo \"$(date -u): ${HOST}:${PORT} still in use, waiting...\";\n    sleep 10;\ndone\n\nshift 2\nCOMMAND=\"$*\"\nif [ -z \"${COMMAND}\" ]; then\n    COMMAND=\"true\"\nfi\nexec $COMMAND\n"}, "pacemaker_resource_lock.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nMAX_RETRIES=10\nCIB_ENOTFOUND=105\n\nusage() {\n   echo \"Set a global property in the cluster with a validity timestamp.\"\n   echo \"Usage:\"\n   echo \"   $0 --acquire <lock_name> <lock_owner> <lock_ttl_in_seconds>\"\n   echo \"   $0 --release <lock_name> <lock_owner>\"\n   echo\n}\n\nlog() {\n    echo \"$(date -u): $1\" 1>&2\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\nlock_create() {\n    local name=$1\n    local data=$2\n    # cibadmin won't overwrite a key if someone else succeeded to create it concurrently\n    cibadmin --sync-call --scope crm_config --create --xml-text \"<cluster_property_set id='${name}'><nvpair id='${name}-pair' name='${name}' value='${data}'/></cluster_property_set>\" &>/dev/null\n    return $?\n}\n\nlock_update() {\n    local name=$1\n    local expected_data=$2\n    local new_data=$3\n    # we only update the lock we expect to see, so we can't update someone else's lock\n    cibadmin --sync-call --scope crm_config --modify --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" --xml-text \"<nvpair id='${name}-pair' name='${name}' value='${new_data}'/>\" &>/dev/null\n    return $?\n}\n\nlock_delete() {\n    local name=$1\n    local expected_data=$2\n    # we only delete the lock we expect to see, so we can't delete someone else's lock\n    cibadmin --sync-call --scope crm_config --delete --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" &>/dev/null\n    return $?\n}\n\nlock_get() {\n    local lockname=$1\n    local res\n    local rc\n    res=$(cibadmin --query --scope crm_config --xpath \"//cluster_property_set/nvpair[@name='$lockname']\" 2>/dev/null)\n    rc=$?\n    if [ $rc -eq 0 ]; then\n        echo \"$res\" | sed -n 's/.*value=\"\\([^\"]*\\)\".*/\\1/p'\n    fi\n    return $rc\n}\n\nlock_owner() {\n    local lock=$1\n    echo \"$lock\" | cut -d':' -f1\n}\n\nlock_has_expired() {\n    local lock=$1\n    local expiry=$(echo \"$lock\" | cut -d':' -f2)\n    local now=$(date +%s)\n    test $now -ge $expiry\n}\n\n\n# Perform a lock action and restart if the CIB has been modified before\n# committing the lock action\ntry_action() {\n    local fun=$1\n    local lock=$2\n    local requester=$3\n    local args=${4:-}\n    local tries=$MAX_RETRIES\n    local rc=1\n    if [ \"$fun\" = \"lock_acquire\" ] || [ \"$fun\" = \"lock_release\" ]; then\n        log \"Try running $fun\"\n    else\n        return 2\n    fi\n    while [ $rc -ne 0 ]; do\n        $fun $lock $requester $args\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Operation $1 succeeded\"\n            return 0\n        elif [ $rc -eq 3 ]; then\n            # rc == 3 -> CIB changed before push\n            if [ $tries -eq 0 ]; then\n                log \"Failed to commit after $MAX_RETRIES retries. Bailing out.\"\n                return 2\n            else\n                log \"Failed to commit. Retrying operation.\"\n                tries=$(($tries - 1))\n            fi\n        elif [ $rc -eq 2 ]; then\n            # rc == 2 -> unrecoverable cib error (e.g. pacemaker down)\n            log \"Unexpected failure. Bailing out\"\n            return $rc\n        else\n            # rc == 1 -> lock error (not owner, lock doesn't exists)\n            return $rc\n        fi\n    done\n}\n\n# The lock mechanism uses cibadmin's atomic creation so cluster-wide\n# state coherency is guaranteed by pacemaker\nlock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc\n    local lock\n    local expiry\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -n \"$lock\" ]; then\n        lock_has_expired $lock\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Lock has expired, now available for being held\"\n        else\n            # lock is still held. check whether we're the owner\n            owner=$(lock_owner $lock)\n            if [ \"$owner\" = \"$requester\" ];then\n                log \"Requester already owns the lock, acquiring attempt will just reconfigure the TTL\"\n            else\n                log \"Lock is held by someone else ($owner)\"\n                return 1\n            fi\n        fi\n    else\n        log \"Lock is not held yet\"\n    fi\n\n    # prepare the lock info\n    expiry=$(($(date +%s) + $ttl))\n\n    if [ -n \"$lock\" ]; then\n        log \"Attempting to update the lock\"\n        lock_update $lockname \"$lock\" \"$requester:$expiry\"\n        rc=$?\n    else\n        log \"Attempting to acquire the lock\"\n        lock_create $lockname \"$requester:$expiry\"\n        rc=$?\n    fi\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' acquired by '$requester', valid until $(date -d @$expiry)\"\n        return 0\n    else\n        log \"CIB changed, lock cannot be acquired\"\n        return 3\n    fi\n}\n\n\n# The lock mechanism uses the CIB's num_updates tag to implement\n# a conditional store. Cluster-wide locking is guaranteed by pacemaker\nlock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n    local lock\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        log \"Lock doesn't exist. Nothing to release\"\n        return 0\n    else\n        log \"Lock exists, check whether we're the owner\"\n        owner=$(lock_owner $lock)\n        if [ \"$owner\" != \"$requester\" ];then\n            log \"Lock is held by someone else ($owner), will not unlock\"\n            return 1\n        fi\n    fi\n\n    lock_delete $lockname \"$lock\"\n    rc=$?\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' released by '$requester'\"\n        return 0\n    else\n        log \"CIB deletion error, lock cannot be released\"\n        return 3\n    fi\n}\n\n\n# Retrieve the owner of a lock from the CIB\n# this is a read-only operation, so no need to log debug info\nlock_get_owner() {\n    local lockname=$1\n    local rc\n    local lock\n    local owner\n\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        return 1\n    else\n        lock_owner $lock\n        return 0\n    fi\n}\n\n\nACTION=$1\nLOCKNAME=$2\nREQUESTER=$3\nTTL=${4:-60}\n\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nif [ $ACTION != \"--help\" ]; then\n    if [ -z \"$LOCKNAME\" ]; then\n        error \"You must specific a lock name\"\n    fi\n    if [ $ACTION != \"--owner\" ] && [ $ACTION != \"-o\" ]; then\n        if [ -z \"$REQUESTER\" ]; then\n            error \"You must specific a lock requester\"\n        fi\n    fi\nfi\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) try_action lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --release|-r) try_action lock_release $LOCKNAME $REQUESTER;;\n    --acquire-once|-A) lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --owner|-o) lock_get_owner $LOCKNAME;;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}, "pacemaker_mutex_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_restart_bundle.sh --lock mysql galera galera-bundle Master _\n# pacemaker_mutex_restart_bundle.sh --lock ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\n\nset -u\n\nusage() {\n    echo \"Restart a clustered resource in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --lock <tripleo-service> <pcmk-resource> <pcmk-bundle> <target-state-local> <target-state-cluster>\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\nACTION=$1\ncase $ACTION in\n    --help) usage; exit 0;;\n    --lock) ;;\n    *) error \"Unknown action '$ACTION'\";;\nesac\n\nTRIPLEO_SERVICE=$2\nLOCK_NAME=${TRIPLEO_SERVICE}-restart-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to restart resource $TRIPLEO_SERVICE\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\nRESOURCE_NAME=$3\nBUNDLE_NAME=$4\nWAIT_TARGET_LOCAL=$5\nWAIT_TARGET_ANYWHERE=${6:-_}\n\nif pacemaker_supports_promoted; then\n    WAIT_TARGET_LOCAL=$(echo \"$5\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    WAIT_TARGET_ANYWHERE=$(echo \"${6:-_}\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    promoted_role=\"Promoted\"\nelse\n    promoted_role=\"Master\"\nfi\n\n# The lock TTL should accomodate for the resource start/promote timeout\nif [ \"$RESOURCE_NAME\" != \"$BUNDLE_NAME\" ]; then\n    if [ \"$WAIT_TARGET_LOCAL\" = \"$promoted_role\" ] || [ \"$WAIT_TARGET_ANYWHERE\" = \"$promoted_role\" ]; then\n        rsc_op=\"promote\"\n    else\n        rsc_op=\"start\"\n    fi\n    # <op id=\"galera-promote-interval-0s\" interval=\"0s\" name=\"promote\" on-fail=\"block\" timeout=\"300s\"/>\n    PCMK_TTL=$(cibadmin -Q | xmllint -xpath \"string(//primitive[@id='${RESOURCE_NAME}']/operations/op[@name='${rsc_op}']/@timeout)\" - | sed 's/s$//')\n    LOCK_TTL=$((PCMK_TTL + 30))\nelse\n    # The podman RA's default start timeout\n    LOCK_TTL=90\nfi\n\nlog \"Acquire a ${LOCK_TTL}s restart lock for service $TRIPLEO_SERVICE before restarting it\"\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nrc=1\nwhile [ $rc -ne 0 ]; do\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire $LOCK_NAME $LOCK_OWNER $LOCK_TTL\n    rc=$?\n    if [ $rc != 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not acquire lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Could not acquire lock, retrying\"\n            sleep 10\n        fi\n    fi\ndone\n\nlog \"Restart the service $TRIPLEO_SERVICE locally\"\n# Reuse the local restart script in t-h-t (driven by env var TRIPLEO_MINOR_UPDATE)\nTRIPLEO_MINOR_UPDATE=true /var/lib/container-config-scripts/pacemaker_restart_bundle.sh $TRIPLEO_SERVICE $RESOURCE_NAME $BUNDLE_NAME $WAIT_TARGET_LOCAL $WAIT_TARGET_ANYWHERE\n\n# If we reached this point, always try to release the lock\nlog \"Release the restart lock for service $TRIPLEO_SERVICE\"\n/var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $LOCK_NAME $LOCK_OWNER\nrc=$?\nif [ $rc -ne 0 ] && [ $rc -ne 1 ]; then\n    error \"Could not release held lock (rc: $rc)\"\nfi\n"}, "pacemaker_mutex_shutdown.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_shutdown.sh --acquire\n# pacemaker_mutex_shutdown.sh --release\n\nset -u\n\nusage() {\n    echo \"Shutdown a cluster node in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --acquire # prevent other node from shutting down until we hold the lock\"\n    echo \"   $0 --release # release the lock, other node can compete for the shutdown lock\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nshutdown_lock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc=1\n    local current_owner\n    local owner_stopped\n    local owner_rc\n\n    log \"Acquiring the shutdown lock\"\n    while [ $rc -ne 0 ]; do\n        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire-once $lockname $requester $ttl\n        rc=$?\n        if [ $rc -ne 0 ]; then\n            if [ $rc -eq 2 ]; then\n                error \"Could not acquire the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n            else\n                # The lock is held by another node.\n                current_owner=$(/var/lib/container-config-scripts/pacemaker_resource_lock.sh --owner $lockname)\n                owner_rc=$?\n                if [ $owner_rc -eq 2 ]; then\n                    error \"Could not get the shutdown lock owner due to unrecoverable error (rc: $owner_rc), bailing out\"\n                fi\n                if [ $owner_rc -eq 0 ]; then\n                    # If the owner is marked as offline, that means it has shutdown and\n                    # we can clean the lock preemptively and try to acquire it.\n                    owner_stopped=$(crm_mon -1X | xmllint --xpath 'count(//nodes/node[@name=\"'${current_owner}'\" and @online=\"false\" and @unclean=\"false\"])' -)\n                    if [ \"${owner_stopped}\" = \"1\" ]; then\n                        log \"Shutdown lock held by stopped node '${current_owner}', lock can be released\"\n                        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $current_owner\n                        continue\n                    fi\n                fi\n                log \"Shutdown lock held by another node (rc: $rc), retrying\"\n                sleep 10\n            fi\n        fi\n    done\n    log \"Shutdown lock acquired\"\n    return 0\n}\n\n\n# Release the lock if we still own it. Not owning it anymore is not fatal\nshutdown_lock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n\n    log \"Releasing the shutdown lock\"\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $requester\n    rc=$?\n    if [ $rc -ne 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not release the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Shutdown lock no longer held, nothing to do\"\n        fi\n    else\n        log \"Shutdown lock released\"\n    fi\n    return 0\n}\n\n\nACTION=$1\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nLOCK_NAME=tripleo-shutdown-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to aquire the shutdown lock\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\n# We start with a very high TTL, that long enough to accomodate a cluster stop.\n# As soon as the node will get offline, the other competing node will be entitled\n# to steal the lock, so they should never wait that long in practice.\nLOCK_TTL=600\n\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) shutdown_lock_acquire ${LOCK_NAME} ${LOCK_OWNER} ${LOCK_TTL};;\n    --release|-r) shutdown_lock_release ${LOCK_NAME} ${LOCK_OWNER};;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-29-uuqpaohwnjnc-ContainersCommon-bc4ifnzkxmfq/25444c42-7a53-466d-b81b-2795608efbbc"}


created_at: 2026-06-14 08:54:17.322411
data:
  {"tuple:('docker_config', 'step_1')": {}, "config_settings": null, "volumes": null, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-29-uuqpaohwnjnc-HAProxyBase-toyo4cxpgoqe-HAProxyLogging-idn4ifl354mn/ff0a3908-8a9e-4a22-b788-734b6a9542d9"}


created_at: 2026-06-14 08:54:17.369046
data:
  {"container_config_scripts": {"container_puppet_apply.sh": {"mode": "0700", "content": "#!/bin/bash\nset -eux\nSTEP=$1\nTAGS=$2\nCONFIG=$3\nEXTRA_ARGS=${4:-''}\nif [ -d /tmp/puppet-etc ]; then\n  # ignore copy failures as these may be the same file depending on docker mounts\n  cp -a /tmp/puppet-etc/* /etc/puppet || true\nfi\necho \"{\\\"step\\\": ${STEP}}\" > /etc/puppet/hieradata/docker_puppet.json\n# $::deployment_type in puppet-tripleo\nexport FACTER_deployment_type=containers\nset +e\npuppet apply $EXTRA_ARGS \\\n    --verbose \\\n    --detailed-exitcodes \\\n    --summarize \\\n    --color=false \\\n    --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \\\n    --tags $TAGS \\\n    -e \"noop_resource('package'); ${CONFIG}\"\nrc=$?\nset -e\nset +ux\nif [ $rc -eq 2 -o $rc -eq 0 ]; then\n    exit 0\nfi\nexit $rc\n"}, "pyshim.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n#\n# Usage: pyshim.sh <script and/or arguments>\n#\n# Unfortunately THT doesn't know which version of python might be in a\n# container so we need this script to be able to try python3 or python2\n# depending on availability.  Since this is a temporary shim until we've\n# fully cut over to python3, we check for the existence of python3 first\n# before falling back to python2. This will help in the transition from\n# python2 based containers to python3.\n\nshow_usage() {\n    echo \"Usage: pyshim.sh <script and/or arguments>\"\n}\n\nif [ $# -lt 1 ]\nthen\n    show_usage\n    exit 1\nfi\n\nset -x\nif command -v python3 >/dev/null; then\n    python3 \"$@\"\nelif command -v python2 >/dev/null; then\n    python2 \"$@\"\nelif command -v python >/dev/null; then\n    python \"$@\"\nelse\n    echo \"ERROR: python is not available!\"\n    exit 1\nfi\n"}, "pacemaker_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nset -u\n\n# ./pacemaker_restart_bundle.sh mysql galera galera-bundle Master _\n# ./pacemaker_restart_bundle.sh redis redis redis-bundle Slave Master\n# ./pacemaker_restart_bundle.sh ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\nRESTART_SCRIPTS_DIR=$(dirname $0)\nTRIPLEO_SERVICE=$1\nRESOURCE_NAME=$2\nBUNDLE_NAME=$3\nWAIT_TARGET_LOCAL=$4\nWAIT_TARGET_ANYWHERE=${5:-_}\nTRIPLEO_MINOR_UPDATE=\"${TRIPLEO_MINOR_UPDATE:-false}\"\nTRIPLEO_HA_WRAPPER_RESOURCE_EXISTS=\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS:-false}\"\n\nbundle_can_be_restarted() {\n    local bundle=$1\n    # As long as the resource bundle is managed by pacemaker and is\n    # not meant to stay stopped, no matter the state of any inner\n    # pcmk_remote or ocf resource, we should restart it to give it a\n    # chance to read the new config.\n    [ \"$(crm_resource --meta -r $1 -g is-managed 2>/dev/null)\" != \"false\" ] && \\\n    [ \"$(crm_resource --meta -r $1 -g target-role 2>/dev/null)\" != \"Stopped\" ]\n}\n\nlog() {\n    local msg=$1\n    logger -t pcmkrestart \"$1\"\n}\n\nHOSTNAME=$(/bin/hostname -s)\nif [ x\"${TRIPLEO_MINOR_UPDATE,,}\" != x\"true\" ]; then\n    if [ x\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS,,}\" = x\"false\" ]; then\n        # Do not restart during initial deployment, as the resource\n        # has just been created.\n        SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n        if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n            log \"Initial deployment, skipping the restart of ${BUNDLE_NAME}\"\n\tfi\n        exit 0\n    else\n        # During a stack update, this script is called in parallel on\n        # every node the resource runs on, after the service's configs\n        # have been updated on all nodes. So we need to run pcs only\n        # once (e.g. on the service's boostrap node).\n        if bundle_can_be_restarted ${BUNDLE_NAME}; then\n            SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n            if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n                replicas_running=$(crm_resource -Q -r $BUNDLE_NAME --locate 2>&1 | wc -l)\n                if [ \"$replicas_running\" != \"0\" ]; then\n                    log \"Restarting ${BUNDLE_NAME} globally. Stopping:\"\n                    /sbin/pcs resource disable --wait=600 $BUNDLE_NAME\n                    log \"Restarting ${BUNDLE_NAME} globally. Starting:\"\n                    /sbin/pcs resource enable --wait=600 $BUNDLE_NAME\n                else\n                    log \"${BUNDLE_NAME} is not running anywhere,\" \\\n                         \"cleaning up to restart it globally if necessary\"\n                    /sbin/pcs resource cleanup $BUNDLE_NAME\n                fi\n            else\n                log \"Skipping global restart of ${BUNDLE_NAME} on ${HOSTNAME} it will be restarted by node ${SERVICE_NODEID}\"\n            fi\n\n        else\n            log \"No global restart needed for ${BUNDLE_NAME}.\"\n        fi\n    fi\nelse\n    # During a minor update workflow however, a host gets fully\n    # updated before updating the next one. So unlike stack\n    # update, at the time this script is called, the service's\n    # configs aren't updated on all nodes yet. So only restart the\n    # resource locally, where it's guaranteed that the config is\n    # up to date.\n    HOST=$(facter hostname)\n\n    if bundle_can_be_restarted ${BUNDLE_NAME}; then\n\t# if the resource is running locally, restart it\n\tif crm_resource -r $BUNDLE_NAME --locate 2>&1 | grep -w -q \"${HOST}\"; then\n            log \"Restarting ${BUNDLE_NAME} locally on '${HOST}'\"\n            /sbin/pcs resource restart $BUNDLE_NAME \"${HOST}\"\n\n\telse\n\t    # At this point, if no resource is running locally, it's\n\t    # either because a) it has failed previously, or b) because\n\t    # it's an A/P resource running elsewhere.\n\t    # By cleaning up resource, we ensure that a) it will try to\n\t    # restart, or b) it won't do anything if the resource is\n\t    # already running elsewhere.\n            log \"${BUNDLE_NAME} is currently not running on '${HOST}',\" \\\n                 \"cleaning up its state to restart it if necessary\"\n            /sbin/pcs resource cleanup $BUNDLE_NAME node=\"${HOST}\"\n\tfi\n\n\t# Wait until the resource is in the expected target state\n\t$RESTART_SCRIPTS_DIR/pacemaker_wait_bundle.sh \\\n            $RESOURCE_NAME $BUNDLE_NAME \\\n            \"$WAIT_TARGET_LOCAL\" \"$WAIT_TARGET_ANYWHERE\" \\\n\t    \"${HOST}\" 600\n    else\n        log \"No restart needed for ${BUNDLE_NAME}.\"\n    fi\nfi\n"}, "pacemaker_wait_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# ----\n# Wait for an OCF resource or a bundle to be restarted\n# ----\n# e.g.:\n# M/S OCF:      $0 galera galera-bundle Master\n# clone OCF:    $0 rabbitmq rabbitmq-bundle Started\n# A/P M/S OCF:  $0 redis redis-bundle Slave Master\n# A/P bundle:   $0 openstack-cinder-volume openstack-cinder-volume _ Started\n# clone bundle: $0 haproxy-bundle haproxy-bundle Started\n\n# design note 1:\n#  - this script is called during a minor update; it is called\n#    once per node that hosts a service replica.\n#  - the purpose of this script is to ensure that restarting the\n#    service replica locally won't disrupt the service availability\n#    for the end user. To reach that goal, the script waits until the\n#    service is restarted locally or globallu and reaches a given\n#    target state (i.e. Started, Slave or Master).\n# design note 2:\n#   - we don't want to track restart error: our only job is to ensure\n#     service restart synchronization, not service health.\n#   - In particular, we don't want to error out in case the resource\n#     cannot be restarted locally, because that would make the minor\n#     update fail, even if potentially other replicas still provide\n#     the service.\n# design note 3:\n#   - we can bail out early if we determine that the resource can't\n#     be restarted automatically by pacemaker (e.g. its \"blocked\",\n#     unmanaged or disabled).\n\nlog() {\n    local msg=$1\n    echo \"$(date -u): $1\"\n}\n\nusage() {\n    echo 2>&1 \"Usage: $0 NAME BUNDLE_NAME ROLE_LOCAL [ROLE_ANYWHERE] [HOST] [TIMEOUT]\"\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\n#\n# Utility functions to detect stuck resources\n#\n\nbundle_failures_locally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local replica_name\n    for i in $(seq 0 $last); do\n\treplica_name=${BUNDLE_NAME}-${engine}-${i}\n\tcrm_failcount -q -G -r $replica_name -N $HOST\n    done\n}\n\nbundle_failures_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    for i in $(seq 0 $last); do\n\tcrm_failcount -q -G -r ${BUNDLE_NAME}-${engine}-${i}\n    done\n}\n\nbundle_running_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    # return the number of running bundles replica, i.e. the number of\n    # docker/podman resource replicas currently running in the cluster\n    crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:heartbeat:${engine}']/node)\" -\n}\n\nocf_failures_globally() {\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local bundle_node\n    for i in $(seq 0 $last); do\n\tbundle_node=${BUNDLE_NAME}-${i}\n\tcrm_failcount -q -G -r $NAME -N $bundle_node\n    done\n}\n\ndid_resource_failed_locally() {\n    local failures\n    local running\n    local remotehost\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# if we're dealing with an ocf resource, it is running on a\n\t# pacemaker_remote rather that on the real host, and the\n\t# failcounts are thus associated to the pcmk remote. Replace\n\t# the host's name with the pcmk remote's name.\n        remotehost=$(crm_mon --as-xml | xmllint --xpath \"string(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource/node[@name='${HOST}']/../../resource[@resource_agent='${OCF}:pacemaker:remote']/@id)\" -)\n\tif [ -n \"${remotehost}\" ]; then\n\t    crm_failcount -q -G -r $NAME -N $remotehost | grep -q -w INFINITY\n\t    return $?\n\tfi\n\t# If no pcmk remote is currently running, the failcount from\n\t# the ocf resource is useless, compute the failcount from the\n\t# bundle case instead (computed below).\n    fi\n\n    # for bundles, pacemaker can run any bundle replica locally\n    # (e.g. galera-bundle-docker-{0,1,2}), and a failure happens when\n    # there are no more replica to try.\n    # That is, when _at least_ one replica failed locally, and all the\n    # others either failed or are currently running elsewhere.\n    failures=$(bundle_failures_locally $HOST | grep -c -w INFINITY)\n    running=$(bundle_running_globally)\n    test $failures -gt 0 && \\\n    test $(( $failures + $running )) -ge $BUNDLE_REPLICAS\n}\n\ndid_resource_failed_globally() {\n    local remotecount\n    local failures\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# we check the state of an ocf resource only if the\n\t# pcmkremotes are started\n        remotecount=$(crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node)\" -)\n\tif [ \"${remotecount}\" = \"0\" ]; then\n\t    # no pcmkremote is running, so check the bundle state\n\t    # instead of checking the ocf resource\n\t    # bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\t    failures=$(bundle_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\telse\n\t    # ocf resource failed if it failed to start on\n\t    # all $BUNDLE_REPLICAS bundle nodes\n\t    failures=$(ocf_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\tfi\n    else\n\t# bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\tfailures=$(bundle_failures_globally | grep -c -w INFINITY)\n\ttest $failures -eq $BUNDLE_REPLICAS\n    fi\n}\n\n\n# Input validation\n#\n\nNAME=$1\nif [ -z \"${NAME}\" ]; then\n    echo 2>&1 \"Error: argument NAME must not be empty\"\n    exit 1\nfi\n\nBUNDLE_NAME=$2\nif [ -z \"${BUNDLE_NAME}\" ]; then\n    echo 2>&1 \"Error: argument BUNDLE_NAME must not be empty\"\n    exit 1\nfi\n\nROLE_LOCAL=$3\nif [ \"${ROLE_LOCAL}\" = \"_\" ]; then\n    ROLE_LOCAL=\"\"\nfi\n\nROLE_ANYWHERE=$4\nif [ \"${ROLE_ANYWHERE}\" = \"_\" ]; then\n    ROLE_ANYWHERE=\"\"\nfi\n\nif [ -z \"${ROLE_LOCAL}\" ]; then\n    if [ -z \"${ROLE_ANYWHERE}\" ]; then\n        echo 2>&1 \"Error: either ROLE_LOCAL or ROLE_ANYWHERE must be non empty\"\n        exit 1\n    fi\nelse\n    if !(echo \"${ROLE_LOCAL}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n        echo 2>&1 \"Error: argument ROLE_LOCAL must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n        exit 1\n    fi\nfi\n\nif [ -n \"${ROLE_ANYWHERE}\" ] && !(echo \"${ROLE_ANYWHERE}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n    echo 2>&1 \"Error: argument ROLE_ANYWHERE must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n    exit 1\nfi\n\n# Ensure compatibility with pacemaker 2.1\nif pacemaker_supports_promoted; then\n    ROLE_LOCAL=$(echo \"$ROLE_LOCAL\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    ROLE_ANYWHERE=$(echo \"$ROLE_ANYWHERE\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    OCF=\"ocf\"\nelse\n    OCF=\"ocf:\"\nfi\n\nHOST=${5:-$(facter hostname)}\nTIMEOUT=${6:-600}\n\n\n# Configure the search\n# ----\n# Note: we can't use crm_resource in all searches because we can't\n# easily extract the host the OCF resources run on (crm_resource\n# returns the pcmk-remote nodes rather than the hosts)\n# So instead, we implement various searches with XPath directly.\n\nif [ \"${BUNDLE_NAME}\" != \"${NAME}\" ]; then\n# ocf resource\nlocal_resource_xpath=\"//bundle/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node[@name='${HOST}']/../../resource[@id='${NAME}']\"\nany_resource_xpath=\"//bundle//resource[@id='${NAME}']\"\nreplicas_xpath=\"//bundle/primitive[@id='${BUNDLE_NAME}']/../*[boolean(@image) and boolean(@replicas)]\"\nelse\n# bundle resource\nlocal_resource_xpath=\"//bundle[@id='${NAME}']/replica/resource/node[@name='${HOST}']/../../resource\"\nany_resource_xpath=\"//bundle[@id='${NAME}']//resource\"\nreplicas_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nfi\n\nbundle_def_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nBUNDLE_CONTAINER_ENGINE=$(cibadmin -Q | xmllint --xpath \"name(${bundle_def_xpath})\" -)\nBUNDLE_REPLICAS=$(cibadmin -Q | xmllint --xpath \"string(${bundle_def_xpath}/@replicas)\" -)\n\n\n# The wait algorithm follows a two-stage approach\n#  1. Depending on how the script is called, we first check whether\n#     the resource is restarted locally. An A/P resource may be\n#     restarted elsewhere in the cluster.\n#  2. If needed, check whether the A/P resource has restarted\n#     elsewhere. For A/P M/S resources, in case the resource is\n#     restarted as Slave locally, ensure a Master is available.\n\nsuccess=1\nbailout=1\ntimeout=$TIMEOUT\nrole=\"\"\n\n# Stage 1: local check\nif [ -n \"$ROLE_LOCAL\" ]; then\n    log \"Waiting until ${NAME} has restarted on ${HOST} and is in state ${ROLE_LOCAL}\"\n    log \"Will probe resource state with the following XPath pattern: ${local_resource_xpath}\"\n\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resource=$(crm_mon -r --as-xml | xmllint --xpath \"${local_resource_xpath}\" - 2>/dev/null)\n        role=$(echo \"${resource}\" | sed -ne 's/.*\\Wrole=\"\\([^\"]*\\)\".*/\\1/p')\n\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resource}\" | grep -q -w \"\\Wblocked=\\\"true\\\"\"; then\n            log \"${NAME} is blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_locally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif [ \"$role\" = \"$ROLE_LOCAL\" ]; then\n            success=0\n            continue\n        elif [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" = \"$ROLE_ANYWHERE\" ]; then\n            # A/P: we are restarted in the expected state\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_LOCAL} on ${HOST}\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\n# Stage 2: global check\nif [ $timeout -gt 0 ] && [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" != \"$ROLE_ANYWHERE\" ]; then\n    log \"Wait until ${NAME} is restarted anywhere in the cluster in state ${ROLE_ANYWHERE}\"\n    log \"Will probe resource state with the following XPath pattern: ${any_resource_xpath}\"\n\n    success=1\n    bailout=1\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resources=$(crm_mon -r --as-xml | xmllint --xpath \"${any_resource_xpath}\" - 2>/dev/null)\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif ! (echo \"${resources}\" | grep -q -w \"\\Wblocked=\\\"false\\\"\"); then\n            log \"${NAME} blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_globally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resources}\" | grep -q -w \"\\Wrole=\\\"${ROLE_ANYWHERE}\\\"\"; then\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_ANYWHERE} anywhere in the cluster\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\nif [ $timeout -le 0 ]; then\n    log \"Timeout reached after ${TIMEOUT}s while waiting for ${NAME} to be restarted\"\nelif [ $bailout -le 0 ]; then\n    log \"Restart monitoring for ${NAME} cancelled\"\nfi\n\nif [ $success -eq 0 ]; then\n    log \"${NAME} successfully restarted\"\nelse\n    log \"${NAME} was not restarted properly\"\nfi\n\n# Don't block minor update or stack update if the wait was unsuccessful\nexit 0\n"}, "wait-port-and-run.sh": {"mode": "0755", "content": "#!/usr/bin/bash\nset -eu\n\nHOST=$1\nPORT=$2\n\necho \"$(date -u): Checking whether we can bind to ${HOST}:${PORT}\"\nwhile (ss -Htnl src \"${HOST}\" \"sport = :${PORT}\" | grep -wq \"${PORT}\"); do\n    echo \"$(date -u): ${HOST}:${PORT} still in use, waiting...\";\n    sleep 10;\ndone\n\nshift 2\nCOMMAND=\"$*\"\nif [ -z \"${COMMAND}\" ]; then\n    COMMAND=\"true\"\nfi\nexec $COMMAND\n"}, "pacemaker_resource_lock.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nMAX_RETRIES=10\nCIB_ENOTFOUND=105\n\nusage() {\n   echo \"Set a global property in the cluster with a validity timestamp.\"\n   echo \"Usage:\"\n   echo \"   $0 --acquire <lock_name> <lock_owner> <lock_ttl_in_seconds>\"\n   echo \"   $0 --release <lock_name> <lock_owner>\"\n   echo\n}\n\nlog() {\n    echo \"$(date -u): $1\" 1>&2\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\nlock_create() {\n    local name=$1\n    local data=$2\n    # cibadmin won't overwrite a key if someone else succeeded to create it concurrently\n    cibadmin --sync-call --scope crm_config --create --xml-text \"<cluster_property_set id='${name}'><nvpair id='${name}-pair' name='${name}' value='${data}'/></cluster_property_set>\" &>/dev/null\n    return $?\n}\n\nlock_update() {\n    local name=$1\n    local expected_data=$2\n    local new_data=$3\n    # we only update the lock we expect to see, so we can't update someone else's lock\n    cibadmin --sync-call --scope crm_config --modify --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" --xml-text \"<nvpair id='${name}-pair' name='${name}' value='${new_data}'/>\" &>/dev/null\n    return $?\n}\n\nlock_delete() {\n    local name=$1\n    local expected_data=$2\n    # we only delete the lock we expect to see, so we can't delete someone else's lock\n    cibadmin --sync-call --scope crm_config --delete --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" &>/dev/null\n    return $?\n}\n\nlock_get() {\n    local lockname=$1\n    local res\n    local rc\n    res=$(cibadmin --query --scope crm_config --xpath \"//cluster_property_set/nvpair[@name='$lockname']\" 2>/dev/null)\n    rc=$?\n    if [ $rc -eq 0 ]; then\n        echo \"$res\" | sed -n 's/.*value=\"\\([^\"]*\\)\".*/\\1/p'\n    fi\n    return $rc\n}\n\nlock_owner() {\n    local lock=$1\n    echo \"$lock\" | cut -d':' -f1\n}\n\nlock_has_expired() {\n    local lock=$1\n    local expiry=$(echo \"$lock\" | cut -d':' -f2)\n    local now=$(date +%s)\n    test $now -ge $expiry\n}\n\n\n# Perform a lock action and restart if the CIB has been modified before\n# committing the lock action\ntry_action() {\n    local fun=$1\n    local lock=$2\n    local requester=$3\n    local args=${4:-}\n    local tries=$MAX_RETRIES\n    local rc=1\n    if [ \"$fun\" = \"lock_acquire\" ] || [ \"$fun\" = \"lock_release\" ]; then\n        log \"Try running $fun\"\n    else\n        return 2\n    fi\n    while [ $rc -ne 0 ]; do\n        $fun $lock $requester $args\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Operation $1 succeeded\"\n            return 0\n        elif [ $rc -eq 3 ]; then\n            # rc == 3 -> CIB changed before push\n            if [ $tries -eq 0 ]; then\n                log \"Failed to commit after $MAX_RETRIES retries. Bailing out.\"\n                return 2\n            else\n                log \"Failed to commit. Retrying operation.\"\n                tries=$(($tries - 1))\n            fi\n        elif [ $rc -eq 2 ]; then\n            # rc == 2 -> unrecoverable cib error (e.g. pacemaker down)\n            log \"Unexpected failure. Bailing out\"\n            return $rc\n        else\n            # rc == 1 -> lock error (not owner, lock doesn't exists)\n            return $rc\n        fi\n    done\n}\n\n# The lock mechanism uses cibadmin's atomic creation so cluster-wide\n# state coherency is guaranteed by pacemaker\nlock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc\n    local lock\n    local expiry\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -n \"$lock\" ]; then\n        lock_has_expired $lock\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Lock has expired, now available for being held\"\n        else\n            # lock is still held. check whether we're the owner\n            owner=$(lock_owner $lock)\n            if [ \"$owner\" = \"$requester\" ];then\n                log \"Requester already owns the lock, acquiring attempt will just reconfigure the TTL\"\n            else\n                log \"Lock is held by someone else ($owner)\"\n                return 1\n            fi\n        fi\n    else\n        log \"Lock is not held yet\"\n    fi\n\n    # prepare the lock info\n    expiry=$(($(date +%s) + $ttl))\n\n    if [ -n \"$lock\" ]; then\n        log \"Attempting to update the lock\"\n        lock_update $lockname \"$lock\" \"$requester:$expiry\"\n        rc=$?\n    else\n        log \"Attempting to acquire the lock\"\n        lock_create $lockname \"$requester:$expiry\"\n        rc=$?\n    fi\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' acquired by '$requester', valid until $(date -d @$expiry)\"\n        return 0\n    else\n        log \"CIB changed, lock cannot be acquired\"\n        return 3\n    fi\n}\n\n\n# The lock mechanism uses the CIB's num_updates tag to implement\n# a conditional store. Cluster-wide locking is guaranteed by pacemaker\nlock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n    local lock\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        log \"Lock doesn't exist. Nothing to release\"\n        return 0\n    else\n        log \"Lock exists, check whether we're the owner\"\n        owner=$(lock_owner $lock)\n        if [ \"$owner\" != \"$requester\" ];then\n            log \"Lock is held by someone else ($owner), will not unlock\"\n            return 1\n        fi\n    fi\n\n    lock_delete $lockname \"$lock\"\n    rc=$?\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' released by '$requester'\"\n        return 0\n    else\n        log \"CIB deletion error, lock cannot be released\"\n        return 3\n    fi\n}\n\n\n# Retrieve the owner of a lock from the CIB\n# this is a read-only operation, so no need to log debug info\nlock_get_owner() {\n    local lockname=$1\n    local rc\n    local lock\n    local owner\n\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        return 1\n    else\n        lock_owner $lock\n        return 0\n    fi\n}\n\n\nACTION=$1\nLOCKNAME=$2\nREQUESTER=$3\nTTL=${4:-60}\n\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nif [ $ACTION != \"--help\" ]; then\n    if [ -z \"$LOCKNAME\" ]; then\n        error \"You must specific a lock name\"\n    fi\n    if [ $ACTION != \"--owner\" ] && [ $ACTION != \"-o\" ]; then\n        if [ -z \"$REQUESTER\" ]; then\n            error \"You must specific a lock requester\"\n        fi\n    fi\nfi\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) try_action lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --release|-r) try_action lock_release $LOCKNAME $REQUESTER;;\n    --acquire-once|-A) lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --owner|-o) lock_get_owner $LOCKNAME;;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}, "pacemaker_mutex_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_restart_bundle.sh --lock mysql galera galera-bundle Master _\n# pacemaker_mutex_restart_bundle.sh --lock ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\n\nset -u\n\nusage() {\n    echo \"Restart a clustered resource in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --lock <tripleo-service> <pcmk-resource> <pcmk-bundle> <target-state-local> <target-state-cluster>\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\nACTION=$1\ncase $ACTION in\n    --help) usage; exit 0;;\n    --lock) ;;\n    *) error \"Unknown action '$ACTION'\";;\nesac\n\nTRIPLEO_SERVICE=$2\nLOCK_NAME=${TRIPLEO_SERVICE}-restart-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to restart resource $TRIPLEO_SERVICE\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\nRESOURCE_NAME=$3\nBUNDLE_NAME=$4\nWAIT_TARGET_LOCAL=$5\nWAIT_TARGET_ANYWHERE=${6:-_}\n\nif pacemaker_supports_promoted; then\n    WAIT_TARGET_LOCAL=$(echo \"$5\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    WAIT_TARGET_ANYWHERE=$(echo \"${6:-_}\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    promoted_role=\"Promoted\"\nelse\n    promoted_role=\"Master\"\nfi\n\n# The lock TTL should accomodate for the resource start/promote timeout\nif [ \"$RESOURCE_NAME\" != \"$BUNDLE_NAME\" ]; then\n    if [ \"$WAIT_TARGET_LOCAL\" = \"$promoted_role\" ] || [ \"$WAIT_TARGET_ANYWHERE\" = \"$promoted_role\" ]; then\n        rsc_op=\"promote\"\n    else\n        rsc_op=\"start\"\n    fi\n    # <op id=\"galera-promote-interval-0s\" interval=\"0s\" name=\"promote\" on-fail=\"block\" timeout=\"300s\"/>\n    PCMK_TTL=$(cibadmin -Q | xmllint -xpath \"string(//primitive[@id='${RESOURCE_NAME}']/operations/op[@name='${rsc_op}']/@timeout)\" - | sed 's/s$//')\n    LOCK_TTL=$((PCMK_TTL + 30))\nelse\n    # The podman RA's default start timeout\n    LOCK_TTL=90\nfi\n\nlog \"Acquire a ${LOCK_TTL}s restart lock for service $TRIPLEO_SERVICE before restarting it\"\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nrc=1\nwhile [ $rc -ne 0 ]; do\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire $LOCK_NAME $LOCK_OWNER $LOCK_TTL\n    rc=$?\n    if [ $rc != 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not acquire lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Could not acquire lock, retrying\"\n            sleep 10\n        fi\n    fi\ndone\n\nlog \"Restart the service $TRIPLEO_SERVICE locally\"\n# Reuse the local restart script in t-h-t (driven by env var TRIPLEO_MINOR_UPDATE)\nTRIPLEO_MINOR_UPDATE=true /var/lib/container-config-scripts/pacemaker_restart_bundle.sh $TRIPLEO_SERVICE $RESOURCE_NAME $BUNDLE_NAME $WAIT_TARGET_LOCAL $WAIT_TARGET_ANYWHERE\n\n# If we reached this point, always try to release the lock\nlog \"Release the restart lock for service $TRIPLEO_SERVICE\"\n/var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $LOCK_NAME $LOCK_OWNER\nrc=$?\nif [ $rc -ne 0 ] && [ $rc -ne 1 ]; then\n    error \"Could not release held lock (rc: $rc)\"\nfi\n"}, "pacemaker_mutex_shutdown.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_shutdown.sh --acquire\n# pacemaker_mutex_shutdown.sh --release\n\nset -u\n\nusage() {\n    echo \"Shutdown a cluster node in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --acquire # prevent other node from shutting down until we hold the lock\"\n    echo \"   $0 --release # release the lock, other node can compete for the shutdown lock\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nshutdown_lock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc=1\n    local current_owner\n    local owner_stopped\n    local owner_rc\n\n    log \"Acquiring the shutdown lock\"\n    while [ $rc -ne 0 ]; do\n        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire-once $lockname $requester $ttl\n        rc=$?\n        if [ $rc -ne 0 ]; then\n            if [ $rc -eq 2 ]; then\n                error \"Could not acquire the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n            else\n                # The lock is held by another node.\n                current_owner=$(/var/lib/container-config-scripts/pacemaker_resource_lock.sh --owner $lockname)\n                owner_rc=$?\n                if [ $owner_rc -eq 2 ]; then\n                    error \"Could not get the shutdown lock owner due to unrecoverable error (rc: $owner_rc), bailing out\"\n                fi\n                if [ $owner_rc -eq 0 ]; then\n                    # If the owner is marked as offline, that means it has shutdown and\n                    # we can clean the lock preemptively and try to acquire it.\n                    owner_stopped=$(crm_mon -1X | xmllint --xpath 'count(//nodes/node[@name=\"'${current_owner}'\" and @online=\"false\" and @unclean=\"false\"])' -)\n                    if [ \"${owner_stopped}\" = \"1\" ]; then\n                        log \"Shutdown lock held by stopped node '${current_owner}', lock can be released\"\n                        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $current_owner\n                        continue\n                    fi\n                fi\n                log \"Shutdown lock held by another node (rc: $rc), retrying\"\n                sleep 10\n            fi\n        fi\n    done\n    log \"Shutdown lock acquired\"\n    return 0\n}\n\n\n# Release the lock if we still own it. Not owning it anymore is not fatal\nshutdown_lock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n\n    log \"Releasing the shutdown lock\"\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $requester\n    rc=$?\n    if [ $rc -ne 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not release the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Shutdown lock no longer held, nothing to do\"\n        fi\n    else\n        log \"Shutdown lock released\"\n    fi\n    return 0\n}\n\n\nACTION=$1\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nLOCK_NAME=tripleo-shutdown-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to aquire the shutdown lock\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\n# We start with a very high TTL, that long enough to accomodate a cluster stop.\n# As soon as the node will get offline, the other competing node will be entitled\n# to steal the lock, so they should never wait that long in practice.\nLOCK_TTL=600\n\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) shutdown_lock_acquire ${LOCK_NAME} ${LOCK_OWNER} ${LOCK_TTL};;\n    --release|-r) shutdown_lock_release ${LOCK_NAME} ${LOCK_OWNER};;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-29-uuqpaohwnjnc-HAProxyBase-toyo4cxpgoqe-ContainersCommon-yxzcnr34r7kx/09e3e827-f02a-40cc-977f-f69c8f6cdeb0"}


created_at: 2026-06-14 08:54:17.373596
data:
  {"tuple:('role_data', 'metadata_settings')": null, "tuple:('role_data', 'certificates_specs')": null, "tuple:('role_data', 'config_settings')": null}


created_at: 2026-06-14 08:54:17.423404
data:
  {"tuple:('role_data', 'host_prep_tasks')": [{"name": "get parameters", "set_fact": {"cert_path": "/etc/pki/tls/private/overcloud_endpoint.pem", "cert_content": "", "chain_content": "", "key_content": ""}, "no_log": "{{ hide_sensitive_logs | bool }}"}, {"name": "manage certificate", "when": ["cert_content is defined", "cert_content != ''"], "block": [{"name": "get DeployedSSLCertificatePath attributes", "register": "attr_cert_path", "stat": {"path": "{{cert_path}}"}}, {"name": "set is_haproxy_bootstrap_node fact", "set_fact": "is_haproxy_bootstrap_node={{haproxy_short_bootstrap_node_name | lower == ansible_facts['hostname'] | lower}}", "when": ["haproxy_short_bootstrap_node_name|default(false)"]}, {"name": "get haproxy status", "register": "haproxy_state", "systemd": {"name": "haproxy"}}, {"name": "get pacemaker status", "register": "pacemaker_state", "systemd": {"name": "pacemaker"}}, {"name": "get docker status", "register": "docker_state", "systemd": {"name": "docker"}}, {"name": "get container_id", "when": ["docker_state.status.ActiveState == 'active' or container_cli == 'podman'", "attr_cert_path.stat.exists", "attr_cert_path.stat.isdir == False"], "command": "{{ container_cli }} ps -q -f name='^haproxy(-bundle)?'", "register": "container_id"}, {"name": "get pcs resource name for haproxy container", "when": ["bootstrap_node is defined", "is_haproxy_bootstrap_node", "pacemaker_state.status.ActiveState == 'active'", "attr_cert_path.stat.exists", "attr_cert_path.stat.isdir"], "shell": "pcs status resources | sed -n 's/^.*container.*: \\(haproxy.*\\) .*/\\1/p'\n", "register": "pacemaker_resource"}, {"name": "remove DeployedSSLCertificatePath if is dir", "when": "attr_cert_path.stat.isdir is defined and attr_cert_path.stat.isdir", "file": {"path": "{{cert_path}}", "state": "absent"}}, {"name": "push certificate content", "no_log": "{{ hide_sensitive_logs | bool }}", "copy": {"dest": "{{cert_path}}", "mode": 288, "owner": "root", "content": "{{cert_content}}\n{{chain_content}}\n{{key_content}}\n"}}, {"name": "BM haproxy non-pacemaker context", "when": "haproxy_state.status.ActiveState == 'active'", "block": [{"name": "set certificate ownership", "file": {"path": "{{cert_path}}", "group": "haproxy"}}, {"name": "reload haproxy if enabled", "service": {"name": "haproxy", "state": "reloaded"}}]}, {"name": "restart pacemaker resource for haproxy", "when": ["pacemaker_resource is defined", "pacemaker_resource.stdout is defined", "pacemaker_resource.stdout != ''"], "command": "pcs resource restart \"{{pacemaker_resource.stdout}}\""}, {"name": "dedicated part for containers", "when": ["container_id is defined", "container_id.stdout is defined", "container_id.stdout != ''"], "block": [{"name": "copy certificate, chgrp, restart haproxy", "shell": "set -e\nif {{ container_cli }} ps -f \"id={{ item }}\" --format \"{{ '{{' }}.Names{{ '}}' }}\" | grep -q \"^haproxy-bundle\"; then\n  tar -c {{ cert_path }} | {{container_cli}} exec -i {{ item }} tar -C / -xv\nelse\n  {{ container_cli }} cp {{ cert_path }} {{ item }}:{{ cert_path }}\nfi\n{{ container_cli }} exec --user root {{ item }} chgrp haproxy {{ cert_path }}\n{{ container_cli }} kill --signal=HUP {{ item }}\n", "register": "container_kill_result", "failed_when": ["container_kill_result.rc != 0", "(\"no such container\" not in container_kill_result.stderr)", "(\"container state improper\" not in container_kill_result.stderr)"], "with_items": "{{ container_id.stdout.split('\n') }}"}]}]}], "tuple:('role_data', 'metadata_settings')": null, "tuple:('role_data', 'certificates_specs')": {}, "tuple:('role_data', 'config_settings')": {}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-29-uuqpaohwnjnc-HAProxyBase-toyo4cxpgoqe-HAProxyPublicTLS-yuqakggqz35z/31fbb578-6a85-40d8-9b53-6f1872890f3a"}


created_at: 2026-06-14 08:54:17.427960
data:
  {"value": {"ContainerHAProxyImage": "registry.redhat.io/rhosp-rhel9/openstack-haproxy:17.1", "ContainerHAProxyConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-haproxy:17.1"}}


created_at: 2026-06-14 08:54:17.436828
data:
  {"tuple:('role_data', 'metadata_settings')": [], "tuple:('role_data', 'monitoring_subscription')": "overcloud-haproxy", "tuple:('role_data', 'host_prep_tasks')": [{"name": "get parameters", "set_fact": {"cert_path": "/etc/pki/tls/private/overcloud_endpoint.pem", "cert_content": "", "chain_content": "", "key_content": ""}, "no_log": "{{ hide_sensitive_logs | bool }}"}, {"name": "manage certificate", "when": ["cert_content is defined", "cert_content != ''"], "block": [{"name": "get DeployedSSLCertificatePath attributes", "register": "attr_cert_path", "stat": {"path": "{{cert_path}}"}}, {"name": "set is_haproxy_bootstrap_node fact", "set_fact": "is_haproxy_bootstrap_node={{haproxy_short_bootstrap_node_name | lower == ansible_facts['hostname'] | lower}}", "when": ["haproxy_short_bootstrap_node_name|default(false)"]}, {"name": "get haproxy status", "register": "haproxy_state", "systemd": {"name": "haproxy"}}, {"name": "get pacemaker status", "register": "pacemaker_state", "systemd": {"name": "pacemaker"}}, {"name": "get docker status", "register": "docker_state", "systemd": {"name": "docker"}}, {"name": "get container_id", "when": ["docker_state.status.ActiveState == 'active' or container_cli == 'podman'", "attr_cert_path.stat.exists", "attr_cert_path.stat.isdir == False"], "command": "{{ container_cli }} ps -q -f name='^haproxy(-bundle)?'", "register": "container_id"}, {"name": "get pcs resource name for haproxy container", "when": ["bootstrap_node is defined", "is_haproxy_bootstrap_node", "pacemaker_state.status.ActiveState == 'active'", "attr_cert_path.stat.exists", "attr_cert_path.stat.isdir"], "shell": "pcs status resources | sed -n 's/^.*container.*: \\(haproxy.*\\) .*/\\1/p'\n", "register": "pacemaker_resource"}, {"name": "remove DeployedSSLCertificatePath if is dir", "when": "attr_cert_path.stat.isdir is defined and attr_cert_path.stat.isdir", "file": {"path": "{{cert_path}}", "state": "absent"}}, {"name": "push certificate content", "no_log": "{{ hide_sensitive_logs | bool }}", "copy": {"dest": "{{cert_path}}", "mode": 288, "owner": "root", "content": "{{cert_content}}\n{{chain_content}}\n{{key_content}}\n"}}, {"name": "BM haproxy non-pacemaker context", "when": "haproxy_state.status.ActiveState == 'active'", "block": [{"name": "set certificate ownership", "file": {"path": "{{cert_path}}", "group": "haproxy"}}, {"name": "reload haproxy if enabled", "service": {"name": "haproxy", "state": "reloaded"}}]}, {"name": "restart pacemaker resource for haproxy", "when": ["pacemaker_resource is defined", "pacemaker_resource.stdout is defined", "pacemaker_resource.stdout != ''"], "command": "pcs resource restart \"{{pacemaker_resource.stdout}}\""}, {"name": "dedicated part for containers", "when": ["container_id is defined", "container_id.stdout is defined", "container_id.stdout != ''"], "block": [{"name": "copy certificate, chgrp, restart haproxy", "shell": "set -e\nif {{ container_cli }} ps -f \"id={{ item }}\" --format \"{{ '{{' }}.Names{{ '}}' }}\" | grep -q \"^haproxy-bundle\"; then\n  tar -c {{ cert_path }} | {{container_cli}} exec -i {{ item }} tar -C / -xv\nelse\n  {{ container_cli }} cp {{ cert_path }} {{ item }}:{{ cert_path }}\nfi\n{{ container_cli }} exec --user root {{ item }} chgrp haproxy {{ cert_path }}\n{{ container_cli }} kill --signal=HUP {{ item }}\n", "register": "container_kill_result", "failed_when": ["container_kill_result.rc != 0", "(\"no such container\" not in container_kill_result.stderr)", "(\"container state improper\" not in container_kill_result.stderr)"], "with_items": "{{ container_id.stdout.split('\n') }}"}]}]}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/log/containers/haproxy", "setype": "var_log_t", "mode": "0750"}, {"path": "/var/lib/haproxy", "setype": "container_file_t"}]}], "tuple:('role_data', 'firewall_rules')": {"107 haproxy stats": {"dport": 1993}}, "tuple:('role_data', 'ansible_group_vars')": {"tripleo_firewall_frontend_enabled": true}, "tuple:('role_data', 'config_settings')": {"tripleo::haproxy::haproxy_service_manage": false, "tripleo::haproxy::haproxy_log_address": "/dev/log", "tripleo::haproxy::haproxy_log_facility": "local0", "tripleo::haproxy::haproxy_stats_user": "admin", "tripleo::haproxy::haproxy_stats_password": "K4rBn0ytG7kChxFj8xL0JLvCM", "tripleo::haproxy::haproxy_stats_bind_address": "%{hiera('ctlplane')}", "tripleo::haproxy::redis_password": "49auApjwL72waJnu1huMAuwhk", "tripleo::haproxy::crl_file": null, "tripleo::haproxy::haproxy_stats": true, "enable_load_balancer": true, "tripleo::profile::base::haproxy::certificates_specs": {}}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-29-uuqpaohwnjnc-HAProxyBase-toyo4cxpgoqe/07cd2d46-408e-4e95-a663-d4baf0e7744c"}


created_at: 2026-06-14 08:54:17.441407
data:
  {"OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-29-uuqpaohwnjnc-HAProxyPublicTLS-s2qzjzp5xom7/cf8402cb-1186-4d92-bcc8-31a91066d51b"}


created_at: 2026-06-14 08:54:17.461900
data:
  {"tuple:('role_data', 'docker_config')": null, "role_data": {"service_name": "haproxy", "firewall_rules": {"107 haproxy stats": {"dport": 1993}}, "monitoring_subscription": "overcloud-haproxy", "ansible_group_vars": {"tripleo_firewall_frontend_enabled": true}, "config_settings": {"tripleo::haproxy::haproxy_service_manage": false, "tripleo::haproxy::haproxy_log_address": "/dev/log", "tripleo::haproxy::haproxy_log_facility": "local0", "tripleo::haproxy::haproxy_stats_user": "admin", "tripleo::haproxy::haproxy_stats_password": "K4rBn0ytG7kChxFj8xL0JLvCM", "tripleo::haproxy::haproxy_stats_bind_address": "%{hiera('ctlplane')}", "tripleo::haproxy::redis_password": "49auApjwL72waJnu1huMAuwhk", "tripleo::haproxy::crl_file": null, "tripleo::haproxy::haproxy_stats": true, "enable_load_balancer": true, "tripleo::profile::base::haproxy::certificates_specs": {}, "tripleo::haproxy::mysql_clustercheck": true, "haproxy_docker": true, "tripleo::profile::pacemaker::haproxy_bundle::container_backend": "podman", "tripleo::profile::pacemaker::haproxy_bundle::tls_mapping": [], "tripleo::profile::pacemaker::haproxy_bundle::tls_mapping_init_bundle": [], "tripleo::profile::pacemaker::haproxy_bundle::internal_certs_directory": "/etc/pki/tls/certs/haproxy", "tripleo::profile::pacemaker::haproxy_bundle::internal_keys_directory": "/etc/pki/tls/private/haproxy", "tripleo::profile::pacemaker::haproxy_bundle::haproxy_docker_image": "cluster.common.tag/haproxy:pcmklatest"}, "service_config_settings": {"rsyslog": {"tripleo_logging_sources_haproxy": [{"tag": "openstack.haproxy", "file": "/var/log/containers/haproxy/haproxy.log", "startmsg.regex": "^[a-zA-Z]{3} [ 123][0-9] [:0-9]{8}"}]}}, "puppet_config": {"config_volume": "haproxy", "puppet_tags": "haproxy_config", "step_config": "exec {'wait-for-settle': command => '/bin/true' }\nclass tripleo::firewall(){}; define tripleo::firewall::rule( $port = undef, $dport = undef, $sport = undef, $proto = undef, $action = undef, $state = undef, $source = undef, $iniface = undef, $chain = undef, $destination = undef, $extras = undef){}\n['pcmk_bundle', 'pcmk_resource', 'pcmk_property', 'pcmk_constraint', 'pcmk_resource_default'].each |String $val| { noop_resource($val) }\ninclude tripleo::profile::pacemaker::haproxy_bundle", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-haproxy:17.1", "volumes": []}, "kolla_config": {"/var/lib/kolla/config_files/haproxy.json": {"command": "bash -c $* -- eval if [ -f /usr/sbin/haproxy-systemd-wrapper ]; then exec /usr/sbin/haproxy-systemd-wrapper -f /etc/haproxy/haproxy.cfg; else exec /usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -Ws; fi", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true, "optional": true}, {"source": "/var/lib/kolla/config_files/src-tls/*", "dest": "/", "merge": true, "optional": true, "preserve_properties": true}], "permissions": [{"path": "/var/lib/haproxy", "owner": "haproxy:haproxy", "recurse": true}, {"path": "/etc/pki/tls/certs/haproxy/*", "owner": "haproxy:haproxy", "perm": "0600", "optional": true}, {"path": "/etc/pki/tls/private/haproxy/*", "owner": "haproxy:haproxy", "perm": "0600", "optional": true}]}}, "container_config_scripts": {"container_puppet_apply.sh": {"mode": "0700", "content": "#!/bin/bash\nset -eux\nSTEP=$1\nTAGS=$2\nCONFIG=$3\nEXTRA_ARGS=${4:-''}\nif [ -d /tmp/puppet-etc ]; then\n  # ignore copy failures as these may be the same file depending on docker mounts\n  cp -a /tmp/puppet-etc/* /etc/puppet || true\nfi\necho \"{\\\"step\\\": ${STEP}}\" > /etc/puppet/hieradata/docker_puppet.json\n# $::deployment_type in puppet-tripleo\nexport FACTER_deployment_type=containers\nset +e\npuppet apply $EXTRA_ARGS \\\n    --verbose \\\n    --detailed-exitcodes \\\n    --summarize \\\n    --color=false \\\n    --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \\\n    --tags $TAGS \\\n    -e \"noop_resource('package'); ${CONFIG}\"\nrc=$?\nset -e\nset +ux\nif [ $rc -eq 2 -o $rc -eq 0 ]; then\n    exit 0\nfi\nexit $rc\n"}, "pyshim.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n#\n# Usage: pyshim.sh <script and/or arguments>\n#\n# Unfortunately THT doesn't know which version of python might be in a\n# container so we need this script to be able to try python3 or python2\n# depending on availability.  Since this is a temporary shim until we've\n# fully cut over to python3, we check for the existence of python3 first\n# before falling back to python2. This will help in the transition from\n# python2 based containers to python3.\n\nshow_usage() {\n    echo \"Usage: pyshim.sh <script and/or arguments>\"\n}\n\nif [ $# -lt 1 ]\nthen\n    show_usage\n    exit 1\nfi\n\nset -x\nif command -v python3 >/dev/null; then\n    python3 \"$@\"\nelif command -v python2 >/dev/null; then\n    python2 \"$@\"\nelif command -v python >/dev/null; then\n    python \"$@\"\nelse\n    echo \"ERROR: python is not available!\"\n    exit 1\nfi\n"}, "pacemaker_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nset -u\n\n# ./pacemaker_restart_bundle.sh mysql galera galera-bundle Master _\n# ./pacemaker_restart_bundle.sh redis redis redis-bundle Slave Master\n# ./pacemaker_restart_bundle.sh ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\nRESTART_SCRIPTS_DIR=$(dirname $0)\nTRIPLEO_SERVICE=$1\nRESOURCE_NAME=$2\nBUNDLE_NAME=$3\nWAIT_TARGET_LOCAL=$4\nWAIT_TARGET_ANYWHERE=${5:-_}\nTRIPLEO_MINOR_UPDATE=\"${TRIPLEO_MINOR_UPDATE:-false}\"\nTRIPLEO_HA_WRAPPER_RESOURCE_EXISTS=\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS:-false}\"\n\nbundle_can_be_restarted() {\n    local bundle=$1\n    # As long as the resource bundle is managed by pacemaker and is\n    # not meant to stay stopped, no matter the state of any inner\n    # pcmk_remote or ocf resource, we should restart it to give it a\n    # chance to read the new config.\n    [ \"$(crm_resource --meta -r $1 -g is-managed 2>/dev/null)\" != \"false\" ] && \\\n    [ \"$(crm_resource --meta -r $1 -g target-role 2>/dev/null)\" != \"Stopped\" ]\n}\n\nlog() {\n    local msg=$1\n    logger -t pcmkrestart \"$1\"\n}\n\nHOSTNAME=$(/bin/hostname -s)\nif [ x\"${TRIPLEO_MINOR_UPDATE,,}\" != x\"true\" ]; then\n    if [ x\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS,,}\" = x\"false\" ]; then\n        # Do not restart during initial deployment, as the resource\n        # has just been created.\n        SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n        if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n            log \"Initial deployment, skipping the restart of ${BUNDLE_NAME}\"\n\tfi\n        exit 0\n    else\n        # During a stack update, this script is called in parallel on\n        # every node the resource runs on, after the service's configs\n        # have been updated on all nodes. So we need to run pcs only\n        # once (e.g. on the service's boostrap node).\n        if bundle_can_be_restarted ${BUNDLE_NAME}; then\n            SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n            if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n                replicas_running=$(crm_resource -Q -r $BUNDLE_NAME --locate 2>&1 | wc -l)\n                if [ \"$replicas_running\" != \"0\" ]; then\n                    log \"Restarting ${BUNDLE_NAME} globally. Stopping:\"\n                    /sbin/pcs resource disable --wait=600 $BUNDLE_NAME\n                    log \"Restarting ${BUNDLE_NAME} globally. Starting:\"\n                    /sbin/pcs resource enable --wait=600 $BUNDLE_NAME\n                else\n                    log \"${BUNDLE_NAME} is not running anywhere,\" \\\n                         \"cleaning up to restart it globally if necessary\"\n                    /sbin/pcs resource cleanup $BUNDLE_NAME\n                fi\n            else\n                log \"Skipping global restart of ${BUNDLE_NAME} on ${HOSTNAME} it will be restarted by node ${SERVICE_NODEID}\"\n            fi\n\n        else\n            log \"No global restart needed for ${BUNDLE_NAME}.\"\n        fi\n    fi\nelse\n    # During a minor update workflow however, a host gets fully\n    # updated before updating the next one. So unlike stack\n    # update, at the time this script is called, the service's\n    # configs aren't updated on all nodes yet. So only restart the\n    # resource locally, where it's guaranteed that the config is\n    # up to date.\n    HOST=$(facter hostname)\n\n    if bundle_can_be_restarted ${BUNDLE_NAME}; then\n\t# if the resource is running locally, restart it\n\tif crm_resource -r $BUNDLE_NAME --locate 2>&1 | grep -w -q \"${HOST}\"; then\n            log \"Restarting ${BUNDLE_NAME} locally on '${HOST}'\"\n            /sbin/pcs resource restart $BUNDLE_NAME \"${HOST}\"\n\n\telse\n\t    # At this point, if no resource is running locally, it's\n\t    # either because a) it has failed previously, or b) because\n\t    # it's an A/P resource running elsewhere.\n\t    # By cleaning up resource, we ensure that a) it will try to\n\t    # restart, or b) it won't do anything if the resource is\n\t    # already running elsewhere.\n            log \"${BUNDLE_NAME} is currently not running on '${HOST}',\" \\\n                 \"cleaning up its state to restart it if necessary\"\n            /sbin/pcs resource cleanup $BUNDLE_NAME node=\"${HOST}\"\n\tfi\n\n\t# Wait until the resource is in the expected target state\n\t$RESTART_SCRIPTS_DIR/pacemaker_wait_bundle.sh \\\n            $RESOURCE_NAME $BUNDLE_NAME \\\n            \"$WAIT_TARGET_LOCAL\" \"$WAIT_TARGET_ANYWHERE\" \\\n\t    \"${HOST}\" 600\n    else\n        log \"No restart needed for ${BUNDLE_NAME}.\"\n    fi\nfi\n"}, "pacemaker_wait_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# ----\n# Wait for an OCF resource or a bundle to be restarted\n# ----\n# e.g.:\n# M/S OCF:      $0 galera galera-bundle Master\n# clone OCF:    $0 rabbitmq rabbitmq-bundle Started\n# A/P M/S OCF:  $0 redis redis-bundle Slave Master\n# A/P bundle:   $0 openstack-cinder-volume openstack-cinder-volume _ Started\n# clone bundle: $0 haproxy-bundle haproxy-bundle Started\n\n# design note 1:\n#  - this script is called during a minor update; it is called\n#    once per node that hosts a service replica.\n#  - the purpose of this script is to ensure that restarting the\n#    service replica locally won't disrupt the service availability\n#    for the end user. To reach that goal, the script waits until the\n#    service is restarted locally or globallu and reaches a given\n#    target state (i.e. Started, Slave or Master).\n# design note 2:\n#   - we don't want to track restart error: our only job is to ensure\n#     service restart synchronization, not service health.\n#   - In particular, we don't want to error out in case the resource\n#     cannot be restarted locally, because that would make the minor\n#     update fail, even if potentially other replicas still provide\n#     the service.\n# design note 3:\n#   - we can bail out early if we determine that the resource can't\n#     be restarted automatically by pacemaker (e.g. its \"blocked\",\n#     unmanaged or disabled).\n\nlog() {\n    local msg=$1\n    echo \"$(date -u): $1\"\n}\n\nusage() {\n    echo 2>&1 \"Usage: $0 NAME BUNDLE_NAME ROLE_LOCAL [ROLE_ANYWHERE] [HOST] [TIMEOUT]\"\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\n#\n# Utility functions to detect stuck resources\n#\n\nbundle_failures_locally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local replica_name\n    for i in $(seq 0 $last); do\n\treplica_name=${BUNDLE_NAME}-${engine}-${i}\n\tcrm_failcount -q -G -r $replica_name -N $HOST\n    done\n}\n\nbundle_failures_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    for i in $(seq 0 $last); do\n\tcrm_failcount -q -G -r ${BUNDLE_NAME}-${engine}-${i}\n    done\n}\n\nbundle_running_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    # return the number of running bundles replica, i.e. the number of\n    # docker/podman resource replicas currently running in the cluster\n    crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:heartbeat:${engine}']/node)\" -\n}\n\nocf_failures_globally() {\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local bundle_node\n    for i in $(seq 0 $last); do\n\tbundle_node=${BUNDLE_NAME}-${i}\n\tcrm_failcount -q -G -r $NAME -N $bundle_node\n    done\n}\n\ndid_resource_failed_locally() {\n    local failures\n    local running\n    local remotehost\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# if we're dealing with an ocf resource, it is running on a\n\t# pacemaker_remote rather that on the real host, and the\n\t# failcounts are thus associated to the pcmk remote. Replace\n\t# the host's name with the pcmk remote's name.\n        remotehost=$(crm_mon --as-xml | xmllint --xpath \"string(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource/node[@name='${HOST}']/../../resource[@resource_agent='${OCF}:pacemaker:remote']/@id)\" -)\n\tif [ -n \"${remotehost}\" ]; then\n\t    crm_failcount -q -G -r $NAME -N $remotehost | grep -q -w INFINITY\n\t    return $?\n\tfi\n\t# If no pcmk remote is currently running, the failcount from\n\t# the ocf resource is useless, compute the failcount from the\n\t# bundle case instead (computed below).\n    fi\n\n    # for bundles, pacemaker can run any bundle replica locally\n    # (e.g. galera-bundle-docker-{0,1,2}), and a failure happens when\n    # there are no more replica to try.\n    # That is, when _at least_ one replica failed locally, and all the\n    # others either failed or are currently running elsewhere.\n    failures=$(bundle_failures_locally $HOST | grep -c -w INFINITY)\n    running=$(bundle_running_globally)\n    test $failures -gt 0 && \\\n    test $(( $failures + $running )) -ge $BUNDLE_REPLICAS\n}\n\ndid_resource_failed_globally() {\n    local remotecount\n    local failures\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# we check the state of an ocf resource only if the\n\t# pcmkremotes are started\n        remotecount=$(crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node)\" -)\n\tif [ \"${remotecount}\" = \"0\" ]; then\n\t    # no pcmkremote is running, so check the bundle state\n\t    # instead of checking the ocf resource\n\t    # bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\t    failures=$(bundle_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\telse\n\t    # ocf resource failed if it failed to start on\n\t    # all $BUNDLE_REPLICAS bundle nodes\n\t    failures=$(ocf_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\tfi\n    else\n\t# bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\tfailures=$(bundle_failures_globally | grep -c -w INFINITY)\n\ttest $failures -eq $BUNDLE_REPLICAS\n    fi\n}\n\n\n# Input validation\n#\n\nNAME=$1\nif [ -z \"${NAME}\" ]; then\n    echo 2>&1 \"Error: argument NAME must not be empty\"\n    exit 1\nfi\n\nBUNDLE_NAME=$2\nif [ -z \"${BUNDLE_NAME}\" ]; then\n    echo 2>&1 \"Error: argument BUNDLE_NAME must not be empty\"\n    exit 1\nfi\n\nROLE_LOCAL=$3\nif [ \"${ROLE_LOCAL}\" = \"_\" ]; then\n    ROLE_LOCAL=\"\"\nfi\n\nROLE_ANYWHERE=$4\nif [ \"${ROLE_ANYWHERE}\" = \"_\" ]; then\n    ROLE_ANYWHERE=\"\"\nfi\n\nif [ -z \"${ROLE_LOCAL}\" ]; then\n    if [ -z \"${ROLE_ANYWHERE}\" ]; then\n        echo 2>&1 \"Error: either ROLE_LOCAL or ROLE_ANYWHERE must be non empty\"\n        exit 1\n    fi\nelse\n    if !(echo \"${ROLE_LOCAL}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n        echo 2>&1 \"Error: argument ROLE_LOCAL must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n        exit 1\n    fi\nfi\n\nif [ -n \"${ROLE_ANYWHERE}\" ] && !(echo \"${ROLE_ANYWHERE}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n    echo 2>&1 \"Error: argument ROLE_ANYWHERE must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n    exit 1\nfi\n\n# Ensure compatibility with pacemaker 2.1\nif pacemaker_supports_promoted; then\n    ROLE_LOCAL=$(echo \"$ROLE_LOCAL\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    ROLE_ANYWHERE=$(echo \"$ROLE_ANYWHERE\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    OCF=\"ocf\"\nelse\n    OCF=\"ocf:\"\nfi\n\nHOST=${5:-$(facter hostname)}\nTIMEOUT=${6:-600}\n\n\n# Configure the search\n# ----\n# Note: we can't use crm_resource in all searches because we can't\n# easily extract the host the OCF resources run on (crm_resource\n# returns the pcmk-remote nodes rather than the hosts)\n# So instead, we implement various searches with XPath directly.\n\nif [ \"${BUNDLE_NAME}\" != \"${NAME}\" ]; then\n# ocf resource\nlocal_resource_xpath=\"//bundle/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node[@name='${HOST}']/../../resource[@id='${NAME}']\"\nany_resource_xpath=\"//bundle//resource[@id='${NAME}']\"\nreplicas_xpath=\"//bundle/primitive[@id='${BUNDLE_NAME}']/../*[boolean(@image) and boolean(@replicas)]\"\nelse\n# bundle resource\nlocal_resource_xpath=\"//bundle[@id='${NAME}']/replica/resource/node[@name='${HOST}']/../../resource\"\nany_resource_xpath=\"//bundle[@id='${NAME}']//resource\"\nreplicas_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nfi\n\nbundle_def_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nBUNDLE_CONTAINER_ENGINE=$(cibadmin -Q | xmllint --xpath \"name(${bundle_def_xpath})\" -)\nBUNDLE_REPLICAS=$(cibadmin -Q | xmllint --xpath \"string(${bundle_def_xpath}/@replicas)\" -)\n\n\n# The wait algorithm follows a two-stage approach\n#  1. Depending on how the script is called, we first check whether\n#     the resource is restarted locally. An A/P resource may be\n#     restarted elsewhere in the cluster.\n#  2. If needed, check whether the A/P resource has restarted\n#     elsewhere. For A/P M/S resources, in case the resource is\n#     restarted as Slave locally, ensure a Master is available.\n\nsuccess=1\nbailout=1\ntimeout=$TIMEOUT\nrole=\"\"\n\n# Stage 1: local check\nif [ -n \"$ROLE_LOCAL\" ]; then\n    log \"Waiting until ${NAME} has restarted on ${HOST} and is in state ${ROLE_LOCAL}\"\n    log \"Will probe resource state with the following XPath pattern: ${local_resource_xpath}\"\n\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resource=$(crm_mon -r --as-xml | xmllint --xpath \"${local_resource_xpath}\" - 2>/dev/null)\n        role=$(echo \"${resource}\" | sed -ne 's/.*\\Wrole=\"\\([^\"]*\\)\".*/\\1/p')\n\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resource}\" | grep -q -w \"\\Wblocked=\\\"true\\\"\"; then\n            log \"${NAME} is blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_locally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif [ \"$role\" = \"$ROLE_LOCAL\" ]; then\n            success=0\n            continue\n        elif [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" = \"$ROLE_ANYWHERE\" ]; then\n            # A/P: we are restarted in the expected state\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_LOCAL} on ${HOST}\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\n# Stage 2: global check\nif [ $timeout -gt 0 ] && [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" != \"$ROLE_ANYWHERE\" ]; then\n    log \"Wait until ${NAME} is restarted anywhere in the cluster in state ${ROLE_ANYWHERE}\"\n    log \"Will probe resource state with the following XPath pattern: ${any_resource_xpath}\"\n\n    success=1\n    bailout=1\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resources=$(crm_mon -r --as-xml | xmllint --xpath \"${any_resource_xpath}\" - 2>/dev/null)\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif ! (echo \"${resources}\" | grep -q -w \"\\Wblocked=\\\"false\\\"\"); then\n            log \"${NAME} blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_globally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resources}\" | grep -q -w \"\\Wrole=\\\"${ROLE_ANYWHERE}\\\"\"; then\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_ANYWHERE} anywhere in the cluster\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\nif [ $timeout -le 0 ]; then\n    log \"Timeout reached after ${TIMEOUT}s while waiting for ${NAME} to be restarted\"\nelif [ $bailout -le 0 ]; then\n    log \"Restart monitoring for ${NAME} cancelled\"\nfi\n\nif [ $success -eq 0 ]; then\n    log \"${NAME} successfully restarted\"\nelse\n    log \"${NAME} was not restarted properly\"\nfi\n\n# Don't block minor update or stack update if the wait was unsuccessful\nexit 0\n"}, "wait-port-and-run.sh": {"mode": "0755", "content": "#!/usr/bin/bash\nset -eu\n\nHOST=$1\nPORT=$2\n\necho \"$(date -u): Checking whether we can bind to ${HOST}:${PORT}\"\nwhile (ss -Htnl src \"${HOST}\" \"sport = :${PORT}\" | grep -wq \"${PORT}\"); do\n    echo \"$(date -u): ${HOST}:${PORT} still in use, waiting...\";\n    sleep 10;\ndone\n\nshift 2\nCOMMAND=\"$*\"\nif [ -z \"${COMMAND}\" ]; then\n    COMMAND=\"true\"\nfi\nexec $COMMAND\n"}, "pacemaker_resource_lock.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nMAX_RETRIES=10\nCIB_ENOTFOUND=105\n\nusage() {\n   echo \"Set a global property in the cluster with a validity timestamp.\"\n   echo \"Usage:\"\n   echo \"   $0 --acquire <lock_name> <lock_owner> <lock_ttl_in_seconds>\"\n   echo \"   $0 --release <lock_name> <lock_owner>\"\n   echo\n}\n\nlog() {\n    echo \"$(date -u): $1\" 1>&2\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\nlock_create() {\n    local name=$1\n    local data=$2\n    # cibadmin won't overwrite a key if someone else succeeded to create it concurrently\n    cibadmin --sync-call --scope crm_config --create --xml-text \"<cluster_property_set id='${name}'><nvpair id='${name}-pair' name='${name}' value='${data}'/></cluster_property_set>\" &>/dev/null\n    return $?\n}\n\nlock_update() {\n    local name=$1\n    local expected_data=$2\n    local new_data=$3\n    # we only update the lock we expect to see, so we can't update someone else's lock\n    cibadmin --sync-call --scope crm_config --modify --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" --xml-text \"<nvpair id='${name}-pair' name='${name}' value='${new_data}'/>\" &>/dev/null\n    return $?\n}\n\nlock_delete() {\n    local name=$1\n    local expected_data=$2\n    # we only delete the lock we expect to see, so we can't delete someone else's lock\n    cibadmin --sync-call --scope crm_config --delete --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" &>/dev/null\n    return $?\n}\n\nlock_get() {\n    local lockname=$1\n    local res\n    local rc\n    res=$(cibadmin --query --scope crm_config --xpath \"//cluster_property_set/nvpair[@name='$lockname']\" 2>/dev/null)\n    rc=$?\n    if [ $rc -eq 0 ]; then\n        echo \"$res\" | sed -n 's/.*value=\"\\([^\"]*\\)\".*/\\1/p'\n    fi\n    return $rc\n}\n\nlock_owner() {\n    local lock=$1\n    echo \"$lock\" | cut -d':' -f1\n}\n\nlock_has_expired() {\n    local lock=$1\n    local expiry=$(echo \"$lock\" | cut -d':' -f2)\n    local now=$(date +%s)\n    test $now -ge $expiry\n}\n\n\n# Perform a lock action and restart if the CIB has been modified before\n# committing the lock action\ntry_action() {\n    local fun=$1\n    local lock=$2\n    local requester=$3\n    local args=${4:-}\n    local tries=$MAX_RETRIES\n    local rc=1\n    if [ \"$fun\" = \"lock_acquire\" ] || [ \"$fun\" = \"lock_release\" ]; then\n        log \"Try running $fun\"\n    else\n        return 2\n    fi\n    while [ $rc -ne 0 ]; do\n        $fun $lock $requester $args\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Operation $1 succeeded\"\n            return 0\n        elif [ $rc -eq 3 ]; then\n            # rc == 3 -> CIB changed before push\n            if [ $tries -eq 0 ]; then\n                log \"Failed to commit after $MAX_RETRIES retries. Bailing out.\"\n                return 2\n            else\n                log \"Failed to commit. Retrying operation.\"\n                tries=$(($tries - 1))\n            fi\n        elif [ $rc -eq 2 ]; then\n            # rc == 2 -> unrecoverable cib error (e.g. pacemaker down)\n            log \"Unexpected failure. Bailing out\"\n            return $rc\n        else\n            # rc == 1 -> lock error (not owner, lock doesn't exists)\n            return $rc\n        fi\n    done\n}\n\n# The lock mechanism uses cibadmin's atomic creation so cluster-wide\n# state coherency is guaranteed by pacemaker\nlock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc\n    local lock\n    local expiry\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -n \"$lock\" ]; then\n        lock_has_expired $lock\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Lock has expired, now available for being held\"\n        else\n            # lock is still held. check whether we're the owner\n            owner=$(lock_owner $lock)\n            if [ \"$owner\" = \"$requester\" ];then\n                log \"Requester already owns the lock, acquiring attempt will just reconfigure the TTL\"\n            else\n                log \"Lock is held by someone else ($owner)\"\n                return 1\n            fi\n        fi\n    else\n        log \"Lock is not held yet\"\n    fi\n\n    # prepare the lock info\n    expiry=$(($(date +%s) + $ttl))\n\n    if [ -n \"$lock\" ]; then\n        log \"Attempting to update the lock\"\n        lock_update $lockname \"$lock\" \"$requester:$expiry\"\n        rc=$?\n    else\n        log \"Attempting to acquire the lock\"\n        lock_create $lockname \"$requester:$expiry\"\n        rc=$?\n    fi\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' acquired by '$requester', valid until $(date -d @$expiry)\"\n        return 0\n    else\n        log \"CIB changed, lock cannot be acquired\"\n        return 3\n    fi\n}\n\n\n# The lock mechanism uses the CIB's num_updates tag to implement\n# a conditional store. Cluster-wide locking is guaranteed by pacemaker\nlock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n    local lock\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        log \"Lock doesn't exist. Nothing to release\"\n        return 0\n    else\n        log \"Lock exists, check whether we're the owner\"\n        owner=$(lock_owner $lock)\n        if [ \"$owner\" != \"$requester\" ];then\n            log \"Lock is held by someone else ($owner), will not unlock\"\n            return 1\n        fi\n    fi\n\n    lock_delete $lockname \"$lock\"\n    rc=$?\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' released by '$requester'\"\n        return 0\n    else\n        log \"CIB deletion error, lock cannot be released\"\n        return 3\n    fi\n}\n\n\n# Retrieve the owner of a lock from the CIB\n# this is a read-only operation, so no need to log debug info\nlock_get_owner() {\n    local lockname=$1\n    local rc\n    local lock\n    local owner\n\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        return 1\n    else\n        lock_owner $lock\n        return 0\n    fi\n}\n\n\nACTION=$1\nLOCKNAME=$2\nREQUESTER=$3\nTTL=${4:-60}\n\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nif [ $ACTION != \"--help\" ]; then\n    if [ -z \"$LOCKNAME\" ]; then\n        error \"You must specific a lock name\"\n    fi\n    if [ $ACTION != \"--owner\" ] && [ $ACTION != \"-o\" ]; then\n        if [ -z \"$REQUESTER\" ]; then\n            error \"You must specific a lock requester\"\n        fi\n    fi\nfi\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) try_action lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --release|-r) try_action lock_release $LOCKNAME $REQUESTER;;\n    --acquire-once|-A) lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --owner|-o) lock_get_owner $LOCKNAME;;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}, "pacemaker_mutex_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_restart_bundle.sh --lock mysql galera galera-bundle Master _\n# pacemaker_mutex_restart_bundle.sh --lock ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\n\nset -u\n\nusage() {\n    echo \"Restart a clustered resource in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --lock <tripleo-service> <pcmk-resource> <pcmk-bundle> <target-state-local> <target-state-cluster>\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\nACTION=$1\ncase $ACTION in\n    --help) usage; exit 0;;\n    --lock) ;;\n    *) error \"Unknown action '$ACTION'\";;\nesac\n\nTRIPLEO_SERVICE=$2\nLOCK_NAME=${TRIPLEO_SERVICE}-restart-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to restart resource $TRIPLEO_SERVICE\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\nRESOURCE_NAME=$3\nBUNDLE_NAME=$4\nWAIT_TARGET_LOCAL=$5\nWAIT_TARGET_ANYWHERE=${6:-_}\n\nif pacemaker_supports_promoted; then\n    WAIT_TARGET_LOCAL=$(echo \"$5\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    WAIT_TARGET_ANYWHERE=$(echo \"${6:-_}\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    promoted_role=\"Promoted\"\nelse\n    promoted_role=\"Master\"\nfi\n\n# The lock TTL should accomodate for the resource start/promote timeout\nif [ \"$RESOURCE_NAME\" != \"$BUNDLE_NAME\" ]; then\n    if [ \"$WAIT_TARGET_LOCAL\" = \"$promoted_role\" ] || [ \"$WAIT_TARGET_ANYWHERE\" = \"$promoted_role\" ]; then\n        rsc_op=\"promote\"\n    else\n        rsc_op=\"start\"\n    fi\n    # <op id=\"galera-promote-interval-0s\" interval=\"0s\" name=\"promote\" on-fail=\"block\" timeout=\"300s\"/>\n    PCMK_TTL=$(cibadmin -Q | xmllint -xpath \"string(//primitive[@id='${RESOURCE_NAME}']/operations/op[@name='${rsc_op}']/@timeout)\" - | sed 's/s$//')\n    LOCK_TTL=$((PCMK_TTL + 30))\nelse\n    # The podman RA's default start timeout\n    LOCK_TTL=90\nfi\n\nlog \"Acquire a ${LOCK_TTL}s restart lock for service $TRIPLEO_SERVICE before restarting it\"\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nrc=1\nwhile [ $rc -ne 0 ]; do\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire $LOCK_NAME $LOCK_OWNER $LOCK_TTL\n    rc=$?\n    if [ $rc != 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not acquire lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Could not acquire lock, retrying\"\n            sleep 10\n        fi\n    fi\ndone\n\nlog \"Restart the service $TRIPLEO_SERVICE locally\"\n# Reuse the local restart script in t-h-t (driven by env var TRIPLEO_MINOR_UPDATE)\nTRIPLEO_MINOR_UPDATE=true /var/lib/container-config-scripts/pacemaker_restart_bundle.sh $TRIPLEO_SERVICE $RESOURCE_NAME $BUNDLE_NAME $WAIT_TARGET_LOCAL $WAIT_TARGET_ANYWHERE\n\n# If we reached this point, always try to release the lock\nlog \"Release the restart lock for service $TRIPLEO_SERVICE\"\n/var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $LOCK_NAME $LOCK_OWNER\nrc=$?\nif [ $rc -ne 0 ] && [ $rc -ne 1 ]; then\n    error \"Could not release held lock (rc: $rc)\"\nfi\n"}, "pacemaker_mutex_shutdown.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_shutdown.sh --acquire\n# pacemaker_mutex_shutdown.sh --release\n\nset -u\n\nusage() {\n    echo \"Shutdown a cluster node in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --acquire # prevent other node from shutting down until we hold the lock\"\n    echo \"   $0 --release # release the lock, other node can compete for the shutdown lock\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nshutdown_lock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc=1\n    local current_owner\n    local owner_stopped\n    local owner_rc\n\n    log \"Acquiring the shutdown lock\"\n    while [ $rc -ne 0 ]; do\n        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire-once $lockname $requester $ttl\n        rc=$?\n        if [ $rc -ne 0 ]; then\n            if [ $rc -eq 2 ]; then\n                error \"Could not acquire the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n            else\n                # The lock is held by another node.\n                current_owner=$(/var/lib/container-config-scripts/pacemaker_resource_lock.sh --owner $lockname)\n                owner_rc=$?\n                if [ $owner_rc -eq 2 ]; then\n                    error \"Could not get the shutdown lock owner due to unrecoverable error (rc: $owner_rc), bailing out\"\n                fi\n                if [ $owner_rc -eq 0 ]; then\n                    # If the owner is marked as offline, that means it has shutdown and\n                    # we can clean the lock preemptively and try to acquire it.\n                    owner_stopped=$(crm_mon -1X | xmllint --xpath 'count(//nodes/node[@name=\"'${current_owner}'\" and @online=\"false\" and @unclean=\"false\"])' -)\n                    if [ \"${owner_stopped}\" = \"1\" ]; then\n                        log \"Shutdown lock held by stopped node '${current_owner}', lock can be released\"\n                        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $current_owner\n                        continue\n                    fi\n                fi\n                log \"Shutdown lock held by another node (rc: $rc), retrying\"\n                sleep 10\n            fi\n        fi\n    done\n    log \"Shutdown lock acquired\"\n    return 0\n}\n\n\n# Release the lock if we still own it. Not owning it anymore is not fatal\nshutdown_lock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n\n    log \"Releasing the shutdown lock\"\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $requester\n    rc=$?\n    if [ $rc -ne 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not release the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Shutdown lock no longer held, nothing to do\"\n        fi\n    else\n        log \"Shutdown lock released\"\n    fi\n    return 0\n}\n\n\nACTION=$1\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nLOCK_NAME=tripleo-shutdown-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to aquire the shutdown lock\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\n# We start with a very high TTL, that long enough to accomodate a cluster stop.\n# As soon as the node will get offline, the other competing node will be entitled\n# to steal the lock, so they should never wait that long in practice.\nLOCK_TTL=600\n\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) shutdown_lock_acquire ${LOCK_NAME} ${LOCK_OWNER} ${LOCK_TTL};;\n    --release|-r) shutdown_lock_release ${LOCK_NAME} ${LOCK_OWNER};;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}}, "host_prep_tasks": [{"name": "get parameters", "set_fact": {"cert_path": "/etc/pki/tls/private/overcloud_endpoint.pem", "cert_content": "", "chain_content": "", "key_content": ""}, "no_log": "{{ hide_sensitive_logs | bool }}"}, {"name": "manage certificate", "when": ["cert_content is defined", "cert_content != ''"], "block": [{"name": "get DeployedSSLCertificatePath attributes", "register": "attr_cert_path", "stat": {"path": "{{cert_path}}"}}, {"name": "set is_haproxy_bootstrap_node fact", "set_fact": "is_haproxy_bootstrap_node={{haproxy_short_bootstrap_node_name | lower == ansible_facts['hostname'] | lower}}", "when": ["haproxy_short_bootstrap_node_name|default(false)"]}, {"name": "get haproxy status", "register": "haproxy_state", "systemd": {"name": "haproxy"}}, {"name": "get pacemaker status", "register": "pacemaker_state", "systemd": {"name": "pacemaker"}}, {"name": "get docker status", "register": "docker_state", "systemd": {"name": "docker"}}, {"name": "get container_id", "when": ["docker_state.status.ActiveState == 'active' or container_cli == 'podman'", "attr_cert_path.stat.exists", "attr_cert_path.stat.isdir == False"], "command": "{{ container_cli }} ps -q -f name='^haproxy(-bundle)?'", "register": "container_id"}, {"name": "get pcs resource name for haproxy container", "when": ["bootstrap_node is defined", "is_haproxy_bootstrap_node", "pacemaker_state.status.ActiveState == 'active'", "attr_cert_path.stat.exists", "attr_cert_path.stat.isdir"], "shell": "pcs status resources | sed -n 's/^.*container.*: \\(haproxy.*\\) .*/\\1/p'\n", "register": "pacemaker_resource"}, {"name": "remove DeployedSSLCertificatePath if is dir", "when": "attr_cert_path.stat.isdir is defined and attr_cert_path.stat.isdir", "file": {"path": "{{cert_path}}", "state": "absent"}}, {"name": "push certificate content", "no_log": "{{ hide_sensitive_logs | bool }}", "copy": {"dest": "{{cert_path}}", "mode": 288, "owner": "root", "content": "{{cert_content}}\n{{chain_content}}\n{{key_content}}\n"}}, {"name": "BM haproxy non-pacemaker context", "when": "haproxy_state.status.ActiveState == 'active'", "block": [{"name": "set certificate ownership", "file": {"path": "{{cert_path}}", "group": "haproxy"}}, {"name": "reload haproxy if enabled", "service": {"name": "haproxy", "state": "reloaded"}}]}, {"name": "restart pacemaker resource for haproxy", "when": ["pacemaker_resource is defined", "pacemaker_resource.stdout is defined", "pacemaker_resource.stdout != ''"], "command": "pcs resource restart \"{{pacemaker_resource.stdout}}\""}, {"name": "dedicated part for containers", "when": ["container_id is defined", "container_id.stdout is defined", "container_id.stdout != ''"], "block": [{"name": "copy certificate, chgrp, restart haproxy", "shell": "set -e\nif {{ container_cli }} ps -f \"id={{ item }}\" --format \"{{ '{{' }}.Names{{ '}}' }}\" | grep -q \"^haproxy-bundle\"; then\n  tar -c {{ cert_path }} | {{container_cli}} exec -i {{ item }} tar -C / -xv\nelse\n  {{ container_cli }} cp {{ cert_path }} {{ item }}:{{ cert_path }}\nfi\n{{ container_cli }} exec --user root {{ item }} chgrp haproxy {{ cert_path }}\n{{ container_cli }} kill --signal=HUP {{ item }}\n", "register": "container_kill_result", "failed_when": ["container_kill_result.rc != 0", "(\"no such container\" not in container_kill_result.stderr)", "(\"container state improper\" not in container_kill_result.stderr)"], "with_items": "{{ container_id.stdout.split('\n') }}"}]}]}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/log/containers/haproxy", "setype": "var_log_t", "mode": "0750"}, {"path": "/var/lib/haproxy", "setype": "container_file_t"}]}, {"name": "Run puppet on the host to apply IPtables rules", "no_log": true, "shell": "puppet apply {{ (puppet_debug|bool) | ternary('--debug --verbose', '') }} --detailed-exitcodes --summarize --color=false \\\n    --modulepath '{{ puppet_modulepath }}' --tags '{{ puppet_tags }}' -e '{{ puppet_execute }}'\n", "register": "puppet_host_outputs", "changed_when": "puppet_host_outputs.rc == 2", "failed_when": false, "vars": {"puppet_execute": "if hiera('enable_load_balancer', true) { class {'::tripleo::haproxy': use_internal_certificates => false, manage_firewall => hiera('tripleo::firewall::manage_firewall', true), }}", "puppet_tags": "tripleo::firewall::rule", "puppet_modulepath": "/etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules", "puppet_debug": false}}, {"name": "Debug output for task: Run puppet on the host to apply IPtables rules", "debug": {"var": "puppet_host_outputs.stdout_lines | default([]) | union(puppet_host_outputs.stderr_lines | default([]))"}, "when": ["not (ansible_check_mode | bool)", "puppet_host_outputs.rc is defined"], "failed_when": "puppet_host_outputs.rc not in [0, 2]"}], "metadata_settings": [], "deploy_steps_tasks": [{"name": "Configure rsyslog for HAproxy container managed by Pacemaker", "when": "step|int == 1", "block": [{"name": "Check if rsyslog exists", "shell": "systemctl is-active rsyslog", "register": "rsyslog_config"}, {"when": ["rsyslog_config is changed", "rsyslog_config.rc == 0"], "block": [{"name": "Forward logging to haproxy.log file", "blockinfile": {"content": "if $syslogfacility-text == '{{facility}}' and $programname == 'haproxy' then -/var/log/containers/haproxy/haproxy.log\n& stop\n", "create": true, "path": "/etc/rsyslog.d/openstack-haproxy.conf"}, "vars": {"facility": "local0"}, "register": "logconfig"}, {"name": "restart rsyslog service after logging conf change", "service": {"name": "rsyslog", "state": "restarted"}, "when": "logconfig is changed"}]}]}, {"name": "HAproxy tag container image for pacemaker", "when": "step|int == 1", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "registry.redhat.io/rhosp-rhel9/openstack-haproxy:17.1", "container_image_latest": "cluster.common.tag/haproxy:pcmklatest"}}, {"name": "HAproxy HA Wrappers Step", "when": "step|int == 2", "block": [{"name": "HAproxy puppet bundle", "import_role": {"name": "tripleo_ha_wrapper"}, "vars": {"tripleo_ha_wrapper_service_name": "haproxy", "tripleo_ha_wrapper_resource_name": "haproxy-bundle", "tripleo_ha_wrapper_bundle_name": "haproxy-bundle", "tripleo_ha_wrapper_resource_state": "Started", "tripleo_ha_wrapper_puppet_config_volume": "haproxy", "tripleo_ha_wrapper_puppet_execute": "include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::haproxy_bundle", "tripleo_ha_wrapper_puppet_tags": "pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation", "tripleo_ha_wrapper_puppet_debug": false, "tripleo_ha_wrapper_config_suffix": ".previous_run"}}]}], "external_update_tasks": [{"when": "step|int == 1", "tags": "ha_image_update", "block": [{"block": [{"name": "Get haproxy image from pacemaker", "become": true, "register": "xmllint_pcmk_haproxy_image", "shell": "xmllint --xpath \"string(//bundle[@id='haproxy-bundle']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container haproxy image", "set_fact": {"haproxy_image": "registry.redhat.io/rhosp-rhel9/openstack-haproxy:17.1", "haproxy_image_latest": "cluster.common.tag/haproxy:pcmklatest", "pcmk_haproxy_image": "{{xmllint_pcmk_haproxy_image.stdout}}"}}], "delegate_to": "{{ (groups[\"haproxy\"] | difference(groups[\"excluded_overcloud\"]))[0] }}"}, {"name": "haproxy temporary pacemaker container tag in case of image switch", "become": true, "import_role": {"name": "tripleo_ha_image_update"}, "vars": {"tripleo_ha_image_update_node_names": "{{ groups[\"haproxy\"] | difference(groups[\"excluded_overcloud\"]) }}", "tripleo_ha_image_update_bundle": "haproxy-bundle", "tripleo_ha_image_update_new_image": "{{haproxy_image_latest}}", "tripleo_ha_image_update_old_image": "{{pcmk_haproxy_image}}"}, "when": ["(pcmk_haproxy_image != \"\")", "(pcmk_haproxy_image != haproxy_image_latest)"]}]}], "update_tasks": [{"block": [{"name": "Get haproxy image from pacemaker", "become": true, "register": "xmllint_pcmk_haproxy_image", "shell": "xmllint --xpath \"string(//bundle[@id='haproxy-bundle']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container haproxy image", "set_fact": {"haproxy_image": "registry.redhat.io/rhosp-rhel9/openstack-haproxy:17.1", "haproxy_image_latest": "cluster.common.tag/haproxy:pcmklatest", "pcmk_haproxy_image": "{{xmllint_pcmk_haproxy_image.stdout}}"}}], "when": "(step|int == 0 or step|int == 2)"}, {"name": "Check for update of haproxy container image name", "when": "step|int == 0", "assert": {"that": "pcmk_haproxy_image == haproxy_image_latest", "fail_msg": "haproxy image change detected, run overcloud external-update --tags ha_image_update first"}}, {"name": "Tear-down non-HA haproxy container", "when": ["step|int == 1"], "block": [{"name": "Remove non-HA haproxy container", "include_role": {"name": "tripleo_container_rm"}, "vars": {"tripleo_container_cli": "{{ container_cli }}", "tripleo_containers_to_rm": ["haproxy"]}}]}, {"name": "Set HAProxy upgrade facts", "when": ["step|int == 1"], "block": [{"name": "set is_haproxy_bootstrap_node fact", "tags": "common", "set_fact": "is_haproxy_bootstrap_node={{haproxy_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}", "when": ["haproxy_short_bootstrap_node_name|default(false)"]}]}, {"name": "Mount TLS cert if needed", "when": ["step|int == 1", "is_haproxy_bootstrap_node"], "block": [{"name": "Check haproxy public certificate configuration in pacemaker", "command": "cibadmin --query --xpath \"//storage-mapping[@id='haproxy-cert']\"", "failed_when": false, "register": "haproxy_cert_mounted"}, {"name": "Disable the haproxy cluster resource", "pacemaker_resource": {"resource": "haproxy-bundle", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0", "when": "haproxy_cert_mounted.rc == 6"}, {"name": "Set HAProxy public cert volume mount fact", "set_fact": {"haproxy_public_cert_path": "/etc/pki/tls/private/overcloud_endpoint.pem", "haproxy_public_tls_enabled": false}}, {"name": "Add a bind mount for public certificate in the haproxy bundle", "command": "pcs resource bundle update haproxy-bundle storage-map add id=haproxy-cert source-dir={{ haproxy_public_cert_path }} target-dir=/var/lib/kolla/config_files/src-tls/{{ haproxy_public_cert_path }} options=ro", "when": "haproxy_cert_mounted.rc == 6 and haproxy_public_tls_enabled|bool"}, {"name": "Enable the haproxy cluster resource", "pacemaker_resource": {"resource": "haproxy-bundle", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0", "when": "haproxy_cert_mounted.rc == 6"}]}, {"name": "Haproxy fetch and retag container image for pacemaker", "tags": "haproxy_syn_block", "when": ["step|int == 2"], "block": [{"name": "Retag pcmklatest to latest haproxy image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{haproxy_image}}", "container_image_latest": "{{haproxy_image_latest}}"}}]}, {"name": "Move virtual IPs to another node before stopping pacemaker", "when": ["step|int == 1", "hostvars[inventory_hostname][\"haproxy_node_names\"]|default([])|length > 1"], "shell": "CLUSTER_NODE=$(crm_node -n)\necho \"Retrieving all the VIPs which are hosted on this node\"\nVIPS_TO_MOVE=$(crm_mon --as-xml | xmllint --xpath '//resource[@resource_agent=\"ocf:heartbeat:IPaddr2\" and @role = \"Started\" and @managed = \"true\" and ./node[@name = \"'${CLUSTER_NODE}'\"]]/@id' - | sed -e 's/id=//g' -e 's/\"//g')\nfor v in ${VIPS_TO_MOVE}; do\n    echo \"Moving VIP $v on another node\"\n    pcs resource ban $v ${CLUSTER_NODE} --wait=300\ndone\necho \"Removing the location constraints that were created to move the VIPs\"\nfor v in ${VIPS_TO_MOVE}; do\n    echo \"Removing location ban for VIP $v\"\n    ban_id=$(cibadmin --query | xmllint --xpath 'string(//rsc_location[@rsc=\"'${v}'\" and @node=\"'${CLUSTER_NODE}'\" and @score=\"-INFINITY\"]/@id)' -)\n    if [ -n \"$ban_id\" ]; then\n        pcs constraint remove ${ban_id}\n    else\n        echo \"Could not retrieve and clear location constraint for VIP $v\" 2>&1\n    fi\ndone\n"}, {"name": "Wait for 10s to settle connections on new VIPs", "wait_for": {"timeout": 10}, "when": ["step|int == 1", "hostvars[inventory_hostname][\"haproxy_node_names\"]|default([])|length > 1"]}, {"name": "Block local INPUT SYN packets on the backends except mysql", "tags": "haproxy_syn_block", "when": ["step|int == 1"], "shell": "# server controller-0.storage.redhat.local 172.17.3.93:8080 check fall 5 inter 2000 rise 2\n# server controller-0.internalapi.redhat.local fd00:fd00:fd00:2000::176:9292 check fall 5 inter 2000 rise 2\nset -o pipefail\nsource /etc/os-release; test  \"${VERSION_ID%*}\" = \"9.0\" && exit 0\ngrep {{ ansible_facts[\"hostname\"]|lower }} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg  | grep -v \":3306 \" | \\\nawk '{print $3}' | \\\nwhile read BACKEND; do\n    IP=${BACKEND%:*}\n    PORT=${BACKEND#\"$IP:\"}\n    if [[ $IP =~ .*:.* ]]\n      then PROTOCOL=\"ip6\"\n      else PROTOCOL=\"ip\"\n    fi\necho \"insert rule $PROTOCOL filter INPUT $PROTOCOL daddr $IP tcp dport $PORT tcp flags syn / fin,syn,rst,ack meta time\"\ndone | xargs -i nft {} $(date +%s)-$(date -d'+20 minutes' +%s) counter drop comment \"{{ ansible_facts[\"hostname\"]|lower }}_haproxy_drop\"\n"}, {"name": "Generate block for other nodes OUTPUT SYN packets on the backends except mysql", "tags": "haproxy_syn_block", "when": ["step|int == 1"], "shell": "set -o pipefail\nsource /etc/os-release; test  \"${VERSION_ID%*}\" = \"9.0\" && exit 0\ngrep {{ ansible_facts[\"hostname\"]|lower }} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg  | grep -v \":3306 \" | \\\nawk '{print $3}' | \\\nwhile read BACKEND; do\n    IP=${BACKEND%:*}\n    PORT=${BACKEND#\"$IP:\"}\n    if [[ $IP =~ .*:.* ]]\n      then PROTOCOL=\"ip6\"\n      else PROTOCOL=\"ip\"\n    fi\n echo \"nft insert rule $PROTOCOL \\$TABLE OUTPUT $PROTOCOL daddr $IP tcp dport $PORT tcp flags syn / fin,syn,rst,ack meta time $(date +%s)-$(date -d'+20 minutes' +%s) counter drop comment \\\"{{ ansible_facts[\"hostname\"]|lower }}_haproxy_drop\\\" \"\ndone\n", "register": "haproxy_iptables_block"}, {"name": "Block OUTPUT SYN packets to this node on other haproxy nodes", "tags": "haproxy_syn_block", "delegate_to": "{{ item }}", "when": ["step|int == 1"], "shell": "set -o pipefail\ngrep {{ ansible_facts[\"hostname\"]|lower }} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | head -n 1 \\\nawk '{print $3}' | while read BACKEND; do\n    IP=${BACKEND%:*}\n    if [[ $IP =~ .*:.* ]]\n      then PROTOCOL=\"ip6\"\n      else PROTOCOL=\"ip\"\n    fi\ndone\nTABLE=$(nft list tables | grep -q \"$PROTOCOL raw\" && echo raw || echo filter )\necho \"{{ haproxy_iptables_block.stdout}}\" | while read i; do bash -c \"$i\"; done\n", "loop": "{{ groups[\"haproxy\"] | difference(groups[\"excluded_overcloud\"]) | difference(ansible_facts[\"hostname\"]|lower) }}"}], "post_update_tasks": [{"name": "HAProxy bundle post update", "when": "step|int == 1", "block": [{"name": "HAproxy puppet bundle", "import_role": {"name": "tripleo_ha_wrapper"}, "vars": {"tripleo_ha_wrapper_service_name": "haproxy", "tripleo_ha_wrapper_resource_name": "haproxy-bundle", "tripleo_ha_wrapper_bundle_name": "haproxy-bundle", "tripleo_ha_wrapper_resource_state": "Started", "tripleo_ha_wrapper_puppet_config_volume": "haproxy", "tripleo_ha_wrapper_puppet_execute": "include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::haproxy_bundle", "tripleo_ha_wrapper_puppet_tags": "pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation", "tripleo_ha_wrapper_puppet_debug": false, "tripleo_ha_wrapper_config_suffix": ".previous_run"}}], "vars": {"tripleo_ha_wrapper_minor_update": true}}, {"name": "Cleanup local SYN DROP rules", "tags": "haproxy_syn_block", "when": "step|int == 1", "shell": "nft -a list chain filter INPUT | grep {{ ansible_facts[\"hostname\"]|lower }} | grep haproxy_drop | \\\nawk -F# '{print \"nft delete rule filter INPUT \"$2}' | \\\nwhile read i; do bash -c \"$i\"; done\n"}, {"name": "Cleanup SYN DROP rules from other haproxy nodes", "tags": "haproxy_syn_block", "when": "step|int == 1", "delegate_to": "{{ item }}", "loop": "{{ groups[\"haproxy\"] | difference(groups[\"excluded_overcloud\"]) | difference(ansible_facts[\"hostname\"]|lower) }}", "shell": "nft -a list chain raw OUTPUT | grep {{ ansible_facts[\"hostname\"]|lower }} | grep haproxy_drop | \\\nawk -F# '{print \"nft delete rule raw OUTPUT \"$2}' | \\\nwhile read i; do bash -c \"$i\"; done\n"}], "upgrade_tasks": [{"name": "Tear-down non-HA haproxy container", "when": ["step|int == 0"], "block": [{"name": "Remove non-HA haproxy container", "include_role": {"name": "tripleo_container_rm"}, "vars": {"tripleo_container_cli": "{{ container_cli }}", "tripleo_containers_to_rm": ["haproxy"]}}]}, {"name": "Prepare switch of haproxy image name", "when": ["step|int == 0"], "block": [{"name": "Get haproxy image id currently used by pacemaker", "shell": "pcs resource config haproxy-bundle | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'", "register": "haproxy_image_current_res", "failed_when": false}, {"name": "Image facts for haproxy", "set_fact": {"haproxy_image_latest": "cluster.common.tag/haproxy:pcmklatest", "haproxy_image_current": "{{haproxy_image_current_res.stdout}}"}}, {"name": "Temporarily tag the current haproxy image id with the upgraded image name", "import_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{haproxy_image_current}}", "container_image_latest": "{{haproxy_image_latest}}", "pull_image": false}, "when": ["haproxy_image_current != ''", "haproxy_image_current != haproxy_image_latest"]}, {"name": "Create haproxy retag statefile", "file": {"path": "/var/lib/tripleo/haproxy_needs_retag", "state": "touch"}, "when": ["haproxy_image_current != ''", "haproxy_image_current != haproxy_image_latest"]}]}, {"name": "Update haproxy pcs resource bundle for new container image", "when": ["step|int == 1"], "block": [{"name": "Set upgrade haproxy facts", "set_fact": {"is_haproxy_bootstrap_node": "{{haproxy_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}"}}, {"name": "Check for haproxy retag statefile", "stat": {"path": "/var/lib/tripleo/haproxy_needs_retag"}, "register": "haproxy_retag_state_file"}]}, {"name": "Update haproxy pcs resource bundle for new container image", "when": ["step|int == 1", "is_haproxy_bootstrap_node|bool", "haproxy_retag_state_file.stat.exists|bool"], "block": [{"name": "Disable the haproxy cluster resource before container upgrade", "pacemaker_resource": {"resource": "haproxy-bundle", "state": "disable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Expose HAProxy stats socket on the host and mount TLS cert if needed", "block": [{"name": "Check haproxy stats socket configuration in pacemaker", "command": "cibadmin --query --xpath \"//storage-mapping[@id='haproxy-var-lib']\"", "failed_when": false, "register": "haproxy_stats_exposed"}, {"name": "Check haproxy public certificate configuration in pacemaker", "command": "cibadmin --query --xpath \"//storage-mapping[@id='haproxy-cert']\"", "failed_when": false, "register": "haproxy_cert_mounted"}, {"name": "Add a bind mount for stats socket in the haproxy bundle", "command": "pcs resource bundle update haproxy-bundle storage-map add id=haproxy-var-lib source-dir=/var/lib/haproxy target-dir=/var/lib/haproxy options=rw", "when": "haproxy_stats_exposed.rc == 6"}, {"name": "Set HAProxy public cert volume mount fact", "set_fact": {"haproxy_public_cert_path": "/etc/pki/tls/private/overcloud_endpoint.pem", "haproxy_public_tls_enabled": false}}, {"name": "Add a bind mount for public certificate in the haproxy bundle", "command": "pcs resource bundle update haproxy-bundle storage-map add id=haproxy-cert source-dir={{ haproxy_public_cert_path }} target-dir=/var/lib/kolla/config_files/src-tls/{{ haproxy_public_cert_path }} options=ro", "when": ["haproxy_cert_mounted.rc == 6", "haproxy_public_tls_enabled|bool"]}]}, {"name": "Update the haproxy bundle to use the new container image name", "command": "pcs resource bundle update haproxy-bundle container image={{haproxy_image_latest}}"}, {"name": "Enable the haproxy cluster resource", "pacemaker_resource": {"resource": "haproxy-bundle", "state": "enable", "wait_for_resource": true}, "register": "output", "retries": 5, "until": "output.rc == 0"}, {"name": "Remove haproxy retag statefile", "file": {"path": "/var/lib/tripleo/haproxy_needs_retag", "state": "absent"}}]}, {"name": "Retag the pacemaker image if containerized", "when": ["step|int == 3"], "block": [{"block": [{"name": "Get haproxy image from pacemaker", "become": true, "register": "xmllint_pcmk_haproxy_image", "shell": "xmllint --xpath \"string(//bundle[@id='haproxy-bundle']/podman/@image)\" /var/lib/pacemaker/cib/cib.xml"}, {"name": "Get container haproxy image", "set_fact": {"haproxy_image": "registry.redhat.io/rhosp-rhel9/openstack-haproxy:17.1", "haproxy_image_latest": "cluster.common.tag/haproxy:pcmklatest", "pcmk_haproxy_image": "{{xmllint_pcmk_haproxy_image.stdout}}"}}]}, {"block": [{"name": "Retag pcmklatest to latest haproxy image", "include_role": {"name": "tripleo_container_tag"}, "vars": {"container_image": "{{haproxy_image}}", "container_image_latest": "{{haproxy_image_latest}}"}}]}, {"name": "Ensure config works for the new config", "shell": "set -o pipefail\nawk -i inplace -v INPLACE_SUFFIX=.bak '/  rsprep/ {print \"  http-response replace-header Location \" $3\" \"$5; next;}; {print} ' /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg"}]}]}, "tuple:('role_data', 'config_settings')": {"tripleo::haproxy::haproxy_service_manage": false, "tripleo::haproxy::haproxy_log_address": "/dev/log", "tripleo::haproxy::haproxy_log_facility": "local0", "tripleo::haproxy::haproxy_stats_user": "admin", "tripleo::haproxy::haproxy_stats_password": "K4rBn0ytG7kChxFj8xL0JLvCM", "tripleo::haproxy::haproxy_stats_bind_address": "%{hiera('ctlplane')}", "tripleo::haproxy::redis_password": "49auApjwL72waJnu1huMAuwhk", "tripleo::haproxy::crl_file": null, "tripleo::haproxy::haproxy_stats": true, "enable_load_balancer": true, "tripleo::profile::base::haproxy::certificates_specs": {}, "tripleo::haproxy::mysql_clustercheck": true, "haproxy_docker": true, "tripleo::profile::pacemaker::haproxy_bundle::container_backend": "podman", "tripleo::profile::pacemaker::haproxy_bundle::tls_mapping": [], "tripleo::profile::pacemaker::haproxy_bundle::tls_mapping_init_bundle": [], "tripleo::profile::pacemaker::haproxy_bundle::internal_certs_directory": "/etc/pki/tls/certs/haproxy", "tripleo::profile::pacemaker::haproxy_bundle::internal_keys_directory": "/etc/pki/tls/private/haproxy", "tripleo::profile::pacemaker::haproxy_bundle::haproxy_docker_image": "cluster.common.tag/haproxy:pcmklatest"}, "tuple:('role_data', 'container_config_scripts')": {"container_puppet_apply.sh": {"mode": "0700", "content": "#!/bin/bash\nset -eux\nSTEP=$1\nTAGS=$2\nCONFIG=$3\nEXTRA_ARGS=${4:-''}\nif [ -d /tmp/puppet-etc ]; then\n  # ignore copy failures as these may be the same file depending on docker mounts\n  cp -a /tmp/puppet-etc/* /etc/puppet || true\nfi\necho \"{\\\"step\\\": ${STEP}}\" > /etc/puppet/hieradata/docker_puppet.json\n# $::deployment_type in puppet-tripleo\nexport FACTER_deployment_type=containers\nset +e\npuppet apply $EXTRA_ARGS \\\n    --verbose \\\n    --detailed-exitcodes \\\n    --summarize \\\n    --color=false \\\n    --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \\\n    --tags $TAGS \\\n    -e \"noop_resource('package'); ${CONFIG}\"\nrc=$?\nset -e\nset +ux\nif [ $rc -eq 2 -o $rc -eq 0 ]; then\n    exit 0\nfi\nexit $rc\n"}, "pyshim.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n#\n# Usage: pyshim.sh <script and/or arguments>\n#\n# Unfortunately THT doesn't know which version of python might be in a\n# container so we need this script to be able to try python3 or python2\n# depending on availability.  Since this is a temporary shim until we've\n# fully cut over to python3, we check for the existence of python3 first\n# before falling back to python2. This will help in the transition from\n# python2 based containers to python3.\n\nshow_usage() {\n    echo \"Usage: pyshim.sh <script and/or arguments>\"\n}\n\nif [ $# -lt 1 ]\nthen\n    show_usage\n    exit 1\nfi\n\nset -x\nif command -v python3 >/dev/null; then\n    python3 \"$@\"\nelif command -v python2 >/dev/null; then\n    python2 \"$@\"\nelif command -v python >/dev/null; then\n    python \"$@\"\nelse\n    echo \"ERROR: python is not available!\"\n    exit 1\nfi\n"}, "pacemaker_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nset -u\n\n# ./pacemaker_restart_bundle.sh mysql galera galera-bundle Master _\n# ./pacemaker_restart_bundle.sh redis redis redis-bundle Slave Master\n# ./pacemaker_restart_bundle.sh ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\nRESTART_SCRIPTS_DIR=$(dirname $0)\nTRIPLEO_SERVICE=$1\nRESOURCE_NAME=$2\nBUNDLE_NAME=$3\nWAIT_TARGET_LOCAL=$4\nWAIT_TARGET_ANYWHERE=${5:-_}\nTRIPLEO_MINOR_UPDATE=\"${TRIPLEO_MINOR_UPDATE:-false}\"\nTRIPLEO_HA_WRAPPER_RESOURCE_EXISTS=\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS:-false}\"\n\nbundle_can_be_restarted() {\n    local bundle=$1\n    # As long as the resource bundle is managed by pacemaker and is\n    # not meant to stay stopped, no matter the state of any inner\n    # pcmk_remote or ocf resource, we should restart it to give it a\n    # chance to read the new config.\n    [ \"$(crm_resource --meta -r $1 -g is-managed 2>/dev/null)\" != \"false\" ] && \\\n    [ \"$(crm_resource --meta -r $1 -g target-role 2>/dev/null)\" != \"Stopped\" ]\n}\n\nlog() {\n    local msg=$1\n    logger -t pcmkrestart \"$1\"\n}\n\nHOSTNAME=$(/bin/hostname -s)\nif [ x\"${TRIPLEO_MINOR_UPDATE,,}\" != x\"true\" ]; then\n    if [ x\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS,,}\" = x\"false\" ]; then\n        # Do not restart during initial deployment, as the resource\n        # has just been created.\n        SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n        if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n            log \"Initial deployment, skipping the restart of ${BUNDLE_NAME}\"\n\tfi\n        exit 0\n    else\n        # During a stack update, this script is called in parallel on\n        # every node the resource runs on, after the service's configs\n        # have been updated on all nodes. So we need to run pcs only\n        # once (e.g. on the service's boostrap node).\n        if bundle_can_be_restarted ${BUNDLE_NAME}; then\n            SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n            if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n                replicas_running=$(crm_resource -Q -r $BUNDLE_NAME --locate 2>&1 | wc -l)\n                if [ \"$replicas_running\" != \"0\" ]; then\n                    log \"Restarting ${BUNDLE_NAME} globally. Stopping:\"\n                    /sbin/pcs resource disable --wait=600 $BUNDLE_NAME\n                    log \"Restarting ${BUNDLE_NAME} globally. Starting:\"\n                    /sbin/pcs resource enable --wait=600 $BUNDLE_NAME\n                else\n                    log \"${BUNDLE_NAME} is not running anywhere,\" \\\n                         \"cleaning up to restart it globally if necessary\"\n                    /sbin/pcs resource cleanup $BUNDLE_NAME\n                fi\n            else\n                log \"Skipping global restart of ${BUNDLE_NAME} on ${HOSTNAME} it will be restarted by node ${SERVICE_NODEID}\"\n            fi\n\n        else\n            log \"No global restart needed for ${BUNDLE_NAME}.\"\n        fi\n    fi\nelse\n    # During a minor update workflow however, a host gets fully\n    # updated before updating the next one. So unlike stack\n    # update, at the time this script is called, the service's\n    # configs aren't updated on all nodes yet. So only restart the\n    # resource locally, where it's guaranteed that the config is\n    # up to date.\n    HOST=$(facter hostname)\n\n    if bundle_can_be_restarted ${BUNDLE_NAME}; then\n\t# if the resource is running locally, restart it\n\tif crm_resource -r $BUNDLE_NAME --locate 2>&1 | grep -w -q \"${HOST}\"; then\n            log \"Restarting ${BUNDLE_NAME} locally on '${HOST}'\"\n            /sbin/pcs resource restart $BUNDLE_NAME \"${HOST}\"\n\n\telse\n\t    # At this point, if no resource is running locally, it's\n\t    # either because a) it has failed previously, or b) because\n\t    # it's an A/P resource running elsewhere.\n\t    # By cleaning up resource, we ensure that a) it will try to\n\t    # restart, or b) it won't do anything if the resource is\n\t    # already running elsewhere.\n            log \"${BUNDLE_NAME} is currently not running on '${HOST}',\" \\\n                 \"cleaning up its state to restart it if necessary\"\n            /sbin/pcs resource cleanup $BUNDLE_NAME node=\"${HOST}\"\n\tfi\n\n\t# Wait until the resource is in the expected target state\n\t$RESTART_SCRIPTS_DIR/pacemaker_wait_bundle.sh \\\n            $RESOURCE_NAME $BUNDLE_NAME \\\n            \"$WAIT_TARGET_LOCAL\" \"$WAIT_TARGET_ANYWHERE\" \\\n\t    \"${HOST}\" 600\n    else\n        log \"No restart needed for ${BUNDLE_NAME}.\"\n    fi\nfi\n"}, "pacemaker_wait_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# ----\n# Wait for an OCF resource or a bundle to be restarted\n# ----\n# e.g.:\n# M/S OCF:      $0 galera galera-bundle Master\n# clone OCF:    $0 rabbitmq rabbitmq-bundle Started\n# A/P M/S OCF:  $0 redis redis-bundle Slave Master\n# A/P bundle:   $0 openstack-cinder-volume openstack-cinder-volume _ Started\n# clone bundle: $0 haproxy-bundle haproxy-bundle Started\n\n# design note 1:\n#  - this script is called during a minor update; it is called\n#    once per node that hosts a service replica.\n#  - the purpose of this script is to ensure that restarting the\n#    service replica locally won't disrupt the service availability\n#    for the end user. To reach that goal, the script waits until the\n#    service is restarted locally or globallu and reaches a given\n#    target state (i.e. Started, Slave or Master).\n# design note 2:\n#   - we don't want to track restart error: our only job is to ensure\n#     service restart synchronization, not service health.\n#   - In particular, we don't want to error out in case the resource\n#     cannot be restarted locally, because that would make the minor\n#     update fail, even if potentially other replicas still provide\n#     the service.\n# design note 3:\n#   - we can bail out early if we determine that the resource can't\n#     be restarted automatically by pacemaker (e.g. its \"blocked\",\n#     unmanaged or disabled).\n\nlog() {\n    local msg=$1\n    echo \"$(date -u): $1\"\n}\n\nusage() {\n    echo 2>&1 \"Usage: $0 NAME BUNDLE_NAME ROLE_LOCAL [ROLE_ANYWHERE] [HOST] [TIMEOUT]\"\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\n#\n# Utility functions to detect stuck resources\n#\n\nbundle_failures_locally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local replica_name\n    for i in $(seq 0 $last); do\n\treplica_name=${BUNDLE_NAME}-${engine}-${i}\n\tcrm_failcount -q -G -r $replica_name -N $HOST\n    done\n}\n\nbundle_failures_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    for i in $(seq 0 $last); do\n\tcrm_failcount -q -G -r ${BUNDLE_NAME}-${engine}-${i}\n    done\n}\n\nbundle_running_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    # return the number of running bundles replica, i.e. the number of\n    # docker/podman resource replicas currently running in the cluster\n    crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:heartbeat:${engine}']/node)\" -\n}\n\nocf_failures_globally() {\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local bundle_node\n    for i in $(seq 0 $last); do\n\tbundle_node=${BUNDLE_NAME}-${i}\n\tcrm_failcount -q -G -r $NAME -N $bundle_node\n    done\n}\n\ndid_resource_failed_locally() {\n    local failures\n    local running\n    local remotehost\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# if we're dealing with an ocf resource, it is running on a\n\t# pacemaker_remote rather that on the real host, and the\n\t# failcounts are thus associated to the pcmk remote. Replace\n\t# the host's name with the pcmk remote's name.\n        remotehost=$(crm_mon --as-xml | xmllint --xpath \"string(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource/node[@name='${HOST}']/../../resource[@resource_agent='${OCF}:pacemaker:remote']/@id)\" -)\n\tif [ -n \"${remotehost}\" ]; then\n\t    crm_failcount -q -G -r $NAME -N $remotehost | grep -q -w INFINITY\n\t    return $?\n\tfi\n\t# If no pcmk remote is currently running, the failcount from\n\t# the ocf resource is useless, compute the failcount from the\n\t# bundle case instead (computed below).\n    fi\n\n    # for bundles, pacemaker can run any bundle replica locally\n    # (e.g. galera-bundle-docker-{0,1,2}), and a failure happens when\n    # there are no more replica to try.\n    # That is, when _at least_ one replica failed locally, and all the\n    # others either failed or are currently running elsewhere.\n    failures=$(bundle_failures_locally $HOST | grep -c -w INFINITY)\n    running=$(bundle_running_globally)\n    test $failures -gt 0 && \\\n    test $(( $failures + $running )) -ge $BUNDLE_REPLICAS\n}\n\ndid_resource_failed_globally() {\n    local remotecount\n    local failures\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# we check the state of an ocf resource only if the\n\t# pcmkremotes are started\n        remotecount=$(crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node)\" -)\n\tif [ \"${remotecount}\" = \"0\" ]; then\n\t    # no pcmkremote is running, so check the bundle state\n\t    # instead of checking the ocf resource\n\t    # bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\t    failures=$(bundle_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\telse\n\t    # ocf resource failed if it failed to start on\n\t    # all $BUNDLE_REPLICAS bundle nodes\n\t    failures=$(ocf_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\tfi\n    else\n\t# bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\tfailures=$(bundle_failures_globally | grep -c -w INFINITY)\n\ttest $failures -eq $BUNDLE_REPLICAS\n    fi\n}\n\n\n# Input validation\n#\n\nNAME=$1\nif [ -z \"${NAME}\" ]; then\n    echo 2>&1 \"Error: argument NAME must not be empty\"\n    exit 1\nfi\n\nBUNDLE_NAME=$2\nif [ -z \"${BUNDLE_NAME}\" ]; then\n    echo 2>&1 \"Error: argument BUNDLE_NAME must not be empty\"\n    exit 1\nfi\n\nROLE_LOCAL=$3\nif [ \"${ROLE_LOCAL}\" = \"_\" ]; then\n    ROLE_LOCAL=\"\"\nfi\n\nROLE_ANYWHERE=$4\nif [ \"${ROLE_ANYWHERE}\" = \"_\" ]; then\n    ROLE_ANYWHERE=\"\"\nfi\n\nif [ -z \"${ROLE_LOCAL}\" ]; then\n    if [ -z \"${ROLE_ANYWHERE}\" ]; then\n        echo 2>&1 \"Error: either ROLE_LOCAL or ROLE_ANYWHERE must be non empty\"\n        exit 1\n    fi\nelse\n    if !(echo \"${ROLE_LOCAL}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n        echo 2>&1 \"Error: argument ROLE_LOCAL must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n        exit 1\n    fi\nfi\n\nif [ -n \"${ROLE_ANYWHERE}\" ] && !(echo \"${ROLE_ANYWHERE}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n    echo 2>&1 \"Error: argument ROLE_ANYWHERE must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n    exit 1\nfi\n\n# Ensure compatibility with pacemaker 2.1\nif pacemaker_supports_promoted; then\n    ROLE_LOCAL=$(echo \"$ROLE_LOCAL\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    ROLE_ANYWHERE=$(echo \"$ROLE_ANYWHERE\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    OCF=\"ocf\"\nelse\n    OCF=\"ocf:\"\nfi\n\nHOST=${5:-$(facter hostname)}\nTIMEOUT=${6:-600}\n\n\n# Configure the search\n# ----\n# Note: we can't use crm_resource in all searches because we can't\n# easily extract the host the OCF resources run on (crm_resource\n# returns the pcmk-remote nodes rather than the hosts)\n# So instead, we implement various searches with XPath directly.\n\nif [ \"${BUNDLE_NAME}\" != \"${NAME}\" ]; then\n# ocf resource\nlocal_resource_xpath=\"//bundle/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node[@name='${HOST}']/../../resource[@id='${NAME}']\"\nany_resource_xpath=\"//bundle//resource[@id='${NAME}']\"\nreplicas_xpath=\"//bundle/primitive[@id='${BUNDLE_NAME}']/../*[boolean(@image) and boolean(@replicas)]\"\nelse\n# bundle resource\nlocal_resource_xpath=\"//bundle[@id='${NAME}']/replica/resource/node[@name='${HOST}']/../../resource\"\nany_resource_xpath=\"//bundle[@id='${NAME}']//resource\"\nreplicas_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nfi\n\nbundle_def_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nBUNDLE_CONTAINER_ENGINE=$(cibadmin -Q | xmllint --xpath \"name(${bundle_def_xpath})\" -)\nBUNDLE_REPLICAS=$(cibadmin -Q | xmllint --xpath \"string(${bundle_def_xpath}/@replicas)\" -)\n\n\n# The wait algorithm follows a two-stage approach\n#  1. Depending on how the script is called, we first check whether\n#     the resource is restarted locally. An A/P resource may be\n#     restarted elsewhere in the cluster.\n#  2. If needed, check whether the A/P resource has restarted\n#     elsewhere. For A/P M/S resources, in case the resource is\n#     restarted as Slave locally, ensure a Master is available.\n\nsuccess=1\nbailout=1\ntimeout=$TIMEOUT\nrole=\"\"\n\n# Stage 1: local check\nif [ -n \"$ROLE_LOCAL\" ]; then\n    log \"Waiting until ${NAME} has restarted on ${HOST} and is in state ${ROLE_LOCAL}\"\n    log \"Will probe resource state with the following XPath pattern: ${local_resource_xpath}\"\n\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resource=$(crm_mon -r --as-xml | xmllint --xpath \"${local_resource_xpath}\" - 2>/dev/null)\n        role=$(echo \"${resource}\" | sed -ne 's/.*\\Wrole=\"\\([^\"]*\\)\".*/\\1/p')\n\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resource}\" | grep -q -w \"\\Wblocked=\\\"true\\\"\"; then\n            log \"${NAME} is blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_locally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif [ \"$role\" = \"$ROLE_LOCAL\" ]; then\n            success=0\n            continue\n        elif [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" = \"$ROLE_ANYWHERE\" ]; then\n            # A/P: we are restarted in the expected state\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_LOCAL} on ${HOST}\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\n# Stage 2: global check\nif [ $timeout -gt 0 ] && [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" != \"$ROLE_ANYWHERE\" ]; then\n    log \"Wait until ${NAME} is restarted anywhere in the cluster in state ${ROLE_ANYWHERE}\"\n    log \"Will probe resource state with the following XPath pattern: ${any_resource_xpath}\"\n\n    success=1\n    bailout=1\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resources=$(crm_mon -r --as-xml | xmllint --xpath \"${any_resource_xpath}\" - 2>/dev/null)\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif ! (echo \"${resources}\" | grep -q -w \"\\Wblocked=\\\"false\\\"\"); then\n            log \"${NAME} blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_globally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resources}\" | grep -q -w \"\\Wrole=\\\"${ROLE_ANYWHERE}\\\"\"; then\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_ANYWHERE} anywhere in the cluster\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\nif [ $timeout -le 0 ]; then\n    log \"Timeout reached after ${TIMEOUT}s while waiting for ${NAME} to be restarted\"\nelif [ $bailout -le 0 ]; then\n    log \"Restart monitoring for ${NAME} cancelled\"\nfi\n\nif [ $success -eq 0 ]; then\n    log \"${NAME} successfully restarted\"\nelse\n    log \"${NAME} was not restarted properly\"\nfi\n\n# Don't block minor update or stack update if the wait was unsuccessful\nexit 0\n"}, "wait-port-and-run.sh": {"mode": "0755", "content": "#!/usr/bin/bash\nset -eu\n\nHOST=$1\nPORT=$2\n\necho \"$(date -u): Checking whether we can bind to ${HOST}:${PORT}\"\nwhile (ss -Htnl src \"${HOST}\" \"sport = :${PORT}\" | grep -wq \"${PORT}\"); do\n    echo \"$(date -u): ${HOST}:${PORT} still in use, waiting...\";\n    sleep 10;\ndone\n\nshift 2\nCOMMAND=\"$*\"\nif [ -z \"${COMMAND}\" ]; then\n    COMMAND=\"true\"\nfi\nexec $COMMAND\n"}, "pacemaker_resource_lock.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\nMAX_RETRIES=10\nCIB_ENOTFOUND=105\n\nusage() {\n   echo \"Set a global property in the cluster with a validity timestamp.\"\n   echo \"Usage:\"\n   echo \"   $0 --acquire <lock_name> <lock_owner> <lock_ttl_in_seconds>\"\n   echo \"   $0 --release <lock_name> <lock_owner>\"\n   echo\n}\n\nlog() {\n    echo \"$(date -u): $1\" 1>&2\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\nlock_create() {\n    local name=$1\n    local data=$2\n    # cibadmin won't overwrite a key if someone else succeeded to create it concurrently\n    cibadmin --sync-call --scope crm_config --create --xml-text \"<cluster_property_set id='${name}'><nvpair id='${name}-pair' name='${name}' value='${data}'/></cluster_property_set>\" &>/dev/null\n    return $?\n}\n\nlock_update() {\n    local name=$1\n    local expected_data=$2\n    local new_data=$3\n    # we only update the lock we expect to see, so we can't update someone else's lock\n    cibadmin --sync-call --scope crm_config --modify --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" --xml-text \"<nvpair id='${name}-pair' name='${name}' value='${new_data}'/>\" &>/dev/null\n    return $?\n}\n\nlock_delete() {\n    local name=$1\n    local expected_data=$2\n    # we only delete the lock we expect to see, so we can't delete someone else's lock\n    cibadmin --sync-call --scope crm_config --delete --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" &>/dev/null\n    return $?\n}\n\nlock_get() {\n    local lockname=$1\n    local res\n    local rc\n    res=$(cibadmin --query --scope crm_config --xpath \"//cluster_property_set/nvpair[@name='$lockname']\" 2>/dev/null)\n    rc=$?\n    if [ $rc -eq 0 ]; then\n        echo \"$res\" | sed -n 's/.*value=\"\\([^\"]*\\)\".*/\\1/p'\n    fi\n    return $rc\n}\n\nlock_owner() {\n    local lock=$1\n    echo \"$lock\" | cut -d':' -f1\n}\n\nlock_has_expired() {\n    local lock=$1\n    local expiry=$(echo \"$lock\" | cut -d':' -f2)\n    local now=$(date +%s)\n    test $now -ge $expiry\n}\n\n\n# Perform a lock action and restart if the CIB has been modified before\n# committing the lock action\ntry_action() {\n    local fun=$1\n    local lock=$2\n    local requester=$3\n    local args=${4:-}\n    local tries=$MAX_RETRIES\n    local rc=1\n    if [ \"$fun\" = \"lock_acquire\" ] || [ \"$fun\" = \"lock_release\" ]; then\n        log \"Try running $fun\"\n    else\n        return 2\n    fi\n    while [ $rc -ne 0 ]; do\n        $fun $lock $requester $args\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Operation $1 succeeded\"\n            return 0\n        elif [ $rc -eq 3 ]; then\n            # rc == 3 -> CIB changed before push\n            if [ $tries -eq 0 ]; then\n                log \"Failed to commit after $MAX_RETRIES retries. Bailing out.\"\n                return 2\n            else\n                log \"Failed to commit. Retrying operation.\"\n                tries=$(($tries - 1))\n            fi\n        elif [ $rc -eq 2 ]; then\n            # rc == 2 -> unrecoverable cib error (e.g. pacemaker down)\n            log \"Unexpected failure. Bailing out\"\n            return $rc\n        else\n            # rc == 1 -> lock error (not owner, lock doesn't exists)\n            return $rc\n        fi\n    done\n}\n\n# The lock mechanism uses cibadmin's atomic creation so cluster-wide\n# state coherency is guaranteed by pacemaker\nlock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc\n    local lock\n    local expiry\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -n \"$lock\" ]; then\n        lock_has_expired $lock\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Lock has expired, now available for being held\"\n        else\n            # lock is still held. check whether we're the owner\n            owner=$(lock_owner $lock)\n            if [ \"$owner\" = \"$requester\" ];then\n                log \"Requester already owns the lock, acquiring attempt will just reconfigure the TTL\"\n            else\n                log \"Lock is held by someone else ($owner)\"\n                return 1\n            fi\n        fi\n    else\n        log \"Lock is not held yet\"\n    fi\n\n    # prepare the lock info\n    expiry=$(($(date +%s) + $ttl))\n\n    if [ -n \"$lock\" ]; then\n        log \"Attempting to update the lock\"\n        lock_update $lockname \"$lock\" \"$requester:$expiry\"\n        rc=$?\n    else\n        log \"Attempting to acquire the lock\"\n        lock_create $lockname \"$requester:$expiry\"\n        rc=$?\n    fi\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' acquired by '$requester', valid until $(date -d @$expiry)\"\n        return 0\n    else\n        log \"CIB changed, lock cannot be acquired\"\n        return 3\n    fi\n}\n\n\n# The lock mechanism uses the CIB's num_updates tag to implement\n# a conditional store. Cluster-wide locking is guaranteed by pacemaker\nlock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n    local lock\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        log \"Lock doesn't exist. Nothing to release\"\n        return 0\n    else\n        log \"Lock exists, check whether we're the owner\"\n        owner=$(lock_owner $lock)\n        if [ \"$owner\" != \"$requester\" ];then\n            log \"Lock is held by someone else ($owner), will not unlock\"\n            return 1\n        fi\n    fi\n\n    lock_delete $lockname \"$lock\"\n    rc=$?\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' released by '$requester'\"\n        return 0\n    else\n        log \"CIB deletion error, lock cannot be released\"\n        return 3\n    fi\n}\n\n\n# Retrieve the owner of a lock from the CIB\n# this is a read-only operation, so no need to log debug info\nlock_get_owner() {\n    local lockname=$1\n    local rc\n    local lock\n    local owner\n\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        return 1\n    else\n        lock_owner $lock\n        return 0\n    fi\n}\n\n\nACTION=$1\nLOCKNAME=$2\nREQUESTER=$3\nTTL=${4:-60}\n\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nif [ $ACTION != \"--help\" ]; then\n    if [ -z \"$LOCKNAME\" ]; then\n        error \"You must specific a lock name\"\n    fi\n    if [ $ACTION != \"--owner\" ] && [ $ACTION != \"-o\" ]; then\n        if [ -z \"$REQUESTER\" ]; then\n            error \"You must specific a lock requester\"\n        fi\n    fi\nfi\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) try_action lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --release|-r) try_action lock_release $LOCKNAME $REQUESTER;;\n    --acquire-once|-A) lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --owner|-o) lock_get_owner $LOCKNAME;;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}, "pacemaker_mutex_restart_bundle.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_restart_bundle.sh --lock mysql galera galera-bundle Master _\n# pacemaker_mutex_restart_bundle.sh --lock ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\n\nset -u\n\nusage() {\n    echo \"Restart a clustered resource in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --lock <tripleo-service> <pcmk-resource> <pcmk-bundle> <target-state-local> <target-state-cluster>\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\nACTION=$1\ncase $ACTION in\n    --help) usage; exit 0;;\n    --lock) ;;\n    *) error \"Unknown action '$ACTION'\";;\nesac\n\nTRIPLEO_SERVICE=$2\nLOCK_NAME=${TRIPLEO_SERVICE}-restart-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to restart resource $TRIPLEO_SERVICE\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\nRESOURCE_NAME=$3\nBUNDLE_NAME=$4\nWAIT_TARGET_LOCAL=$5\nWAIT_TARGET_ANYWHERE=${6:-_}\n\nif pacemaker_supports_promoted; then\n    WAIT_TARGET_LOCAL=$(echo \"$5\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    WAIT_TARGET_ANYWHERE=$(echo \"${6:-_}\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    promoted_role=\"Promoted\"\nelse\n    promoted_role=\"Master\"\nfi\n\n# The lock TTL should accomodate for the resource start/promote timeout\nif [ \"$RESOURCE_NAME\" != \"$BUNDLE_NAME\" ]; then\n    if [ \"$WAIT_TARGET_LOCAL\" = \"$promoted_role\" ] || [ \"$WAIT_TARGET_ANYWHERE\" = \"$promoted_role\" ]; then\n        rsc_op=\"promote\"\n    else\n        rsc_op=\"start\"\n    fi\n    # <op id=\"galera-promote-interval-0s\" interval=\"0s\" name=\"promote\" on-fail=\"block\" timeout=\"300s\"/>\n    PCMK_TTL=$(cibadmin -Q | xmllint -xpath \"string(//primitive[@id='${RESOURCE_NAME}']/operations/op[@name='${rsc_op}']/@timeout)\" - | sed 's/s$//')\n    LOCK_TTL=$((PCMK_TTL + 30))\nelse\n    # The podman RA's default start timeout\n    LOCK_TTL=90\nfi\n\nlog \"Acquire a ${LOCK_TTL}s restart lock for service $TRIPLEO_SERVICE before restarting it\"\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nrc=1\nwhile [ $rc -ne 0 ]; do\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire $LOCK_NAME $LOCK_OWNER $LOCK_TTL\n    rc=$?\n    if [ $rc != 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not acquire lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Could not acquire lock, retrying\"\n            sleep 10\n        fi\n    fi\ndone\n\nlog \"Restart the service $TRIPLEO_SERVICE locally\"\n# Reuse the local restart script in t-h-t (driven by env var TRIPLEO_MINOR_UPDATE)\nTRIPLEO_MINOR_UPDATE=true /var/lib/container-config-scripts/pacemaker_restart_bundle.sh $TRIPLEO_SERVICE $RESOURCE_NAME $BUNDLE_NAME $WAIT_TARGET_LOCAL $WAIT_TARGET_ANYWHERE\n\n# If we reached this point, always try to release the lock\nlog \"Release the restart lock for service $TRIPLEO_SERVICE\"\n/var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $LOCK_NAME $LOCK_OWNER\nrc=$?\nif [ $rc -ne 0 ] && [ $rc -ne 1 ]; then\n    error \"Could not release held lock (rc: $rc)\"\nfi\n"}, "pacemaker_mutex_shutdown.sh": {"mode": "0755", "content": "#!/usr/bin/bash\n\n# pacemaker_mutex_shutdown.sh --acquire\n# pacemaker_mutex_shutdown.sh --release\n\nset -u\n\nusage() {\n    echo \"Shutdown a cluster node in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --acquire # prevent other node from shutting down until we hold the lock\"\n    echo \"   $0 --release # release the lock, other node can compete for the shutdown lock\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nshutdown_lock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc=1\n    local current_owner\n    local owner_stopped\n    local owner_rc\n\n    log \"Acquiring the shutdown lock\"\n    while [ $rc -ne 0 ]; do\n        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire-once $lockname $requester $ttl\n        rc=$?\n        if [ $rc -ne 0 ]; then\n            if [ $rc -eq 2 ]; then\n                error \"Could not acquire the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n            else\n                # The lock is held by another node.\n                current_owner=$(/var/lib/container-config-scripts/pacemaker_resource_lock.sh --owner $lockname)\n                owner_rc=$?\n                if [ $owner_rc -eq 2 ]; then\n                    error \"Could not get the shutdown lock owner due to unrecoverable error (rc: $owner_rc), bailing out\"\n                fi\n                if [ $owner_rc -eq 0 ]; then\n                    # If the owner is marked as offline, that means it has shutdown and\n                    # we can clean the lock preemptively and try to acquire it.\n                    owner_stopped=$(crm_mon -1X | xmllint --xpath 'count(//nodes/node[@name=\"'${current_owner}'\" and @online=\"false\" and @unclean=\"false\"])' -)\n                    if [ \"${owner_stopped}\" = \"1\" ]; then\n                        log \"Shutdown lock held by stopped node '${current_owner}', lock can be released\"\n                        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $current_owner\n                        continue\n                    fi\n                fi\n                log \"Shutdown lock held by another node (rc: $rc), retrying\"\n                sleep 10\n            fi\n        fi\n    done\n    log \"Shutdown lock acquired\"\n    return 0\n}\n\n\n# Release the lock if we still own it. Not owning it anymore is not fatal\nshutdown_lock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n\n    log \"Releasing the shutdown lock\"\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $requester\n    rc=$?\n    if [ $rc -ne 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not release the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Shutdown lock no longer held, nothing to do\"\n        fi\n    else\n        log \"Shutdown lock released\"\n    fi\n    return 0\n}\n\n\nACTION=$1\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nLOCK_NAME=tripleo-shutdown-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to aquire the shutdown lock\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\n# We start with a very high TTL, that long enough to accomodate a cluster stop.\n# As soon as the node will get offline, the other competing node will be entitled\n# to steal the lock, so they should never wait that long in practice.\nLOCK_TTL=600\n\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) shutdown_lock_acquire ${LOCK_NAME} ${LOCK_OWNER} ${LOCK_TTL};;\n    --release|-r) shutdown_lock_release ${LOCK_NAME} ${LOCK_OWNER};;\n    *) error \"Invalid action\";;\nesac\nexit $?\n"}}, "tuple:('role_data', 'step_config')": null, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "haproxy", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-29-uuqpaohwnjnc/1288ee50-e56d-4e84-9b1c-3ca210a00965"}


created_at: 2026-06-14 08:54:18.877306
data:
  {"type": "json", "value": {"ContainerHeatApiImage": "registry.redhat.io/rhosp-rhel9/openstack-heat-api:17.1", "ContainerHeatApiConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-heat-api:17.1"}}


created_at: 2026-06-14 08:54:23.940868
data:
  {"value": {"ContainerHeatApiImage": "registry.redhat.io/rhosp-rhel9/openstack-heat-api:17.1", "ContainerHeatApiConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-heat-api:17.1"}}


created_at: 2026-06-14 08:54:24.002529
data:
  {"tuple:('role_data', 'metadata_settings')": null, "tuple:('role_data', 'config_settings')": {"apache::ip": "%{hiera('internal_api')}", "apache::default_vhost": false, "apache::trace_enable": "Off", "apache::server_signature": "Off", "apache::server_tokens": "Prod", "apache::timeout": 90, "apache::default_mods": false, "apache::mod::prefork::maxrequestworkers": 100, "apache::mod::prefork::serverlimit": 100, "apache::mod::remoteip::proxy_ips": ["172.17.0.0/24"], "apache::mod::alias::icons_options": "None"}, "tuple:('role_data', 'deploy_steps_tasks')": [{"name": "Certificate generation", "when": ["step|int == 1", "enable_internal_tls"], "block": [{"name": "Create dirs for certificates and keys", "file": {"path": "{{ item }}", "state": "directory", "serole": "object_r", "setype": "cert_t", "seuser": "system_u"}, "with_items": ["/etc/pki/tls/certs/httpd", "/etc/pki/tls/private/httpd"]}, {"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "httpd-ctlplane", "dns": "{{ fqdn_ctlplane }}", "principal": "HTTP/{{ fqdn_ctlplane }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-ctlplane.crt /etc/pki/tls/certs/httpd/httpd-ctlplane.crt\ncp /etc/pki/tls/private/httpd-ctlplane.key /etc/pki/tls/private/httpd/httpd-ctlplane.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage", "dns": "{{ fqdn_storage }}", "principal": "HTTP/{{ fqdn_storage }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage.crt /etc/pki/tls/certs/httpd/httpd-storage.crt\ncp /etc/pki/tls/private/httpd-storage.key /etc/pki/tls/private/httpd/httpd-storage.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage_mgmt", "dns": "{{ fqdn_storage_mgmt }}", "principal": "HTTP/{{ fqdn_storage_mgmt }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage_mgmt.crt /etc/pki/tls/certs/httpd/httpd-storage_mgmt.crt\ncp /etc/pki/tls/private/httpd-storage_mgmt.key /etc/pki/tls/private/httpd/httpd-storage_mgmt.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-internal_api", "dns": "{{ fqdn_internal_api }}", "principal": "HTTP/{{ fqdn_internal_api }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-internal_api.crt /etc/pki/tls/certs/httpd/httpd-internal_api.crt\ncp /etc/pki/tls/private/httpd-internal_api.key /etc/pki/tls/private/httpd/httpd-internal_api.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-external", "dns": "{{ fqdn_external }}", "principal": "HTTP/{{ fqdn_external }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-external.crt /etc/pki/tls/certs/httpd/httpd-external.crt\ncp /etc/pki/tls/private/httpd-external.key /etc/pki/tls/private/httpd/httpd-external.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}]}}]}], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-30-dzyuxplz4ekk-ApacheServiceBase-4qx2hkk2kf7k/3dc7b639-adcc-4cdf-90d1-136cc7def773"}


created_at: 2026-06-14 08:54:24.037546
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-30-dzyuxplz4ekk-ContainersCommon-ansvl4bve6hj/3f7bdda7-78b7-44de-88c4-2e54650d3752"}


created_at: 2026-06-14 08:54:24.100991
data:
  {"tuple:('role_data', 'config_settings')": {"heat::notification_driver": ["messagingv2"], "heat::logging::debug": true, "heat::policy::policies": {}, "heat::enable_proxy_headers_parsing": true, "heat::rpc_response_timeout": 600, "heat::rabbit_heartbeat_timeout_threshold": 60, "heat::rabbit_heartbeat_in_pthread": false, "heat::region_name": "regionOne", "heat::keystone::authtoken::project_name": "service", "heat::keystone::authtoken::user_domain_name": "Default", "heat::keystone::authtoken::project_domain_name": "Default", "heat::keystone::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "heat::keystone::authtoken::auth_url": "http://172.17.0.2:5000", "heat::keystone::authtoken::password": "EumUoUtqjQYt1RrYT2q8IMlZH", "heat::keystone::authtoken::region_name": "regionOne", "heat::keystone::authtoken::interface": "internal", "heat::keystone::authtoken::memcache_use_advanced_pool": true, "heat::keystone::domain::domain_name": "heat_stack", "heat::keystone::domain::domain_admin": "heat_stack_domain_admin", "heat::keystone::domain::domain_admin_email": "heat_stack_domain_admin@localhost", "heat::db::database_db_max_retries": -1, "heat::db::database_max_retries": -1, "heat::yaql_memory_quota": 100000, "heat::yaql_limit_iterators": 1000, "heat::cors::max_age": 3600, "heat::cors::allow_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma,X-Auth-Token", "heat::cors::expose_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma", "heat::cron::purge_deleted::ensure": "present", "heat::cron::purge_deleted::minute": "1", "heat::cron::purge_deleted::hour": "0", "heat::cron::purge_deleted::monthday": "*", "heat::cron::purge_deleted::month": "*", "heat::cron::purge_deleted::weekday": "*", "heat::cron::purge_deleted::maxdelay": "3600", "heat::cron::purge_deleted::user": "heat", "heat::cron::purge_deleted::age": "30", "heat::cron::purge_deleted::age_type": "days", "heat::cron::purge_deleted::destination": "/dev/null", "heat::max_json_body_size": 4194304, "heat::cache::enabled": true, "heat::cache::tls_enabled": false, "heat::cache::resource_finder_caching": false, "heat::cache::backend": "dogpile.cache.memcached"}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-30-dzyuxplz4ekk-HeatBase-mt2y6lr5m6hw/8c2bcb57-ba35-44b6-9250-079dafcfa2cb"}


created_at: 2026-06-14 08:54:24.143143
data:
  {"config_settings": null, "tuple:('docker_config', 'step_2')": {}, "volumes": ["/var/log/containers/heat:/var/log/heat:z", "/var/log/containers/httpd/heat-api:/var/log/httpd:z"], "host_prep_tasks": [{"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/heat", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/heat-api", "setype": "container_file_t", "mode": "0750"}]}], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-30-dzyuxplz4ekk-HeatApiLogging-2mirmgdpjy4s/dd575f42-2a7c-4fd9-a56a-47c0268a1ce9"}


created_at: 2026-06-14 08:54:24.161446
data:
  {"tuple:('role_data', 'docker_config')": {"step_2": {}, "step_4": {"heat_api": {"image": "registry.redhat.io/rhosp-rhel9/openstack-heat-api:17.1", "net": "host", "privileged": false, "restart": "always", "user": "root", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/heat:/var/log/heat:z", "/var/log/containers/httpd/heat-api:/var/log/httpd:z", "/var/lib/kolla/config_files/heat_api.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/heat_api:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "heat_api_cron": {"image": "registry.redhat.io/rhosp-rhel9/openstack-heat-api:17.1", "net": "host", "user": "root", "privileged": false, "restart": "always", "healthcheck": {"test": "/usr/share/openstack-tripleo-common/healthcheck/cron heat"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/heat:/var/log/heat:z", "/var/log/containers/httpd/heat-api:/var/log/httpd:z", "/var/lib/kolla/config_files/heat_api_cron.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/heat_api:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "role_data": {"service_name": "heat_api", "firewall_rules": {"125 heat_api": {"dport": [8004]}}, "firewall_frontend_rules": {"100 heat_api_haproxy_frontend": {"dport": [8004]}}, "firewall_ssl_frontend_rules": {"100 heat_api_haproxy_frontend_ssl": {"dport": [13004]}}, "keystone_resources": {"heat": {"endpoints": {"public": "http://172.21.0.2:8004/v1/%(tenant_id)s", "internal": "http://172.17.0.2:8004/v1/%(tenant_id)s", "admin": "http://172.17.0.2:8004/v1/%(tenant_id)s"}, "users": {"heat": {"password": "EumUoUtqjQYt1RrYT2q8IMlZH"}, "heat_stack_domain_admin": {"password": "ATIVqqjnxUwGZ7mH1nnY7wfKP", "roles": ["admin"], "domain": "heat_stack"}}, "region": "regionOne", "service": "orchestration", "roles": ["heat_stack_user"], "domains": ["heat_stack"]}}, "monitoring_subscription": "overcloud-heat-api", "config_settings": {"heat::notification_driver": ["messagingv2"], "heat::logging::debug": true, "heat::policy::policies": {}, "heat::enable_proxy_headers_parsing": true, "heat::rpc_response_timeout": 600, "heat::rabbit_heartbeat_timeout_threshold": 60, "heat::rabbit_heartbeat_in_pthread": false, "heat::region_name": "regionOne", "heat::keystone::authtoken::project_name": "service", "heat::keystone::authtoken::user_domain_name": "Default", "heat::keystone::authtoken::project_domain_name": "Default", "heat::keystone::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "heat::keystone::authtoken::auth_url": "http://172.17.0.2:5000", "heat::keystone::authtoken::password": "EumUoUtqjQYt1RrYT2q8IMlZH", "heat::keystone::authtoken::region_name": "regionOne", "heat::keystone::authtoken::interface": "internal", "heat::keystone::authtoken::memcache_use_advanced_pool": true, "heat::keystone::domain::domain_name": "heat_stack", "heat::keystone::domain::domain_admin": "heat_stack_domain_admin", "heat::keystone::domain::domain_admin_email": "heat_stack_domain_admin@localhost", "heat::db::database_db_max_retries": -1, "heat::db::database_max_retries": -1, "heat::yaql_memory_quota": 100000, "heat::yaql_limit_iterators": 1000, "heat::cors::max_age": 3600, "heat::cors::allow_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma,X-Auth-Token", "heat::cors::expose_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma", "heat::cron::purge_deleted::ensure": "present", "heat::cron::purge_deleted::minute": "1", "heat::cron::purge_deleted::hour": "0", "heat::cron::purge_deleted::monthday": "*", "heat::cron::purge_deleted::month": "*", "heat::cron::purge_deleted::weekday": "*", "heat::cron::purge_deleted::maxdelay": "3600", "heat::cron::purge_deleted::user": "heat", "heat::cron::purge_deleted::age": "30", "heat::cron::purge_deleted::age_type": "days", "heat::cron::purge_deleted::destination": "/dev/null", "heat::max_json_body_size": 4194304, "heat::cache::enabled": true, "heat::cache::tls_enabled": false, "heat::cache::resource_finder_caching": false, "heat::cache::backend": "dogpile.cache.memcached", "apache::ip": "%{hiera('internal_api')}", "apache::default_vhost": false, "apache::trace_enable": "Off", "apache::server_signature": "Off", "apache::server_tokens": "Prod", "apache::timeout": 90, "apache::default_mods": false, "apache::mod::prefork::maxrequestworkers": 100, "apache::mod::prefork::serverlimit": 100, "apache::mod::remoteip::proxy_ips": ["172.17.0.0/24"], "apache::mod::alias::icons_options": "None", "heat::api::bind_host": "%{hiera('internal_api')}", "heat::wsgi::apache_api::ssl": false, "heat::wsgi::apache_api::vhost_custom_fragment": "Timeout 600", "heat::api::service_name": "httpd", "heat::wsgi::apache_api::bind_host": "%{hiera('internal_api')}", "heat::wsgi::apache_api::servername": "%{hiera('fqdn_internal_api')}", "heat::wsgi::apache_api::workers": 1}, "service_config_settings": {"rsyslog": {"tripleo_logging_sources_heat_api": [{"tag": "openstack.heat.api", "file": "/var/log/containers/heat/heat_api.log"}]}}, "puppet_config": {"config_volume": "heat_api", "puppet_tags": "heat_config,file,concat,file_line,heat_api_paste_ini", "step_config": "include tripleo::profile::base::heat::api\n", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-heat-api:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/heat_api.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/heat", "owner": "heat:heat", "recurse": true}]}, "/var/lib/kolla/config_files/heat_api_cron.json": {"command": "/usr/sbin/crond -n", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/heat", "owner": "heat:heat", "recurse": true}]}}, "docker_config": {"step_2": {}, "step_4": {"heat_api": {"image": "registry.redhat.io/rhosp-rhel9/openstack-heat-api:17.1", "net": "host", "privileged": false, "restart": "always", "user": "root", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/heat:/var/log/heat:z", "/var/log/containers/httpd/heat-api:/var/log/httpd:z", "/var/lib/kolla/config_files/heat_api.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/heat_api:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "heat_api_cron": {"image": "registry.redhat.io/rhosp-rhel9/openstack-heat-api:17.1", "net": "host", "user": "root", "privileged": false, "restart": "always", "healthcheck": {"test": "/usr/share/openstack-tripleo-common/healthcheck/cron heat"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/heat:/var/log/heat:z", "/var/log/containers/httpd/heat-api:/var/log/httpd:z", "/var/lib/kolla/config_files/heat_api_cron.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/heat_api:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "host_prep_tasks": [{"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/heat", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/heat-api", "setype": "container_file_t", "mode": "0750"}]}], "upgrade_tasks": [], "metadata_settings": null, "deploy_steps_tasks": [{"name": "Certificate generation", "when": ["step|int == 1", "enable_internal_tls"], "block": [{"name": "Create dirs for certificates and keys", "file": {"path": "{{ item }}", "state": "directory", "serole": "object_r", "setype": "cert_t", "seuser": "system_u"}, "with_items": ["/etc/pki/tls/certs/httpd", "/etc/pki/tls/private/httpd"]}, {"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "httpd-ctlplane", "dns": "{{ fqdn_ctlplane }}", "principal": "HTTP/{{ fqdn_ctlplane }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-ctlplane.crt /etc/pki/tls/certs/httpd/httpd-ctlplane.crt\ncp /etc/pki/tls/private/httpd-ctlplane.key /etc/pki/tls/private/httpd/httpd-ctlplane.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage", "dns": "{{ fqdn_storage }}", "principal": "HTTP/{{ fqdn_storage }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage.crt /etc/pki/tls/certs/httpd/httpd-storage.crt\ncp /etc/pki/tls/private/httpd-storage.key /etc/pki/tls/private/httpd/httpd-storage.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage_mgmt", "dns": "{{ fqdn_storage_mgmt }}", "principal": "HTTP/{{ fqdn_storage_mgmt }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage_mgmt.crt /etc/pki/tls/certs/httpd/httpd-storage_mgmt.crt\ncp /etc/pki/tls/private/httpd-storage_mgmt.key /etc/pki/tls/private/httpd/httpd-storage_mgmt.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-internal_api", "dns": "{{ fqdn_internal_api }}", "principal": "HTTP/{{ fqdn_internal_api }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-internal_api.crt /etc/pki/tls/certs/httpd/httpd-internal_api.crt\ncp /etc/pki/tls/private/httpd-internal_api.key /etc/pki/tls/private/httpd/httpd-internal_api.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-external", "dns": "{{ fqdn_external }}", "principal": "HTTP/{{ fqdn_external }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-external.crt /etc/pki/tls/certs/httpd/httpd-external.crt\ncp /etc/pki/tls/private/httpd-external.key /etc/pki/tls/private/httpd/httpd-external.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}]}}]}], "external_upgrade_tasks": [{"when": ["step|int == 1"], "tags": ["never", "system_upgrade_transfer_data", "system_upgrade_stop_services"], "block": [{"name": "Stop heat api container", "import_role": {"name": "tripleo_container_stop"}, "vars": {"tripleo_containers_to_stop": ["heat_api", "heat_api_cron"], "tripleo_delegate_to": "{{ groups['heat_api'] | difference(groups['excluded_overcloud']) }}"}}]}]}, "tuple:('role_data', 'config_settings')": {"heat::notification_driver": ["messagingv2"], "heat::logging::debug": true, "heat::policy::policies": {}, "heat::enable_proxy_headers_parsing": true, "heat::rpc_response_timeout": 600, "heat::rabbit_heartbeat_timeout_threshold": 60, "heat::rabbit_heartbeat_in_pthread": false, "heat::region_name": "regionOne", "heat::keystone::authtoken::project_name": "service", "heat::keystone::authtoken::user_domain_name": "Default", "heat::keystone::authtoken::project_domain_name": "Default", "heat::keystone::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "heat::keystone::authtoken::auth_url": "http://172.17.0.2:5000", "heat::keystone::authtoken::password": "EumUoUtqjQYt1RrYT2q8IMlZH", "heat::keystone::authtoken::region_name": "regionOne", "heat::keystone::authtoken::interface": "internal", "heat::keystone::authtoken::memcache_use_advanced_pool": true, "heat::keystone::domain::domain_name": "heat_stack", "heat::keystone::domain::domain_admin": "heat_stack_domain_admin", "heat::keystone::domain::domain_admin_email": "heat_stack_domain_admin@localhost", "heat::db::database_db_max_retries": -1, "heat::db::database_max_retries": -1, "heat::yaql_memory_quota": 100000, "heat::yaql_limit_iterators": 1000, "heat::cors::max_age": 3600, "heat::cors::allow_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma,X-Auth-Token", "heat::cors::expose_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma", "heat::cron::purge_deleted::ensure": "present", "heat::cron::purge_deleted::minute": "1", "heat::cron::purge_deleted::hour": "0", "heat::cron::purge_deleted::monthday": "*", "heat::cron::purge_deleted::month": "*", "heat::cron::purge_deleted::weekday": "*", "heat::cron::purge_deleted::maxdelay": "3600", "heat::cron::purge_deleted::user": "heat", "heat::cron::purge_deleted::age": "30", "heat::cron::purge_deleted::age_type": "days", "heat::cron::purge_deleted::destination": "/dev/null", "heat::max_json_body_size": 4194304, "heat::cache::enabled": true, "heat::cache::tls_enabled": false, "heat::cache::resource_finder_caching": false, "heat::cache::backend": "dogpile.cache.memcached", "apache::ip": "%{hiera('internal_api')}", "apache::default_vhost": false, "apache::trace_enable": "Off", "apache::server_signature": "Off", "apache::server_tokens": "Prod", "apache::timeout": 90, "apache::default_mods": false, "apache::mod::prefork::maxrequestworkers": 100, "apache::mod::prefork::serverlimit": 100, "apache::mod::remoteip::proxy_ips": ["172.17.0.0/24"], "apache::mod::alias::icons_options": "None", "heat::api::bind_host": "%{hiera('internal_api')}", "heat::wsgi::apache_api::ssl": false, "heat::wsgi::apache_api::vhost_custom_fragment": "Timeout 600", "heat::api::service_name": "httpd", "heat::wsgi::apache_api::bind_host": "%{hiera('internal_api')}", "heat::wsgi::apache_api::servername": "%{hiera('fqdn_internal_api')}", "heat::wsgi::apache_api::workers": 1}, "tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'step_config')": null, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "heat_api", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-30-dzyuxplz4ekk/c20d2b35-dd1f-41fc-a489-e95e64fed609"}


created_at: 2026-06-14 08:54:24.627427
data:
  {"type": "json", "value": {"ContainerHeatApiCfnImage": "registry.redhat.io/rhosp-rhel9/openstack-heat-api-cfn:17.1", "ContainerHeatApiCfnConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-heat-api-cfn:17.1"}}


created_at: 2026-06-14 08:54:30.762770
data:
  {"config_settings": null, "tuple:('docker_config', 'step_2')": {}, "volumes": ["/var/log/containers/heat:/var/log/heat:z", "/var/log/containers/httpd/heat-api-cfn:/var/log/httpd:z"], "host_prep_tasks": [{"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/heat", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/heat-api-cfn", "setype": "container_file_t", "mode": "0750"}]}], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-31-n73pf2jbs4cy-HeatApiCfnLogging-pqisppouuxfz/e2097e3a-be39-402f-929c-62e001bc4563"}


created_at: 2026-06-14 08:54:30.831219
data:
  {"tuple:('role_data', 'metadata_settings')": null, "tuple:('role_data', 'deploy_steps_tasks')": [{"name": "Certificate generation", "when": ["step|int == 1", "enable_internal_tls"], "block": [{"name": "Create dirs for certificates and keys", "file": {"path": "{{ item }}", "state": "directory", "serole": "object_r", "setype": "cert_t", "seuser": "system_u"}, "with_items": ["/etc/pki/tls/certs/httpd", "/etc/pki/tls/private/httpd"]}, {"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "httpd-ctlplane", "dns": "{{ fqdn_ctlplane }}", "principal": "HTTP/{{ fqdn_ctlplane }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-ctlplane.crt /etc/pki/tls/certs/httpd/httpd-ctlplane.crt\ncp /etc/pki/tls/private/httpd-ctlplane.key /etc/pki/tls/private/httpd/httpd-ctlplane.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage", "dns": "{{ fqdn_storage }}", "principal": "HTTP/{{ fqdn_storage }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage.crt /etc/pki/tls/certs/httpd/httpd-storage.crt\ncp /etc/pki/tls/private/httpd-storage.key /etc/pki/tls/private/httpd/httpd-storage.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage_mgmt", "dns": "{{ fqdn_storage_mgmt }}", "principal": "HTTP/{{ fqdn_storage_mgmt }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage_mgmt.crt /etc/pki/tls/certs/httpd/httpd-storage_mgmt.crt\ncp /etc/pki/tls/private/httpd-storage_mgmt.key /etc/pki/tls/private/httpd/httpd-storage_mgmt.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-internal_api", "dns": "{{ fqdn_internal_api }}", "principal": "HTTP/{{ fqdn_internal_api }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-internal_api.crt /etc/pki/tls/certs/httpd/httpd-internal_api.crt\ncp /etc/pki/tls/private/httpd-internal_api.key /etc/pki/tls/private/httpd/httpd-internal_api.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-external", "dns": "{{ fqdn_external }}", "principal": "HTTP/{{ fqdn_external }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-external.crt /etc/pki/tls/certs/httpd/httpd-external.crt\ncp /etc/pki/tls/private/httpd-external.key /etc/pki/tls/private/httpd/httpd-external.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}]}}]}], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-31-n73pf2jbs4cy-ApacheServiceBase-utgxh4k7jsoh/8e1223be-d66a-4a1c-806b-e6abb916d959"}


created_at: 2026-06-14 08:54:30.859509
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-31-n73pf2jbs4cy-ContainersCommon-l4nvm6zmbu3t/69a5ffc0-421c-4a8d-8430-eabf1579de43"}


created_at: 2026-06-14 08:54:30.920071
data:
  {"tuple:('role_data', 'config_settings')": {"heat::notification_driver": ["messagingv2"], "heat::logging::debug": true, "heat::policy::policies": {}, "heat::enable_proxy_headers_parsing": true, "heat::rpc_response_timeout": 600, "heat::rabbit_heartbeat_timeout_threshold": 60, "heat::rabbit_heartbeat_in_pthread": false, "heat::region_name": "regionOne", "heat::keystone::authtoken::project_name": "service", "heat::keystone::authtoken::user_domain_name": "Default", "heat::keystone::authtoken::project_domain_name": "Default", "heat::keystone::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "heat::keystone::authtoken::auth_url": "http://172.17.0.2:5000", "heat::keystone::authtoken::password": "EumUoUtqjQYt1RrYT2q8IMlZH", "heat::keystone::authtoken::region_name": "regionOne", "heat::keystone::authtoken::interface": "internal", "heat::keystone::authtoken::memcache_use_advanced_pool": true, "heat::keystone::domain::domain_name": "heat_stack", "heat::keystone::domain::domain_admin": "heat_stack_domain_admin", "heat::keystone::domain::domain_admin_email": "heat_stack_domain_admin@localhost", "heat::db::database_db_max_retries": -1, "heat::db::database_max_retries": -1, "heat::yaql_memory_quota": 100000, "heat::yaql_limit_iterators": 1000, "heat::cors::max_age": 3600, "heat::cors::allow_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma,X-Auth-Token", "heat::cors::expose_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma", "heat::cron::purge_deleted::ensure": "present", "heat::cron::purge_deleted::minute": "1", "heat::cron::purge_deleted::hour": "0", "heat::cron::purge_deleted::monthday": "*", "heat::cron::purge_deleted::month": "*", "heat::cron::purge_deleted::weekday": "*", "heat::cron::purge_deleted::maxdelay": "3600", "heat::cron::purge_deleted::user": "heat", "heat::cron::purge_deleted::age": "30", "heat::cron::purge_deleted::age_type": "days", "heat::cron::purge_deleted::destination": "/dev/null", "heat::max_json_body_size": 4194304, "heat::cache::enabled": true, "heat::cache::tls_enabled": false, "heat::cache::resource_finder_caching": false, "heat::cache::backend": "dogpile.cache.memcached"}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-31-n73pf2jbs4cy-HeatBase-2vnof5czodzs/b3fe27b7-5b49-444b-8481-96ee08166eac"}


created_at: 2026-06-14 08:54:30.924962
data:
  {"value": {"ContainerHeatApiCfnImage": "registry.redhat.io/rhosp-rhel9/openstack-heat-api-cfn:17.1", "ContainerHeatApiCfnConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-heat-api-cfn:17.1"}}


created_at: 2026-06-14 08:54:30.937014
data:
  {"tuple:('role_data', 'docker_config')": {"step_2": {}, "step_4": {"heat_api_cfn": {"image": "registry.redhat.io/rhosp-rhel9/openstack-heat-api-cfn:17.1", "net": "host", "privileged": false, "restart": "always", "user": "root", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/heat:/var/log/heat:z", "/var/log/containers/httpd/heat-api-cfn:/var/log/httpd:z", "/var/lib/kolla/config_files/heat_api_cfn.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/heat_api_cfn:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "role_data": {"service_name": "heat_api_cfn", "firewall_rules": {"125 heat_cfn": {"dport": [8000]}}, "firewall_frontend_rules": {"100 heat_api_cfn_haproxy_frontend": {"dport": [8000]}}, "firewall_ssl_frontend_rules": {"100 heat_api_cfn_haproxy_frontend_ssl": {"dport": [13005]}}, "keystone_resources": {"heat-cfn": {"endpoints": {"public": "http://172.21.0.2:8000/v1", "internal": "http://172.17.0.2:8000/v1", "admin": "http://172.17.0.2:8000/v1"}, "users": {"heat-cfn": {"password": "EumUoUtqjQYt1RrYT2q8IMlZH"}}, "region": "regionOne", "service": "cloudformation"}}, "monitoring_subscription": "overcloud-heat-api-cfn", "config_settings": {"heat::notification_driver": ["messagingv2"], "heat::logging::debug": true, "heat::policy::policies": {}, "heat::enable_proxy_headers_parsing": true, "heat::rpc_response_timeout": 600, "heat::rabbit_heartbeat_timeout_threshold": 60, "heat::rabbit_heartbeat_in_pthread": false, "heat::region_name": "regionOne", "heat::keystone::authtoken::project_name": "service", "heat::keystone::authtoken::user_domain_name": "Default", "heat::keystone::authtoken::project_domain_name": "Default", "heat::keystone::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "heat::keystone::authtoken::auth_url": "http://172.17.0.2:5000", "heat::keystone::authtoken::password": "EumUoUtqjQYt1RrYT2q8IMlZH", "heat::keystone::authtoken::region_name": "regionOne", "heat::keystone::authtoken::interface": "internal", "heat::keystone::authtoken::memcache_use_advanced_pool": true, "heat::keystone::domain::domain_name": "heat_stack", "heat::keystone::domain::domain_admin": "heat_stack_domain_admin", "heat::keystone::domain::domain_admin_email": "heat_stack_domain_admin@localhost", "heat::db::database_db_max_retries": -1, "heat::db::database_max_retries": -1, "heat::yaql_memory_quota": 100000, "heat::yaql_limit_iterators": 1000, "heat::cors::max_age": 3600, "heat::cors::allow_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma,X-Auth-Token", "heat::cors::expose_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma", "heat::cron::purge_deleted::ensure": "present", "heat::cron::purge_deleted::minute": "1", "heat::cron::purge_deleted::hour": "0", "heat::cron::purge_deleted::monthday": "*", "heat::cron::purge_deleted::month": "*", "heat::cron::purge_deleted::weekday": "*", "heat::cron::purge_deleted::maxdelay": "3600", "heat::cron::purge_deleted::user": "heat", "heat::cron::purge_deleted::age": "30", "heat::cron::purge_deleted::age_type": "days", "heat::cron::purge_deleted::destination": "/dev/null", "heat::max_json_body_size": 4194304, "heat::cache::enabled": true, "heat::cache::tls_enabled": false, "heat::cache::resource_finder_caching": false, "heat::cache::backend": "dogpile.cache.memcached", "apache::default_vhost": false, "heat::api_cfn::bind_host": "%{hiera('internal_api')}", "heat::wsgi::apache_api_cfn::ssl": false, "heat::api_cfn::service_name": "httpd", "heat::wsgi::apache_api_cfn::bind_host": "%{hiera('internal_api')}", "heat::wsgi::apache_api_cfn::servername": "%{hiera('fqdn_internal_api')}", "heat::wsgi::apache_api_cfn::workers": 1}, "service_config_settings": {"rsyslog": {"tripleo_logging_sources_heat_api_cfn": [{"tag": "openstack.heat.api.cfn", "file": "/var/log/containers/heat/heat_api_cfn.log"}]}}, "puppet_config": {"config_volume": "heat_api_cfn", "puppet_tags": "heat_config,file,concat,file_line", "step_config": "include tripleo::profile::base::heat::api_cfn\n", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-heat-api-cfn:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/heat_api_cfn.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/heat", "owner": "heat:heat", "recurse": true}]}}, "docker_config": {"step_2": {}, "step_4": {"heat_api_cfn": {"image": "registry.redhat.io/rhosp-rhel9/openstack-heat-api-cfn:17.1", "net": "host", "privileged": false, "restart": "always", "user": "root", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/heat:/var/log/heat:z", "/var/log/containers/httpd/heat-api-cfn:/var/log/httpd:z", "/var/lib/kolla/config_files/heat_api_cfn.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/heat_api_cfn:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "host_prep_tasks": [{"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/heat", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/heat-api-cfn", "setype": "container_file_t", "mode": "0750"}]}], "upgrade_tasks": [], "metadata_settings": null, "deploy_steps_tasks": [{"name": "Certificate generation", "when": ["step|int == 1", "enable_internal_tls"], "block": [{"name": "Create dirs for certificates and keys", "file": {"path": "{{ item }}", "state": "directory", "serole": "object_r", "setype": "cert_t", "seuser": "system_u"}, "with_items": ["/etc/pki/tls/certs/httpd", "/etc/pki/tls/private/httpd"]}, {"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "httpd-ctlplane", "dns": "{{ fqdn_ctlplane }}", "principal": "HTTP/{{ fqdn_ctlplane }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-ctlplane.crt /etc/pki/tls/certs/httpd/httpd-ctlplane.crt\ncp /etc/pki/tls/private/httpd-ctlplane.key /etc/pki/tls/private/httpd/httpd-ctlplane.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage", "dns": "{{ fqdn_storage }}", "principal": "HTTP/{{ fqdn_storage }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage.crt /etc/pki/tls/certs/httpd/httpd-storage.crt\ncp /etc/pki/tls/private/httpd-storage.key /etc/pki/tls/private/httpd/httpd-storage.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage_mgmt", "dns": "{{ fqdn_storage_mgmt }}", "principal": "HTTP/{{ fqdn_storage_mgmt }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage_mgmt.crt /etc/pki/tls/certs/httpd/httpd-storage_mgmt.crt\ncp /etc/pki/tls/private/httpd-storage_mgmt.key /etc/pki/tls/private/httpd/httpd-storage_mgmt.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-internal_api", "dns": "{{ fqdn_internal_api }}", "principal": "HTTP/{{ fqdn_internal_api }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-internal_api.crt /etc/pki/tls/certs/httpd/httpd-internal_api.crt\ncp /etc/pki/tls/private/httpd-internal_api.key /etc/pki/tls/private/httpd/httpd-internal_api.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-external", "dns": "{{ fqdn_external }}", "principal": "HTTP/{{ fqdn_external }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-external.crt /etc/pki/tls/certs/httpd/httpd-external.crt\ncp /etc/pki/tls/private/httpd-external.key /etc/pki/tls/private/httpd/httpd-external.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}]}}]}], "external_upgrade_tasks": [{"when": ["step|int == 1"], "tags": ["never", "system_upgrade_transfer_data", "system_upgrade_stop_services"], "block": [{"name": "Stop heat cfn container", "import_role": {"name": "tripleo_container_stop"}, "vars": {"tripleo_containers_to_stop": ["heat_api_cfn"], "tripleo_delegate_to": "{{ groups['heat_api_cfn'] | difference(groups['excluded_overcloud']) }}"}}]}]}, "tuple:('role_data', 'config_settings')": {"heat::notification_driver": ["messagingv2"], "heat::logging::debug": true, "heat::policy::policies": {}, "heat::enable_proxy_headers_parsing": true, "heat::rpc_response_timeout": 600, "heat::rabbit_heartbeat_timeout_threshold": 60, "heat::rabbit_heartbeat_in_pthread": false, "heat::region_name": "regionOne", "heat::keystone::authtoken::project_name": "service", "heat::keystone::authtoken::user_domain_name": "Default", "heat::keystone::authtoken::project_domain_name": "Default", "heat::keystone::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "heat::keystone::authtoken::auth_url": "http://172.17.0.2:5000", "heat::keystone::authtoken::password": "EumUoUtqjQYt1RrYT2q8IMlZH", "heat::keystone::authtoken::region_name": "regionOne", "heat::keystone::authtoken::interface": "internal", "heat::keystone::authtoken::memcache_use_advanced_pool": true, "heat::keystone::domain::domain_name": "heat_stack", "heat::keystone::domain::domain_admin": "heat_stack_domain_admin", "heat::keystone::domain::domain_admin_email": "heat_stack_domain_admin@localhost", "heat::db::database_db_max_retries": -1, "heat::db::database_max_retries": -1, "heat::yaql_memory_quota": 100000, "heat::yaql_limit_iterators": 1000, "heat::cors::max_age": 3600, "heat::cors::allow_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma,X-Auth-Token", "heat::cors::expose_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma", "heat::cron::purge_deleted::ensure": "present", "heat::cron::purge_deleted::minute": "1", "heat::cron::purge_deleted::hour": "0", "heat::cron::purge_deleted::monthday": "*", "heat::cron::purge_deleted::month": "*", "heat::cron::purge_deleted::weekday": "*", "heat::cron::purge_deleted::maxdelay": "3600", "heat::cron::purge_deleted::user": "heat", "heat::cron::purge_deleted::age": "30", "heat::cron::purge_deleted::age_type": "days", "heat::cron::purge_deleted::destination": "/dev/null", "heat::max_json_body_size": 4194304, "heat::cache::enabled": true, "heat::cache::tls_enabled": false, "heat::cache::resource_finder_caching": false, "heat::cache::backend": "dogpile.cache.memcached", "apache::default_vhost": false, "heat::api_cfn::bind_host": "%{hiera('internal_api')}", "heat::wsgi::apache_api_cfn::ssl": false, "heat::api_cfn::service_name": "httpd", "heat::wsgi::apache_api_cfn::bind_host": "%{hiera('internal_api')}", "heat::wsgi::apache_api_cfn::servername": "%{hiera('fqdn_internal_api')}", "heat::wsgi::apache_api_cfn::workers": 1}, "tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'step_config')": null, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "heat_api_cfn", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-31-n73pf2jbs4cy/472d9cab-7b85-4579-934c-974c13403b99"}


created_at: 2026-06-14 08:54:31.396581
data:
  {"type": "json", "value": {"ContainerHeatEngineImage": "registry.redhat.io/rhosp-rhel9/openstack-heat-engine:17.1"}}


created_at: 2026-06-14 08:54:35.311960
data:
  {"type": "json", "value": {"ContainerHeatEngineImage": "registry.redhat.io/rhosp-rhel9/openstack-heat-engine:17.1", "ContainerHeatConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-heat-api:17.1"}}


created_at: 2026-06-14 08:54:36.382598
data:
  {"value": {"ContainerHeatEngineImage": "registry.redhat.io/rhosp-rhel9/openstack-heat-engine:17.1", "ContainerHeatConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-heat-api:17.1"}}


created_at: 2026-06-14 08:54:36.435755
data:
  {"healthcheck_rpc_port": {"test": "/openstack/healthcheck 5672"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-32-3mv6b5356qai-ContainersCommon-2wksqh5bnknc/f48bf39b-ab56-4e36-8e22-e91828c53428"}


created_at: 2026-06-14 08:54:36.490224
data:
  {"tuple:('role_data', 'config_settings')": {"heat::notification_driver": ["messagingv2"], "heat::logging::debug": true, "heat::policy::policies": {}, "heat::enable_proxy_headers_parsing": true, "heat::rpc_response_timeout": 600, "heat::rabbit_heartbeat_timeout_threshold": 60, "heat::rabbit_heartbeat_in_pthread": false, "heat::region_name": "regionOne", "heat::keystone::authtoken::project_name": "service", "heat::keystone::authtoken::user_domain_name": "Default", "heat::keystone::authtoken::project_domain_name": "Default", "heat::keystone::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "heat::keystone::authtoken::auth_url": "http://172.17.0.2:5000", "heat::keystone::authtoken::password": "EumUoUtqjQYt1RrYT2q8IMlZH", "heat::keystone::authtoken::region_name": "regionOne", "heat::keystone::authtoken::interface": "internal", "heat::keystone::authtoken::memcache_use_advanced_pool": true, "heat::keystone::domain::domain_name": "heat_stack", "heat::keystone::domain::domain_admin": "heat_stack_domain_admin", "heat::keystone::domain::domain_admin_email": "heat_stack_domain_admin@localhost", "heat::db::database_db_max_retries": -1, "heat::db::database_max_retries": -1, "heat::yaql_memory_quota": 100000, "heat::yaql_limit_iterators": 1000, "heat::cors::max_age": 3600, "heat::cors::allow_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma,X-Auth-Token", "heat::cors::expose_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma", "heat::cron::purge_deleted::ensure": "present", "heat::cron::purge_deleted::minute": "1", "heat::cron::purge_deleted::hour": "0", "heat::cron::purge_deleted::monthday": "*", "heat::cron::purge_deleted::month": "*", "heat::cron::purge_deleted::weekday": "*", "heat::cron::purge_deleted::maxdelay": "3600", "heat::cron::purge_deleted::user": "heat", "heat::cron::purge_deleted::age": "30", "heat::cron::purge_deleted::age_type": "days", "heat::cron::purge_deleted::destination": "/dev/null", "heat::max_json_body_size": 4194304, "heat::cache::enabled": true, "heat::cache::tls_enabled": false, "heat::cache::resource_finder_caching": false, "heat::cache::backend": "dogpile.cache.memcached"}, "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-32-3mv6b5356qai-HeatBase-t52m4jyb6wml/638004f7-1ad8-4a3b-839f-dbd2febe1589"}


created_at: 2026-06-14 08:54:36.545424
data:
  {"value": {"ContainerHeatEngineImage": "registry.redhat.io/rhosp-rhel9/openstack-heat-engine:17.1"}}


created_at: 2026-06-14 08:54:36.551518
data:
  {"cmd_extra_args": "", "tuple:('docker_config', 'step_2')": {"heat_init_log": {"image": "registry.redhat.io/rhosp-rhel9/openstack-heat-engine:17.1", "net": "none", "user": "root", "volumes": ["/var/log/containers/heat:/var/log/heat:z"], "command": ["/bin/bash", "-c", "chown -R heat:heat /var/log/heat"]}}, "volumes": ["/var/log/containers/heat:/var/log/heat:z"], "host_prep_tasks": [{"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/heat", "setype": "container_file_t", "mode": "0750"}]}], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-32-3mv6b5356qai-HeatEngineLogging-bie6o7igyawy/86e37541-f844-455f-b0fa-e35639f2f113"}


created_at: 2026-06-14 08:54:36.584912
data:
  {"tuple:('role_data', 'step_config')": "include tripleo::profile::base::database::mysql::client", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-32-3mv6b5356qai-MySQLClient-46yiczdlmj3z/c54aa43a-a6b7-4292-b7a8-c623498121cc"}


created_at: 2026-06-14 08:54:36.598174
data:
  {"tuple:('role_data', 'docker_config')": {"step_2": {"heat_init_log": {"image": "registry.redhat.io/rhosp-rhel9/openstack-heat-engine:17.1", "net": "none", "user": "root", "volumes": ["/var/log/containers/heat:/var/log/heat:z"], "command": ["/bin/bash", "-c", "chown -R heat:heat /var/log/heat"]}}, "step_3": {"heat_engine_db_sync": {"image": "registry.redhat.io/rhosp-rhel9/openstack-heat-engine:17.1", "cap_add": ["AUDIT_WRITE"], "net": "host", "privileged": false, "detach": false, "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/heat:/var/log/heat:z", "/var/lib/kolla/config_files/heat_engine_db_sync.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/heat:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1781427082"}}}, "step_4": {"heat_engine": {"image": "registry.redhat.io/rhosp-rhel9/openstack-heat-engine:17.1", "net": "host", "privileged": false, "stop_grace_period": 60, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck 5672"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/heat:/var/log/heat:z", "/var/lib/kolla/config_files/heat_engine.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/heat:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "role_data": {"service_name": "heat_engine", "monitoring_subscription": "overcloud-heat-engine", "config_settings": {"heat::notification_driver": ["messagingv2"], "heat::logging::debug": true, "heat::policy::policies": {}, "heat::enable_proxy_headers_parsing": true, "heat::rpc_response_timeout": 600, "heat::rabbit_heartbeat_timeout_threshold": 60, "heat::rabbit_heartbeat_in_pthread": false, "heat::region_name": "regionOne", "heat::keystone::authtoken::project_name": "service", "heat::keystone::authtoken::user_domain_name": "Default", "heat::keystone::authtoken::project_domain_name": "Default", "heat::keystone::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "heat::keystone::authtoken::auth_url": "http://172.17.0.2:5000", "heat::keystone::authtoken::password": "EumUoUtqjQYt1RrYT2q8IMlZH", "heat::keystone::authtoken::region_name": "regionOne", "heat::keystone::authtoken::interface": "internal", "heat::keystone::authtoken::memcache_use_advanced_pool": true, "heat::keystone::domain::domain_name": "heat_stack", "heat::keystone::domain::domain_admin": "heat_stack_domain_admin", "heat::keystone::domain::domain_admin_email": "heat_stack_domain_admin@localhost", "heat::db::database_db_max_retries": -1, "heat::db::database_max_retries": -1, "heat::yaql_memory_quota": 100000, "heat::yaql_limit_iterators": 1000, "heat::cors::max_age": 3600, "heat::cors::allow_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma,X-Auth-Token", "heat::cors::expose_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma", "heat::cron::purge_deleted::ensure": "present", "heat::cron::purge_deleted::minute": "1", "heat::cron::purge_deleted::hour": "0", "heat::cron::purge_deleted::monthday": "*", "heat::cron::purge_deleted::month": "*", "heat::cron::purge_deleted::weekday": "*", "heat::cron::purge_deleted::maxdelay": "3600", "heat::cron::purge_deleted::user": "heat", "heat::cron::purge_deleted::age": "30", "heat::cron::purge_deleted::age_type": "days", "heat::cron::purge_deleted::destination": "/dev/null", "heat::max_json_body_size": 4194304, "heat::cache::enabled": true, "heat::cache::tls_enabled": false, "heat::cache::resource_finder_caching": false, "heat::cache::backend": "dogpile.cache.memcached", "apache::default_vhost": false, "heat::engine::configure_delegated_roles": false, "heat::engine::trusts_delegated_roles": [], "heat::engine::max_nested_stack_depth": 6, "heat::engine::max_resources_per_stack": 1000, "heat::engine::reauthentication_auth_method": "", "heat::engine::heat_metadata_server_url": "http://172.21.0.2:8000", "heat::engine::heat_waitcondition_server_url": "http://172.21.0.2:8000/v1/waitcondition", "heat::engine::convergence_engine": true, "heat::engine::client_retry_limit": 2, "tripleo::profile::base::heat::manage_db_purge": true, "heat::database_connection": "mysql+pymysql://heat:EumUoUtqjQYt1RrYT2q8IMlZH@172.17.0.2/heat?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "heat::keystone_ec2_uri": "http://172.17.0.2:5000/v3/ec2tokens", "heat::keystone::domain::domain_password": "ATIVqqjnxUwGZ7mH1nnY7wfKP", "heat::engine::auth_encryption_key": "JjtJl9DhaaCfhZ3Zk7BVorKxlqBReLqx", "heat::engine::plugin_dirs": [], "heat::engine::num_engine_workers": 1}, "service_config_settings": {"rsyslog": {"tripleo_logging_sources_heat_engine": [{"tag": "openstack.heat.engine", "file": "/var/log/containers/heat/heat-engine.log"}]}, "mysql": {"heat::db::mysql::password": "EumUoUtqjQYt1RrYT2q8IMlZH", "heat::db::mysql::user": "heat", "heat::db::mysql::host": "%", "heat::db::mysql::dbname": "heat"}}, "puppet_config": {"config_volume": "heat", "puppet_tags": "heat_config,file,concat,file_line", "step_config": "include tripleo::profile::base::heat::engine\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-heat-api:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/heat_engine.json": {"command": "/usr/bin/heat-engine --config-file /usr/share/heat/heat-dist.conf --config-file /etc/heat/heat.conf ", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/heat", "owner": "heat:heat", "recurse": true}]}, "/var/lib/kolla/config_files/heat_engine_db_sync.json": {"command": "/usr/bin/bootstrap_host_exec heat_engine su heat -s /bin/bash -c 'heat-manage db_sync'", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/heat", "owner": "heat:heat", "recurse": true}]}}, "docker_config": {"step_2": {"heat_init_log": {"image": "registry.redhat.io/rhosp-rhel9/openstack-heat-engine:17.1", "net": "none", "user": "root", "volumes": ["/var/log/containers/heat:/var/log/heat:z"], "command": ["/bin/bash", "-c", "chown -R heat:heat /var/log/heat"]}}, "step_3": {"heat_engine_db_sync": {"image": "registry.redhat.io/rhosp-rhel9/openstack-heat-engine:17.1", "cap_add": ["AUDIT_WRITE"], "net": "host", "privileged": false, "detach": false, "user": "root", "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/heat:/var/log/heat:z", "/var/lib/kolla/config_files/heat_engine_db_sync.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/heat:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1781427082"}}}, "step_4": {"heat_engine": {"image": "registry.redhat.io/rhosp-rhel9/openstack-heat-engine:17.1", "net": "host", "privileged": false, "stop_grace_period": 60, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck 5672"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/heat:/var/log/heat:z", "/var/lib/kolla/config_files/heat_engine.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/heat:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "host_prep_tasks": [{"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/heat", "setype": "container_file_t", "mode": "0750"}]}, {"name": "enable virt_sandbox_use_netlink for healthcheck", "seboolean": {"name": "virt_sandbox_use_netlink", "persistent": true, "state": true}, "when": ["ansible_facts.selinux is defined", "ansible_facts.selinux.status == \"enabled\""]}], "upgrade_tasks": [], "external_upgrade_tasks": [{"when": ["step|int == 1"], "tags": ["never", "system_upgrade_transfer_data", "system_upgrade_stop_services"], "block": [{"name": "Stop heat engine container", "import_role": {"name": "tripleo_container_stop"}, "vars": {"tripleo_containers_to_stop": ["heat_engine"], "tripleo_delegate_to": "{{ groups['heat_engine'] | difference(groups['excluded_overcloud']) }}"}}]}]}, "tuple:('role_data', 'config_settings')": {"heat::notification_driver": ["messagingv2"], "heat::logging::debug": true, "heat::policy::policies": {}, "heat::enable_proxy_headers_parsing": true, "heat::rpc_response_timeout": 600, "heat::rabbit_heartbeat_timeout_threshold": 60, "heat::rabbit_heartbeat_in_pthread": false, "heat::region_name": "regionOne", "heat::keystone::authtoken::project_name": "service", "heat::keystone::authtoken::user_domain_name": "Default", "heat::keystone::authtoken::project_domain_name": "Default", "heat::keystone::authtoken::www_authenticate_uri": "http://172.21.0.2:5000", "heat::keystone::authtoken::auth_url": "http://172.17.0.2:5000", "heat::keystone::authtoken::password": "EumUoUtqjQYt1RrYT2q8IMlZH", "heat::keystone::authtoken::region_name": "regionOne", "heat::keystone::authtoken::interface": "internal", "heat::keystone::authtoken::memcache_use_advanced_pool": true, "heat::keystone::domain::domain_name": "heat_stack", "heat::keystone::domain::domain_admin": "heat_stack_domain_admin", "heat::keystone::domain::domain_admin_email": "heat_stack_domain_admin@localhost", "heat::db::database_db_max_retries": -1, "heat::db::database_max_retries": -1, "heat::yaql_memory_quota": 100000, "heat::yaql_limit_iterators": 1000, "heat::cors::max_age": 3600, "heat::cors::allow_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma,X-Auth-Token", "heat::cors::expose_headers": "Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma", "heat::cron::purge_deleted::ensure": "present", "heat::cron::purge_deleted::minute": "1", "heat::cron::purge_deleted::hour": "0", "heat::cron::purge_deleted::monthday": "*", "heat::cron::purge_deleted::month": "*", "heat::cron::purge_deleted::weekday": "*", "heat::cron::purge_deleted::maxdelay": "3600", "heat::cron::purge_deleted::user": "heat", "heat::cron::purge_deleted::age": "30", "heat::cron::purge_deleted::age_type": "days", "heat::cron::purge_deleted::destination": "/dev/null", "heat::max_json_body_size": 4194304, "heat::cache::enabled": true, "heat::cache::tls_enabled": false, "heat::cache::resource_finder_caching": false, "heat::cache::backend": "dogpile.cache.memcached", "apache::default_vhost": false, "heat::engine::configure_delegated_roles": false, "heat::engine::trusts_delegated_roles": [], "heat::engine::max_nested_stack_depth": 6, "heat::engine::max_resources_per_stack": 1000, "heat::engine::reauthentication_auth_method": "", "heat::engine::heat_metadata_server_url": "http://172.21.0.2:8000", "heat::engine::heat_waitcondition_server_url": "http://172.21.0.2:8000/v1/waitcondition", "heat::engine::convergence_engine": true, "heat::engine::client_retry_limit": 2, "tripleo::profile::base::heat::manage_db_purge": true, "heat::database_connection": "mysql+pymysql://heat:EumUoUtqjQYt1RrYT2q8IMlZH@172.17.0.2/heat?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "heat::keystone_ec2_uri": "http://172.17.0.2:5000/v3/ec2tokens", "heat::keystone::domain::domain_password": "ATIVqqjnxUwGZ7mH1nnY7wfKP", "heat::engine::auth_encryption_key": "JjtJl9DhaaCfhZ3Zk7BVorKxlqBReLqx", "heat::engine::plugin_dirs": [], "heat::engine::num_engine_workers": 1}, "tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'step_config')": null, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "heat_engine", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-32-3mv6b5356qai/aeb9e4f7-4dc0-4a63-87be-2cf46d083a6b"}


created_at: 2026-06-14 08:54:37.994357
data:
  {"type": "json", "value": {"ContainerHorizonImage": "registry.redhat.io/rhosp-rhel9/openstack-horizon:17.1", "ContainerHorizonConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-horizon:17.1"}}


created_at: 2026-06-14 08:54:39.052391
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-33-dgolnup3ziua-ContainersCommon-etoqqi3nt5gw/cb1c9b80-1283-4b09-ac54-c37ec9799d44"}


created_at: 2026-06-14 08:54:39.055361
data:
  {"value": {"ContainerHorizonImage": "registry.redhat.io/rhosp-rhel9/openstack-horizon:17.1", "ContainerHorizonConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-horizon:17.1"}}


created_at: 2026-06-14 08:54:39.065090
data:
  {"tuple:('role_data', 'docker_config')": {"step_2": {"horizon_fix_perms": {"image": "registry.redhat.io/rhosp-rhel9/openstack-horizon:17.1", "net": "none", "user": "root", "command": ["/bin/bash", "-c", "touch /var/log/horizon/horizon.log ; chown -R apache:apache /var/log/horizon && chmod -R a+rx /etc/openstack-dashboard"], "volumes": ["/var/log/containers/horizon:/var/log/horizon:z", "/var/log/containers/httpd/horizon:/var/log/httpd:z", "/var/lib/config-data/puppet-generated/horizon/etc/openstack-dashboard:/etc/openstack-dashboard"]}}, "step_3": {"horizon": {"image": "registry.redhat.io/rhosp-rhel9/openstack-horizon:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/horizon.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/horizon:/var/lib/kolla/config_files/src:ro", "/var/log/containers/horizon:/var/log/horizon:z", "/var/log/containers/httpd/horizon:/var/log/httpd:z", "/var/tmp/horizon:/var/tmp:z", "/var/www:/var/www:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "ENABLE_DESIGNATE": "yes", "ENABLE_HEAT": "yes", "ENABLE_IRONIC": "yes", "ENABLE_MANILA": "yes", "ENABLE_OCTAVIA": "yes"}}}}, "role_data": {"service_name": "horizon", "firewall_rules": {"126 horizon": {"dport": [80]}}, "firewall_frontend_rules": {"100 horizon_haproxy_frontend": {"dport": [80]}}, "firewall_ssl_frontend_rules": {"100 horizon_haproxy_frontend_ssl": {"dport": [443]}}, "monitoring_subscription": "overcloud-horizon", "config_settings": {"horizon::allowed_hosts": ["*"], "horizon::enable_secure_proxy_ssl_header": true, "horizon::secure_proxy_addr_header": "HTTP_X_FORWARDED_FOR", "horizon::disable_password_reveal": true, "horizon::enforce_password_check": true, "horizon::disallow_iframe_embed": true, "horizon::cache_backend": "django.core.cache.backends.memcached.MemcachedCache", "horizon::django_session_engine": "django.contrib.sessions.backends.cache", "horizon::vhost_extra_params": {"add_listen": true, "priority": 10, "access_log_format": "%a %l %u %t \\\"%r\\\" %>s %b \\\"%%{}{Referer}i\\\" \\\"%%{}{User-Agent}i\\\"", "options": ["FollowSymLinks", "MultiViews"]}, "horizon::bind_address": "%{hiera('internal_api')}", "horizon::keystone_url": "http://172.21.0.2:5000/v3", "horizon::password_validator": "", "horizon::password_validator_help": "", "horizon::secret_key": "yBb46cqIUt", "horizon::secure_cookies": false, "horizon::session_timeout": 1800, "memcached_ipv6": false, "horizon::servername": "%{hiera('fqdn_internal_api')}", "horizon::listen_ssl": false, "horizon::customization_module": "", "horizon::timezone": "UTC", "horizon::file_upload_temp_dir": "/var/tmp", "horizon::help_url": "http://docs.openstack.org", "horizon::enable_user_pass": "UNSET", "horizon::django_debug": true, "horizon::log_level": "DEBUG"}, "ansible_group_vars": {"keystone_enable_member": true}, "service_config_settings": {"rsyslog": {"tripleo_logging_sources_horizon": [{"tag": "openstack.horizon", "file": "/var/log/containers/horizon/horizon.log"}]}}, "puppet_config": {"config_volume": "horizon", "puppet_tags": "horizon_config", "step_config": "include tripleo::profile::base::horizon\n", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-horizon:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/horizon.json": {"command": "/usr/sbin/httpd -DFOREGROUND", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}], "permissions": [{"path": "/var/log/horizon/", "owner": "apache:apache", "recurse": true}, {"path": "/etc/openstack-dashboard/", "owner": "apache:apache", "recurse": true}, {"path": "/usr/share/openstack-dashboard/openstack_dashboard/local/", "owner": "apache:apache", "recurse": false}, {"path": "/usr/share/openstack-dashboard/openstack_dashboard/local/local_settings.d/", "owner": "apache:apache", "recurse": false}]}}, "docker_config": {"step_2": {"horizon_fix_perms": {"image": "registry.redhat.io/rhosp-rhel9/openstack-horizon:17.1", "net": "none", "user": "root", "command": ["/bin/bash", "-c", "touch /var/log/horizon/horizon.log ; chown -R apache:apache /var/log/horizon && chmod -R a+rx /etc/openstack-dashboard"], "volumes": ["/var/log/containers/horizon:/var/log/horizon:z", "/var/log/containers/httpd/horizon:/var/log/httpd:z", "/var/lib/config-data/puppet-generated/horizon/etc/openstack-dashboard:/etc/openstack-dashboard"]}}, "step_3": {"horizon": {"image": "registry.redhat.io/rhosp-rhel9/openstack-horizon:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/horizon.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/horizon:/var/lib/kolla/config_files/src:ro", "/var/log/containers/horizon:/var/log/horizon:z", "/var/log/containers/httpd/horizon:/var/log/httpd:z", "/var/tmp/horizon:/var/tmp:z", "/var/www:/var/www:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "ENABLE_DESIGNATE": "yes", "ENABLE_HEAT": "yes", "ENABLE_IRONIC": "yes", "ENABLE_MANILA": "yes", "ENABLE_OCTAVIA": "yes"}}}}, "host_prep_tasks": [{"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode|default(omit) }}"}, "with_items": [{"path": "/var/log/containers/horizon", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/horizon", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/www", "setype": "container_file_t"}, {"path": "/var/tmp/horizon", "setype": "container_file_t", "mode": "01777"}]}, {"name": "ensure /var/tmp/horizon exists on boot", "copy": {"dest": "/etc/tmpfiles.d/var-tmp-horizon.conf", "content": "d /var/tmp/horizon 01777 root root - -\n"}}], "upgrade_tasks": [{"name": "Anchor for upgrade and update tasks", "when": "step|int == 0", "block": [{"name": "Reset selinux label on /var/tmp", "file": {"path": "/var/tmp", "state": "directory", "setype": "tmp_t", "mode": 1023}}]}], "update_tasks": [{"name": "Anchor for upgrade and update tasks", "when": "step|int == 0", "block": [{"name": "Reset selinux label on /var/tmp", "file": {"path": "/var/tmp", "state": "directory", "setype": "tmp_t", "mode": 1023}}]}], "external_upgrade_tasks": [{"when": ["step|int == 1"], "tags": ["never", "system_upgrade_transfer_data", "system_upgrade_stop_services"], "block": [{"name": "Stop horizon container", "import_role": {"name": "tripleo_container_stop"}, "vars": {"tripleo_containers_to_stop": ["horizon"], "tripleo_delegate_to": "{{ groups['horizon'] | difference(groups['excluded_overcloud']) }}"}}]}]}, "tuple:('role_data', 'config_settings')": {"horizon::allowed_hosts": ["*"], "horizon::enable_secure_proxy_ssl_header": true, "horizon::secure_proxy_addr_header": "HTTP_X_FORWARDED_FOR", "horizon::disable_password_reveal": true, "horizon::enforce_password_check": true, "horizon::disallow_iframe_embed": true, "horizon::cache_backend": "django.core.cache.backends.memcached.MemcachedCache", "horizon::django_session_engine": "django.contrib.sessions.backends.cache", "horizon::vhost_extra_params": {"add_listen": true, "priority": 10, "access_log_format": "%a %l %u %t \\\"%r\\\" %>s %b \\\"%%{}{Referer}i\\\" \\\"%%{}{User-Agent}i\\\"", "options": ["FollowSymLinks", "MultiViews"]}, "horizon::bind_address": "%{hiera('internal_api')}", "horizon::keystone_url": "http://172.21.0.2:5000/v3", "horizon::password_validator": "", "horizon::password_validator_help": "", "horizon::secret_key": "yBb46cqIUt", "horizon::secure_cookies": false, "horizon::session_timeout": 1800, "memcached_ipv6": false, "horizon::servername": "%{hiera('fqdn_internal_api')}", "horizon::listen_ssl": false, "horizon::customization_module": "", "horizon::timezone": "UTC", "horizon::file_upload_temp_dir": "/var/tmp", "horizon::help_url": "http://docs.openstack.org", "horizon::enable_user_pass": "UNSET", "horizon::django_debug": true, "horizon::log_level": "DEBUG"}, "tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'step_config')": null, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "horizon", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-33-dgolnup3ziua/25f5b4ac-e8cd-4874-b3d0-14a27073c676"}


created_at: 2026-06-14 08:54:39.571761
data:
  {"type": "json", "value": {"tripleo_tripleo_lvmfilter_enabled": false, "tripleo_tripleo_lvmfilter_devices_allowlist": [], "tripleo_tripleo_lvmfilter_devices_denylist": [".*"], "ContainerIscsidImage": "registry.redhat.io/rhosp-rhel9/openstack-iscsid:17.1", "ContainerIscsidConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-iscsid:17.1"}}


created_at: 2026-06-14 08:54:42.702581
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-34-4c7p7vi6rrpo-ContainersCommon-d4y2ln2mage6/32d525d6-5a0b-4973-91cf-dcd4e98ef10f"}


created_at: 2026-06-14 08:54:42.709167
data:
  {"value": {"tripleo_tripleo_lvmfilter_enabled": false, "tripleo_tripleo_lvmfilter_devices_allowlist": [], "tripleo_tripleo_lvmfilter_devices_denylist": [".*"], "ContainerIscsidImage": "registry.redhat.io/rhosp-rhel9/openstack-iscsid:17.1", "ContainerIscsidConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-iscsid:17.1"}}


created_at: 2026-06-14 08:54:42.721531
data:
  {"tuple:('role_data', 'docker_config')": {"step_3": {"iscsid": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-iscsid:17.1", "net": "host", "privileged": true, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/iscsid.json:/var/lib/kolla/config_files/config.json:ro", "/dev:/dev", "/run:/run", "/sys:/sys", "/lib/modules:/lib/modules:ro", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/etc/target:/etc/target:z", "/var/lib/iscsi:/var/lib/iscsi:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "role_data": {"service_name": "iscsid", "config_settings": {"tripleo::profile::base::iscsid::chap_algs": "SHA3-256,SHA256,SHA1,MD5"}, "service_config_settings": {}, "deploy_steps_tasks": [{"name": "Run lvmfilter role", "include_role": {"name": "tripleo_lvmfilter"}, "when": ["step|int == 1"]}], "ansible_group_vars": {"tripleo_tripleo_lvmfilter_enabled": false, "tripleo_tripleo_lvmfilter_devices_allowlist": [], "tripleo_tripleo_lvmfilter_devices_denylist": [".*"], "ContainerIscsidImage": "registry.redhat.io/rhosp-rhel9/openstack-iscsid:17.1", "ContainerIscsidConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-iscsid:17.1"}, "puppet_config": {"config_volume": "iscsid", "puppet_tags": "iscsid_config", "step_config": "include tripleo::profile::base::iscsid\n", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-iscsid:17.1", "volumes": ["/etc/iscsi:/tmp/iscsi.host:z"]}, "kolla_config": {"/var/lib/kolla/config_files/iscsid.json": {"command": "/usr/sbin/iscsid -f", "config_files": [{"source": "/var/lib/kolla/config_files/src-iscsid/", "dest": "/etc/iscsi/", "merge": true, "preserve_properties": true}]}}, "docker_config": {"step_3": {"iscsid": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-iscsid:17.1", "net": "host", "privileged": true, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/lib/kolla/config_files/iscsid.json:/var/lib/kolla/config_files/config.json:ro", "/dev:/dev", "/run:/run", "/sys:/sys", "/lib/modules:/lib/modules:ro", "/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro", "/etc/target:/etc/target:z", "/var/lib/iscsi:/var/lib/iscsi:z"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}}, "host_prep_tasks": [{"name": "create fcontext entry for iscsi", "community.general.sefcontext": {"target": "{{ item.path }}(/.*)?", "setype": "{{ item.setype }}", "state": "present"}, "with_items": [{"path": "/etc/iscsi", "setype": "container_file_t"}, {"path": "/etc/target", "setype": "container_file_t"}, {"path": "/var/lib/iscsi", "setype": "container_file_t"}]}, {"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}"}, "with_items": [{"path": "/etc/iscsi", "setype": "container_file_t"}, {"path": "/etc/target", "setype": "container_file_t"}, {"path": "/var/lib/iscsi", "setype": "container_file_t"}]}, {"name": "stat /lib/systemd/system/iscsid.socket", "stat": "path=/lib/systemd/system/iscsid.socket", "register": "stat_iscsid_socket"}, {"name": "Stop and disable iscsid.socket service", "service": "name=iscsid.socket state=stopped enabled=no", "when": "stat_iscsid_socket.stat.exists"}, {"name": "Check if iscsi.service is enabled", "command": "systemctl is-enabled --quiet iscsi.service", "failed_when": false, "register": "iscsi_service_enabled_result"}, {"name": "Stop iscsi.service", "service": "name=iscsi.service state=stopped enabled=no", "when": ["iscsi_service_enabled_result is changed", "iscsi_service_enabled_result.rc == 0"]}], "upgrade_tasks": []}, "tuple:('role_data', 'config_settings')": {"tripleo::profile::base::iscsid::chap_algs": "SHA3-256,SHA256,SHA1,MD5"}, "tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'step_config')": null, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "iscsid", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-34-4c7p7vi6rrpo/9ff3b0bf-0c35-4d98-9dcb-e1a69910d3a1"}


created_at: 2026-06-14 08:54:43.029884
data:
  {"type": "json", "value": {"extra_kernel_modules": {}, "extra_kernel_packages": {}, "extra_sysctl_settings": {}}}


created_at: 2026-06-14 08:54:44.131711
data:
  {"tuple:('role_data', 'docker_config')": null, "role_data": {"service_name": "kernel", "host_prep_tasks": [{"include_role": {"name": "tripleo_kernel"}}], "ansible_group_vars": {"hieradata_localhost_address": "localhost", "tripleo_kernel_extra_modules": {}, "tripleo_kernel_extra_packages": {}, "tripleo_kernel_sysctl_extra_settings": {"net.ipv6.conf.default.disable_ipv6": {"value": 0}, "net.ipv4.ip_local_reserved_ports": {"value": "35357,49000-49001"}, "net.ipv6.conf.all.disable_ipv6": {"value": 0}, "net.ipv6.conf.lo.disable_ipv6": {"value": 0}, "net.ipv4.ip_forward": {"value": 1}, "net.ipv4.conf.all.rp_filter": {"value": 1}, "net.ipv6.conf.all.forwarding": {"value": 0}, "net.ipv4.ip_nonlocal_bind": {"value": 1}, "net.ipv6.ip_nonlocal_bind": {"value": 1}, "kernel.pid_max": {"value": 1048576}, "net.ipv4.neigh.default.gc_thresh1": {"value": 1024}, "net.ipv4.neigh.default.gc_thresh2": {"value": 2048}, "net.ipv4.neigh.default.gc_thresh3": {"value": 4096}, "net.bridge.bridge-nf-call-arptables": {"value": 1}, "net.bridge.bridge-nf-call-iptables": {"value": 1}, "net.bridge.bridge-nf-call-ip6tables": {"value": 1}, "fs.inotify.max_user_instances": {"value": 1024}}}}, "tuple:('role_data', 'config_settings')": null, "tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'step_config')": null, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "kernel", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-35-44zw46hweisx/c1eac96c-ffb4-475e-a250-dcd81ffd5c55"}


created_at: 2026-06-14 08:54:44.575876
data:
  {"type": "json", "value": {"ContainerKeystoneImage": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1", "ContainerKeystoneConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1"}}


created_at: 2026-06-14 08:54:45.730707
data:
  {"type": "json", "value": {"ContainerKeystoneImage": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1"}}


created_at: 2026-06-14 08:54:50.595062
data:
  {"value": {"ContainerKeystoneImage": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1", "ContainerKeystoneConfigImage": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1"}}


created_at: 2026-06-14 08:54:50.647567
data:
  {"tuple:('role_data', 'metadata_settings')": null, "tuple:('role_data', 'config_settings')": {"apache::ip": "%{hiera('internal_api')}", "apache::default_vhost": false, "apache::trace_enable": "Off", "apache::server_signature": "Off", "apache::server_tokens": "Prod", "apache::timeout": 90, "apache::default_mods": false, "apache::mod::prefork::maxrequestworkers": 100, "apache::mod::prefork::serverlimit": 100, "apache::mod::remoteip::proxy_ips": ["172.17.0.0/24"], "apache::mod::alias::icons_options": "None"}, "tuple:('role_data', 'deploy_steps_tasks')": [{"name": "Certificate generation", "when": ["step|int == 1", "enable_internal_tls"], "block": [{"name": "Create dirs for certificates and keys", "file": {"path": "{{ item }}", "state": "directory", "serole": "object_r", "setype": "cert_t", "seuser": "system_u"}, "with_items": ["/etc/pki/tls/certs/httpd", "/etc/pki/tls/private/httpd"]}, {"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "httpd-ctlplane", "dns": "{{ fqdn_ctlplane }}", "principal": "HTTP/{{ fqdn_ctlplane }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-ctlplane.crt /etc/pki/tls/certs/httpd/httpd-ctlplane.crt\ncp /etc/pki/tls/private/httpd-ctlplane.key /etc/pki/tls/private/httpd/httpd-ctlplane.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage", "dns": "{{ fqdn_storage }}", "principal": "HTTP/{{ fqdn_storage }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage.crt /etc/pki/tls/certs/httpd/httpd-storage.crt\ncp /etc/pki/tls/private/httpd-storage.key /etc/pki/tls/private/httpd/httpd-storage.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage_mgmt", "dns": "{{ fqdn_storage_mgmt }}", "principal": "HTTP/{{ fqdn_storage_mgmt }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage_mgmt.crt /etc/pki/tls/certs/httpd/httpd-storage_mgmt.crt\ncp /etc/pki/tls/private/httpd-storage_mgmt.key /etc/pki/tls/private/httpd/httpd-storage_mgmt.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-internal_api", "dns": "{{ fqdn_internal_api }}", "principal": "HTTP/{{ fqdn_internal_api }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-internal_api.crt /etc/pki/tls/certs/httpd/httpd-internal_api.crt\ncp /etc/pki/tls/private/httpd-internal_api.key /etc/pki/tls/private/httpd/httpd-internal_api.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-external", "dns": "{{ fqdn_external }}", "principal": "HTTP/{{ fqdn_external }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-external.crt /etc/pki/tls/certs/httpd/httpd-external.crt\ncp /etc/pki/tls/private/httpd-external.key /etc/pki/tls/private/httpd/httpd-external.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}]}}]}], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-36-wzob7eoxl5ya-ApacheServiceBase-lebtaw4hmf3o/ad32d998-fcb2-40d3-be7d-ab78ff9ce4a5"}


created_at: 2026-06-14 08:54:50.688034
data:
  {"volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-36-wzob7eoxl5ya-ContainersCommon-ssucep4ekccf/84334e2e-db7d-4c59-ab9b-2034549fec01"}


created_at: 2026-06-14 08:54:50.852009
data:
  {"host_prep_tasks": [{"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/keystone", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/keystone", "setype": "container_file_t", "mode": "0750"}]}], "environment": null, "config_settings": null, "tuple:('docker_config', 'step_2')": {"keystone_init_log": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1", "net": "none", "user": "root", "command": ["/bin/bash", "-c", "chown -R keystone:keystone /var/log/keystone"], "volumes": ["/var/log/containers/keystone:/var/log/keystone:z", "/var/log/containers/httpd/keystone:/var/log/httpd:z"]}}, "volumes": ["/var/log/containers/keystone:/var/log/keystone:z", "/var/log/containers/httpd/keystone:/var/log/httpd:z"], "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-36-wzob7eoxl5ya-KeystoneLogging-43xcm2fzqmze/2afb685a-9897-4695-8641-0443ef13fdf0"}


created_at: 2026-06-14 08:54:50.890799
data:
  {"tuple:('role_data', 'step_config')": "include tripleo::profile::base::database::mysql::client", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-36-wzob7eoxl5ya-MySQLClient-xhftcipwich5/6ba5ef80-1587-486c-8ec0-c6b75b04c5cf"}


created_at: 2026-06-14 08:54:50.905193
data:
  {"tuple:('role_data', 'docker_config')": {"step_2": {"keystone_init_log": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1", "net": "none", "user": "root", "command": ["/bin/bash", "-c", "chown -R keystone:keystone /var/log/keystone"], "volumes": ["/var/log/containers/keystone:/var/log/keystone:z", "/var/log/containers/httpd/keystone:/var/log/httpd:z"]}}, "step_3": {"keystone_db_sync": {"image": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1", "net": "host", "user": "root", "privileged": false, "detach": false, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/keystone:/var/log/keystone:z", "/var/log/containers/httpd/keystone:/var/log/httpd:z", "/etc/openldap:/etc/openldap:ro", "/var/lib/kolla/config_files/keystone.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/keystone:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_BOOTSTRAP": true, "KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1781427082"}, "command": ["/usr/bin/bootstrap_host_exec", "keystone", "/usr/local/bin/kolla_start"]}, "keystone": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/keystone:/var/log/keystone:z", "/var/log/containers/httpd/keystone:/var/log/httpd:z", "/etc/openldap:/etc/openldap:ro", "/var/lib/kolla/config_files/keystone.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/keystone:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "keystone_bootstrap": {"start_order": 3, "action": "exec", "user": "root", "command": ["keystone", "/usr/bin/bootstrap_host_exec", "keystone", "keystone-manage", "bootstrap"], "environment": {"KOLLA_BOOTSTRAP": true, "OS_BOOTSTRAP_PASSWORD": "QsweAtH0uqJJ3gecvauV85Tii", "OS_BOOTSTRAP_USERNAME": "admin", "OS_BOOTSTRAP_PROJECT_NAME": "admin", "OS_BOOTSTRAP_ROLE_NAME": "admin", "OS_BOOTSTRAP_SERVICE_NAME": "keystone", "OS_BOOTSTRAP_ADMIN_URL": "http://192.168.122.99:35357", "OS_BOOTSTRAP_PUBLIC_URL": "http://172.21.0.2:5000", "OS_BOOTSTRAP_INTERNAL_URL": "http://172.17.0.2:5000", "OS_BOOTSTRAP_REGION_ID": "regionOne"}}, "keystone_cron": {"start_order": 4, "image": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1", "user": "root", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/usr/share/openstack-tripleo-common/healthcheck/cron keystone"}, "command": ["/bin/bash", "-c", "/usr/local/bin/kolla_set_configs && /usr/sbin/crond -n"], "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/keystone:/var/log/keystone:z", "/var/log/containers/httpd/keystone:/var/log/httpd:z", "/var/lib/kolla/config_files/keystone_cron.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/keystone:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}, "step_4": {"keystone_refresh": {"start_order": 1, "action": "exec", "user": "root", "command": ["keystone", "pkill", "--signal", "USR1", "httpd"]}}}, "role_data": {"service_name": "keystone", "firewall_rules": {"111 keystone": {"dport": [5000, "35357"]}}, "firewall_frontend_rules": {"100 keystone_public_haproxy_frontend": {"dport": [5000]}, "100 keystone_admin_haproxy_frontend": {"dport": ["35357"]}}, "firewall_ssl_frontend_rules": {"100 keystone_public_haproxy_frontend_ssl": {"dport": [13000]}}, "monitoring_subscription": "overcloud-keystone", "config_settings": {"apache::ip": "%{hiera('internal_api')}", "apache::default_vhost": false, "apache::trace_enable": "Off", "apache::server_signature": "Off", "apache::server_tokens": "Prod", "apache::timeout": 90, "apache::default_mods": false, "apache::mod::prefork::maxrequestworkers": 100, "apache::mod::prefork::serverlimit": 100, "apache::mod::remoteip::proxy_ips": ["172.17.0.0/24"], "apache::mod::alias::icons_options": "None", "keystone::database_connection": "mysql+pymysql://keystone:H8r5Ds7XHkZTwmxqufNxHzf5Y@172.17.0.2/keystone?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "keystone::token_expiration": 3600, "keystone::policy::policies": {}, "keystone_ssl_certificate": "", "keystone_ssl_certificate_key": "", "keystone::token_provider": "fernet", "keystone::enable_fernet_setup": true, "keystone::fernet_max_active_keys": 5, "keystone::enable_proxy_headers_parsing": true, "keystone::enable_credential_setup": true, "keystone::credential_keys": {"/etc/keystone/credential-keys/0": {"content": "aLqkr8lE-3F2CEOiKxPp78E8PuYnJHm0d7IHUR0aTlE="}, "/etc/keystone/credential-keys/1": {"content": "pC7HLUCY5_roBRZxxiQvRap_MQXU43JBao9PlpjkvZo="}}, "keystone::fernet_keys": {"/etc/keystone/fernet-keys/0": {"content": "AGRh2m-RqVDRLH5dXN_ecAwkUFcN7D7hqJ9_YWMJ4eo="}, "/etc/keystone/fernet-keys/1": {"content": "IPuF8GpXRYZQVnVrGvoXuTt9mPC3zXmrRCRR97MZa2Y="}}, "keystone::fernet_replace_keys": true, "keystone::logging::debug": true, "keystone::notification_driver": ["messagingv2"], "keystone::notification_format": "basic", "tripleo::profile::base::keystone::extra_notification_topics": [], "keystone_enable_db_purge": true, "keystone::cron::trust_flush::ensure": "present", "keystone::cron::trust_flush::minute": "1", "keystone::cron::trust_flush::hour": "*", "keystone::cron::trust_flush::monthday": "*", "keystone::cron::trust_flush::month": "*", "keystone::cron::trust_flush::weekday": "*", "keystone::cron::trust_flush::maxdelay": 0, "keystone::cron::trust_flush::destination": "/var/log/keystone/keystone-trustflush.log", "keystone::cron::trust_flush::user": "keystone", "keystone::rabbit_heartbeat_timeout_threshold": 60, "keystone::rabbit_heartbeat_in_pthread": false, "keystone::service_name": "httpd", "keystone::enable_ssl": false, "keystone::wsgi::apache::api_port": [5000, "35357"], "keystone::wsgi::apache::ssl": false, "keystone::wsgi::apache::servername": "%{hiera('fqdn_internal_api')}", "keystone::wsgi::apache::workers": "1", "keystone::wsgi::apache::threads": 1, "keystone::db::database_db_max_retries": -1, "keystone::db::database_max_retries": -1, "keystone::wsgi::apache::bind_host": ["%{hiera('internal_api')}", "%{hiera('ctlplane')}"], "keystone::cache::enabled": true, "keystone::cache::backend_argument": ["memcached_expire_time: 3600"], "keystone::cache::tls_enabled": false, "keystone::cache::backend": "dogpile.cache.memcached"}, "service_config_settings": {"rsyslog": {"tripleo_logging_sources_keystone": {"tag": "openstack.keystone", "file": "/var/log/containers/keystone/keystone.log"}}, "mysql": {"keystone::db::mysql::password": "H8r5Ds7XHkZTwmxqufNxHzf5Y", "keystone::db::mysql::user": "keystone", "keystone::db::mysql::host": "%", "keystone::db::mysql::dbname": "keystone"}, "pacemaker": {"keystone::endpoint::public_url": "http://172.21.0.2:5000", "keystone::endpoint::internal_url": "http://172.17.0.2:5000", "keystone::endpoint::admin_url": "http://192.168.122.99:35357", "keystone::endpoint::region": "regionOne", "keystone::admin_password": "QsweAtH0uqJJ3gecvauV85Tii"}}, "puppet_config": {"config_volume": "keystone", "puppet_tags": "keystone_config,keystone_domain_config", "step_config": "['Keystone_user', 'Keystone_endpoint', 'Keystone_domain', 'Keystone_tenant', 'Keystone_user_role', 'Keystone_role', 'Keystone_service'].each |String $val| { noop_resource($val) }\ninclude tripleo::profile::base::keystone\n\ninclude tripleo::profile::base::database::mysql::client", "config_image": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1"}, "kolla_config": {"/var/lib/kolla/config_files/keystone.json": {"command": "/usr/sbin/httpd", "config_files": [{"source": "/var/lib/kolla/config_files/src/etc/keystone/fernet-keys", "dest": "/etc/keystone/fernet-keys", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.d", "dest": "/etc/httpd/conf.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d", "dest": "/etc/httpd/conf.modules.d", "merge": false, "preserve_properties": true}, {"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}, "/var/lib/kolla/config_files/keystone_cron.json": {"command": "/usr/sbin/crond -n", "config_files": [{"source": "/var/lib/kolla/config_files/src/*", "dest": "/", "merge": true, "preserve_properties": true}]}}, "docker_config": {"step_2": {"keystone_init_log": {"start_order": 1, "image": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1", "net": "none", "user": "root", "command": ["/bin/bash", "-c", "chown -R keystone:keystone /var/log/keystone"], "volumes": ["/var/log/containers/keystone:/var/log/keystone:z", "/var/log/containers/httpd/keystone:/var/log/httpd:z"]}}, "step_3": {"keystone_db_sync": {"image": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1", "net": "host", "user": "root", "privileged": false, "detach": false, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/keystone:/var/log/keystone:z", "/var/log/containers/httpd/keystone:/var/log/httpd:z", "/etc/openldap:/etc/openldap:ro", "/var/lib/kolla/config_files/keystone.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/keystone:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_BOOTSTRAP": true, "KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS", "TRIPLEO_DEPLOY_IDENTIFIER": "1781427082"}, "command": ["/usr/bin/bootstrap_host_exec", "keystone", "/usr/local/bin/kolla_start"]}, "keystone": {"start_order": 2, "image": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/openstack/healthcheck"}, "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/keystone:/var/log/keystone:z", "/var/log/containers/httpd/keystone:/var/log/httpd:z", "/etc/openldap:/etc/openldap:ro", "/var/lib/kolla/config_files/keystone.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/keystone:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}, "keystone_bootstrap": {"start_order": 3, "action": "exec", "user": "root", "command": ["keystone", "/usr/bin/bootstrap_host_exec", "keystone", "keystone-manage", "bootstrap"], "environment": {"KOLLA_BOOTSTRAP": true, "OS_BOOTSTRAP_PASSWORD": "QsweAtH0uqJJ3gecvauV85Tii", "OS_BOOTSTRAP_USERNAME": "admin", "OS_BOOTSTRAP_PROJECT_NAME": "admin", "OS_BOOTSTRAP_ROLE_NAME": "admin", "OS_BOOTSTRAP_SERVICE_NAME": "keystone", "OS_BOOTSTRAP_ADMIN_URL": "http://192.168.122.99:35357", "OS_BOOTSTRAP_PUBLIC_URL": "http://172.21.0.2:5000", "OS_BOOTSTRAP_INTERNAL_URL": "http://172.17.0.2:5000", "OS_BOOTSTRAP_REGION_ID": "regionOne"}}, "keystone_cron": {"start_order": 4, "image": "registry.redhat.io/rhosp-rhel9/openstack-keystone:17.1", "user": "root", "net": "host", "privileged": false, "restart": "always", "healthcheck": {"test": "/usr/share/openstack-tripleo-common/healthcheck/cron keystone"}, "command": ["/bin/bash", "-c", "/usr/local/bin/kolla_set_configs && /usr/sbin/crond -n"], "volumes": ["/etc/hosts:/etc/hosts:ro", "/etc/localtime:/etc/localtime:ro", "/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro", "/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro", "/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro", "/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro", "/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro", "/dev/log:/dev/log", "/etc/puppet:/etc/puppet:ro", "/var/log/containers/keystone:/var/log/keystone:z", "/var/log/containers/httpd/keystone:/var/log/httpd:z", "/var/lib/kolla/config_files/keystone_cron.json:/var/lib/kolla/config_files/config.json:ro", "/var/lib/config-data/puppet-generated/keystone:/var/lib/kolla/config_files/src:ro"], "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}}}, "step_4": {"keystone_refresh": {"start_order": 1, "action": "exec", "user": "root", "command": ["keystone", "pkill", "--signal", "USR1", "httpd"]}}}, "external_deploy_tasks": [{"name": "Manage clouds.yaml files", "when": ["step|int == 1", "not ansible_check_mode|bool"], "block": [{"name": "Create /etc/openstack directory if it does not exist", "become": true, "file": {"mode": "0755", "owner": "root", "path": "/etc/openstack", "state": "directory"}}, {"name": "Configure /etc/openstack/clouds.yaml", "include_role": {"name": "tripleo_keystone_resources", "tasks_from": "clouds"}, "vars": {"tripleo_keystone_resources_cloud_name": "standalone", "tripleo_keystone_resources_cloud_config": {"auth": {"auth_url": "http://172.21.0.2:5000", "password": "QsweAtH0uqJJ3gecvauV85Tii", "project_domain_name": "Default", "project_name": "admin", "user_domain_name": "Default", "username": "admin"}, "cacert": "", "identity_api_version": "3", "volume_api_version": "3", "region_name": "regionOne"}}}]}, {"name": "Manage Keystone resources", "become": true, "when": ["step|int == 4", "not ansible_check_mode|bool"], "block": [{"name": "Manage Keystone resources for OpenStack services", "include_role": {"name": "tripleo_keystone_resources"}, "vars": {"tripleo_keystone_resources_catalog_config": "{{ keystone_resources }}", "tripleo_keystone_resources_service_project": "service", "tripleo_keystone_resources_cloud_name": "standalone", "tripleo_keystone_resources_region": "regionOne", "tripleo_keystone_resources_admin_endpoint": "http://192.168.122.99:35357", "tripleo_keystone_resources_public_endpoint": "http://172.21.0.2:5000", "tripleo_keystone_resources_internal_endpoint": "http://172.17.0.2:5000", "tripleo_keystone_resources_admin_password": "QsweAtH0uqJJ3gecvauV85Tii", "tripleo_keystone_resources_member_role_enabled": false}}, {"name": "is Keystone LDAP enabled", "set_fact": {"keystone_ldap_domain_enabled": false}}, {"name": "Set fact for tripleo_keystone_ldap_domains", "set_fact": {"tripleo_keystone_ldap_domains": {}}, "when": "keystone_ldap_domain_enabled|bool"}, {"name": "Manage Keystone domains from LDAP config", "when": "keystone_ldap_domain_enabled|bool", "include_role": {"name": "tripleo_keystone_resources", "tasks_from": "domains"}, "vars": {"tripleo_keystone_resources_catalog_config": "{{ keystone_resources }}", "tripleo_keystone_resources_cloud_name": "standalone", "batched_tripleo_keystone_resources_domains": "{{ tripleo_keystone_ldap_domains | list }}"}}]}], "deploy_steps_tasks": [{"name": "Certificate generation", "when": ["step|int == 1", "enable_internal_tls"], "block": [{"name": "Create dirs for certificates and keys", "file": {"path": "{{ item }}", "state": "directory", "serole": "object_r", "setype": "cert_t", "seuser": "system_u"}, "with_items": ["/etc/pki/tls/certs/httpd", "/etc/pki/tls/private/httpd"]}, {"include_role": {"name": "linux-system-roles.certificate"}, "vars": {"certificate_requests": [{"name": "httpd-ctlplane", "dns": "{{ fqdn_ctlplane }}", "principal": "HTTP/{{ fqdn_ctlplane }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-ctlplane.crt /etc/pki/tls/certs/httpd/httpd-ctlplane.crt\ncp /etc/pki/tls/private/httpd-ctlplane.key /etc/pki/tls/private/httpd/httpd-ctlplane.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage", "dns": "{{ fqdn_storage }}", "principal": "HTTP/{{ fqdn_storage }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage.crt /etc/pki/tls/certs/httpd/httpd-storage.crt\ncp /etc/pki/tls/private/httpd-storage.key /etc/pki/tls/private/httpd/httpd-storage.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-storage_mgmt", "dns": "{{ fqdn_storage_mgmt }}", "principal": "HTTP/{{ fqdn_storage_mgmt }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-storage_mgmt.crt /etc/pki/tls/certs/httpd/httpd-storage_mgmt.crt\ncp /etc/pki/tls/private/httpd-storage_mgmt.key /etc/pki/tls/private/httpd/httpd-storage_mgmt.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-internal_api", "dns": "{{ fqdn_internal_api }}", "principal": "HTTP/{{ fqdn_internal_api }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-internal_api.crt /etc/pki/tls/certs/httpd/httpd-internal_api.crt\ncp /etc/pki/tls/private/httpd-internal_api.key /etc/pki/tls/private/httpd/httpd-internal_api.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}, {"name": "httpd-external", "dns": "{{ fqdn_external }}", "principal": "HTTP/{{ fqdn_external }}@{{ idm_realm }}", "run_after": "cp /etc/pki/tls/certs/httpd-external.crt /etc/pki/tls/certs/httpd/httpd-external.crt\ncp /etc/pki/tls/private/httpd-external.key /etc/pki/tls/private/httpd/httpd-external.key\npkill -USR1 httpd\n", "key_size": "2048", "ca": "ipa"}]}}]}, {"name": "validate keystone container state", "containers.podman.podman_container_info": {"name": "keystone"}, "register": "keystone_infos", "failed_when": ["keystone_infos.containers.0.Healthcheck.Status is defined", "'healthy' not in keystone_infos.containers.0.Healthcheck.Status"], "retries": 10, "delay": 30, "tags": ["opendev-validation", "opendev-validation-keystone"], "when": ["container_cli == 'podman'", "not container_healthcheck_disabled", "step|int == 4"]}], "host_prep_tasks": [{"name": "create persistent directories", "file": {"path": "{{ item.path }}", "state": "directory", "setype": "{{ item.setype }}", "mode": "{{ item.mode }}"}, "with_items": [{"path": "/var/log/containers/keystone", "setype": "container_file_t", "mode": "0750"}, {"path": "/var/log/containers/httpd/keystone", "setype": "container_file_t", "mode": "0750"}]}, {"name": "Check if file certs_valid exist", "stat": {"path": "/etc/openldap/certs/certs_valid"}, "register": "certs_valid_stat"}, {"name": "Check if file cert9.db exist", "stat": {"path": "/etc/openldap/certs/cert9.db"}, "register": "cert9_stat", "when": "not certs_valid_stat.stat.exists"}, {"name": "Check if file key4.db exist", "stat": {"path": "/etc/openldap/certs/key4.db"}, "register": "key4_stat", "when": "not certs_valid_stat.stat.exists"}, {"fail": {"msg": "Keys and/or certificates were found in /etc/openldap/certs but these conflicts with keystone python LDAP calls.  If you know those certificates are valid and not causing any conflicts, you can touch /etc/openldap/certs/certs_valid in order to skip this failure and retry or you can delete the files located in /etc/openldap/certs and retry.\n"}, "when": "( cert9_stat.stat.exists or key4_stat.stat.exists ) and not certs_valid_stat.stat.exists"}], "metadata_settings": null, "external_upgrade_tasks": [{"when": ["step|int == 1"], "tags": ["never", "system_upgrade_transfer_data", "system_upgrade_stop_services"], "block": [{"name": "Stop keystone container", "import_role": {"name": "tripleo_container_stop"}, "vars": {"tripleo_containers_to_stop": ["keystone", "keystone_cron"], "tripleo_delegate_to": "{{ groups['keystone'] | difference(groups['excluded_overcloud']) }}"}}]}]}, "tuple:('role_data', 'config_settings')": {"apache::ip": "%{hiera('internal_api')}", "apache::default_vhost": false, "apache::trace_enable": "Off", "apache::server_signature": "Off", "apache::server_tokens": "Prod", "apache::timeout": 90, "apache::default_mods": false, "apache::mod::prefork::maxrequestworkers": 100, "apache::mod::prefork::serverlimit": 100, "apache::mod::remoteip::proxy_ips": ["172.17.0.0/24"], "apache::mod::alias::icons_options": "None", "keystone::database_connection": "mysql+pymysql://keystone:H8r5Ds7XHkZTwmxqufNxHzf5Y@172.17.0.2/keystone?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo", "keystone::token_expiration": 3600, "keystone::policy::policies": {}, "keystone_ssl_certificate": "", "keystone_ssl_certificate_key": "", "keystone::token_provider": "fernet", "keystone::enable_fernet_setup": true, "keystone::fernet_max_active_keys": 5, "keystone::enable_proxy_headers_parsing": true, "keystone::enable_credential_setup": true, "keystone::credential_keys": {"/etc/keystone/credential-keys/0": {"content": "aLqkr8lE-3F2CEOiKxPp78E8PuYnJHm0d7IHUR0aTlE="}, "/etc/keystone/credential-keys/1": {"content": "pC7HLUCY5_roBRZxxiQvRap_MQXU43JBao9PlpjkvZo="}}, "keystone::fernet_keys": {"/etc/keystone/fernet-keys/0": {"content": "AGRh2m-RqVDRLH5dXN_ecAwkUFcN7D7hqJ9_YWMJ4eo="}, "/etc/keystone/fernet-keys/1": {"content": "IPuF8GpXRYZQVnVrGvoXuTt9mPC3zXmrRCRR97MZa2Y="}}, "keystone::fernet_replace_keys": true, "keystone::logging::debug": true, "keystone::notification_driver": ["messagingv2"], "keystone::notification_format": "basic", "tripleo::profile::base::keystone::extra_notification_topics": [], "keystone_enable_db_purge": true, "keystone::cron::trust_flush::ensure": "present", "keystone::cron::trust_flush::minute": "1", "keystone::cron::trust_flush::hour": "*", "keystone::cron::trust_flush::monthday": "*", "keystone::cron::trust_flush::month": "*", "keystone::cron::trust_flush::weekday": "*", "keystone::cron::trust_flush::maxdelay": 0, "keystone::cron::trust_flush::destination": "/var/log/keystone/keystone-trustflush.log", "keystone::cron::trust_flush::user": "keystone", "keystone::rabbit_heartbeat_timeout_threshold": 60, "keystone::rabbit_heartbeat_in_pthread": false, "keystone::service_name": "httpd", "keystone::enable_ssl": false, "keystone::wsgi::apache::api_port": [5000, "35357"], "keystone::wsgi::apache::ssl": false, "keystone::wsgi::apache::servername": "%{hiera('fqdn_internal_api')}", "keystone::wsgi::apache::workers": "1", "keystone::wsgi::apache::threads": 1, "keystone::db::database_db_max_retries": -1, "keystone::db::database_max_retries": -1, "keystone::wsgi::apache::bind_host": ["%{hiera('internal_api')}", "%{hiera('ctlplane')}"], "keystone::cache::enabled": true, "keystone::cache::backend_argument": ["memcached_expire_time: 3600"], "keystone::cache::tls_enabled": false, "keystone::cache::backend": "dogpile.cache.memcached"}, "tuple:('role_data', 'container_config_scripts')": null, "tuple:('role_data', 'step_config')": null, "tuple:('role_data', 'service_names')": null, "tuple:('role_data', 'service_name')": "keystone", "OS::stack_id": "arn:openstack:heat::admin:stacks/standalone-StandaloneServiceChain-27wkvojnpwdd-ServiceChain-essbxuht2pfr-36-wzob7eoxl5ya/77b92765-fdbf-4681-a75e-3a52d1cf4d2a"}


