Ensure configuration directories are present for each Datadog check

Ensure datadog-agent-sysprobe is running if enabled and installed

Ensure datadog-agent-sysprobe is stopped if disabled or not installed

Ensure datadog-agent, datadog-agent-process and datadog-agent-trace are not running

Stop play if datadog_agent_version and datadog_agent_major_version are not compatible

Set datadog_agent_major_version to deduced value from datadog_agent_version

Flag custom repository file for deletion if different from current repository config

(Custom) Remove Datadog custom repository file when not set or updated

but what if you have a complex module that needs complicated data?

Try to set secontext to default, but this will fail because of the lack of a default in the policy

Create a zfs file system with quota of 10GiB and visible snapdir

Fail if there is no Ansible inventory group matching the blueprint's host_groups

Fail if the selected components should not be part of an HDP 3 blueprint

Fail if the selected components should not be part of an HDP 2 blueprint

Fail if the required HDFS components are not part of the blueprint

Fail if the required Yarn components are not part of the blueprint

Fail if the required Hive components are not part of the blueprint

Fail if the required Druid components are not part of the blueprint

Fail if the required Accumulo components are not part of the blueprint

Add nodes to the hadoop-cluster group and groups representing the host_groups

Fail if no Ansible inventory group called 'hadoop-cluster' exists

Fail if no Ansible inventory group called 'ambari-server' exists

Add nodes to hadoop-cluster and {{ outer_loop.host_group }} groups

Modify the HDF base_url repository for HDF {{ hdf_minor_version }}

Upload the HDF Version Definition file for HDF-only clusters (Ambari 2.6+)

Attempt to get an existing VDF for the required version (Ambari >= 2.6)

Update repo_version model to set ambari_managed_repositories=false

Install snappy from HDP-UTILS repo (bug in SLES 12 HDP-UTILS repo)

Copy the JCE jar files to {{ oraclejdk_options.base_folder }}/latest/jre/lib/security

Create the http secret key locally (if nothing was previously fetched)

Create the {{ db_username }} database user and host based access ({{ database }})

Configure IP based access for the {{ db_username }} user ({{ database }})

Create the {{ db_username }} database user and IP based access from {{ outer_loop }} ({{ database }})

Configure access for the {{ db_username }} user ({{ database }})

Configure access for the {{ db_username }} user from {{ outer_loop }} ({{ database }})

Create the KDC database for realm {{ security_options.realm | upper }}

Add the admin principal for realm {{ security_options.realm | upper }}

configtest before restart; fail immediately if our config is bad

configtest before status check; fail immediately if our config is bad

fetch stackviz results to the root of the collect_dir for os_tempest

Copy testrepository.subunit file to the root of collect_dir for os_tempest

Fetch .sh and .log files from local working directory on localhost

Create the zuul-based reproducer script if we are running on zuul

Generate and retrieve the ARA static playbook report for undercloud

Generate and retrieve the ARA static playbook report for OC deploy

Windows | Set service startup mode to auto and ensure it is started

grant USAGE privilege on clinlims schema for atomfeed console application user

add privileges to atomfeed console application db user in postgres databases

allow atomfeed console application host to access postgres databases

Check if openmrs database dump is provided in /etc/bahmni-installer/deployment-artifacts

Install openmrs database dump if provided and database does not exist

Check if openerp database dump is provided in /etc/bahmni-installer/deployment-artifacts

Install openerp database dump if provided and database does not exist

Check if openelis database dump is provided in /etc/bahmni-installer/deployment-artifacts

Install openelis database dump if provided and database does not exist

Check if Odoo database dump is provided in /etc/bahmni-installer/deployment-artifacts

Install Odoo database dump if provided and database does not exist

Link order templates in openmrs application data directory if it exists

Link encounter modifiers in openmrs application data directory if it exists

Link patient match algorithms in openmrs application data directory if it exists

Link elis feed interceptors in openmrs application data directory if it exists

Link observation adders in openmrs application data directory if it exists

DROP ALL Incoming connections except those which are marked as ACCEPT

Create /var/log/mysql directory to store binlogs if it does not exist

Create and grant privileges to replication user of slave in master DB

Take mysql dump in /opt/mysql-replication directory of master server

Check if  {{ restore_point }} db dump exists in {{ postgres.path }}/{{options}}

insert/update postgres config after "local" is for Unix domain socket connections only line

Give a message to reboot machine on changing from disabled to enabled

install python-xml for opensuse only if python2 is installed already

set_fact container_binary, container_binding_name, container_service_name, container_package_name

collect ceph logs, config and keys in "{{ localtempfile.path }}" on the machine running ansible

create lvs for fs journals for the bucket index on the nvme device

create the lv for data portion of the bucket index on the nvme device

exit playbook, if user did not mean to tear down logical volumes

show container images on all the nodes (should be empty if tags was passed remove_img)

container | waiting for the containerized monitor to join the quorum...

activate scanned ceph-disk osds and migrate to ceph-volume if deploying nautilus

container | disallow pre-octopus OSDs and enable all new octopus-only functionality

non container | disallow pre-octopus OSDs and enable all new octopus-only functionality

set_fact container_exec_cmd build {{ container_binary }} exec command (containerized)

confirm whether user really meant to remove osd(s) from the cluster

exit playbook, if user did not mean to switch from non-containerized to containerized daemons?

switching from non-containerized to containerized ceph rbd-mirror

set_fact keys_tmp - preserve backward compatibility after the introduction of the ceph_keys module

set_fact ceph_release - override ceph_release with ceph_stable_release

fetch the red hat storage iso from the ansible server for redhat systems

fetch the red hat storage iso from the ansible server for debian systems

pulling {{ ceph_docker_registry }}/{{ ceph_docker_image }}:{{ ceph_docker_image_tag }} image

inspecting {{ ceph_docker_registry }}/{{ ceph_docker_image }}:{{ ceph_docker_image_tag }} image after pulling

set_fact use_new_ceph_iscsi package or old ceph-iscsi-config/cli

copy ceph user and bootstrap keys to the ansible server in {{ fetch_directory }}/{{ fsid }}/

remove ceph rbd mirror socket if exists and not used by a process

remove ceph nfs ganesha socket if exists and not used by a process

set ntp service and chrony daemon name for RedHat and Suse family

systemd start tcmu-runner, rbd-target-api and rbd-target-gw containers

generate systemd unit files for tcmu-runner, rbd-target-api and rbd-target-gw

set _ceph_mgr_modules fact (convert _ceph_mgr_modules.stdout to a dict)

copy rgw keyring when deploying internal ganesha with external ceph cluster

set_fact container_env_args '-e osd_bluestore=0 -e osd_filestore=1 -e osd_dmcrypt=0'

set_fact container_env_args '-e osd_bluestore=0 -e osd_filestore=1 -e osd_dmcrypt=1'

set_fact container_env_args '-e osd_bluestore=1 -e osd_filestore=0 -e osd_dmcrypt=0'

set_fact container_env_args '-e osd_bluestore=1 -e osd_filestore=0 -e osd_dmcrypt=1'

set_fact openstack_keys_tmp - preserve backward compatibility after the introduction of the ceph_keys module

check no gpt header is present when osd scenario is lvm/lvm-batch

fail if {{ monitor_interface }} does not exist on {{ inventory_hostname }}

fail if {{ monitor_interface }} is not active on {{ inventory_hostname }}

fail if {{ monitor_interface }} does not have any ip v4 address on {{ inventory_hostname }}

fail if {{ monitor_interface }} does not have any ip v6 address on {{ inventory_hostname }}

fail if {{ radosgw_interface }} does not exist on {{ inventory_hostname }}

fail if {{ radosgw_interface }} is not active on {{ inventory_hostname }}

fail if {{ radosgw_interface }} does not have any ip v4 address on {{ inventory_hostname }}

fail if {{ radosgw_interface }} does not have any ip v6 address on {{ inventory_hostname }}

fail if {{ inventory_hostname }} does not have any {{ ip_version }} address on {{ monitor_address_block }}

fail if ceph_nfs_rgw_access_key or ceph_nfs_rgw_secret_key are undefined (nfs standalone)

fail if target_size_ratio is not set when pg_autoscale_mode is True

fail on unsupported SUSE/openSUSE distribution (only 15.x supported)

fail when dashboard_admin_password and/or grafana_admin_password are not set

generate and upload a random 10Mb file - containerized deployment

resize logical volume for root partition to fill remaining free space

Fail if an iso is provided in combination with either a kernel or initrd

Upload megacli and cli64 for raid monitoring and smart.pl to /usr/sbin/.

Upload custom netsaint scripts for raid/disk/smart/monitoring to /usr/libexec/.

Pull dci-common for pre-I9db68725d6c8cd05fa50a9052abed206fd7811dc rpm

Ensure user can identify with password authentication mechanisms

install inxi - Command line system information script for console and IRC

Job Template to launch a Job Template with update on launch inventory set

display variables for create blueprint based on {{ app_template }}

display variables for create application based on deployed blueprint and wait for start

create application based on deployed blueprint and wait for start

Create empty local ssh config as defined by deploy_local_ssh_config_location

Waiting for Ravello to unlock the APP for deletion, and deleting.

Configure all hosts with Repositories, Common Files and Set environment key

Save windows_password or generated_windows_password into workdir/

Command to enable the wildcard routes in the OCP cluster for 3scale

Set Node Selector to empty for project openshift-template-service-broker

Assert new_node_instance_count and node_instance_count are setup properly.

allow OPENTLC-PROJECT-PROVISIONERS members to provision their own projects

Ensure Project and AnsibleGroup tags are present on all resources

Step 003.2 - Configure Repositories, Run common Role and Set SSH Key as authorised

Step 004.2 - Configure Repositories, Run common Role and Set SSH Key as authorised

Update Ansible (Automation) Broker to show images from DockerHub

wait for database deployments in project {{ project_cicd }} to complete (succeed or fail)

wait for database deployments in project {{ project_prod }} to complete (succeed or fail)

wait for database deployments in project {{ project_test }} to complete (succeed or fail)

wait for database deployments in project {{ project_dev }} to complete (succeed or fail)

wait for other deployments in project {{ project_cicd }} to complete (succeed or fail)

wait for other deployments in project {{ project_prod }} to complete (succeed or fail)

wait for other deployments in project {{ project_stage }} to complete (succeed or fail)

wait for other deployments in project {{ project_test }} to complete (succeed or fail)

wait for other deployments in project {{ project_dev }} to complete (succeed or fail)

run cloned ansible-playbook -i /etc/ansible/hosts /root/openshift-ansible/playbooks/byo/config.yml (3.7 and earlier)

run ansible-playbook -i /etc/ansible/hosts /usr/share/ansible/openshift-ansible/playbooks/byo/config.yml (3.7 and earlier)

run cloned ansible-playbook -i /etc/ansible/hosts /root/openshift-ansible/playbooks/prerequisites.yml (3.9 and later)

run ansible-playbook -i /etc/ansible/hosts /usr/share/ansible/openshift-ansible/playbooks/prerequisites.yml (3.9 and later)

run cloned ansible-playbook -i /etc/ansible/hosts /root/openshift-ansible/playbooks/deploy_cluster.yml (3.9 and later)

run ansible-playbook -i /etc/ansible/hosts /usr/share/ansible/openshift-ansible/playbooks/deploy_cluster.yml (3.9 and later)

support, Pull gluster images before installation (fire and forget)

infranodes, Pull OCP images before installation (fire and forget)

Update openshift-ansible package to latest available release (3.10.14)

Wait a bit for the previous stack and child resources to be deleted

Create temporary installation directory for AWS Service Broker files

Patch AWS Service Broker Installation Script (remove 'oc login' step)

Patch AWS Service Broker Installation Script (remove 'oc create-project' step)

Switch back to 'default' project after running AWS Broker script

Add AWS Secret Access Key to Let's Encrypt Acme.sh configuration

Patch Openwhisk template for correct CronJob API Version (3.10+)

Grant privileged SCC to default service account for Node Exporter

Remove user Quota - oc delete clusterresourcequota  "clusterquota-{{ocp_username}}-{{guid}}"

Remove user Quota - oc delete clusterresourcequota  "clusterquota-{{ocp_username}}"

Remove user Projects - "oc delete project {{item.metadata.name}} "

Process the OpenShift Template and create the OpenShift objects for the 3scale API Management Platform

Ensure the following directory is refreshed in remote, /tmp/{{namespace}}/enmasse

execute ansible-playbook using shell to create standard deployment

Remove user from developer group - (remove ability to create projects)

Remove user Projects - "oc delete project {{item.metadata.name}}"

Give ocp_username access to {{ocp_constraints_project}};  user = {{ocp_username}}

Give ocp_username access to ocp_project; user = {{ocp_username}}

Initialize OCP resources from the project template using CLUSTER {{ ocp_apps_domain }}

Initialize OCP resources from the project template using app_name = {{app_name}}

Check if repository nationalparks exists in git for user "developer"

Push nationalparks to git repository in Gogs for user "developer"

Determine if istio-system namespace already exists.  Provision istio control plane once per OCP cluster

Add anyuid scc to all authenticated: {{oc_projects.stdout_lines}}

Add edit access for user to istio-system namespace (for istioctl to be able to view istio config map )

Patch catalog-service deployment to correctly pick up newly built image

Copy the templates used in this role (Remove the .j2 if they have it in the name)

Cancel ansible service broker rollout in case it is still running

remove filename parameter from htpasswd authentication for 3.10+

Step 004.3.1 - Gluster Node preparation for OpenShift deployment

Put SELinux in permissive mode, logging actions that would be blocked.

wrapper playbook for kitchen testing "ansible-ssh-hardening" with custom settings

wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings

install selinux dependencies when selinux is installed on RHEL or Oracle Linux

install selinux dependencies when selinux is installed on Debian or Ubuntu

remove selinux-policy when Pam is used, because Allowing sshd to read the shadow file directly is considered a potential security risk (http://danwalsh.livejournal.com/12333.html)

Ensure HAProxy is enabled (so init script will start it on Debian).

reset ssh connection to allow user changes to affect 'current login user'

Check whether cloud-init has been installed, and ensure manage_etc_hosts is disabled

Set variable that indicates if we have a folder for custom meter YAML files

Find all *.yaml files in custom meter definitions folder (if the folder exist)

Set the variable that control the copy of custom meter definitions

Copy the external certificate crt to be the internal when internal + external are same network

Copy the external certificate key to be the internal when internal + external are same network

Copy the external PEM file to be the internal when internal + external are same network

Copy the external CA Certificate file to be the internal when internal + external are same network

Check if custom {{ cloudkitty_custom_metrics_yaml_file }} exists

Determine whether logs should be forwarded directly to Elasticsearch

Checking if kolla_internal_vip_address and kolla_external_vip_address are not pingable from any node

Checking if kolla_internal_vip_address is in the same network as api_interface on all nodes

Set fact with the generated cron jobs for building the crontab later

Checking fernet_token_expiry in globals.yml. Update fernet_token_expiry to allowed value if this task fails

Taking {{ mariadb_backup_type }} database backup via Mariabackup

Fail when MariaDB services are not synced across the whole cluster

Copying grastate.dat file from MariaDB container in bootstrap host

Add {{ monasca_grafana_admin_username }} user to control plane organisation

Enable Monasca Grafana datasource for control plane organisation

Check if external mariadb hosts are reachable from the load balancer

Checking empty passwords in passwords.yml. Run kolla-genpwd if this task fails

Validate that internal and external vip address are different when TLS is enabled only on either the internal and external network

Check if each rabbit hostname resolves uniquely to the proper IP address

Ensure IPv6 addresses on the managed interface are no longer tentative

Record the running state of the environment as seen by the setup module

For CNS change default storage class to glusterfs-storage (3.9.27, 3.9.30)

Set SSL Certificate to self signed certificate if no certificate file specified

No Certificates on host or acme_force_issue=true -> set up Let's Encrypt Certificates

run openshift-ansible byo/config.yml (from cloned upstream, 3.7 and earlier)

run openshift-ansible prerequisites.yml (from cloned upstream, 3.9 and later)

run openshift-ansible deploy_cluster.yml (from cloned upstream, 3.9 and later)

For OCP 3.10.14 update openshift-ansible package to latest available release (3.10.21)

Remove user Quota - oc delete clusterresourcequota  "clusterquota-{{ocp_username}}-{{lab_name}}"

Give ocp_username access to Lab Infra project; user = {{ocp_username}}

Copy tenant provisioning script to known path; REMOVE_TENANTS_ONLY = {{REMOVE_TENANTS_ONLY}}

Remove user Quota - oc delete clusterresourcequota  "clusterquota-{{admin_username}}-{{ocp_project}}"

Remove user Quota - oc delete clusterresourcequota  "clusterquota-{{admin_username}}-{{lab_name}}"

Provision Istio Control Plane (which creates istio-system namespace)

Create limitrange because Istio deploys are not pre-configured with limits and requests

Give admin_username access to ocp_project; user = {{admin_username}}

Wait for following replication controllers to be created: {{ item }}

Remove user Quota - oc delete clusterresourcequota  "{{cluster_quota_name}}"

Wait for following deployments to become ready in {{ocp_project}}: {{pod_to_wait}}

Provide user with ability to impersonate system admin so as to be able to run istio commands

Remove user Quota - oc delete clusterresourcequota  "clusterquota-{{ocp_project}}"

Remove user Quota - oc delete clusterresourcequota  clusterquota-{{ocp_username}}-{{lab_name}}

Create limitrange because Strimzi deploys are not pre-configured with limits and requests

Create  cluster role binding for strimzi-cluster-operator-topic-operator-delegation

Check the presence of upper constraints on your repos and check load balancing

Halt the upgrade and warn the user to inspect the env.d files for changes

Remove fact cache to ensure a fresh one is built during the upgrade

Check that bootstrap_host_scenario is not set with mutually exclusive options

Fail if there is not enough disk space available (disk specified)

Determine whether partitions labeled openstack-data{1,2} are present

Dismount and remove fstab entries for anything on the data disk device

Configure systcl fs.inotify.max_user_watches=1048576 on elastic hosts

If a keyfile is provided, copy the gpg keyfile to the key location

Generate post-install networks scripts for systemd-networkd family

Enable/disable vm_use_snapshot based on whether there are base image files

Set fact to indicate that the volumes changed (later used to force formatting)

Ensure python-shade library is present to run ansible os_xxx modules

Commit, compress and save VM Disk Image and prepare new copy-on-write image

Ensure that nested virtualization is enabled (if it is available)

Create service setup environment when localhost is the service setup host

Fail if service was deployed using a different installation method

Run nova-status upgrade check to validate a healthy configuration

Remove existing directory if it is not a git repo or it is dirty

Script installed to make future kernels readable to nova group/user

fix docker removal issue with ansible's docker_container on centos

ensuring python pip package is present for fedora via the python2-pip rpm

retrieve all container logs, current and previous (if they exist)

Fix static hugepage support for to libvirt-qemu apparmor profile

Ensure DHIS psql user has the right access level to the database

Make sure the dump file doesn't exist before extracting the archive

Make sure the OpenSRP directory is absent in Tomcat's app directory

Wait until the folder webapps/opensrp/WEB-INF is present before continuing. Tomcat is extracting war file

Fetch upstream and reqcheck project {{ zuul.project.name }} with rdopkg

Ensure Uchiwa/Sensu Enterprise Dashboard server service is running

Wait for RabbitMQ to be up and running before asking to create a vhost

Ensure that credential is supplied if installing Sensu Enterprise

Check for search_optimization::dfs_job_extractor in limits.conf"

Check if the target virthost distro is supported (RHEL or CentOS)

redefine the libvirt networks so the config is written to /etc/libvirt

indirect role include (workaround to https://github.com/ansible/ansible/issues/19472)

Add virt power key to root authorized keys if using qemu:///system

Determine if the undercloud image is a whole disk image so we can resize it appropriately

set fact used in ssh_config_no_undercloud.j2 to determine if IdentityFile should be included

set_fact for all filtered openstack inventory nodes by cluster id

Add overcloud nodes to inventory, accessed via undercloud/bastion

set vbmc address if there is a (nat) network defined with an address

Setup the provisioned virtual machines to look like nodepool nodes

Fail the tempest playbook on undefined cloud name and install method

Disable configured servers in ntp.conf (if custom servers are defined)

Use local {{ ansible_distribution }} mirror if available ( centos 7 and RHEL )

Substitute containers registry to {{ docker_registry_host|default('nothing') }}/{{ docker_registry_namespace_used|default('nothing') }}

Substitute name_prefix to {{ docker_prep_prefix|default('nothing') }}

Substitute ceph_namespace to {{ docker_ceph_image|default('nothing') }}

Set project name when there is a dependency on tripleo-quickstart

Remove previously checked out git repo
(workaround for ansible bug https://github.com/ansible/ansible-modules-core/issues/5504 )

Set the download url to specified release branch if amphora_url not provided

Export actual used cell deploy args for persistence to other plays

Extract the number of cell controllers to be deployed (from cell topology_map)

Extract the number of cell computes to be deployed (from cell topology_map)

extract the number of controllers to be deployed (from topology_map)

Prepare the network-isolation required networks on the undercloud

update container tag if needed in container-prepare-parameters.yaml

update the keystone config in tripleo_ui_config.js, connect via virthost ip

update the heat config in tripleo_ui_config.js, connect via virthost ip

update the ironic config in tripleo_ui_config.js, connect via virthost ip

update the ironic-inspector config in tripleo_ui_config.js, connect via virthost ip

update the mistral config in tripleo_ui_config.js, connect via virthost ip

update the swift config in tripleo_ui_config.js, connect via virthost ip

update the zaqar-websocket config in tripleo_ui_config.js, connect via virthost ip

update config in tripleo_ui_config.js, connect via virthost ip with ssl

Update the default ansible callback setting in /etc/ansible/ansible.cfg

Update the default ansible action setting in /etc/ansible/ansible.cfg

Add a unique hostname to /etc/hosts resolved to the first IPv4 available

Override containerized undercloud CI hostname for tripleo client

Verifying bugs in bugzilla and launchpad and generating skip file

remove tripleo-quickstart image cache (/var/cache/tripleo-quickstart/images)

Re-run the validation with ceph-ansible installed and fail due to wrong repo

Add RGW pools if requested unless in custom pool list (only for default zone)

Succeed if CephPools parameter will satisfy PG overdoce protection

check appropriate running containers against list - if FAILED, check next task

Set facts for skipping host principals check without IdM/FreeIPA config

RedHat/CentOS/Fedora | Configure Elasticsearch System Resources.

Trusty | set MAX_LOCKED_MEMORY=unlimited in Elasticsearch in /etc/security/limits.conf

Trusty | set MAX_LOCKED_MEMORY=unlimited in Elasticsearch in /etc/security/limits.d/elasticsearch.conf

RedHat/CentOS/Fedora | Remove Elasticsearch repository (and clean up left-over metadata)

Generating certificates for Elasticsearch security (generating CA)

Generating certificates for Elasticsearch security (using provided CA | Without CA Password)

Generating certificates for Elasticsearch security (using provided CA | Using CA Password)

Stopping early, trying to compile Wazuh Kibana Plugin on Debian 10 is not possible

Remove Elasticsearch repository (and clean up left-over metadata)

Debian/Ubuntu | Remove Filebeat repository (and clean up left-over metadata)

RedHat/CentOS/Fedora | Remove Filebeat repository (and clean up left-over metadata)

Executing "install.sh" script to build and install the Wazuh Agent

Linux | Vuls integration deploy (runs in background, can take a while)

RedHat/CentOS/Fedora | Remove NodeJS repository (and clean up left-over metadata)

RedHat/CentOS/Fedora | Remove Wazuh repository (and clean up left-over metadata)

datadog_enabled and not ansible_check_mode and not ansible_os_family == "Windows"

datadog_enabled and not ansible_check_mode and ansible_os_family == "Windows"

name="{{ datadog_user }}" groups="{{ datadog_additional_groups }}" append=yes

datadog_additional_groups is defined and (datadog_additional_groups | length != 0)

not datadog_skip_running_check and datadog_enabled and not ansible_check_mode

{{ ansible_facts.services['datadog-agent-sysprobe'] is defined or ansible_facts.services['datadog-agent-sysprobe.service'] is defined }}

{{ system_probe_config is defined and system_probe_config['enabled'] and datadog_sysprobe_installed }}

not datadog_skip_running_check and datadog_enabled and not ansible_check_mode and datadog_sysprobe_enabled

not datadog_skip_running_check and (not datadog_enabled or not datadog_sysprobe_enabled) and datadog_sysprobe_installed

{{ ansible_facts.env['ProgramData'] }}\Datadog\conf.d\{{ item }}.d

{{ ansible_facts.env['ProgramData'] }}\Datadog\conf.d\{{ item }}.d\conf.yaml

{{ ansible_facts.env['ProgramData'] }}\Datadog\conf.d\{{ item }}.yaml

{{ ansible_facts.env['ProgramData'] }}\Datadog\process-agent.conf

Unkown action '{{ item.value.action }}' for integration command ({{ item.key }}). Valid actions are 'install' and 'remove'

item.value.action != "install" and item.value.action != "remove"

item.value.action == "remove" and ansible_os_family != "Windows"

"{{ datadog_agent_binary_path }}" integration remove {{ item.key }}

item.value.action == "remove" and ansible_os_family == "Windows"

item.value.action == "install" and ansible_os_family != "Windows"

"{{ datadog_agent_binary_path }}" integration install {{ item.key }}=={{ item.value.version }}

item.value.action == "install" and ansible_os_family == "Windows"

datadog_agent_major_version|int == 5 and ansible_os_family != "Windows"

datadog_agent_major_version|int > 5 and ansible_os_family != "Windows"

datadog_agent_major_version|int > 5 and ansible_os_family == "Windows"

The Datadog Ansible role does not support your OS yet. Please email support@datadoghq.com to open a feature request.

ansible_os_family not in ["RedHat", "Debian", "Suse", "Windows"]

{{ datadog_agent_version | regex_search(regexp, '\g<epoch>', '\g<major>', '\g<minor>', '\g<bugfix>', '\g<suffix>', '\g<release>') }}

The provided major version {{ datadog_agent_major_version }} is not compatible with the version {{ datadog_major }} deduced from datadog_agent_version ({{ datadog_agent_version }}). Aborting play.

datadog_agent_major_version | length > 0 and datadog_major != datadog_agent_major_version

{{ datadog_epoch }}:{{ datadog_major }}.{{ datadog_minor }}.{{ datadog_bugfix }}{{ datadog_suffix }}-{{ datadog_release }}

{{ datadog_major }}.{{ datadog_minor }}.{{ datadog_bugfix }}{{ datadog_suffix }}-{{ datadog_release }}

{{ datadog_major }}.{{ datadog_minor }}.{{ datadog_bugfix }}{{ datadog_suffix }}

{{ datadog_apt_backup_keyserver if use_apt_backup_keyserver else datadog_apt_keyserver }}

{% if item.key == datadog_agent_major_version|int and datadog_apt_repo | length == 0 %}present{% else %}absent{% endif %}

{{ lookup('file', '/etc/apt/sources.list.d/ansible_datadog_custom.list') }}

(datadog_apt_repo | length == 0) or datadog_remove_custom_repo_file and (not ansible_check_mode)

{% if datadog_agent_major_version|int == 7 %}{{ datadog_yum_gpgkey_e09422b3 }}{% else %}{{ datadog_yum_gpgkey }}{% endif %}

{% if item.key == datadog_agent_major_version|int and datadog_yum_repo | length == 0 %}present{% else %}absent{% endif %}

datadog_agent_major_version|int < 7 and ansible_distribution_version|int >= 12

{{ win_install_args }} DDAGENTUSER_NAME={{ datadog_windows_ddagentuser_name }}

{{ win_install_args }} DDAGENTUSER_PASSWORD={{ datadog_windows_ddagentuser_password }}

Set-ExecutionPolicy Bypass -Scope Process -Force
&$env:temp\fix_6_14.ps1

{% if datadog_agent_major_version|int == 7 %}{{ datadog_windows_agent7_latest_url }} {% else %}{{ datadog_windows_agent6_latest_url }}{% endif %}

The Agent versions you pinned (6.14.0 or 6.14.1) have been blacklisted, please use 6.14.2 instead. See http://dtdg.co/win-614-fix.

datadog_agent_version == "6.14.0" or datadog_agent_version == "6.14.1"

{{ datadog_windows_versioned_url }}-{{ datadog_agent_windows_version }}.msi

{'ansible_group':'jboss', 'type':'{{ ec2_instance_type }}', 'group':'{{ ec2_security_group }}', 'Name':'demo_''{{ tower_user_name }}'}

access_key="{{ ec2_access_key }}" secret_key="{{ ec2_secret_key }}" keypair="{{ ec2_keypair }}" group="{{ ec2_security_group }}" type="{{ ec2_instance_type }}" image="{{ ec2_image }}" region="{{ ec2_region }}" instance_tags="{'ansible_group':'{{ ec2_tag_webservers }}', 'type':'{{ ec2_instance_type }}', 'group':'{{ ec2_security_group }}', 'Name':'demo_''{{ tower_user_name }}'}" count="{{ ec2_instance_count }}"

access_key="{{ ec2_access_key }}" secret_key="{{ ec2_secret_key }}" keypair="{{ ec2_keypair }}" group="{{ ec2_security_group }}" type="{{ ec2_instance_type }}" image="{{ ec2_image }}" region="{{ ec2_region }}" instance_tags="{'ansible_group':'{{ ec2_tag_dbservers }}', 'type':'{{ ec2_instance_type }}', 'group':'{{ ec2_security_group }}', 'Name':'demo_''{{ tower_user_name }}'}" count="1"

access_key="{{ ec2_access_key }}" secret_key="{{ ec2_secret_key }}" keypair="{{ ec2_keypair }}" group="{{ ec2_security_group }}" type="{{ ec2_instance_type }}" image="{{ ec2_image }}" region="{{ ec2_region }}" instance_tags="{'ansible_group':'{{ ec2_tag_lbservers }}', 'type':'{{ ec2_instance_type }}', 'group':'{{ ec2_security_group }}', 'Name':'demo_''{{ tower_user_name }}'}" count="1"

access_key="{{ ec2_access_key }}" secret_key="{{ ec2_secret_key }}" keypair="{{ ec2_keypair }}" group="{{ ec2_security_group }}" type="{{ ec2_instance_type }}" image="{{ ec2_image }}" region="{{ ec2_region }}" instance_tags="{'ansible_group':'{{ ec2_tag_monitoring }}', 'type':'{{ ec2_instance_type }}', 'group':'{{ ec2_security_group }}', 'Name':'demo_''{{ tower_user_name }}'}" count="1"

wait_for host={{ item.public_dns_name }} port=22 delay=60 timeout=320 state=started

action=disable_alerts host={{ inventory_hostname }} services=webserver

state=disabled backend=myapplb host={{ inventory_hostname }} socket=/var/lib/haproxy/stats

state=enabled backend=myapplb host={{ inventory_hostname }} socket=/var/lib/haproxy/stats

action=enable_alerts host={{ inventory_hostname }} services=webserver

{'ansible_group':'webservers', 'type':'{{ ec2_instance_type }}', 'group':'{{ ec2_security_group }}', 'Name':'demo_''{{ tower_user_name }}'}

{'ansible_group':'dbservers', 'type':'{{ ec2_instance_type }}', 'group':'{{ ec2_security_group }}', 'Name':'demo_''{{ tower_user_name }}'}

{'ansible_group':'lbservers', 'type':'{{ ec2_instance_type }}', 'group':'{{ ec2_security_group }}', 'Name':'demo_''{{ tower_user_name }}'}

{'ansible_group':'monitoring', 'type':'{{ ec2_instance_type }}', 'group':'{{ ec2_security_group }}', 'Name':'demo_''{{ tower_user_name }}'}

name={{ dbuser }} password={{ upassword }} priv=*.*:ALL host='%' state=present

src={{ item + ".j2" }} dest=/etc/nagios/ansible-managed/{{ item }}

repo={{ repository }} version={{ webapp_version }} dest=/var/www/html/

dest=/etc/sysconfig/iptables state=present regexp="{{ mysql_port }}" insertafter="^:OUTPUT " line="-A INPUT -p tcp  --dport {{ mysql_port }} -j  ACCEPT"

dest=/etc/sysconfig/iptables create=yes state=present regexp="{{ httpd_port }}" insertafter="^:OUTPUT " line="-A INPUT -p tcp  --dport {{ httpd_port }} -j  ACCEPT"

path=/var/log/mysqld.log state=touch owner=mysql group=mysql mode=0775

path=/var/run/mysqld state=directory owner=mysql group=mysql mode=0775

port={{ mysql_port }}/tcp permanent=true state=enabled immediate=yes

port={{ httpd_port }}/tcp permanent=true state=enabled immediate=yes

path={{workdir}} state=directory owner=root group=root mode=0751

src=/etc/ansible/hosts dest=/etc/ansible/hosts owner=root group=root mode=0644

src=templates/etc_cron.d_ansible-pull.j2 dest=/etc/cron.d/ansible-pull owner=root group=root mode=0644

src=templates/etc_logrotate.d_ansible-pull.j2 dest=/etc/logrotate.d/ansible-pull owner=root group=root mode=0644

stack_name="ansible-cloudformation" state=present region=us-east-1 disable_rollback=true template=files/cloudformation-example.json

keypair={{keypair}} group={{security_group}} instance_type={{instance_type}} image={{image}} wait=true count=5

host={{item.public_dns_name}} port=22 delay=60 timeout=320 state=started

url=http://code.jquery.com/{{item}}  dest={{jquery_directory}} mode=0444

nsc_host={{nsc_host}} user={{nsc_user}} password={{nsc_pass}} name={{name}} type={{type}} action=disable

nsc_host={{nsc_host}} user={{nsc_user}} password={{nsc_pass}} name={{name}} type={{type}} action=enable

repo='deb http://www.rabbitmq.com/debian/ testing main' state=present

user={{item}} password=changeme tags=administrator,{{item}} vhost=/ configure_priv=.* write_priv=.* read_priv=.* state=present

name=tset comment=TsetUser group=users shell=/sbin/nologin createhome=no

login_user=admin login_password=${mongo_admin_pass} login_port=${mongos_port} database=test user=admin password=${mongo_admin_pass} state=present

/usr/bin/mongo localhost:${mongos_port}/test -u admin -p ${mongo_admin_pass} /tmp/testsharding.js

/usr/bin/mongo localhost:${mongos_port}/admin -u admin -p ${mongo_admin_pass} /tmp/enablesharding.js

path={{ mongodb_datadir_prefix }} owner=mongod group=mongod state=directory

path={{ mongodb_datadir_prefix }}/configdb state=directory owner=mongod group=mongod

src=roles/mongod/files/secret dest={{ mongodb_datadir_prefix }}/secret owner=mongod group=mongod mode=0400

database=admin name=admin password={{ mongo_admin_pass }} login_port={{ mongoc_port }} state=present

path={{ mongodb_datadir_prefix }}/mongo-{{ inventory_hostname }} state=directory owner=mongod group=mongod

src=mongod.j2 dest=/etc/init.d/mongod-{{ inventory_hostname }} mode=0655

src=mongod.conf.j2 dest=/etc/mongod-{{ inventory_hostname }}.conf

src=secret dest={{ mongodb_datadir_prefix }}/secret owner=mongod group=mongod mode=0400

creates=/var/lock/subsys/mongod-{{ inventory_hostname }} /etc/init.d/mongod-{{ inventory_hostname }} start

src=shard_init.j2 dest=/tmp/shard_init_{{ inventory_hostname }}.js

/usr/bin/mongo localhost:{{ mongos_port }}/admin -u admin -p {{ mongo_admin_pass }} /tmp/shard_init_{{ inventory_hostname }}.js

THERE ARE {{light_info.json.lights | length}} HUE LIGHTS PRESENT

src=msm-sample-webapp-1.0-SNAPSHOT.war dest=/var/lib/tomcat/webapps/ROOT.war owner=tomcat group=tomcat

ansible_os_family == 'RedHat' and ansible_distribution_major_version == '6'

rpm -ivh /tmp/epel-release-latest-6.noarch.rpm creates=/etc/yum.repos.d/epel.repo

ansible_os_family == 'RedHat' and ansible_distribution_major_version == '7'

rpm -ivh /tmp/epel-release-latest-7.noarch.rpm creates=/etc/yum.repos.d/epel.repo

chdir=/usr/share /bin/tar xvf /opt/apache-tomcat-7.0.61.tar.gz -C /opt/ creates=/opt/apache-tomcat-7.0.61

path=/usr/share/tomcat/ owner=tomcat group=tomcat state=directory recurse=yes

port={{ http_port }}/tcp permanent=true state=enabled immediate=yes

port={{ https_port }}/tcp permanent=true state=enabled immediate=yes

access_key="{{ ec2_access_key }}" secret_key="{{ ec2_secret_key }}" keypair="{{ ec2_keypair }}" group="{{ ec2_security_group }}" type="{{ ec2_instance_type }}" image="ami-0d789266" region="{{ ec2_region }}" instance_tags="{'ansible_group':'windows_webservers', 'type':'{{ ec2_instance_type }}', 'group':'{{ ec2_security_group }}', 'Name':'demo_''{{ tower_user_name }}'}" count="{{ ec2_instance_count }}" wait=true

access_key="{{ ec2_access_key }}" secret_key="{{ ec2_secret_key }}" keypair="{{ ec2_keypair }}" group="{{ ec2_security_group }}" type="{{ ec2_instance_type }}" image="ami-17d66f7c" region="{{ ec2_region }}" instance_tags="{'ansible_group':'windows_dbservers', 'type':'{{ ec2_instance_type }}', 'group':'{{ ec2_security_group }}', 'Name':'demo_''{{ tower_user_name }}'}" count="1" wait=true

wait_for host={{ item.public_dns_name }} port=5986 delay=60 timeout=320 state=started

wait_for host={{ inventory_hostname }} port=80 state=started timeout=80

mv /etc/php-fpm.d/www.conf /etc/php-fpm.d/www.disabled creates=/etc/php-fpm.d/www.disabled

url=http://wordpress.org/wordpress-{{ wp_version }}.tar.gz dest=/srv/wordpress-{{ wp_version }}.tar.gz sha256sum="{{ wp_sha256sum }}"

chdir=/srv/ /bin/tar xvf wordpress-{{ wp_version }}.tar.gz creates=/srv/wordpress

name={{ wp_db_user }} password={{ wp_db_password }} priv={{ wp_db_name }}.*:ALL host='localhost' state=present

path=/srv/wordpress/ owner=wordpress group=wordpress state=directory recurse=yes setype=httpd_sys_content_t

port={{ nginx_port }}/tcp permanent=true state=enabled immediate=yes

path=/srv/wordpress/ owner=wordpress group=wordpress state=directory recurse=yes

semanage fcontext -a -t httpd_sys_content_t "/srv/wordpress(/.*)?"

semanage fcontext -a -t httpd_sys_script_exec_t "/srv/wordpress/wp-config\.php"

semanage fcontext -a -t httpd_sys_rw_content_t "/srv/wordpress/wp-content(/.*)?"

semanage fcontext -a -t httpd_sys_script_exec_t "/srv/wordpress/.*\.php"

semanage fcontext -a -t httpd_sys_rw_content_t "/srv/wordpress/wp-content/upgrade(/.*)?"

semanage fcontext -a -t httpd_sys_rw_content_t "/srv/wordpress/wp-content/uploads(/.*)?"

semanage fcontext -a -t httpd_sys_script_exec_t "/srv/wordpress/wp-includes/.*\.php"

The {{ item.host_group }} host_group is defined in the blueprint but there is no matching Ansible inventory group called {{ item.host_group }} or there are no hosts in this group.

groups[item.host_group] is not defined or (groups[item.host_group] is defined and groups[item.host_group]|length == 0)

The 'ZOOKEEPER_SERVER' component is required by all installations.

Ranger is part of the blueprint but the database is set to 'embedded'.

(rangeradmin_hosts|length > 0 or rangerkms_hosts|length > 0) and database == 'embedded'

Atlas requires all of the following components to be present in the blueprint: INFRA_SOLR, HBASE_MASTER, HBASE_REGIONSERVER, KAFKA_BROKER.

'ATLAS_SERVER' in blueprint_all_services and ('INFRA_SOLR' not in blueprint_all_services or 'HBASE_MASTER' not in blueprint_all_services or 'HBASE_REGIONSERVER' not in blueprint_all_services or 'KAFKA_BROKER' not in blueprint_all_services)

Streamline is part of the blueprint but the database is set to 'embedded'.

Registry is part of the blueprint but the database is set to 'embedded'.

Multiple nodes are configured to run Druid components but the database is set to 'embedded'.

Amazon Linux does not support Hive with the 'embedded' database. Set the database to another option and re-run the playbooks.

database == 'embedded' and ansible_distribution|lower == "amazon" and hiveserver_hosts|length > 0

When installing HDP 3 the component {{ item }} must not be part of the blueprint.

install_hdp and hdp_major_version == '3' and item in blueprint_all_clients | union(blueprint_all_services)

When installing HDP 2 the component {{ item }} must not be part of the blueprint.

install_hdp and hdp_major_version == '2' and item in blueprint_all_clients | union(blueprint_all_services)

Some or all of the following components are missing from the blueprint: NAMENODE, DATANODE{{ (namenode_groups|length == 1) | ternary(', SECONDARY_NAMENODE',', ZKFC, JOURNALNODE') }}.

(namenode_groups|length == 1 and ['NAMENODE', 'DATANODE', 'SECONDARY_NAMENODE'] | difference(blueprint_all_services) | length > 0 ) or (namenode_groups|length > 1 and ['NAMENODE', 'DATANODE', 'ZKFC', 'JOURNALNODE'] | difference(blueprint_all_services) | length > 0 )

HA NameNode has been requested but there are less than 3 JournalNodes defined in the blueprint.

HA NameNode has been requested but the ZKFC component must be present in the nodes running the NAMENODE (only).

namenode_groups|length > 1 and (zkfc_groups|length < 2 or namenode_groups | symmetric_difference(zkfc_groups) | length > 0 )

HA NameNode has been requested but the SECONDARY_NAMENODE component is still present in the blueprint.

namenode_groups|length > 1 and 'SECONDARY_NAMENODE' in blueprint_all_services

Some or all of the following components are missing from the blueprint: NODEMANAGER, APP_TIMELINE_SERVER{{ (hdp_major_version == '3') | ternary(', YARN_REGISTRY_DNS, TIMELINE_READER','') }}.

resourcemanager_groups|length > 0 and ((hdp_major_version == '3' and ['NODEMANAGER', 'APP_TIMELINE_SERVER', 'YARN_REGISTRY_DNS', 'TIMELINE_READER'] | difference(blueprint_all_services) | length > 0 ) or (hdp_major_version == '2' and ['NODEMANAGER', 'APP_TIMELINE_SERVER'] | difference(blueprint_all_services) | length > 0 ))

Some or all of the following components are missing from the blueprint: HIVE_SERVER, HIVE_METASTORE{{ (hdp_major_version == '2') | ternary(', WEBHCAT_SERVER','') }}.

hiveserver_hosts|length > 0 and ((hdp_major_version == '3' and ['HIVE_SERVER', 'HIVE_METASTORE'] | difference(blueprint_all_services) | length > 0 ) or (hdp_major_version == '2' and ['HIVE_SERVER', 'HIVE_METASTORE', 'WEBHCAT_SERVER'] | difference(blueprint_all_services) | length > 0 ))

One or more of the following components are missing from the blueprint: DRUID_BROKER, DRUID_COORDINATOR, DRUID_ROUTER, DRUID_MIDDLEMANAGER, DRUID_HISTORICAL, DRUID_OVERLORD.

druid_hosts|length > 0 and ['DRUID_BROKER', 'DRUID_COORDINATOR', 'DRUID_ROUTER', 'DRUID_MIDDLEMANAGER', 'DRUID_HISTORICAL', 'DRUID_OVERLORD'] | difference(blueprint_all_services) | length > 0

One or more of the following components are missing from the blueprint: ACCUMULO_CLIENT, ACCUMULO_MASTER, ACCUMULO_MONITOR, ACCUMULO_TRACER, ACCUMULO_GC, ACCUMULO_TSERVER.

(['ACCUMULO_CLIENT', 'ACCUMULO_MASTER', 'ACCUMULO_MONITOR', 'ACCUMULO_TRACER', 'ACCUMULO_GC', 'ACCUMULO_TSERVER'] | difference(blueprint_all_clients | union(blueprint_all_services)) | length > 0) and (['ACCUMULO_CLIENT', 'ACCUMULO_MASTER', 'ACCUMULO_MONITOR', 'ACCUMULO_TRACER', 'ACCUMULO_GC', 'ACCUMULO_TSERVER'] | difference(blueprint_all_clients | union(blueprint_all_services)) | length < 6)

database != "embedded" and not database_options.external_hostname|default('')

security == "mit-kdc" and not security_options.external_hostname|default('')

The ambari_groups list is empty. This usually means there is no 'AMBARI_SERVER' component defined in the blueprint or there is no Ansible inventory group corresponding with the name of the blueprint's host_group.

The {{ item }} host_group is defined in the blueprint but there is no matching Ansible inventory group called {{ item }} or there are no hosts in this group.

The 'hadoop-cluster' Ansible inventory group is required before continuing. Check the inventory for possible issues.

groups['hadoop-cluster'] is not defined or (groups['hadoop-cluster'] is defined and groups['hadoop-cluster']|length == 0)

The 'ambari-server' Ansible inventory group is required before continuing. Check the inventory for possible issues.

groups['ambari-server'] is not defined or (groups['ambari-server'] is defined and groups['ambari-server']|length == 0)

{{ hostvars[groups['ambari-server']|first]['install_hdpsearch'] }}

{{ (outer_loop.public_ip|default(false)== true) | ternary(hostvars[local_loop].ec2_dns_name,hostvars[local_loop].ec2_private_dns_name) }}

{{ (outer_loop.public_ip|default(false)== true) | ternary(hostvars[local_loop].ec2_ip_address,hostvars[local_loop].ec2_private_ip_address) }}

{{ (outer_loop.public_ip|default(false)== true) | ternary(hostvars[local_loop].public_ip,hostvars[local_loop].private_ip) }}

{{ (outer_loop.public_ip|default(false)== true) | ternary(hostvars[local_loop].gce_public_ip,hostvars[local_loop].gce_private_ip) }}

{{ (outer_loop.public_ip|default(false)== true) | ternary(hostvars[local_loop].openstack.public_v4,hostvars[local_loop].openstack.private_v4) }}

{{ groups['meta-Group_'~cluster_name~'-'~outer_loop.host_group] }}

{{ hostvars[local_loop]['ansible_ssh_private_key_file']|default(omit) }}

groups['hadoop-cluster'] is not defined or groups['hadoop-cluster']|length == 0

The AMI {{ outer_loop.image }} does not exist in region {{ cloud_config.region }} or it does not provide any information.

{{ (outer_loop.spot|default(false) == true) | ternary(outer_loop.spot_price,omit) }}

{{ (outer_loop.spot|default(false) == true) | ternary('terminate','stop') }}

#!/bin/sh
[ -e /bin/yum-config-manager ] && yum-config-manager --enable rhui-REGION-rhel-server-optional

{{ local_loop.1.id }} - {{ aws_tags.Name }}-{{ '%02d' | format(local_loop.0 + 1) }}

{{ aws_tags | combine({'Instance': local_loop.1.attachment_set.instance_id}, {'Device': local_loop.1.attachment_set.device}) }}

{{ local_loop.1.id }} - {{ local_loop.1.attachment_set.device }}

{{ (outer_loop.public_ip|default(false)== true) | ternary(local_loop.public_ip,local_loop.private_ip) }}

IP-{{ cluster_name }}-{{ outer_loop.host_group }}{{ (outer_loop.count > 1) | ternary(local_loop,'') }}

NIC-{{ cluster_name }}-{{ outer_loop.host_group }}{{ (outer_loop.count > 1) | ternary(local_loop,'') }}

ipconfig-{{ cluster_name }}-{{ outer_loop.host_group }}{{ (outer_loop.count > 1) | ternary(local_loop,'') }}

{{ cluster_name }}-{{ outer_loop.host_group }}{{ (outer_loop.count > 1) | ternary(local_loop,'') }}{{ cloud_config.name_suffix|default('') }}

{{ cluster_name }}-{{ outer_loop.host_group }}{{ (outer_loop.count > 1) | ternary(local_loop,'') }}

{{ (outer_loop.public_ip|default(false)|bool == true) | ternary('ephemeral','none') }}

{{ (outer_loop.public_ip|default(false) == true) | ternary(local_loop.instance_data.0.public_ip,local_loop.instance_data.0.private_ip) }}

(ansible_os_family|lower == "redhat" and ansible_distribution_major_version|int == 7) or (ansible_os_family|lower == "suse" and ansible_distribution_major_version|int == 12)

hostname={{ hostvars[groups['ambari-server']|first]['ansible_fqdn'] }}

(ansible_python_version is version_compare('2.7.9', '>=') and ansible_os_family|lower == "debian") or (ansible_python_version is version_compare('2.7', '>=') and ((ansible_os_family|lower == "redhat" and ansible_distribution_major_version|int >= 7) or (ansible_os_family|lower == "suse" and ansible_distribution_major_version|int >= 12) or (ansible_os_family|lower == "redhat" and ansible_distribution|lower == "amazon")))

{{ ansible_os_family|lower }}-{{ ansible_distribution|lower }}-{{ ansible_distribution_major_version }}.yml

{{ ansible_os_family|lower }}-{{ ansible_distribution|lower }}.yml

{{ ansible_os_family|lower }}-{{ ansible_distribution_major_version }}.yml

http://{{ ansible_fqdn }}:8080/api/v1/version_definitions?VersionDefinition/release/version={{ (install_hdp|default(false) == true) | ternary(hdp_version,hdf_version) }}

Could not get the VersionDefinition from Ambari. The following is the received information from Ambari: {{ version_definition }}

http://{{ ansible_fqdn }}:8080/api/v1/clusters/{{ cluster_name }}

{{ lookup('template', cluster_template_file, convert_data=False) }}

http://{{ ansible_fqdn }}:8080/api/v1/blueprints/{{ blueprint_name }}

(((cluster_check_task.content|from_json).Requests.request_status == 'COMPLETED' and (cluster_check_task.content|from_json).Requests.completed_task_count|int > 0) or (cluster_check_task.content|from_json).Requests.request_status == 'FAILED' or (cluster_check_task.content|from_json).Requests.request_status == 'TIMEDOUT' or (cluster_check_task.content|from_json).Requests.request_status == 'ABORTED')

Failed to build the {{ cluster_name }} cluster. Task Status is {{ (cluster_check_task.content|from_json).Requests.request_status }}.

wait and ((cluster_check_task.content|from_json).Requests.request_status == 'FAILED' or (cluster_check_task.content|from_json).Requests.request_status == 'TIMEDOUT' or (cluster_check_task.content|from_json).Requests.request_status == 'ABORTED')

{{ ansible_os_family|lower }}-{{ ansible_distribution|lower }}-{{ ansible_distribution_version }}.yml

gpl.license.accepted={{ (accept_gpl|default(omit)|bool == true) | ternary('true', 'false') }}

 {"Users":{ "password":"{{ ambari_admin_password }}", "old_password":"{{ ambari_admin_default_password }}"}}

ambari_admin_user == 'admin' and ambari_admin_password != ambari_admin_default_password

echo yes | ambari-server install-mpack --mpack={{ repo_base_url }}/HDP-SOLR/hdp-solr-ambari-mp/{{ mpack_filename }}

hdf-ambari-mpack-{{ hdf_version }}-{{ hdf_build_number_auto|default(hdf_build_number) }}.tar.gz

echo yes | ambari-server install-mpack --mpack={{ hdf_main_repo_url }}/tars/hdf_ambari_mp/{{ mpack_filename }}

/var/lib/ambari-server/resources/mpacks/{{ mpack_filename | regex_replace('.tar.gz$','') }}

echo yes | ambari-server install-mpack --mpack={{ hdf_main_repo_url }}/tars/hdf_ambari_mp/{{ mpack_filename }} --purge

http://{{ ansible_fqdn }}:8080/api/v1/stacks/HDF/versions/{{ hdf_minor_version }}/{{ main_os_target }}/repositories/HDF-{{ hdf_minor_version }}

 {"Repositories" : { "repo_name": "HDF", "base_url" : "{{ hdf_main_repo_url }}", "verify_base_url": true } }

ambari_version is version_compare('2.6', '>=') and not install_hdp|default(false)

 {"VersionDefinition":{ "version_url":"file:/tmp/cluster_vdf.xml"}}

{{ repo_version_template | default('repo_version_template.json.j2') }}

http://{{ ansible_fqdn }}:8080/api/v1/stacks/HDP/versions/{{ hdp_minor_version }}/repository_versions/1

{{ lookup('file', '/tmp/repo_version_update_body.json')|to_json }}

http://{{ ansible_fqdn }}:8080/api/v1/hosts/{{ hostvars[item]['ansible_fqdn']|lower }}

/usr/sbin/ambari-server setup --jdbc-db=mysql --jdbc-driver={{ mysql_jdbc_location }}

/usr/sbin/ambari-server setup --jdbc-db={{ database | regex_replace('mariadb', 'mysql') }} --jdbc-driver={{ lookup('vars', database + '_jdbc_location') }}

--database={{ database | regex_replace('mariadb', 'mysql') }} --databasehost={{ database_options.external_hostname|default(ansible_fqdn,true) }} --databaseport={{ lookup('vars', database | regex_replace('mariadb', 'mysql') + '_port') }} --databasename={{ database_options.ambari_db_name }} --databaseusername={{ database_options.ambari_db_username }} --databasepassword={{ database_options.ambari_db_password }}

/usr/sbin/ambari-server setup -s {{ ambari_java_options|default("") }} {{ ambari_database_options|default("") }}

java == "openjdk" and ansible_os_family|lower == "suse" and ansible_distribution_major_version|int == 11

{{ oraclejdk_options.base_folder }}/latest/jre/lib/security/UnlimitedJCEPolicyJDK8/{{ item }}

^{{ hostvars[item]['ansible_'~hostvars[item].ansible_default_ipv4.alias | regex_replace('-','_')]['ipv4']['address'] }}.*

{{ hostvars[item]['ansible_'~hostvars[item].ansible_default_ipv4.alias | regex_replace('-','_')]['ipv4']['address'] }} {{ hostvars[item]['ansible_nodename'] }}

* soft nofile 32768
* hard nofile 32768
* soft nproc 32768
* hard nproc 32768
root       soft    nproc     unlimited
ams        -       nofile   64000
atlas      -       nofile   64000
druid      -       nofile   64000
hive       -       nofile   64000
infra-solr -       nofile   64000
kms        -       nofile   64000
knox       -       nofile   64000
logsearch  -       nofile   64000
ranger     -       nofile   64000
spark      -       nofile   64000
zeppelin   -       nofile   64000
zookeeper  -       nofile   64000

ansible_os_family|lower == "redhat" and ansible_distribution|lower != "amazon" and is_vm_docker_containers != "yes"

echo never > /sys/kernel/mm/transparent_hugepage/enabled && echo never > /sys/kernel/mm/transparent_hugepage/defrag

((ansible_os_family|lower == "redhat" and ansible_distribution_major_version|int >= 7) or (ansible_distribution|lower == "amazon" and ansible_distribution_version|int >= 2) or (ansible_os_family|lower == "debian" and ansible_distribution_major_version|int >= 7) or (ansible_os_family|lower == "suse" and ansible_distribution_major_version|int >= 12)) and is_vm_docker_containers != "yes"

ansible_os_family|lower == "redhat" and ansible_distribution_major_version|int == 7 and is_vm_docker_containers != "yes"

shell dd if=/dev/urandom of=/tmp/hadoop_http_secret bs=1024 count=1

MariaDB is not available or supported on SLES 11 and Debian/Ubuntu

database == "mariadb" and ((ansible_os_family|lower == "suse" and ansible_distribution_major_version|int == 11) or ansible_os_family|lower == "debian")

deb {{ mysql_repo_url }} {{ ansible_lsb.codename }} mysql-apt-config

deb {{ mysql_repo_url }} {{ ansible_lsb.codename }} mysql-{{ mysql_version }}

deb-src {{ mysql_repo_url }} {{ ansible_lsb.codename }} mysql-{{ mysql_version }}

deb {{ postgres_repo_url }} {{ ansible_lsb.codename }}-pgdg main

{{ hostvars[inventory_hostname][database + '_packages'] | join(',') }}

{{ (database == 'mariadb') | ternary(mariadb_config_file, mysql_config_file) }}

{{ hostvars[outer_loop]['ansible_'~local_loop | regex_replace('-','_')]['ipv4']['address'] }}

local_loop != 'lo' and 'ipv4' in hostvars[outer_loop]['ansible_'~local_loop | regex_replace('-','_')]

su - postgres -c "psql -c \"CREATE ROLE {{ db_username }} ENCRYPTED PASSWORD '{{ db_password_md5 }}' NOSUPERUSER NOCREATEDB NOCREATEROLE INHERIT LOGIN;\""

The user could not be created. Error is {{ createuser_results.stderr }}!

createuser_results is failed and not createuser_results.stderr is search("role .* already exists")

The database could not be created. Error is {{ createdb_results.stderr }}!

createdb_results is failed and not createdb_results.stderr is search("database .* already exists")

^host {{ db_name }} {{ db_username }} {{ hostvars[outer_loop]['ansible_'~local_loop | regex_replace('-','_')]['ipv4']['address'] }}/32 .*

host {{ db_name }} {{ db_username }} {{ hostvars[outer_loop]['ansible_'~local_loop | regex_replace('-','_')]['ipv4']['address'] }}/32 md5

{{ kdc_init_command }} -r {{ security_options.realm | upper }} -P {{ security_options.kdc_master_key }}

{{ kadmin_command }} -q "add_principal -pw {{ security_options.admin_password }} {{ security_options.admin_principal }}/admin@{{ security_options.realm | upper }}"

The admin principal could not be created. Error is {{ addprinc_result.stderr }}

addprinc_result is failed or not (addprinc_result.stdout is search("Principal .* created") or addprinc_result.stderr is search("Principal or policy already exists while creating"))

msg="We need updates in Ansible 2.5.0. Please update your kit. 'pip install -U Ansible'"

ansible_os_family == 'RedHat' and ansible_selinux and ansible_selinux.status == 'enabled'

firewall-cmd --zone=dmz --permanent --add-service=http --add-service=https

firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" source address="{{ item }}/32" port port=4949 protocol="tcp" accept'

certbot certonly --nginx --email '{{ admin_email }}' --agree-tos -d '{{ item }}' {% if certbot_staging %} --staging {% endif %}

repo='deb http://http.debian.net/debian wheezy-backports main' state=present

src=haproxy_enabled dest=/etc/default/haproxy owner=root group=root mode=644

/usr/sbin/haproxy -v | grep version | sed -r "s/.+version ([0-9.]+) .+/\1/"

src=haproxy.cfg.j2 dest=/etc/haproxy/haproxy.cfg owner=root group=root mode=644 backup=true

127.0.0.1{{'	'}}{{inventory_hostname}}{% if inventory_hostname != inventory_hostname_short %}{{'	'}}{{inventory_hostname_short}}{% endif %}{{'	'}}localhost

::1{{'		'}}{{inventory_hostname}}{% if inventory_hostname != inventory_hostname_short %}{{'	'}}{{inventory_hostname_short}}{% endif %}{{'	'}}localhost ip6-localhost ip6-loopback

src=plone_events.j2 dest=/etc/logwatch/conf/services/plone_events.conf owner=root group=root

src=update-notify.j2 dest=/etc/logwatch/scripts/services/update-notify owner=root group=root mode=0755

src=munin-node.conf.j2 dest=/etc/munin/munin-node.conf owner=root group=root mode=644

path="/etc/munin/plugins/{{ item }}" state=link src="/usr/share/munin/plugins/{{ item }}"

path="/etc/munin/plugins/haproxy_ng" state=link src="/usr/share/munin/plugins/haproxy_ng" mode=0755

/usr/sbin/varnishd -V 2>&1 | grep varnishd | sed -r "s/.+varnish-([0-9.]+) .+/\1/"

src=monitors/varnish4_ dest=/etc/munin/plugins/varnish4_hit_rate mode=0755

path="/etc/munin/plugins/varnish4_{{ item }}" state=link src="/etc/munin/plugins/varnish4_hit_rate"

/usr/sbin/nginx -v 2>&1 >/dev/null | sed -r 'sX^.*nginx/([0-9.]+).*$X\1X'

{{ allow_http2 | default(nginx_v_result.stdout is version('1.9.5', 'ge')) }}

openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048 creates=/etc/nginx/ssl/dhparam.pem

/etc/nginx/sites-enabled/{{ item.protocol|default('http') }}_{{ item.hostname|default(inventory_hostname)|replace('.', '_') }}

{{ playbook_plones|map(attribute='webserver_virtualhosts')|list }}

/etc/nginx/conf.d/{{ item.protocol|default('http') }}_{{ item.hostname|default(inventory_hostname)|replace('.', '_') }}.conf

src=main.cf.j2 dest=/etc/postfix/main.cf owner=root group=root mode=644

src=restart_clients.sh.j2 dest="{{ restart_instance_script_path }}/restart_clients.sh" owner=root group=root mode=0544

src=restart_single_client.sh.j2 dest="{{ restart_instance_script_path }}/restart_single_client.sh" owner=root group=root mode=0544

src=restart_if_hot.py.j2 dest="{{ restart_instance_script_path }}/restart_if_hot.py" owner=root group=root mode=0544

item.plone_client_max_memory|default(plone_client_max_memory) != 0

Restart {{ item.plone_instance_name|default(plone_instance_name) }} clients if too hot

{{ item.plone_hot_monitor|default(plone_hot_monitor)|default('superlance') != 'cron' or item.plone_client_max_memory|default(plone_client_max_memory) == 0 }}

{{ item.plone_restart_hot_minute|default(plone_restart_hot_minute) }}

path=/var/lib/varnish state=directory owner=varnish group=varnish

sysd_varnish.rc == 0 and ansible_os_family == 'Debian' and varnish_version < '4.1'

dest=/etc/systemd/system/multi-user.target.wants/varnish.service section=Service option=ExecStart value="/usr/sbin/varnishd -a :{{ proxycache_port }} -T localhost:{{ proxycache_port + 1}} -f /etc/varnish/default.vcl -S /etc/varnish/secret -s {{ proxycache_method }},{{ proxycache_size }} -u varnish -g varnish" backup=yes

sysd_varnish.rc == 0 and ansible_os_family == 'Debian' and varnish_version >= '4.1'

dest=/lib/systemd/system/varnish.service section=Service option=ExecStart value="/usr/sbin/varnishd -j unix,user=vcache -F -a :{{ proxycache_port }} -T localhost:{{ proxycache_port + 1}} -f /etc/varnish/default.vcl -S /etc/varnish/secret -s {{ proxycache_method }},{{ proxycache_size }}" backup=yes

src=varnish.params.j2 dest=/etc/varnish/varnish.params backup=yes

artcl_commands_flatten had unexpected value {{ artcl_commands_flatten }}

export PATH=$PATH:/usr/local/sbin:/usr/sbin
source {{ infrared_venv }}/bin/activate
ir plugin add {{ ansible_env.HOME }}/artcl-src --src-path infrared_plugin

ir plugin list

{{ ansible_user_dir }}/workspace/logs/_No_valid_host_was_found.log

grep 'No valid host was found' {{ ansible_user_dir }}/workspace/logs/failures_file

grep 'No valid host was found' {{ ansible_user_dir }}/workspace/logs/_No_valid_host_was_found.log

{{ artcl_commands | combine(artcl_commands_extras, recursive=True) }}

{{ combined_cmds | dict2items|selectattr("key", "in", collect_log_types) | list | items2dict | flatten_nested_dict }}

{% if not item.capture_disable | default(False) %}
exec >{% if not capture_file.startswith('/') %}/var/log/extra/{% endif %}{{ capture_file }} 2>&1
{% endif %}
{# do not put anything after the command #}
{{ item.cmd }}

{{ artcl_collect_list }} + {{ artcl_collect_list_append|default([]) }}

{{ artcl_exclude_list|default([]) }} + {{ artcl_exclude_list_append|default([]) }}

find {{ collect_list|join(' ') }} -maxdepth {{ artcl_find_maxdepth }} -type f \ -size -{{ artcl_find_max_size }}M {% if artcl_exclude_list is defined %} -not -path {{ artcl_exclude_list|map('quote')|join(' -not -path ') }} {% endif %} -print0 > /tmp/{{ inventory_hostname }}-rsync-list

set -o pipefail && rsync --quiet --recursive --copy-links --prune-empty-dirs --ignore-errors {% if artcl_rsync_collect_list|bool %} --filter '. /tmp/{{ inventory_hostname }}-rsync-filter' {% else %} --from0 --files-from=/tmp/{{ inventory_hostname }}-rsync-list {% endif %} / /tmp/{{ inventory_hostname }}; find /tmp/{{ inventory_hostname }} -type d -print0 | xargs -0 chmod 755; find /tmp/{{ inventory_hostname }} -type f -print0 | xargs -0 chmod 644; find /tmp/{{ inventory_hostname }} -not -type f -not -type d -delete; {# chown can fail with: chown: invalid spec: '0:' #} chown -R {{ ansible_user | default(ansible_effective_user_id) }}: /tmp/{{ inventory_hostname }} || true;

tar xf {{ inventory_hostname }}.tar
rm -f {{ inventory_hostname }}.tar

awk -f "{{ local_working_dir }}/usr/local/share/ansible/roles/collect-logs/scripts/doc_extrapolation.awk" \
  "{{ artcl_collect_dir }}/undercloud/home/{{ undercloud_user }}/{{ item }}.sh" > \
  "{{ artcl_docs_source_dir }}/{{ item }}.rst"

cp "{{ artcl_docs_source_dir }}/../static/{{ item }}.rst" "{{ artcl_docs_source_dir }}"

set -o pipefail && sphinx-build -b html "{{ artcl_docs_source_dir }}" "{{ artcl_docs_build_dir }}" 2>&1 {{ timestamper_cmd }} > {{ artcl_collect_dir }}/docs/sphinx_build.log

family-{{ ansible_os_family | lower }}-{{ ansible_distribution_major_version | lower }}.yml

{{ ansible_distribution | lower | replace(' ', '-') }}-{{ ansible_distribution_major_version | lower }}.yml

{{ ansible_distribution | lower | replace(' ', '-') }}-{{ ansible_distribution_version.split('.')[0:2] | join('-') | lower }}.yml

grep -q "{{ item }}" "{{ artcl_collect_dir }}/docs/build/index.html"

if [[ ! -d "{{ artcl_collect_dir }}" && ! -h "{{ artcl_collect_dir }}" ]]; then
    mkdir -p "{{ artcl_collect_dir }}"
fi

set -o pipefail && curl -k "{{ lookup('env', 'BUILD_URL') }}/timestamps/?time=yyyy-MM-dd%20HH:mm:ss.SSS%20|&appendLog&locale=en_GB" > {{ artcl_collect_dir }}/console.log

if [ -d {{ artcl_collect_dir }}/undercloud/var/log/extra/stackviz/data ]; then
    cp -r {{ artcl_collect_dir }}/undercloud/var/log/extra/stackviz {{ artcl_collect_dir }};
    gunzip -fr {{ artcl_collect_dir }}/stackviz;
fi;

if [ -d {{ artcl_collect_dir }}/undercloud/var/log/tempest/stackviz/data ]; then
    cp -r {{ artcl_collect_dir }}/undercloud/var/log/tempest/stackviz {{ artcl_collect_dir }};
fi;

cp {{ artcl_collect_dir }}/undercloud/home/stack/tempest/tempest.{xml,html}{,.gz} {{ artcl_collect_dir }} || true; gunzip {{ artcl_collect_dir }}/tempest.{xml,html}.gz || true;

cp {{ artcl_collect_dir }}/undercloud/var/log/tempest/testrepository.subunit.gz {{ artcl_collect_dir }}/testrepository.subunit.gz || true

if [ -f {{ artcl_readme_path }} ]; then
    cp {{ artcl_readme_path }} {{ artcl_readme_file }};
fi;

set -o pipefail && find {{ artcl_collect_dir }}/ -type f | awk 'function rename(orig) { new=orig; sub(/\.gz$/, ".txt.gz", new); system("mv " orig " " new) } /\.(conf|ini|json|sh|log|yaml|yml|repo|cfg|j2|py)\.gz$/ { rename($0) } /(\/var\/log\/|\/etc\/)[^ \/\.]+\.gz$/ { rename($0) }';

rsync -av --quiet -e "ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null {{ artcl_report_server_key|default('') }}" {{ artcl_collect_dir }}/ {{ artcl_rsync_path }}/{{ lookup('env', 'BUILD_TAG') }}

rsync -av --quiet {{ artcl_collect_dir }}/ {{ artcl_rsync_path }}/{{ lookup('env', 'BUILD_TAG') }}

swift upload --quiet --header "X-Delete-After:{{ artcl_swift_delete_after }}" {{ artcl_swift_container }}/{{ lookup('env', 'BUILD_TAG') }} *

"{{ artcl_zuul_swift_upload_path }}/zuul_swift_upload.py --name {{ artcl_swift_container }} --delete-after {{ artcl_swift_delete_after }} {{ artcl_collect_dir }}"

{{ local_working_dir }}/bin/ara generate html {{ local_working_dir }}/ara_oooq; {{ local_working_dir }}/bin/ara task list --all -f json > {{ artcl_collect_dir }}/ara.json; cp -r {{ local_working_dir }}/ara_oooq {{ artcl_collect_dir }}/;

{{ local_working_dir }}/bin/ara generate html {{ local_working_dir }}/ara_oooq_uc; {{ local_working_dir }}/bin/ara task list --all -f json > {{ artcl_collect_dir }}/ara.oooq.uc.json; cp -r {{ local_working_dir }}/ara_oooq_uc {{ artcl_collect_dir }}/;

{{ local_working_dir }}/bin/ara generate html {{ local_working_dir }}/ara_oooq_oc; {{ local_working_dir }}/bin/ara task list --all -f json > {{ artcl_collect_dir }}/ara.oooq.oc.json; cp -r {{ local_working_dir }}/ara_oooq_oc {{ artcl_collect_dir }}/;

mkdir -p {{ artcl_collect_dir }}/{{ item.dir }}/ara-report;
cp {{ item.file }} {{ artcl_collect_dir }}/{{ item.dir }}/ara-report/ansible.sqlite;

cp /opt/opendaylight/data/log/* /var/log/extra/odl/; journalctl -u opendaylight > /var/log/extra/odl/odl_journal.log

/tmp/dstat_graph/generate_page.sh /var/log/extra/dstat-csv.log > /var/log/extra/dstat.html

echo "netstat" > /var/log/extra/network.txt; netstat -i &> /var/log/extra/network.txt; for ipv in 4 6; do
  echo "### IPv${ipv} addresses" >> /var/log/extra/network.txt;
  ip -${ipv} a &>> /var/log/extra/network.txt;
  echo "### IPv${ipv} routing" >> /var/log/extra/network.txt;
  ip -${ipv} r &>> /var/log/extra/network.txt;
  echo "### IPTables (IPv${ipv})" &>> /var/log/extra/network.txt;
  test $ipv -eq 4 && iptables-save &>> /var/log/extra/network.txt;
  test $ipv -eq 6 && ip6tables-save &>> /var/log/extra/network.txt;
done; (for NS in $(ip netns list | cut -f 1 -d " "); do
  for ipv in 4 6; do
    echo "==== $NS (${ipv})====";
    echo "### IPv${ipv} addresses";
    ip netns exec $NS ip -${ipv} a;
    echo "### IPv${ipv} routing";
    ip netns exec $NS ip -${ipv} r;
    echo "### IPTables (IPv${ipv})";
    test $ipv -eq 4 && ip netns exec $NS ip iptables-save;
    test $ipv -eq 6 && ip netns exec $NS ip ip6tables-save;
  done
  PIDS="$(ip netns pids $NS)";
  [[ ! -z "$PIDS" ]] && ps --no-headers -f --pids "$PIDS";
  echo "";
done) &>> /var/log/extra/network-netns; (for NB in $(ovs-vsctl show | grep Bridge |awk '{print $2}'); do
  echo "==== Bridge name - $NB ====";
  ovs-ofctl show $NB;
  ovs-ofctl dump-flows $NB;
  echo "";
done; ovsdb-client dump) &> /var/log/extra/network-bridges;

which openstack-status &> /dev/null && (. ~/keystonerc_admin; openstack-status &> /var/log/extra/openstack-status.txt)

if [[ -e {{ working_dir }}/stackrc ]]; then source {{ working_dir }}/stackrc; openstack server list &> /var/log/extra/nova_list.txt; fi

if [[ -e {{ working_dir }}/stackrc ]]; then source {{ working_dir }}/stackrc; openstack baremetal node list &> /var/log/extra/baremetal_list.txt; fi

{{ ansible_pkg_mgr }} list installed >/var/log/extra/package-list-installed.txt

for user in $(cut -f1 -d':' /etc/passwd); do \
echo $user; crontab -u $user -l | grep -v '^$\|^\s*\#\|^\s*PATH'; done \
&> /var/log/extra/installed_crons.txt

repoquery --disablerepo='*' --enablerepo='delorean'\
-a --qf '%{sourcerpm}'|sort -u|sed 's/.src.rpm//g' >> /var/log/extra/import-delorean.txt

repoquery --disablerepo='*' --enablerepo='delorean-*-deps'\
-a --qf '%{sourcerpm}'|sort -u|sed 's/.src.rpm//g' >> /var/log/extra/import-delorean-deps.txt

systemctl -t service --failed --no-legend | awk '{print $1}' | xargs -r -n1 journalctl -u > /var/log/extra/failed_services.txt 2>&1

pgrep haproxy && \ test -S /var/lib/haproxy/stats && \ echo 'show info;show stat;show table' | socat /var/lib/haproxy/stats stdio &> /var/log/extra/haproxy-stats.txt || \ echo "No HAProxy or no socket on host" > /var/log/extra/haproxy-stats.txt

{{ ansible_python.executable }} -m pip list &> /var/log/extra/pip.txt

systemctl list-units --full --all &> /var/log/extra/services.txt
systemctl status "*" &>> /var/log/extra/services.txt

grep -i denied /var/log/audit/audit* && grep -i denied /var/log/audit/audit* > /var/log/extra/denials.txt

grep -v ansible-command /var/log/messages | grep segfault && grep -v ansible-command /var/log/messages | grep segfault > /var/log/extra/segfaults.txt

grep -v ansible-command /var/log/messages | grep oom-killer && grep -v ansible-command /var/log/messages | grep oom-killer > /var/log/extra/oom-killers.txt

if [[ -e /home/{{ undercloud_user }}/DLRN/data/repos ]]; then rm -rf /tmp/delorean_logs && mkdir /tmp/delorean_logs; find /home/{{ undercloud_user }}/DLRN/data/repos/ -name '*.log' -exec cp --parents \{\} /tmp/delorean_logs/ \; ; find /home/{{ undercloud_user }}/DLRN/ -name 'projects.ini' -exec cp \{\} /tmp/delorean_logs/ \; ; find /tmp/delorean_logs -name '*.log' -exec gzip \{\} \; ; find /tmp/delorean_logs -name '*.log.gz' -exec sh -c 'x="{}"; mv "$x" "${x%.log.gz}.log.txt.gz"' \; ; rm -rf {{ artcl_collect_dir }}/delorean_logs && mkdir {{ artcl_collect_dir }}/delorean_logs; mv /tmp/delorean_logs/home/{{ undercloud_user }}/DLRN/data/repos/* {{ artcl_collect_dir }}/delorean_logs/; mv /tmp/delorean_logs/projects.ini {{ artcl_collect_dir }}/delorean_logs/; fi

grep -rE '^[-0-9]+ [0-9:\.]+ [0-9 ]*ERROR ' /var/log/ | sed "s/\(.*\)\(20[0-9][0-9]-[0-9][0-9]-[0-9][0-9] [0-9][0-9]:[0-9][0-9]:[0-9][0-9]\.[0-9]\+\)\(.*\)/\2 ERROR \1\3/g" > /tmp/errors.txt; if (( $(stat -c "%s" /tmp/errors.txt) > 10485760 )); then
  ERR_NAME=big-errors.txt;
else
  ERR_NAME=errors.txt;
fi; mv /tmp/errors.txt /var/log/extra/${ERR_NAME}.txt

for i in {{ artcl_logstash_files|default([])|join(" ") }}; do cat $i; done | grep "^20.*|" | sort -sk1,2 | sed "s/\(20[0-9][0-9]-[0-9][0-9]-[0-9][0-9] [0-9][0-9]:[0-9][0-9]:[0-9][0-9]\.*[0-9]*\)\(.*\)/\1 INFO \2/g" > /var/log/extra/logstash.txt

{{ item.docker_host | default(lookup('env', 'DOCKER_HOST') or 'unix://var/run/docker.sock') }}

{{ molecule_ephemeral_directory }}/Dockerfile_{{ item.image | regex_replace('[^a-zA-Z0-9_]', '_') }}

{{ item.item.docker_host | default(lookup('env', 'DOCKER_HOST') or 'unix://var/run/docker.sock') }}

{{ item.item.dockerfile | default(item.invocation.module_args.dest) }}

platforms.changed or docker_images.results | map(attribute='images') | select('equalto', []) | list | count >= 0

{{ item.command | default('bash -c "while true; do sleep 10000; done"') }}

{{ telegraf_win_install_dir }}\telegraf-{{ telegraf_agent_version }}_windows_amd64.zip

{{ telegraf_win_install_dir }}\telegraf\telegraf.exe {{ telegraf_win_service_args | join(" ") }}

telegraf={{ telegraf_agent_version }}-{{ telegraf_agent_version_patch }}

deb https://repos.influxdata.com/{{ ansible_distribution|lower }} {{ ansible_lsb.codename }} stable

deb https://repos.influxdata.com/{{ ansible_distribution|lower }} {{ ansible_distribution_release }} stable

ansible_lsb is not defined or ansible_lsb.codename is not defined

-config /etc/telegraf/telegraf.conf -config-directory /etc/telegraf/telegraf.d

sysrc telegraf_flags="-quiet -config-directory=/usr/local/etc/telegraf.d"

{{ telegraf_yum_baseurl[ansible_distribution|lower] | default(telegraf_yum_baseurl['default']) }}

db == 'openmrs' and (passive is not defined or passive != 'yes')

db == 'bahmni_reports' and (passive is not defined or passive != 'yes')

backup_type == 'all' or options == 'postgres' or options == 'all' or options == 'clinlims' or options == 'odoo' or options == 'bahmni_pacs' or options == 'pacsdb'

options == 'postgres' or options == 'openerp'  or options == 'clinlims' or options == 'dcm4chee-db' or options == 'pacs-integration-db'

openssl req -new -key {{ certs_dir }}/domain.key -out {{ certs_dir }}/csr.csr -subj "/CN={{ commonName }}"

prompt="Add NAME = {{ letsencrypt_data['challenge_data'][item]["dns-01"]["resource"] }}.{{ item }} and VALUE = {{ letsencrypt_data['challenge_data'][item]["dns-01"]["resource_value"] }} as DNS TXT record. Wait for sometime to let the TXT records sync with other DNS servers. Press ENTER after you are done"

{ cat {{ certs_dir }}/cert.crt & wget -O - {{ intermediate_cert }}; } > {{ certs_dir }}/chained.pem

name=atomfeed-console-{{ atomfeed_console_version }} state=latest

src=templates/atomfeed-console.yml.j2 dest=/etc/atomfeed-console/atomfeed-console.yml mode=644 owner={{ atomfeed_console_user }} group={{ atomfeed_console_group }}

iptables -nL --line-numbers | grep ATOMFEED_CONSOLE  -m 1 | cut -c 1-2

/sbin/iptables -I INPUT 1 -p tcp --dport {{ atomfeed_console_port }} -j ACCEPT -m comment --comment "ATOMFEED_CONSOLE"

name={{ atomfeed_console_db_username }} role_attr_flags=NOSUPERUSER

groups['bahmni-lab-db'] is defined and groups['bahmni-lab-db'] | length > 0

#<!-- {mark} ANSIBLE MANAGED BLOCK atomfeed-console:{{ item.db }} -->

{% if groups['atomfeed-console'][0] not in [False, 'localhost', '127.0.0.1'] %}
host {{ item.db }} {{ item.db_user }} {{ groups['atomfeed-console'][0] }}/32 trust
{% endif %}

src=templates/atomfeed_console_ssl.conf.j2 dest=/etc/httpd/conf.d/atomfeed_console_ssl.conf mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

path={{item.backup_to_path}} owner=bahmni group=bahmni mode=0755 state=directory

artifacts_to_backup="{{artifacts_to_backup|default([]) + [item.item.name] }}"

tar  -C $(dirname  {{item.backup_from_path}} ) -czvf {{backup_temp_dest_dir}}/$(date +%Y-%m-%d_%H%M%S)-{{item.name}}.tar.gz $(basename {{item.backup_from_path}}) 2>{{backup_log_file}}; chown bahmni:bahmni {{backup_temp_dest_dir}}/$(ls -t {{backup_temp_dest_dir}} | grep {{item.name}}); chmod 0755 {{backup_temp_dest_dir}}/$(ls -t {{backup_temp_dest_dir}} | grep {{item.name}}); cp -rp  {{backup_temp_dest_dir}}/$(ls -t {{backup_temp_dest_dir}} | grep {{item.name}}) {{item.backup_to_path}} 2>{{backup_log_file}};

artifacts_to_backup is defined and item.name in artifacts_to_backup

tar  -C $(dirname  {{item.backup_from_path}} ) -czvf {{backup_temp_dest_dir}}/$(date +%Y-%m-%d_%H%M%S)-{{item.name}}.tar.gz $(basename {{item.backup_from_path}}) 2>{{backup_log_file}}; chown bahmni:bahmni {{backup_temp_dest_dir}}/$(ls -t {{backup_temp_dest_dir}} | grep {{item.name}}); chmod 0755 {{backup_temp_dest_dir}}/$(ls -t {{backup_temp_dest_dir}} | grep {{item.name}}); cp -rp {{backup_temp_dest_dir}}/$(ls -t {{backup_temp_dest_dir}} | grep {{item.name}}) {{item.backup_to_path}} 2>{{backup_log_file}};

path={{item}} owner=bahmni group=bahmni mode=0755 state=directory

src=/root/.ssh/id_rsa.pub dest=/tmp/id_rsa.pub flat=yes fail_on_missing=yes mode=766

user={{ bahmni_support_user }} key="{{ lookup('file', '/tmp/id_rsa.pub') }}"

path={{item}} owner={{ bahmni_user }} group={{ bahmni_group }} mode=0755 state=directory

name="sync_patient_image_cron" minute="*/1" user=root job="rsync -rh --progress -i --itemize-changes --update --rsync-path='sudo rsync' -pog {{patient_images_dir}} -e 'ssh -o StrictHostKeyChecking=no' {{bahmni_support_user}}@{{item}}:{{patient_images_dir}}/../"

{{ (passive is not defined or passive != 'yes') and hostvars[item].get('passive') | default('') == 'yes' }}

name="sync_document_image_cron" minute="*/1" user=root job="rsync -rh --progress -i --itemize-changes --update --rsync-path='sudo rsync' -pog {{document_images_dir}} -e 'ssh -o StrictHostKeyChecking=no' {{bahmni_support_user}}@{{item}}:{{document_images_dir}}/../"

name="sync_uploaded_files_cron" minute="*/1" user=root job="rsync -rh --progress -i --itemize-changes --update --rsync-path='sudo rsync' -pog {{uploaded_files_dir}} -e 'ssh -o StrictHostKeyChecking=no' {{bahmni_support_user}}@{{item}}:{{uploaded_files_dir}}/../"

name="sync_uploaded_results_cron" minute="*/1" user=root job="rsync -rh --progress -i --itemize-changes --update --rsync-path='sudo rsync' -pog {{uploaded_results_dir}} -e 'ssh -o StrictHostKeyChecking=no' {{bahmni_support_user}}@{{item}}:{{uploaded_results_dir}}/../"

name="sync_clinical_forms_cron" minute="*/1" user=root job="rsync -rh --progress -i --itemize-changes --update --rsync-path='sudo rsync' -pog {{clinical_forms_dir}} -e 'ssh -o StrictHostKeyChecking=no' {{bahmni_support_user}}@{{item}}:{{clinical_forms_dir}}/../"

Please specify timezone to be set to the server by adding value for key 'timezone' in /etc/bahmni-installer/setup.yml. Example, timezone: Asia/Kolkata. Take a look at https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for available timezones 

msg="Timezone specified in /etc/bahmni-installer/setup.yml is incorrect. Example - Asia/Kolkata. Take a look at https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for available time zones"

src=/usr/share/zoneinfo/{{ timezone }}  dest=/etc/localtime state=link force=yes

setupToolsVersion.stdout.find("{{ odoo_setuptools_version }}") == -1

bahmni_create_connect_artifacts.sh {{ OpenMRS_username }} {{ OpenMRS_password }}

installed_bahmni_emr.stdout.find("{{ bahmni_emr_version }}") == -1

src=/etc/bahmni-installer/deployment-artifacts/openmrs_backup.sql dest=/etc/bahmni-installer/deployment-artifacts/openmrs_backup.sql mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=openmrs.conf.j2 dest={{ openmrs_install_dir }}/etc/openmrs.conf mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=bahmnicore.properties.j2 dest={{ openmrs_install_dir }}/bahmnicore.properties mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=rulesengine-concept.properties.j2 dest={{ openmrs_install_dir }}/rulesengine-concept.properties mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=openmrs-runtime.properties.j2 dest={{ openmrs_install_dir }}/etc/openmrs-runtime.properties mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

/sbin/iptables -I INPUT 1 -p tcp --dport  {{ openmrs_port }} -j ACCEPT -m comment --comment "OPENMRS"

mysql --user={{ mysql_root_user }} --password={{ mysql_root_password }} openmrs --host={{ groups['bahmni-emr-db'][0] }} --batch --skip-column-names --execute="SELECT salt from users where username='{{ openmrs_user_id }}' or system_id='{{ openmrs_user_id }}';"

python -c "import hashlib; print(hashlib.sha512(('{{ openmrs_user_password }}'+'{{ salt.stdout }}').encode()).hexdigest())"

mysql --user={{mysql_root_user}} --password={{mysql_root_password}} openmrs --host={{ groups['bahmni-emr-db'][0] }} --batch --skip-column-names --execute="UPDATE users set password='{{ hashedPassword.stdout }}' where username='{{ openmrs_user_id }}' or system_id='{{ openmrs_user_id }}';"

mysql --user={{mysql_root_user}} --password={{mysql_root_password}} openmrs --host={{ groups['bahmni-emr-db'][0] }} --batch --skip-column-names --execute="UPDATE global_property set property_value='{{ openmrs_user_password }}' where property='scheduler.password' ;"

url={{ item }} dest=/opt/openmrs/modules/ owner={{ bahmni_user }} group={{ bahmni_group }} mode=755

src=/etc/bahmni-installer/deployment-artifacts/modules/ dest=/etc/bahmni-installer/deployment-artifacts/modules/ owner={{ bahmni_user }} group={{ bahmni_group }} mode=644

(passive is not defined or passive != 'yes') and two_factor_auth is defined and two_factor_auth == 'enabled'

src=bahmni-two-factor-auth.conf.j2 dest=/opt/bahmni-two-factor-auth/etc/bahmni-two-factor-auth.conf mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=bahmni-two-factor-auth.properties.j2 dest=/opt/bahmni-two-factor-auth/etc/application.properties mode=755 owner={{ bahmni_user }} group={{ bahmni_group }}

src=getversion.py dest=/var/www/cgi-bin/ mode=755 owner={{ bahmni_user }} group={{ bahmni_group }}

src=emr_ssl.conf.j2 dest=/etc/httpd/conf.d/emr_ssl.conf mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=systemdate.sh dest=/var/www/cgi-bin/systemdate mode=755 owner={{ bahmni_user }} group={{ bahmni_group }}

wget -q -O {{ postgres_repo_rpm_location }} {{postgres_repo_download_url}} creates={{ postgres_repo_rpm_location }}

installed_bahmni_erp.stdout.find("{{ bahmni_erp_version }}") == -1

src=/etc/bahmni-installer/deployment-artifacts/openerp_backup.sql dest=/etc/bahmni-installer/deployment-artifacts/openerp_backup.sql mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=openerp-server.conf.j2 dest=/etc/openerp/openerp-server.conf owner=openerp group=openerp mode=0655

/sbin/iptables -I INPUT 1 -p tcp --dport  {{ openerp_port }} -j ACCEPT -m comment --comment "BAHMNIERP"

{% if openerp_url is defined and openerp_url.startswith('https') %}
  {% for erp_host in groups['bahmni-erp'] %}
  {% if hostvars[erp_host].get('passive', 'no') == hostvars[item].get('passive', 'no') %}
      RewriteCond %{HTTP_HOST} ={{ openerp_url | regex_replace('(?:https?://)?([^/:]+)?.*', '\1')  }}
      RewriteRule (.*) http://{{ erp_host }}:{{ openerp_port }}$1 [P]
  {% endif %}
  {% endfor %}
{% endif %}

installed_bahmni_erp_connect.stdout.find("{{ bahmni_erp_connect_version }}") == -1

name="bahmni-erp-connect-{{ bahmni_erp_connect_version }}" state=present

src=bahmni-erp-connect.conf.j2 dest=/opt/bahmni-erp-connect/etc/bahmni-erp-connect.conf owner=bahmni group=bahmni mode=0644

src=erp-atomfeed.properties.j2 dest=/opt/bahmni-erp-connect/bahmni-erp-connect/WEB-INF/classes/erp-atomfeed.properties mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

installed_bahmni_event_log_service.stdout.find("{{ bahmni_event_log_service_version }}") == -1

name="bahmni-event-log-service-{{ bahmni_event_log_service_version }}" state=present

src=bahmni-event-log-service.conf.j2 dest=/opt/bahmni-event-log-service/etc/bahmni-event-log-service.conf mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=bahmni-event-log-service-application.properties.j2 dest=/opt/bahmni-event-log-service/bahmni-event-log-service/WEB-INF/classes/application.properties mode=755 owner={{ bahmni_user }} group={{ bahmni_group }}

iptables -nL --line-numbers | grep BAHMNIEVENTLOGSERVICE  -m 1 | cut -c 1-2

/sbin/iptables -I INPUT 1 -p tcp --dport  {{ bahmni_event_log_service_port }} -j ACCEPT -m comment --comment "BAHMNIEVENTLOGSERVICE"

src=bahmni_eventlog_ssl.conf.j2 dest=/etc/httpd/conf.d/bahmni_eventlog_ssl.conf mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

expire-artifacts.sh {{item.name}} {{item.backup_to_path}} {{item.retention_limit}}

installed_bahmni_implementer_interface.stdout.find("{{ bahmni_implementer_interface_version }}") == -1

name="bahmni-implementer-interface-{{ bahmni_implementer_interface_version }}" state=present

installed_bahmni_lab.stdout.find("{{ bahmni_lab_version }}") == -1

src=/etc/bahmni-installer/deployment-artifacts/openelis_backup.sql dest=/etc/bahmni-installer/deployment-artifacts/openelis_backup.sql mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=bahmni-lab.conf.j2 dest=/etc/bahmni-lab/bahmni-lab.conf mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=hibernate.cfg.xml.j2 dest=/opt/bahmni-lab/bahmni-lab/WEB-INF/classes/us/mn/state/health/lims/hibernate/hibernate.cfg.xml mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=log4j.xml.j2 dest=/opt/bahmni-lab/bahmni-lab/WEB-INF/classes/ mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=atomfeed.properties.j2 dest=/opt/bahmni-lab/bahmni-lab/WEB-INF/classes/atomfeed.properties mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

/sbin/iptables -I INPUT 1 -p tcp --dport  {{ bahmni_lab_port }} -j ACCEPT -m comment --comment "BAHMNILAB"

src=bahmnilab_ssl.conf.j2 dest=/etc/httpd/conf.d/bahmnilab_ssl.conf mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

installed_bahmni_lab_connect.stdout.find("{{ bahmni_lab_connect_version }}") == -1

name="bahmni-lab-connect-{{ bahmni_lab_connect_version }}" state=present

src=/etc/bahmni-installer/deployment-artifacts/odoo_backup.sql dest=/etc/bahmni-installer/deployment-artifacts/odoo_backup.sql mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=odoo.conf.j2 dest=/etc/odoo.conf owner=odoo group=odoo mode=0655

name="bahmni-offline-{{ bahmni_offline_version }}" state=present

{% for connect_host in groups['bahmni-offline'] %}
{% if hostvars[connect_host].get('passive', 'no') == hostvars[item].get('passive', 'no') %}
      Alias /bahmni-connect /var/www/bahmni-connect-apps
{% endif %}
{% endfor %}

installed_bahmni_reports.stdout.find("{{ bahmni_reports_version }}") == -1

name="bahmni-reports-{{ bahmni_reports_version }}" state=present

src=bahmni-reports.conf.j2 dest=/opt/bahmni-reports/etc/bahmni-reports.conf mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=bahmni-reports.properties.j2 dest=/opt/bahmni-reports/etc/bahmni-reports.properties mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

iptables -nL --line-numbers | grep BAHMNIREPORTS  -m 1 | cut -c 1-2

/sbin/iptables -I INPUT 1 -p tcp --dport  {{ bahmni_reports_port }} -j ACCEPT -m comment --comment "BAHMNIREPORTS"

src=bahmni_reports_ssl.conf.j2 dest=/etc/httpd/conf.d/bahmni_reports_ssl.conf mode=644 force=yes owner={{ bahmni_user }} group={{ bahmni_group }}

name="sync_reports_cron" minute="*/1" user=root job="rsync -rh --progress -i --itemize-changes --update --rsync-path='sudo rsync' -pog {{reports_save_dir}} -e 'ssh -o StrictHostKeyChecking=no' {{bahmni_support_user}}@{{item}}:{{reports_save_dir}}/../"

artifacts_to_restore="{{artifacts_to_restore|default([]) + [item.item.name] }}"

cp -r {{item.restore_to_path}}{{item.name}} {{item.restore_to_path}}{{item.name}}_old/

artifacts_to_restore is defined and item.name in artifacts_to_restore

tar -xzvf {{item.restore_from_path}}/$(ls -A1 {{item.restore_from_path}} | grep {{item.name}} | tail -1) -C {{restore_temp_dest_dir}}  2>{{restore_log_file}}; cp -rp {{restore_temp_dest_dir}}/{{item.name}} {{item.restore_to_path}} 2>{{restore_log_file}};

tar -xzvf {{item.restore_from_path}}/$(ls -A1 {{item.restore_from_path}} | grep {{item.name}} | tail -1)  -C {{restore_temp_dest_dir}}  2>{{restore_log_file}}; cp -rp {{restore_temp_dest_dir}}/{{item.name}} {{item.restore_to_path}} 2>{{restore_log_file}};

name={{ bahmni_support_user }} group={{ bahmni_support_group }} generate_ssh_key=yes ssh_key_bits=2048 password={{bahmni_password_hash}} state=present

dest=/etc/sudoers state=present backup=yes regexp='^{{bahmni_support_user}}' insertafter='^# %wheel' line='{{bahmni_support_user}} ALL=(ALL) NOPASSWD: ALL' validate='visudo -cf %s'

dest=/etc/ssh/sshd_config backrefs=yes backup=yes regexp='(AllowGroups(?!.*\b{{ bahmni_support_group }}\b).*)' state=present line='\1 {{ bahmni_support_group }}'

dest=/etc/ssh/sshd_config backrefs=yes backup=yes regexp='(AllowUsers(?!.*\b{{ bahmni_support_user }}\b).*)' state=present line='\1 {{ bahmni_support_user }}'

installed_bahmni_web.stdout.find("{{ bahmni_web_version }}") == -1

src=ssl.conf.j2 dest=/etc/httpd/conf.d/ssl.conf mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

/sbin/iptables -I INPUT 1 -p tcp --dport  {{ dchm4chee_port }} -j ACCEPT -m comment --comment "DCM4CHEE"

/sbin/iptables -I INPUT 1 -p tcp --dport  {{ dcm4chee_imagestorage_port }} -j ACCEPT -m comment --comment "dcm4cheeimagestorage"

src=oviyam2-1-config.xml.j2 dest=/opt/dcm4chee/etc/oviyam2-1-config.xml mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=server.xml.j2 dest=/opt/dcm4chee/etc/server.xml mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=dcm4chee.conf.j2 dest=/opt/dcm4chee/etc/dcm4chee.conf mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=pacs-postgres-ds.xml.j2 dest=/opt/dcm4chee/etc/pacs-postgres-ds.xml mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=orm2dcm_bahmni.xsl.j2 dest=/opt/dcm4chee/etc/orm2dcm_bahmni.xsl mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

path={{ dcm4chee_archive_dir }} owner={{ bahmni_user }} group={{ bahmni_group }} mode=0755 state=directory

src={{ dcm4chee_archive_dir }} dest={{ dcm4chee_archive_dir_link }} owner={{ bahmni_user }} group={{ bahmni_group }} state=link

name="sync_dcm4chee_archive_dir" minute="*/1" user=root job="rsync -rh --progress -i --itemize-changes --update --rsync-path='sudo rsync' -pog {{dcm4chee_archive_dir}} -e 'ssh -o StrictHostKeyChecking=no' {{bahmni_support_user}}@{{item}}:{{dcm4chee_archive_dir}}/../"

src=dcm4chee_ssl.conf.j2 dest=/etc/httpd/conf.d/dcm4chee_ssl.conf force=yes mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

wget -q -p -O {{ java_rpm_location }} --no-check-certificate --no-cookies --header 'Cookie:oraclelicense=accept-securebackup-cookie' {{java_download_url}} creates={{ java_rpm_location }}

{{ downloaded_java.stat.exists == false  }} or {{ force_new_java_download == true }}

iptables -nL --line-numbers | grep "WEB SERVER"  -m 1 | cut -c 1-2

/sbin/iptables -I INPUT 1 -p tcp --dport  80 -j ACCEPT -m comment --comment "WEB SERVER"

/sbin/iptables -I INPUT 1 -p tcp --dport  443 -j ACCEPT -m comment --comment "https"

path=/etc/bahmni-certs state=directory owner={{ bahmni_user }} group={{ bahmni_group }} mode=755

src=index.html.j2 dest=/var/www/html/index.html mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

path=/var/www/bahmni_revisions state=directory owner={{ bahmni_user }} group={{ bahmni_group }} mode=755

src=bahmni_openmrs_revision.json dest=/var/www/bahmni_revisions/. mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=bahmni_openerp_revision.json dest=/var/www/bahmni_revisions/. mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=bahmni_openelis_revision.json dest=/var/www/bahmni_revisions/. mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

httpd_html_dir.stat.exists == True and maintenance_status == 'start'

/etc/bahmni-installer/deployment-artifacts/{{ implementation_name }}_config/

path=/var/www/bahmni_config state=directory owner={{ bahmni_user }} group={{ bahmni_group }} mode=755 recurse=yes

src=/var/www/bahmni_config/openmrs/obscalculator  dest=/opt/openmrs/obscalculator state=link owner={{ bahmni_user }} group={{ bahmni_group }}

src=/var/www/bahmni_config/openmrs/ordertemplates  dest=/opt/openmrs/ordertemplates state=link owner={{ bahmni_user }} group={{ bahmni_group }}

src=/var/www/bahmni_config/openmrs/encounterModifier  dest=/opt/openmrs/encounterModifier state=link owner={{ bahmni_user}} group={{ bahmni_group }}

src=/var/www/bahmni_config/openmrs/patientMatchingAlgorithm  dest=/opt/openmrs/patientMatchingAlgorithm state=link owner={{ bahmni_user }} group={{ bahmni_group }}

src=/var/www/bahmni_config/openmrs/elisFeedInterceptor  dest=/opt/openmrs/elisFeedInterceptor state=link owner={{ bahmni_user }} group={{ bahmni_group }}

src=/var/www/bahmni_config/openmrs/observationsAdder  dest=/opt/openmrs/observationsAdder state=link owner={{ bahmni_user }} group={{ bahmni_group }}

src=/var/www/bahmni_config dest=/opt/openmrs/bahmni_config state=link owner={{ bahmni_user }} group={{ bahmni_group }}

Please specify implementation name 'implementation_name' in /etc/bahmni-installer/setup.yml. Bahmni will pick the config from /etc/bahmni-installer/deployment-artifacts/. Example, implementation_name: default

path=/etc/bahmni-installer state=directory mode=0755 owner={{ bahmni_user }} group={{ bahmni_group }}

path=/etc/bahmni-installer/deployment-artifacts state=directory mode=0755 owner={{ bahmni_user }} group={{ bahmni_group }}

path=/etc/bahmni-installer/atomfeed-backup state=directory mode=0755 owner={{ bahmni_user }} group={{ bahmni_group }}

src=bahmni.conf.j2 dest=/etc/bahmni-installer/bahmni.conf mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

path=/etc/bahmni-installer/deployment-artifacts/modules state=directory owner=bahmni group=bahmni mode=0755 recurse=yes

/sbin/iptables -A INPUT -i lo -j ACCEPT -m comment --comment "lo"

/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT -m comment --comment "SSH"

path=/var/log/mysql state=directory mode=0755 owner=mysql group=mysql

grep 'temporary password' /var/log/mysqld.log | awk '{print $11}'

mysql -e "SET PASSWORD = PASSWORD('{{ mysql_root_password }}'); FLUSH PRIVILEGES;" --connect-expired-password -u root -i -p'{{ mysql_temp_password.stdout }}'

mysql -e "UPDATE mysql.user SET authentication_string=PASSWORD('{{mysql_root_password}}') WHERE User='root'; FLUSH PRIVILEGES;" -u root -i -p'{{mysql_old_root_password}}'

/sbin/iptables -I INPUT 1 -p tcp --dport 3306 -j ACCEPT -m comment --comment "MYSQL"

mysql -u{{mysql_root_user}} -p{{mysql_root_password}} -e 'SHOW DATABASES;' | grep {{db}}

echo `date +%Y%m%d-%H:%M:%S` STARTED : Taking backup using mysql dump >> {{log_file}}

mysqldump -u{{mysql_root_user}} -p{{mysql_root_password}} --routines --databases {{db}} | grep -v 'SQL SECURITY DEFINER' | gzip  > {{backup_path}}/{{db}}_dump_{{time.stdout}}.sql.gz

echo `date +%Y%m%d-%H:%M:%S` ENDED : Taking backup using mysql dump >> {{log_file}}

echo `date +%Y%m%d-%H:%M:%S` STARTED : Taking backup using Xtrabackup, Strategy:{{strategy}} >> {{log_file}}

touch {{backup_path}}/backup_info.txt; cat {{backup_path}}/backup_info.txt|tail -n 1|cut -f 3 -d ' '

echo `date +%Y%m%d%H%M%S` 'type:{{strategy}}' 'basedir:{{latest_backup_dir}}' 'incrementaldir:{{backup_path}}/{{ time.stdout }}_{{strategy}}' >>/var/log/bahmni-backup.log

xtrabackup --user={{mysql_root_user}} --password={{mysql_root_password}}  --backup --target-dir={{backup_path}}/{{ time.stdout }}_full/ --databases {{db}}

(strategy == "full") or (strategy == "incr" and result_files.matched == 0)

echo `date +%Y%m%d%H%M%S` 'full {{ time.stdout }}_full' >> {{backup_path}}/backup_info.txt

mysqldump -u {{mysql_root_user}}  --password={{mysql_root_password}} --no-data --routines {{db}} >{{backup_path}}/{{ time.stdout }}_full/{{db}}_schema.sql

echo `date +%Y%m%d%H%M%S` '{{strategy}} {{ time.stdout }}_{{strategy}}' >> {{backup_path}}/backup_info.txt

echo `date +%Y%m%d-%H:%M:%S` COMPLETED : Full backup using Xtrabackup to dir:{{backup_path}}/{{ time.stdout }}_full/  >> {{log_file}}

xtrabackup --user={{mysql_root_user}} --password={{mysql_root_password}} --backup --target-dir={{backup_path}}/{{ time.stdout }}_incr/  --incremental-basedir={{ latest_backup_dir }}/ --databases {{db}}

mysqldump -u {{mysql_root_user}}  --password={{mysql_root_password}} --no-data --routines {{db}} >{{backup_path}}/{{ time.stdout }}_incr/{{db}}_schema.sql

echo `date +%Y%m%d%H%M%S` '{{strategy}} {{ time.stdout }}_{{strategy}} {{base_directory.stdout}}' >> {{backup_path}}/backup_info.txt

echo `date +%Y%m%d-%H:%M:%S` COMPLETED : Incremental backup using Xtrabackup to dir:{{backup_path}}/{{ time.stdout }}_incr/  >> {{log_file}}

ls -1tr {{backup_path}} |grep _full|tail -n{{retention_limit}} |head -1

rsync -avP -e ssh {{backup_path}} {{sync.user}}@{{sync.host}}:{{sync.path}}

not( (sync.host is undefined) or (sync.host is none) or (sync.host | trim == '') )

mysql -u{{ mysql_root_user }} -p{{ mysql_root_password }} -e'drop database {{db}};';

echo `date +%Y%m%d-%H:%M:%S` STARTED : Restoring dump {{restore_path}}/{{restore_point}}  >> {{log_file}}

gunzip -c {{restore_path}}/{{restore_point}} | mysql -u{{ mysql_root_user }} -p{{ mysql_root_password }}

echo `date +%Y%m%d-%H:%M:%S` COMPLETED : Restoring dump {{restore_path}}/{{restore_point}}  >> {{log_file}}

echo `date +%Y%m%d-%H:%M:%S` STARTED : Restore using xtrabackup {{restore_path}}/{{restore_point}}  >> {{log_file}}

mysql -u{{ mysql_root_user }} -p{{ mysql_root_password }} -e'create database {{db}};';

mysql -u{{ mysql_root_user }} -p{{ mysql_root_password }} -e'set global foreign_key_checks=0;'

cat {{restore_path}}/{{restore_point}}/{{db}}_schema.sql | mysql -u{{ mysql_root_user }} -p{{ mysql_root_password }} {{db}}

restore_tablespace.sh {{mysql_root_user}} {{mysql_root_password}} {{db}} DISCARD

chmod 660 /var/lib/mysql/{{db}}/*.ibd; chown mysql:mysql /var/lib/mysql/{{db}}/*.ibd;

restore_tablespace.sh {{mysql_root_user}} {{mysql_root_password}} {{db}} IMPORT

mysql -u{{ mysql_root_user }} -p{{ mysql_root_password }} -e'set global foreign_key_checks=1;'

echo `date +%Y%m%d-%H:%M:%S` COMPLETED : Restore using xtrabackup {{restore_path}}/{{restore_point}}  >> {{log_file}}

path=/opt/mysql-replication group={{bahmni_group}} owner={{bahmni_user}} mode=0755 state=directory recurse=yes

inventory_hostname in groups['bahmni-emr-db'] or inventory_hostname in groups['bahmni-reports-db']

inventory_hostname in groups['bahmni-emr-db-slave'] or inventory_hostname in groups['bahmni-reports-db-slave']

mysqldump -u{{mysql_root_user}} -p{{mysql_root_password}} --routines --all-databases | grep -v 'SQL SECURITY DEFINER' | gzip  > /opt/mysql-replication/mysql_dump.sql.gz

src=/opt/mysql-replication/mysql_dump.sql.gz dest=/tmp/ flat=yes fail_on_missing=yes

src=/tmp/mysql_dump.sql.gz dest=/opt/mysql-replication/ mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

gunzip -c /opt/mysql-replication/mysql_dump.sql.gz | mysql -u{{ mysql_root_user }} -p{{ mysql_root_password }}

src=ssmtp.conf dest=/etc/ssmtp/ssmtp.conf owner=root group=nagios mode=0664

src=revaliases dest=/etc/ssmtp/revaliases owner=root group=nagios mode=0664

Please specify email id to which nagios mail notifications should be sent by adding value for key 'nagios_contact_email' in /etc/bahmni-installer/setup.yml. Example, nagios_contact_email: abc@gmail.com

/sbin/iptables -I INPUT 1 -p tcp --dport 80 -j ACCEPT -m comment --comment "ApacheHttp"

src=cgi.cfg dest=/etc/nagios/cgi.cfg owner=root group=nagios mode=0664

src=nagios.cfg dest=/etc/nagios/nagios.cfg owner=root group=nagios mode=0664

src=commands.cfg dest=/etc/nagios/objects/commands.cfg owner=root group=nagios mode=0664

src=templates.cfg dest=/etc/nagios/objects/templates.cfg owner=root group=nagios mode=0664

src=contacts.cfg dest=/etc/nagios/objects/contacts.cfg owner=root group=nagios mode=0664

src=localhost.cfg dest=/etc/nagios/objects/localhost.cfg owner=root group=nagios mode=0664

src=hosts.cfg dest=/etc/nagios/objects/hosts.cfg owner=root group=nagios mode=0664

src=hostgroups.cfg dest=/etc/nagios/objects/hostgroups.cfg owner=root group=nagios mode=0664

src=services.cfg dest=/etc/nagios/objects/services.cfg owner=root group=nagios mode=0664

src=timeperiods.cfg dest=/etc/nagios/objects/timeperiods.cfg owner=root group=nagios mode=0664

create=yes name={{ item.name }} password={{ item.password }} path=/etc/nagios/passwd owner=root group=nagios mode=0644

src=nagios.conf dest=/etc/httpd/conf.d/nagios.conf owner=root group=root mode=0664

src=nrpe.cfg dest=/etc/nagios/nrpe.cfg owner=root group=root mode=0644

src={{ item }} dest=/usr/lib64/nagios/plugins/{{ item }} mode=0755 owner=root group=root

/sbin/iptables -I INPUT 1 -p tcp --dport 5666 -j ACCEPT -m comment --comment "NagiosNRPE"

alternatives --install "/usr/bin/java" "java" "/usr/java/default/bin/java" 2000

alternatives --install "/usr/bin/javac" "javac" "/usr/java/default/bin/javac" 2000

alternatives --install "/usr/bin/jar" "jar" "/usr/java/default/bin/jar" 2000

installed_pacs_integration.stdout.find("{{ pacs_integration_version }}") == -1

name="pacs-integration-{{ pacs_integration_version }}" state=present

src=pacs-integration.conf.j2 dest=/opt/pacs-integration/etc/pacs-integration.conf mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=atomfeed.properties.j2 dest=/opt/pacs-integration/pacs-integration/WEB-INF/classes/atomfeed.properties mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

src=application.properties.j2 dest=/opt/pacs-integration/pacs-integration/WEB-INF/classes/application.properties mode=644 owner={{ bahmni_user }} group={{ bahmni_group }}

iptables -nL --line-numbers | grep PACSINTEGRATION  -m 1 | cut -c 1-2

/sbin/iptables -I INPUT 1 -p tcp --dport  {{ pacs_integration_port }} -j ACCEPT -m comment --comment "PACSINTEGRATION"

path={{ postgres.path }} state=directory owner=postgres group=postgres mode=777

installed_pgbackrest.stdout.find("pgbackrest [options] [command]") == -1

installed_pgbackrest.stdout.find("pgbackrest [options] [command]") >= 0

cd /;sudo -u postgres pgbackrest --stanza=bahmni-postgres --type=full --log-level-console=info backup 2>>{{ logfile }}

cd /;sudo -u postgres pgbackrest --stanza=bahmni-postgres --type=incr --log-level-console=info backup 2>>{{ logfile }}

pg_dump -Upostgres --create  {{ options }} | gzip > {{postgres.path}}/{{options}}/{{ options }}_dump_{{ time.stdout }}.sql.gz

file path={{postgres.path}}/pgdbdump-backup state=directory mode=0777

src={{postgres.path}}/{{options}}/{{ options }}_dump_{{time.stdout}}.sql.gz dest={{postgres.path}}/{{options}}/ flat=yes

wget -q -O - \https://github.com/pgbackrest/pgbackrest/archive/release/1.12.tar.gz | \tar zx -C /home/bahmni/

cp -R "/home/bahmni/pgbackrest-release-1.12/lib/pgBackRest" /usr/share/perl5/

cp -R "/home/bahmni/pgbackrest-release-1.12/bin/pgbackrest" /usr/bin/pgbackrest; chmod 777 /usr/bin/pgbackrest;

path=/var/log/pgbackrest state=directory mode=777 owner=postgres group=postgres

path=/var/lib/pgbackrest state=directory mode=777 owner=postgres group=postgres

archive_mode = on
archive_command = 'pgbackrest --stanza=bahmni-postgres archive-push %p'
wal_level = hot_standby 

pgbackrest --stanza=bahmni-postgres --log-level-console=info stanza-create

gunzip -c {{postgres.path}}/{{options}}/{{ restore_point }} | psql -U postgres

#{{app_server_group}}
{% for host in groups[app_server_group] %}
{% if host not in [False, 'localhost', '127.0.0.1'] %}
host all postgres {{ hostvars.get(host, {}).get('ansible_ssh_host') or host }}/32 trust
host {{ db_name }} {{ db_user }} {{ hostvars.get(host, {}).get('ansible_ssh_host') or host }}/32 trust #access to app server
{% endif %}
{% for host in groups[master_db_group] %}
{% if host not in [False, 'localhost', '127.0.0.1'] and host != inventory_hostname %}
host {{ db_name }} {{ db_user }} {{ hostvars.get(host, {}).get('ansible_ssh_host') or host }}/32 trust # access to master db
{% endif %}
{% for host in groups[slave_db_group] %}
host {{ db_name }} {{ db_user }} {{ hostvars.get(host, {}).get('ansible_ssh_host') or host }}/32 trust #access to slave db
host replication {{ db_user }} {{ hostvars.get(host, {}).get('ansible_ssh_host') or host }}/32	trust #access to slave db ipv6

{% endif %}

wal_level = {{ slave | default(false) | ternary('minimal', 'hot_standby') }}
max_wal_senders = {{ slave | default(false) | ternary('0', '3') }}  
wal_keep_segments = {{ slave | default(false) | ternary('0', '32') }}
hot_standby = on

path=/var/lib/pgsql/{{ postgres_version }}/data/recovery.conf state=absent

inventory_hostname in groups['bahmni-lab-db'] or inventory_hostname in groups['bahmni-erp-db'] or inventory_hostname in groups['pacs-integration-db'] or inventory_hostname in groups['dcm4chee-db']

/sbin/iptables -I INPUT 1 -p tcp --dport  5432 -j ACCEPT -m comment --comment "POSTGRES"

name=postgresql-{{ postgres_version }} enabled=yes state=started

name={{ postgres_user }} role_attr_flags=CREATEDB,NOCREATEROLE,SUPERUSER,REPLICATION

postgres_user is defined and (inventory_hostname in groups['bahmni-lab-db'] or inventory_hostname in groups['bahmni-erp-db'] or inventory_hostname in groups['pacs-integration-db'] or inventory_hostname in groups['dcm4chee-db'])

{{ inventory_hostname in groups['bahmni-lab-db'] or inventory_hostname in groups['bahmni-erp-db'] or inventory_hostname in groups['pacs-integration-db'] or inventory_hostname in groups['dcm4chee-db'] }}

{{ inventory_hostname in groups['bahmni-lab-db-slave'] or inventory_hostname in groups['bahmni-erp-db-slave'] or inventory_hostname in groups['pacs-integration-db-slave'] or inventory_hostname in groups['dcm4chee-db-slave'] }}

path=/var/lib/pgsql/{{ postgres_version }}/data-backup state=absent

mv -f /var/lib/pgsql/{{ postgres_version }}/data /var/lib/pgsql/{{ postgres_version }}/data-backup

sudo -u postgres pg_basebackup -h {{ master_db }} -D /var/lib/pgsql/{{ postgres_version }}/data -U {{ replication_user }} -v -P --xlog-method=stream

src=recovery.conf.j2 dest=/var/lib/pgsql/{{ postgres_version }}/data/recovery.conf mode=644 owner=postgres group=postgres

msg="You will have to reboot machine to have selinux enabled. Reboot and trigger installation again. If you wish to disable selinux, set 'selinux_state' to permissive or disabled in /etc/bahmni-installer/setup.yml"

checkmodule -M -m -o /tmp/bahmni_httpd_home_dir.mod /tmp/bahmni_httpd_home_dir.te

semodule_package -o /tmp/bahmni_httpd_home_dir.pp -m /tmp/bahmni_httpd_home_dir.mod

{{ 'dnf' if stat_dnf3.rc == 0 else 'yum' }} -y install python3; ln -sf /usr/bin/python3 /usr/bin/python creates=/usr/bin/python

not delegate_facts_host | bool or inventory_hostname in groups.get(client_group_name, [])

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} osd set noup

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} osd unset noup

Playbook has complete.
However, note that it will be deprecated in a future release.
You can achieve the same goal using the main playbook with --limit

{{ groups['all'] | difference(groups.get(client_group_name | default('clients'), [])) }}

WARNING: {{ inventory_hostname }} is already using bluestore. Skipping all tasks.

{{ container_binary + ' run --rm --privileged=true --ulimit nofile=1024:4096 --net=host --pid=host --ipc=host -v /dev:/dev -v /etc/ceph:/etc/ceph -v /var/lib/ceph:/var/lib/ceph -v /var/run:/var/run --entrypoint=' if containerized_deployment else '' }}ceph-volume {{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment else '' }}

{{ container_run_cmd }} --cluster {{ cluster }} inventory --format json

blkid "{{ item + 'p' if item is match('/dev/(cciss/c[0-9]d[0-9]|nvme[0-9]n[0-9]){1,2}$') else item }}"1 -s PARTLABEL -o value

{{ container_run_cmd }} --cluster {{ cluster }} simple scan {{ item.item + 'p1' if item.item is match('/dev/(cciss/c[0-9]d[0-9]|nvme[0-9]n[0-9]){1,2}$') else item.item + '1' }} --stdout

{{ container_exec_cmd }} ceph --cluster {{ cluster }} osd out {{ (item.0.stdout | from_json).whoami }}

/var/lib/ceph/osd/{{ cluster }}-{{ (item.0.stdout | from_json).whoami }}

/var/lib/ceph/osd-lockbox/{{ (item.0.stdout | from_json).data.uuid }}

cryptsetup close "{{ (item.0.stdout | from_json).journal.uuid }}"

{{ container_run_cmd }} --cluster {{ cluster }} lvm zap --destroy {{ (item.0.stdout | from_json).data.path }}

{{ container_run_cmd }} --cluster {{ cluster }} lvm zap --destroy {{ (item.0.stdout | from_json).journal.path }}

{{ container_run_cmd }} --cluster {{ cluster }} lvm list --format json

{{ container_exec_cmd }} ceph --cluster {{ cluster }} osd out {{ item }}

ceph-volume@lvm-{{ item.tags['ceph.osd_id'] }}-{{ item.tags['ceph.osd_fsid'] }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} osd down {{ item }}

{{ osd_fsid_list | default([]) + [{'osd_fsid': item.tags['ceph.osd_fsid'], 'destroy': (item.lv_name.startswith('osd-data-') and item.vg_name.startswith('ceph-')) | ternary(true, false), 'device': item.devices[0]}] }}

{{ ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment else None }}

{{ ((osd_tree.stdout | from_json).nodes | selectattr('name', 'match', inventory_hostname) | map(attribute='children') | list) }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} osd purge {{ item }} --yes-i-really-mean-it

{{ (devices + dedicated_devices + ceph_disk_osds_devices | default([])) | unique }}

{{ config_part | default([]) + [item | combine({'db': item.journal})] }}

{{ lvm_volumes | selectattr('journal_vg', 'undefined') | list }}

{{ config_vglv | default([]) + [item | combine({'db': item.journal, 'db_vg': item.journal_vg})] }}

"Exiting lv-teardown playbook, logical volumes were NOT torn down.
 To tear down the logical volumes, either say 'yes' on the prompt or
 or use `-e ireallymeanit=yes` on the command line when
 invoking the playbook"

"Exiting purge-cluster playbook, cluster was NOT purged.
 To purge the cluster, either say 'yes' on the prompt or

ceph-radosgw@rgw.{{ ansible_hostname }}.{{ item.instance_name }}

if [ -d /var/lib/ceph/osd ] ; then ls /var/lib/ceph/osd | sed 's/.*-//' ; fi

blkid -t TYPE=crypto_LUKS -s PARTLABEL -s PARTUUID | grep "ceph.*." | grep -o PARTUUID.* | cut -d '"' -f 2

(grep /var/lib/ceph/osd /proc/mounts || echo -n) | awk '{ print $2 }'

cryptsetup luksDump /dev/disk/by-partuuid/{{ item }} | awk '/Payload offset:/ { print $3 }'

dd if=/dev/zero of=/dev/disk/by-partuuid/{{ item.0 }} bs={{ item.1.stdout }} count={{ item.2.stdout }} oflag=direct

{{ ceph_data_partition_to_erase_path.stdout_lines + ceph_lockbox_partition_to_erase_path.stdout_lines + ceph_block_partition_to_erase_path.stdout_lines + ceph_journal_partition_to_erase_path.stdout_lines + ceph_db_partition_to_erase_path.stdout_lines + ceph_wal_partition_to_erase_path.stdout_lines }}

{{ tmp_resolved_parent_device.results | map(attribute='stdout') | list | unique }}

wipefs --all "{{ item }}"
dd if=/dev/zero of="{{ item }}" bs=1 count=4096

# if the disk passed is a raw device AND the boot system disk
if parted -s /dev/"{{ item }}" print | grep -sq boot; then
  echo "Looks like /dev/{{ item }} has a boot partition,"
  echo "if you want to delete specific partitions point to the partition instead of the raw device"
  echo "Do not use your system disk!"
  exit 1
fi
sgdisk -Z --clear --mbrtogpt -g -- /dev/"{{ item }}"
dd if=/dev/zero of=/dev/"{{ item }}" bs=1M count=200
parted -s /dev/"{{ item }}" mklabel gpt
partprobe /dev/"{{ item }}"
udevadm settle --timeout=600

"Exiting purge-container-cluster playbook, cluster was NOT purged.

echo {{ item.path | basename }} > /sys/bus/rbd/remove_single_major

systemctl list-units | grep 'loaded[[:space:]]\+active' | grep -oE "ceph-osd@([0-9]+).service"

{{ ceph_docker_registry }}/{{ ceph_docker_image }}:{{ ceph_docker_image_tag }}

{{ container_binary }} container prune{% if container_binary == 'docker' %} -f{% endif %}

{{ container_binary }} rmi {{ ceph_docker_registry }}/{{ ceph_docker_image }}:{{ ceph_docker_image_tag }}

"You have aborted the purge of the iSCSI gateway configuration"

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} dashboard iscsi-gateway-list -f json

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} dashboard iscsi-gateway-rm {{ item }}

"Exiting rolling_update.yml playbook, cluster was NOT upgraded.
 To upgrade the cluster, either say 'yes' on the prompt or
 use `-e ireallymeanit=yes` on the command line when

Upgrade of cluster with less than three monitors is not supported.

{{ groups[mon_group_name] | difference([inventory_hostname]) | last }}

inventory_hostname in groups[mgr_group_name] | default([]) or groups[mgr_group_name] | default([]) | length == 0

ceph --cluster "{{ cluster }}" -m "{{ hostvars[groups[mon_group_name][0]]['_current_monitor_address'] }}" -s --format json

(hostvars[inventory_hostname]['ansible_hostname'] in (ceph_health_raw.stdout | default('{}') |  from_json)["quorum_names"] or hostvars[inventory_hostname]['ansible_fqdn'] in (ceph_health_raw.stdout | default('{}') | from_json)["quorum_names"])

{{ container_binary }} exec ceph-mon-{{ ansible_hostname }} ceph --cluster "{{ cluster }}" -m "{{ hostvars[groups[mon_group_name][0]]['_current_monitor_address'] }}" -s --format json

(hostvars[inventory_hostname]['ansible_hostname'] in (ceph_health_raw.stdout | default('{}') | from_json)["quorum_names"] or hostvars[inventory_hostname]['ansible_fqdn'] in (ceph_health_raw.stdout | default('{}') | from_json)["quorum_names"])

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} osd set {{ item }}

systemctl list-units | grep -E "loaded * active" | grep -oE "ceph-osd@([0-9]+).service"

{{ container_binary }} exec ceph-mon-{{ hostvars[groups[mon_group_name][0]]['ansible_hostname'] }}

{{ container_exec_cmd_update_osd|default('') }} ceph --cluster {{ cluster }} -s --format json

(((ceph_health_post.stdout | from_json).pgmap.pgs_by_state | length) > 0) and (((ceph_health_post.stdout | from_json).pgmap.pgs_by_state | selectattr('state_name', 'search', '^active\\+clean') | map(attribute='count') | list | sum) == (ceph_pgs.stdout | from_json).pgmap.num_pgs)

{{ container_exec_cmd_update_osd | default('') }} ceph osd unset {{ item }} --cluster {{ cluster }}

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} fs set {{ cephfs }} max_mds 1

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} fs get {{ cephfs }} -f json

(wait_rank_zero.stdout | from_json).mdsmap.in | length == 1 and (wait_rank_zero.stdout | from_json).mdsmap.in[0]  == 0

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} fs dump -f json

{{ (_mds_active_name.stdout | from_json)['filesystems'][0]['mdsmap']['info'][item.key]['name'] }}

{{ (_mds_active_name.stdout | default('{}') | from_json).filesystems[0]['mdsmap']['info'] | default({}) }}

{{ mds_active_host[0] if mds_active_host is defined else groups.get(mds_group_name)[0] }}

{{ hostvars[mds_active_host[0] if mds_active_host is defined else groups.get(mds_group_name)[0]]['ansible_host'] | default(omit) }}

{{ hostvars[mds_active_host[0] if mds_active_host is defined else groups.get(mds_group_name)[0]]['ansible_port'] | default(omit) }}

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} fs set {{ cephfs }} max_mds {{ mds_max_mds }}

ceph-nfs@{{ ceph_nfs_service_suffix | default(ansible_hostname) }}

{{ container_binary }} exec ceph-mon-{{ hostvars[groups[mon_group_name][0]]['ansible_hostname'] }} ceph osd require-osd-release octopus

{{ container_binary }} exec ceph-mon-{{ hostvars[groups[mon_group_name][0]]['ansible_hostname'] }} ceph mon enable-msgr2

{{ container_exec_cmd_status|default('') }} ceph --cluster {{ cluster }} -s

{{ container_exec_cmd_status|default('') }} ceph --cluster {{ cluster }} versions

{{ container_exec_cmd | default('') }} ceph tell mds.{{ mds_to_kill }} exit

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} -s -f json

Can't remove more mds as it won't satisfy current max_mds setting

((((ceph_status.stdout | from_json)['fsmap']['up'] | int) + ((ceph_status.stdout | from_json)['fsmap']['up:standby'] | int)) - 1) < current_max_mds | int

(ceph_fs_status.stdout | from_json)['standbys'] | map(attribute='name') | list

(mds_to_kill in active_mdss | default([])) or (mds_to_kill in standby_mdss | default([]))

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} fs rm --yes-i-really-mean-it {{ cephfs }}

(ceph_status.stdout | from_json)['fsmap']['up:standby'] | int == 0

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} mgr dump -f json

mgr_to_kill_hostname in (([mgr_dump.stdout | from_json] | map(attribute='active_name') | list) + (mgr_dump.stdout | from_json)['standbys'] | map(attribute='name') | list)

mgr_to_kill_hostname not in (([mgr_dump.stdout | from_json] | map(attribute='active_name') | list) + (mgr_dump.stdout | from_json)['standbys'] | map(attribute='name') | list)

{{ container_binary }} exec ceph-mon-{{ hostvars[mon_host]['ansible_hostname'] }}

{{ container_exec_cmd }} timeout 5 ceph --cluster {{ cluster }} health

{{ container_exec_cmd }} ceph --cluster {{ cluster }} mon remove {{ mon_to_kill_hostname }}

Exiting shrink-osd playbook, no osd(s) was/were removed.. To shrink the cluster, either say 'yes' on the prompt or or use `-e ireallymeanit=yes` on the command line when invoking the playbook

osd_to_kill must be declared Exiting shrink-osd playbook, no OSD(s) was/were removed. On the command line when invoking the playbook, you can use -e osd_to_kill=0,1,2,3 argument.

set_fact container_exec_cmd build docker exec command (containerized)

{{ container_exec_cmd }} ceph --cluster {{ cluster }} osd find {{ item }}

{{ osd_hosts | default([]) + [ [ (item.stdout | from_json).crush_location.host, (item.stdout | from_json).osd_fsid, item.item ] ] }}

{{ _lvm_list | default({}) | combine(item.stdout | from_json) }}

{{ ceph_osd_data_json | default({}) | combine({ item.item.item.2: item.content | b64decode | from_json}) }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} osd out {{ osd_to_kill.replace(',', ' ') }}

/var/lib/ceph/osd-lockbox/{{ ceph_osd_data_json[item.2]['data']['uuid'] }}

lsblk --noheadings --output PKNAME --nodeps "{{ ceph_osd_data_json[item.2]['data']['path'] }}"

{{ ceph_osd_data_json | default({}) | combine({item.item[2]: {'pkname_data': '/dev/' + item.stdout}}, recursive=True) }}

cryptsetup close {{ ceph_osd_data_json[item.2][item.3]['uuid'] }}

{{ container_run_cmd }} lvm zap --destroy {{ ceph_osd_data_json[item.2]['pkname_data'] if item.3 == 'data' else ceph_osd_data_json[item.2][item.3]['path'] }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} osd down {{ osd_to_kill.replace(',', ' ') }}

/var/lib/ceph/bootstrap-rbd-mirror/{{ cluster }}-{{ rbdmirror_to_kill_hostname }}

rgw_to_kill must be declared. Exiting shrink-cluster playbook, no RGW was removed. On the command line when invoking the playbook, you can use "-e rgw_to_kill=ceph.rgw0 argument".  You can only remove a single RGW each time the playbook runs.

Exiting shrink-mon playbook, no monitor was removed. To shrink the cluster, either say 'yes' on the prompt or use '-e ireallymeanit=yes' on the command line when  invoking the playbook

{{ container_exec_cmd | default('') }} timeout 5 ceph --cluster {{ cluster }} health

rgw_to_kill not in (rgw_instances.stdout | from_json).servicemap.services.rgw.daemons.keys() | list

It seems that the rgw instance given is not part of the ceph cluster. Please make sure it is. The rgw instance format is $(hostname}.rgw$(instance number).

(ceph_status.stdout | from_json).servicemap.services.rgw is defined

rgw_to_kill in (ceph_status.stdout | from_json).servicemap.services.rgw.daemons.keys() | list

rgw_to_kill not in (ceph_status.stdout | from_json).servicemap.services.rgw.daemons.keys() | list

{{ container_exec_cmd | default('')}} ceph --cluster {{ cluster }} -s

"Exiting switch-from-non-containerized-to-containerized-ceph-daemons.yml playbook,
 cluster did not switch from non-containerized to containerized ceph daemons.
 To switch from non-containerized to containerized ceph daemons, either say 'yes' on the prompt or

{{ groups['all'] | difference(groups.get(client_group_name, [])) }}

find /var/lib/ceph /etc/ceph -not -( -user {{ ceph_uid }} -or -group {{ ceph_uid }} -) -execdir chown {{ ceph_uid }}:{{ ceph_uid }} {} +

copy mon initial keyring in /etc/ceph to satisfy fetch config task in ceph-container-common

cp /var/lib/ceph/mon/{{ cluster }}-{{ ansible_hostname }}/keyring /etc/ceph/{{ cluster }}.mon.keyring

{{ container_exec_cmd }} ceph --cluster {{ cluster }} -s --format json

hostvars[mon_host]['ansible_hostname'] in (ceph_health_raw.stdout | from_json)["quorum_names"]

systemctl list-units | grep "loaded active" | grep -Eo 'ceph-osd@[0-9]+.service|ceph-volume|ceph\.target'

find /var/lib/ceph/osd {% if dmcrypt | bool %}/var/lib/ceph/osd-lockbox{% endif %} -maxdepth 1 -mindepth 1 -type d

{{ container_binary }} exec ceph-mon-{{ hostvars[groups[mon_group_name][0]]['ansible_hostname'] }} ceph --cluster {{ cluster }} -s --format json

basename $(grep --exclude '*.bak' -R fsid /etc/ceph/ | egrep -o '^[^.]*' | head -n 1)

/etc/ceph/{{ cluster_name.stdout }}-{{ ansible_date_time.iso8601_basic_short }}.conf.bak

devices must be define in host_vars/default.yml or host_vars/{{ ansible_hostname }}.yml

sgdisk --new={{item.1.index}}:0:+{{item.1.size}} "--change-name={{item.1.index}}:ceph {{item.1.type}}" "--typecode={{item.1.index}}:{% if item.1.type=='data' %}{{data_typecode}}{% else %}{{journal_typecode}}{% endif %}" --mbrtogpt -- /dev/{{item.0.device_name}}

item.0.device_name | match('/dev/(cciss/c[0-9]d[0-9]|nvme[0-9]n[0-9]){1,2}$')

/var/lib/ceph/osd/{{ cluster }}-{{ item.1.osd_id }}/journal_uuid

sgdisk --new={{item.item[1].index}}:0:+{{item.item[1].size}} "--change-name={{ item.item[1].index }}:ceph journal"  --typecode={{ item.item[1].index }}:{{ journal_typecode }}  --partition-guid={{ item.item[1].index }}:{{ item.stdout }}  --mbrtogpt -- {{ item.item[0].device_name }}

ceph-osd -i {{ item.item[1].osd_id }} --flush-journal --cluster {{ cluster }}

ln -sf /dev/disk/by-partuuid/{{ item.stdout }} /var/lib/ceph/osd/{{ cluster }}-{{ item.item[1].osd_id }}/journal

echo {{ item.stdout }} > /var/lib/ceph/osd/{{ cluster }}-{{ item.item[1].osd_id }}/journal_uuid

ceph-osd -i {{ item.item[1].osd_id }} --mkjournal --cluster {{ cluster }}

please enter the target hostname which to recover osds after ssd journal failure

cat "/var/lib/ceph/osd/{{ cluster }}-{{ item.1.osd_id }}/journal_uuid"

Exiting replace-osd playbook, no osd(s) was/were replaced.. To replace the osd(s), either say 'yes' on the prompt or or use `-e ireallymeanit=yes` on the command line when invoking the playbook

osd_to_replace must be declared Exiting replace-osd playbook, no OSD(s) was/were replaced. On the command line when invoking the playbook, you can use -e osd_to_replace=0,1,2,3 argument.

docker exec ceph-mon-{{ hostvars[groups[mon_group_name][0]]['ansible_hostname'] }}

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} osd find {{ item }}

{{ osd_hosts | default([]) + [ (item.stdout | from_json).crush_location.host ] }}

The Ceph admin key is not present on the OSD node, please add it and remove it after the playbook is done.

docker run --privileged=true -v /dev:/dev --entrypoint /usr/sbin/ceph-disk {{ ceph_docker_registry}}/{{ ceph_docker_image }}:{{ ceph_docker_image_tag }} list | awk  -v pattern=osd.{{ item.1 }} '$0 ~ pattern {print $1}'

docker run --privileged=true -v /dev:/dev --entrypoint /usr/sbin/ceph-disk {{ ceph_docker_registry}}/{{ ceph_docker_image }}:{{ ceph_docker_image_tag }} zap {{ item.1 }}

ceph-disk destroy --cluster {{ cluster }} --destroy-by-id {{ item.1 }} --zap

ceph-disk prepare {{ item.1 }}  --osd-id {{ item.2 }} --osd-uuid $(uuidgen)

docker run --privileged=true -v /dev:/dev --entrypoint /usr/sbin/ceph-disk {{ ceph_docker_registry}}/{{ ceph_docker_image }}:{{ ceph_docker_image_tag }} prepare {{ item.1 }}

docker run --privileged=true -v /dev:/dev --entrypoint /usr/sbin/ceph-disk {{ ceph_docker_registry}}/{{ ceph_docker_image }}:{{ ceph_docker_image_tag }} activate {{ item.1 }}1

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} -s

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} osd tree

{{ keys_tmp|default([]) + [ { 'key': item.key, 'name': item.name, 'caps': { 'mon': item.mon_cap, 'osd': item.osd_cap|default(''), 'mds': item.mds_cap|default(''), 'mgr': item.mgr_cap|default('') } , 'mode': item.mode } ] }}

(hostvars[item]['ansible_architecture'] == 'x86_64') or (not containerized_deployment | bool)

{{ groups[mon_group_name][0] if groups.get(mon_group_name, []) | length > 0 else inventory_hostname }}

{{ True if groups.get(mon_group_name, []) | length > 0 else copy_admin_key }}

{{ ceph_conf_key_directory }}/{{ cluster }}.{{ item.name }}.keyring

inventory_hostname == groups.get('_filtered_clients', []) | first

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} osd pool get {{ item.name }} size

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} osd pool create {{ item.0.name }} {{ item.0.pg_num | default(osd_pool_default_pg_num) if not item.0.pg_autoscale_mode | default(False) | bool else 16 }} {{ item.0.pgp_num | default(item.0.pg_num) | default(osd_pool_default_pg_num) if not item.0.pg_autoscale_mode | default(False) | bool else '' }} {%- if item.0.type | default(1) | int == 1 or item.0.type | default('replicated') == 'replicated' %} replicated {{ item.0.rule_name | default(osd_pool_default_crush_rule) }} {{ item.0.expected_num_objects | default(0) }} {%- else %} erasure {{ item.0.erasure_profile }} {%- endif %}

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} osd pool set {{ item.name }} target_size_ratio {{ item.target_size_ratio }}

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} osd pool set {{ item.name }} pg_autoscale_mode {{ item.pg_autoscale_mode | default(False) | ternary('on', 'warn') }}

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} osd pool set {{ item.name }} size {{ item.size | default(osd_pool_default_size) }} {{ '--yes-i-really-mean-it' if item.size | default(osd_pool_default_size) | int == 1 else '' }}

item.size | default(osd_pool_default_size) != ceph_osd_pool_default_size

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} osd pool set {{ item.name }} min_size {{ item.min_size | default(osd_pool_default_min_size) }}

(item.min_size | default(osd_pool_default_min_size))|int > ceph_osd_pool_default_min_size

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} osd pool application enable {{ item.name }} {{ item.application }}

{{ hostvars[groups['_filtered_clients'][0]]['slurp_client_keys']['results'] }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} auth get {{ item.name }}

{{ etc_default_ceph.stat.isdir | ternary('/etc/default/ceph/ceph', '/etc/default/ceph') }}

TCMALLOC_MAX_TOTAL_THREAD_CACHE_BYTES={{ ceph_tcmalloc_max_total_thread_cache }}

{{ ansible_dir }}/rundep_installer.sh {{ rundep_location.path }}

deb {{ ceph_stable_repo }} {{ ceph_stable_distro_source | default(ansible_distribution_release) }} main

deb {{ ceph_custom_repo }} {{ ansible_distribution_release }} main

https://shaman.ceph.com/api/repos/ceph/{{ ceph_dev_branch }}/{{ ceph_dev_sha1 }}/{{ ansible_distribution | lower }}/{{ ansible_distribution_release }}/repo

deb {{ ceph_stable_repo_uca }} {{ ceph_stable_release_uca }} main

{{ (upgrade_ceph_packages|bool) | ternary('latest','present') }}

{{ ceph_stable_release_uca | default('') if ceph_origin == 'repository' and ceph_repository == 'uca' else '' }}{{ ansible_distribution_release ~ '-backports' if ceph_origin == 'distro' and ceph_use_distro_backports else '' }}

rhceph-{{ ceph_rhcs_version }}-mon-for-rhel-8-{{ ansible_architecture }}-rpms

(mon_group_name in group_names or mgr_group_name in group_names)

rhceph-{{ ceph_rhcs_version }}-osd-for-rhel-8-{{ ansible_architecture }}-rpms

rhceph-{{ ceph_rhcs_version }}-tools-for-rhel-8-{{ ansible_architecture }}-rpms

(rgw_group_name in group_names or mds_group_name in group_names or nfs_group_name in group_names or iscsi_gw_group_name in group_names or client_group_name in group_names)

deb {{ ceph_rhcs_cdn_debian_repo }}{{ ceph_rhcs_cdn_debian_repo_version }}/{{ item.repo }} {{ ceph_stable_distro_source | default(ansible_distribution_release) }} main

cp -r {{ ceph_rhcs_mount_path }}/* {{ ceph_rhcs_repository_path }}

{{ ceph_rhcs_repository_path+'/README' if not rolling_update else 'dummy' }}

deb file://{{ ceph_rhcs_repository_path }}/{{ item }} {{ ansible_distribution_release }} main

{{ ceph_mirror }}/rpm-{{ ceph_stable_release }}/{{ ceph_stable_redhat_distro }}/$basearch

{{ ceph_mirror }}/rpm-{{ ceph_stable_release }}/{{ ceph_stable_redhat_distro }}/noarch

https://shaman.ceph.com/api/repos/ceph/{{ ceph_dev_branch }}/{{ ceph_dev_sha1 }}/centos/{{ ansible_distribution_major_version }}/repo

run 'ceph-volume lvm batch --report' to see how many osds are to be created

set_fact num_osds from the output of 'ceph-volume lvm batch --report'

{{ ((lvm_batch_report.stdout | default('{}') | from_json).osds | default([]) | length | int) + (_rejected_devices | default([]) | length | int) }}

(lvm_batch_report.stdout | default('{}') | from_json).changed | default(true) | bool

run 'ceph-volume lvm list' to see how many osds have already been created

not (lvm_batch_report.stdout | default('{}') | from_json).changed | default(false) | bool

{{ lvm_list.stdout | default('{}') | from_json | length | int }}

((inventory_hostname in groups.get(mon_group_name, [])) or (groups.get(nfs_group_name, []) | length > 0) and inventory_hostname == groups.get(nfs_group_name, [])[0])

{{ container_binary }} inspect {{ ceph_mon_container_stat.stdout }}

{{ container_binary }} inspect {{ ceph_osd_container_stat.stdout }}

{{ container_binary }} inspect {{ ceph_mds_container_stat.stdout }}

{{ container_binary }} inspect {{ ceph_rgw_container_stat.stdout }}

{{ container_binary }} inspect {{ ceph_mgr_container_stat.stdout }}

{{ container_binary }} inspect {{ ceph_rbd_mirror_container_stat.stdout }}

ceph_rbd_mirror_container_stat.get('stdout_lines', [])|length != 0

{{ container_binary }} inspect {{ ceph_nfs_container_stat.stdout }}

{{ container_binary }} inspect {{ (ceph_mon_inspect.stdout | from_json)[0].Image }}

{{ container_binary }} inspect {{ (ceph_osd_inspect.stdout | from_json)[0].Image }}

{{ container_binary }} inspect {{ (ceph_rgw_inspect.stdout | from_json)[0].Image }}

{{ container_binary }} inspect {{ (ceph_mds_inspect.stdout | from_json)[0].Image }}

{{ container_binary }} inspect {{ (ceph_mgr_inspect.stdout | from_json)[0].Image }}

{{ container_binary }} inspect {{ (ceph_rbd_mirror_inspect.stdout | from_json)[0].Image }}

{{ container_binary }} inspect {{ (ceph_nfs_inspect.stdout | from_json)[0].Image }}

{{ (ceph_mon_container_inspect_before_pull.stdout | from_json)[0].RepoDigests[0].split('@')[1] }}

{{ (ceph_osd_container_inspect_before_pull.stdout | from_json)[0].RepoDigests[0].split('@')[1] }}

{{ (ceph_mds_container_inspect_before_pull.stdout | from_json)[0].RepoDigests[0].split('@')[1] }}

{{ (ceph_rgw_container_inspect_before_pull.stdout | from_json)[0].RepoDigests[0].split('@')[1] }}

{{ (ceph_mgr_container_inspect_before_pull.stdout | from_json)[0].RepoDigests[0].split('@')[1] }}

{{ (ceph_rbd_mirror_container_inspect_before_pull.stdout | from_json)[0].RepoDigests[0].split('@')[1] }}

{{ (ceph_nfs_container_inspect_before_pull.stdout | from_json)[0].RepoDigests[0].split('@')[1] }}

{{ timeout_command }} {{ container_binary }} pull {{ ceph_docker_registry }}/{{ ceph_docker_image }}:{{ ceph_docker_image_tag }}

(ceph_docker_dev_image is undefined or not ceph_docker_dev_image | bool)

{{ container_binary }} inspect {{ ceph_docker_registry }}/{{ ceph_docker_image }}:{{ ceph_docker_image_tag }}

{{ (image_inspect_after_pull.stdout | from_json)[0].RepoDigests[0].split('@')[1] }}

{{ ceph_mon_image_repodigest_before_pulling != image_repodigest_after_pulling }}

ceph_mon_image_repodigest_before_pulling != image_repodigest_after_pulling

{{ ceph_osd_image_repodigest_before_pulling != image_repodigest_after_pulling }}

ceph_osd_image_repodigest_before_pulling != image_repodigest_after_pulling

{{ ceph_mds_image_repodigest_before_pulling != image_repodigest_after_pulling }}

ceph_mds_image_repodigest_before_pulling != image_repodigest_after_pulling

{{ ceph_rgw_image_repodigest_before_pulling != image_repodigest_after_pulling }}

ceph_rgw_image_repodigest_before_pulling != image_repodigest_after_pulling

{{ ceph_mgr_image_repodigest_before_pulling != image_repodigest_after_pulling }}

ceph_mgr_image_repodigest_before_pulling != image_repodigest_after_pulling

{{ ceph_rbd_mirror_image_repodigest_before_pulling != image_repodigest_after_pulling }}

{{ ceph_nfs_image_repodigest_before_pulling != image_repodigest_after_pulling }}

ceph_nfs_image_repodigest_before_pulling != image_repodigest_after_pulling

{{ container_binary }} save -o "/tmp/{{ ceph_docker_username }}-{{ ceph_docker_imagename }}-{{ ceph_docker_image_tag }}.tar" "{{ ceph_docker_username }}/{{ ceph_docker_imagename }}:{{ ceph_docker_image_tag }}"

/tmp/{{ ceph_docker_username }}-{{ ceph_docker_imagename }}-{{ ceph_docker_image_tag }}.tar

(ceph_docker_dev_image is defined and ceph_docker_dev_image | bool)

{{ container_binary }} load -i /tmp/{{ ceph_docker_username }}-{{ ceph_docker_imagename }}-{{ ceph_docker_image_tag }}.tar

{{ container_binary }} run --rm --net=host --entrypoint /usr/bin/ceph {{ ceph_client_docker_registry }}/{{ ceph_client_docker_image }}:{{ ceph_client_docker_image_tag }} --version

{{ container_binary }} login -u {{ ceph_docker_registry_username }} -p {{ ceph_docker_registry_password }} {{ ceph_docker_registry }}

https://download.docker.com/linux/{{ ansible_distribution | lower }}/gpg

deb https://download.docker.com/linux/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} stable

{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml

{{ container_exec_cmd }} ceph --cluster {{ cluster }} config set mgr mgr/dashboard/ssl false

{{ container_exec_cmd }} ceph --cluster {{ cluster }} config set mgr mgr/dashboard/ssl true

test -f /etc/ceph/ceph-dashboard.key -a -f /etc/ceph/ceph-dashboard.crt || \
openssl req -new -nodes -x509 -subj '/O=IT/CN=ceph-dashboard' -days 3650 -keyout /etc/ceph/ceph-dashboard.key -out /etc/ceph/ceph-dashboard.crt -extensions v3_ca

{{ container_exec_cmd }} ceph --cluster {{ cluster }} config-key set mgr/dashboard/crt -i /etc/ceph/ceph-dashboard.crt

{{ container_exec_cmd }} ceph --cluster {{ cluster }} config-key set mgr/dashboard/key -i /etc/ceph/ceph-dashboard.key

{{ container_exec_cmd }} ceph --cluster {{ cluster }} config set mgr mgr/dashboard/server_port {{ dashboard_port }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} config set mgr mgr/dashboard/ssl_server_port {{ dashboard_port }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} mgr module disable dashboard

{{ container_exec_cmd }} ceph --cluster {{ cluster }} mgr module enable dashboard

if {{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard ac-user-show {{ dashboard_admin_user | quote }}; then
  {{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard ac-user-set-password {{ dashboard_admin_user | quote }} {{ dashboard_admin_password | quote }}
else
  {{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard ac-user-create {{ dashboard_admin_user | quote }} {{ dashboard_admin_password | quote }} administrator
fi

{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-grafana-api-username {{ grafana_admin_user }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-grafana-api-password {{ grafana_admin_password }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-alertmanager-api-host {{ dashboard_protocol }}://{{ grafana_server_addrs | first }}:{{ alertmanager_port }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-prometheus-api-host {{ dashboard_protocol }}://{{ grafana_server_addrs | first }}:{{ prometheus_port }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-grafana-api-url {{ dashboard_protocol }}://{{ dashboard_frontend_vip }}:{{ grafana_port }}

dashboard_frontend_vip is defined and dashboard_frontend_vip |length > 0

timeout --foreground -s KILL 20 {{ container_exec_cmd }} radosgw-admin --cluster {{ cluster }} user info --uid={{ dashboard_rgw_api_user_id }}

timeout --foreground -s KILL 20 {{ container_exec_cmd }} radosgw-admin --cluster {{ cluster }} user create --uid={{ dashboard_rgw_api_user_id }} --display-name='Ceph dashboard' --system

{{ (create_rgw_user.stdout | default(get_rgw_user.stdout) | from_json)['keys'][0]['access_key'] }}

{{ (create_rgw_user.stdout | default(get_rgw_user.stdout) | from_json)['keys'][0]['secret_key'] }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-rgw-api-user-id {{ dashboard_rgw_api_user_id }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-rgw-api-access-key {{ rgw_access_key }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-rgw-api-secret-key {{ rgw_secret_key }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-rgw-api-host {{ hostvars[groups[rgw_group_name][0]]['rgw_instances'][0]['radosgw_address'] }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-rgw-api-port {{ hostvars[groups[rgw_group_name][0]]['rgw_instances'][0]['radosgw_frontend_port'] }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-rgw-api-scheme {{ 'https' if radosgw_frontend_ssl_certificate else 'http' }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-rgw-api-admin-resource {{ dashboard_rgw_api_admin_resource }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-rgw-api-ssl-verify False

{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-iscsi-api-ssl-verification false

{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard iscsi-gateway-add {{ 'https' if hostvars[item]['api_secure'] | default(false) | bool else 'http' }}://{{ hostvars[item]['api_user'] | default('admin') }}:{{ hostvars[item]['api_password'] | default('admin') }}@{{ hostvars[item]['ansible_all_ipv4_addresses'] | ips_in_ranges(public_network.split(',')) | first }}:{{ hostvars[item]['api_port'] | default(5000) }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard iscsi-gateway-add {{ 'https' if hostvars[item]['api_secure'] | default(false) | bool else 'http' }}://{{ hostvars[item]['api_user'] | default('admin') }}:{{ hostvars[item]['api_password'] | default('admin') }}@{{ hostvars[item]['ansible_all_ipv6_addresses'] | ips_in_ranges(public_network.split(',')) | last | ipwrap }}:{{ hostvars[item]['api_port'] | default(5000) }}

{{ hostvars[dashboard_backend]['ansible_all_ipv4_addresses'] | ips_in_ranges(public_network.split(',')) | first }}

{{ hostvars[dashboard_backend]['ansible_all_ipv6_addresses'] | ips_in_ranges(public_network.split(',')) | last | ipwrap }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} config set mgr mgr/dashboard/{{ hostvars[dashboard_backend]['ansible_hostname'] }}/server_addr {{ mgr_server_addr }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard set-grafana-api-url {{ dashboard_protocol }}://{{ grafana_server_addr }}:{{ grafana_port }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} dashboard grafana dashboards update

The dashboard has been deployed! You can access your dashboard web UI at {{ dashboard_protocol }}://{{ ansible_fqdn }}:{{ dashboard_port }}/ as an '{{ dashboard_admin_user }}' user with '{{ dashboard_admin_password }}' password.

{{ 'podman' if (podman_binary.stat.exists and ansible_distribution == 'Fedora') or (ansible_os_family == 'RedHat' and ansible_distribution_major_version == '8') else 'docker' }}

{{ container_binary }} exec ceph-mon-{{ hostvars[groups[mon_group_name][0]]['ansible_hostname'] if not rolling_update else hostvars[mon_host | default(groups[mon_group_name][0])]['ansible_hostname'] }}

{{ container_binary }} ps -q --filter name=ceph-mon-{{ hostvars[item]['ansible_hostname'] }}

stat --printf=%n {{ rbd_client_admin_socket_path }}/{{ cluster }}-mon*.asok

{{ container_binary }} exec ceph-mon-{{ hostvars[groups[mon_group_name][0] if running_mon is undefined else running_mon]['ansible_hostname'] }}

{{ timeout_command }} {{ _container_exec_cmd | default('') }} ceph --cluster {{ cluster }} -s -f json

{{ groups[mon_group_name][0] if running_mon is undefined else running_mon }}

{{ timeout_command }} {{ container_exec_cmd }} ceph --admin-daemon /var/run/ceph/{{ cluster }}-mon.{{ hostvars[mon_host | default(groups[mon_group_name][0])]['ansible_hostname'] }}.asok config get fsid

{{ hostvars[groups[mon_group_name][0]]['discovered_interpreter_python'] }} -c 'import uuid; print(str(uuid.uuid4()))'

{{ (devices | default([]) + [ item.key | regex_replace('^', '/dev/') ]) | unique }}

{% set _value = ansible_hostname -%} {% for key in (ceph_current_status['servicemap']['services']['rgw']['daemons'] | list) -%} {% if key == ansible_fqdn -%} {% set _value = key -%} {% endif -%} {% endfor -%} {{ _value }}

inventory_hostname in groups.get(rgw_group_name, []) or inventory_hostname in groups.get(nfs_group_name, [])

{{ ceph_conf_overrides.get('global', {}).get('osd_pool_default_pg_num', ceph_osd_pool_default_pg_num) }}

{{ ceph_conf_overrides.get('global', {}).get('osd_pool_default_size', ceph_osd_pool_default_size) }}

{{ ceph_conf_overrides.get('global', {}).get('osd_pool_default_min_size', ceph_osd_pool_default_min_size) }}

{% if crush_rule_variable.rc == 0 %}{{ crush_rule_variable.stdout.split(' = ')[1] }}{% else %}{{ ceph_osd_pool_default_crush_rule }}{% endif %}

{{ (gateway_ip_list  == '0.0.0.0' and gateway_iqn | length == 0 and client_connections | length == 0 and rbd_devices | length == 0) | bool | ternary(true, false) }}

{{ hostvars[inventory_hostname]['ansible_all_ipv4_addresses'] | ips_in_ranges(public_network.split(',')) | first }}

{{ hostvars[inventory_hostname]['ansible_all_ipv6_addresses'] | ips_in_ranges(public_network.split(',')) | last | ipwrap }}

{{ (grafana_server_addrs | default([]) + [hostvars[item]['ansible_all_ipv4_addresses'] | ips_in_ranges(public_network.split(',')) | first]) | unique }}

{{ (grafana_server_addrs | default([]) + [hostvars[item]['ansible_all_ipv6_addresses'] | ips_in_ranges(public_network.split(',')) | last | ipwrap]) | unique }}

{{ _monitor_addresses | default([]) + [{ 'name': item, 'addr': hostvars[item]['ansible_all_ipv4_addresses'] | ips_in_ranges(hostvars[item]['monitor_address_block'].split(',')) | first }] }}

item not in _monitor_addresses | default([]) | selectattr('name', 'defined') |  map(attribute='name') | list

{{ _monitor_addresses | default([]) + [{ 'name': item, 'addr': hostvars[item]['ansible_all_ipv6_addresses'] | ips_in_ranges(hostvars[item]['monitor_address_block'].split(',')) | last | ipwrap }] }}

{{ _monitor_addresses | default([]) + [{ 'name': item, 'addr': hostvars[item]['monitor_address'] | ipwrap}] }}

item not in _monitor_addresses | default([]) | selectattr('name', 'defined') | map(attribute='name') | list

{{ _monitor_addresses | default([]) + [{ 'name': item, 'addr': hostvars[item]['ansible_' + (hostvars[item]['monitor_interface']|replace('-', '_'))][ip_version]['address'] | ipwrap }]  }}

hostvars[item]['monitor_address_block'] | default('subnet')  == 'subnet'

hostvars[item]['monitor_address'] | default('x.x.x.x') == 'x.x.x.x'

hostvars[item]['monitor_interface'] | default('interface') != 'interface'

{{ _monitor_addresses | default([]) + [{ 'name': item, 'addr': hostvars[item]['ansible_' + (hostvars[item]['monitor_interface']|replace('-', '_'))][ip_version][0]['address'] | ipwrap }] }}

{{ hostvars[inventory_hostname]['ansible_all_ipv4_addresses'] | ips_in_ranges(hostvars[inventory_hostname]['radosgw_address_block'].split(',')) | first }}

{{ hostvars[inventory_hostname]['ansible_all_ipv6_addresses'] | ips_in_ranges(hostvars[inventory_hostname]['radosgw_address_block'].split(',')) | last | ipwrap }}

{{ hostvars[inventory_hostname][_interface][ip_version]['address'] }}

{{ hostvars[inventory_hostname][_interface][ip_version][0]['address'] }}

{{ rgw_instances|default([]) | union([{'instance_name': 'rgw' + item|string, 'radosgw_address': _radosgw_address, 'radosgw_frontend_port': radosgw_frontend_port|int + item|int }]) }}

{{ rgw_instances|default([]) | union([{'instance_name': 'rgw' + item | string, 'radosgw_address': _radosgw_address, 'radosgw_frontend_port': radosgw_frontend_port | int, 'rgw_realm': rgw_realm | string, 'rgw_zonegroup': rgw_zonegroup | string, 'rgw_zone': rgw_zone | string, 'system_access_key': system_access_key, 'system_secret_key': system_secret_key, 'rgw_zone_user': rgw_zone_user, 'rgw_zone_user_display_name': rgw_zone_user_display_name, 'endpoint': (rgw_pull_proto + '://' + rgw_pullhost + ':' + rgw_pull_port | string) if not rgw_zonemaster | bool and rgw_zonesecondary | bool else omit }]) }}

{{ rgw_instances_all | default([]) | union([item.1 | combine({"host": item.0})]) }}

{{ grafana_server_addr if ip_version == "ipv4" else grafana_server_addr[1:-1] }}

https://raw.githubusercontent.com/ceph/ceph/{{ grafana_dashboard_version }}/monitoring/grafana/dashboards/{{ item }}

test -f /etc/grafana/ceph-dashboard.key -a -f /etc/grafana/ceph-dashboard.crt || \
(openssl req -new -nodes -x509 -subj '/O=IT/CN=ceph-grafana' -days 3650 -keyout /etc/grafana/ceph-dashboard.key -out /etc/grafana/ceph-dashboard.crt -extensions v3_ca && \
chown {{ grafana_uid }}:{{ grafana_uid }} /etc/grafana/ceph-dashboard.key /etc/grafana/ceph-dashboard.crt)

{{ container_binary }} ps -q --filter='name=ceph-mon-{{ ansible_hostname }}'

{{ container_binary }} ps -q --filter='name=ceph-mds-{{ ansible_hostname }}'

{{ container_binary }} ps -q --filter='name=ceph-rgw-{{ ansible_hostname }}'

{{ container_binary }} ps -q --filter='name=ceph-mgr-{{ ansible_hostname }}'

{{ container_binary }} ps -q --filter='name=ceph-rbd-mirror-{{ ansible_hostname }}'

{{ container_binary }} ps -q --filter='name=ceph-nfs-{{ ceph_nfs_service_suffix | default(ansible_hostname) }}'

stat --printf=%n {{ rbd_client_admin_socket_path }}/{{ cluster }}-osd*.asok

stat --printf=%n {{ rbd_client_admin_socket_path }}/{{ cluster }}-mds*.asok

stat --printf=%n {{ rbd_client_admin_socket_path }}/{{ cluster }}-client.rgw*.asok

stat --printf=%n {{ rbd_client_admin_socket_path }}/{{ cluster }}-mgr*.asok

stat --printf=%n {{ rbd_client_admin_socket_path }}/{{ cluster }}-client.rbd-mirror*.asok

{{ hostvars[groups[mon_group_name][0]]['container_exec_cmd'] | default('') }} ceph --cluster {{ cluster }} osd unset noup

hostvars[item]['handler_rbd_mirror_status'] | default(False) | bool

hostvars[item]['_rbdmirror_handler_called'] | default(False) | bool

hostvars[item]['_rbd_target_api_handler_called'] | default(False) | bool

hostvars[item]['_rbd_target_gw_handler_called'] | default(False) | bool

hostvars[item]['_tcmu_runner_handler_called'] | default(False) | bool

{{ (mon_socket_stat.get('rc') == 0) if not containerized_deployment | bool else (ceph_mon_container_stat.get('rc') == 0 and ceph_mon_container_stat.get('stdout_lines', []) | length != 0) }}

{{ (osd_socket_stat.get('rc') == 0 and ceph_current_status.fsid is defined) if not containerized_deployment | bool else (ceph_osd_container_stat.get('rc') == 0 and ceph_osd_container_stat.get('stdout_lines', []) | length != 0) }}

{{ (mds_socket_stat.get('rc') == 0) if not containerized_deployment | bool else (ceph_mds_container_stat.get('rc') == 0 and ceph_mds_container_stat.get('stdout_lines', []) | length != 0) }}

{{ (rgw_socket_stat.get('rc') == 0) if not containerized_deployment | bool else (ceph_rgw_container_stat.get('rc') == 0 and ceph_rgw_container_stat.get('stdout_lines', []) | length != 0) }}

{{ (nfs_socket_stat.get('rc') == 0) if not containerized_deployment | bool else (ceph_nfs_container_stat.get('rc') == 0 and ceph_nfs_container_stat.get('stdout_lines', []) | length != 0) }}

{{ (rbd_mirror_socket_stat.get('rc') == 0) if not containerized_deployment | bool else (ceph_rbd_mirror_container_stat.get('rc') == 0 and ceph_rbd_mirror_container_stat.get('stdout_lines', []) | length != 0) }}

{{ (mgr_socket_stat.get('rc') == 0) if not containerized_deployment | bool else (ceph_mgr_container_stat.get('rc') == 0 and ceph_mgr_container_stat.get('stdout_lines', []) | length != 0) }}

{{ public_network.split(',') | union(cluster_network.split(',')) }}

{{ trusted_ip_list }},{{ hostvars[item]["ansible_all_ipv4_addresses"] | ips_in_ranges(public_network.split(",")) | first }}

{{ trusted_ip_list }},{{ hostvars[item]["ansible_all_ipv6_addresses"] | ips_in_ranges(public_network.split(",")) | last }}

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} osd pool ls --format json

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} osd pool create {{ iscsi_pool_name }} {{ osd_pool_default_pg_num }}

{{ container_exec_cmd }} ceph --connect-timeout 5 --cluster {{ cluster }} osd pool application enable {{ iscsi_pool_name }} rbd

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} osd pool set {{ iscsi_pool_name }} size {{ iscsi_pool_size | default(osd_pool_default_size) }} {{ '--yes-i-really-mean-it' if iscsi_pool_size | default(osd_pool_default_size) | int == 1 else '' }}

iscsi_pool_size | default(osd_pool_default_size) != ceph_osd_pool_default_size

{{ container_exec_cmd }} ceph --cluster {{ cluster }} config get iscsi/ssl/{{ item }}

{{ crt_files_exist.results | selectattr('rc', 'equalto', 0) | map(attribute='rc') | list | length != crt_files | length }}

openssl req -newkey rsa:2048 -nodes -keyout {{ iscsi_ssl_tmp_dir.path }}/iscsi-gateway.key
 -x509 -days 365 -out {{ iscsi_ssl_tmp_dir.path }}/iscsi-gateway.crt
 -subj "/C=US/ST=./L=./O=RedHat/OU=Linux/CN={{ ansible_hostname }}"

cat {{ iscsi_ssl_tmp_dir.path }}/iscsi-gateway.crt {{ iscsi_ssl_tmp_dir.path }}/iscsi-gateway.key > {{ iscsi_ssl_tmp_dir.path }}/iscsi-gateway.pem

openssl x509 -inform pem -in {{ iscsi_ssl_tmp_dir.path }}/iscsi-gateway.pem -pubkey -noout > {{ iscsi_ssl_tmp_dir.path }}/iscsi-gateway-pub.key

{{ container_exec_cmd }} ceph --cluster {{ cluster }} config-key put iscsi/ssl/{{ item.item }} {{ item.content }}

{{ crt_files_exist.results if not crt_files_missing else iscsi_ssl_files_content.results }}

https://shaman.ceph.com/api/repos/{{ item }}/master/latest/{{ ansible_distribution | lower }}/{{ ansible_distribution_major_version }}/repo

https://download.ceph.com/ceph-iscsi/{{ "3" if use_new_ceph_iscsi | bool else "2" }}/rpm/el{{ ansible_distribution_major_version }}/ceph-iscsi.repo

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} auth get {{ item.name }}

{{ container_binary }} exec ceph-mds-{{ ansible_hostname }} sh -c 'stat /var/run/ceph/{{ cluster }}-mds.{{ ansible_hostname }}.asok || stat /var/run/ceph/{{ cluster }}-mds.{{ ansible_fqdn }}.asok'

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} osd pool ls

osd_pool_ls.stdout_lines | intersect(cephfs_pool_names) | length > 0

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} osd pool create {{ item.name }} {{ item.pg_num | default(osd_pool_default_pg_num) if not item.pg_autoscale_mode | default(False) | bool else 16 }} {{ item.pgp_num | default(item.pg_num) | default(osd_pool_default_pg_num) if not item.pg_autoscale_mode | default(False) | bool else '' }} {%- if item.type | default(1) | int == 1 or item.type | default('replicated') == 'replicated' %} replicated {{ item.rule_name | default(osd_pool_default_crush_rule) }} {{ item.expected_num_objects | default(0) }} {%- else %} erasure {{ item.erasure_profile }} {%- endif %}

{{ hostvars[groups[mon_group_name][0]]['container_exec_cmd'] | default('') }} ceph --cluster {{ cluster }} osd pool set {{ item.name }} target_size_ratio {{ item.target_size_ratio }}

{{ hostvars[groups[mon_group_name][0]]['container_exec_cmd'] | default('') }} ceph --cluster {{ cluster }} osd pool set {{ item.name }} pg_autoscale_mode {{ item.pg_autoscale_mode | default(False) | ternary('on', 'warn') }}

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} fs get {{ cephfs }}

{{ container_exec_cmd | default('') }} ceph --cluster {{ cluster }} fs new {{ cephfs }} {{ cephfs_metadata_pool.name }} {{ cephfs_data_pool.name }}

ceph --cluster {{ cluster }} --name client.bootstrap-mds --keyring /var/lib/ceph/bootstrap-mds/{{ cluster }}.keyring auth get-or-create mds.{{ mds_name }} osd 'allow rwx' mds 'allow' mon 'allow profile mds' -o /var/lib/ceph/mds/{{ cluster }}-{{ mds_name }}/keyring

{{ _container_exec_cmd | default('') }} ceph --cluster {{ cluster }} auth get {{ item.name }}

{{ container_binary }} exec ceph-mon-{{ hostvars[item]['ansible_hostname'] }}

((groups[mgr_group_name] | default([]) | length == 0 and inventory_hostname == groups[mon_group_name] | last) or (groups[mgr_group_name] | default([]) | length > 0 and inventory_hostname == groups[mgr_group_name] | last))

{{ (ceph_mgr_modules + [ 'dashboard', 'prometheus' ]) | unique }}

{{ hostvars[groups[mon_group_name][0]]['container_exec_cmd'] | default('') }} ceph --cluster {{ cluster }} mgr dump -f json

{{ hostvars[groups[mon_group_name][0]]['container_exec_cmd'] | default('') }} ceph --cluster {{ cluster }} --format json mgr module ls

{% if _ceph_mgr_modules.disabled_modules | length == 0 %}[]{% elif _ceph_mgr_modules.disabled_modules[0] | type_debug != 'dict' %}{{ _ceph_mgr_modules['disabled_modules'] }}{% else %}{{ _ceph_mgr_modules['disabled_modules'] | map(attribute='name') | list }}{% endif %}

{{ hostvars[groups[mon_group_name][0]]['container_exec_cmd'] | default('') }} ceph --cluster {{ cluster }} mgr module disable {{ item }}

{{ hostvars[groups[mon_group_name][0]]['container_exec_cmd'] | default('') }} ceph --cluster {{ cluster }} mgr module enable {{ item }}

(item in _disabled_ceph_mgr_modules or _disabled_ceph_mgr_modules == [])

{{ ceph_stable_release_uca | default('') if ceph_origin == 'repository' and ceph_repository == 'uca' else ''}}{{ ansible_distribution_release ~ '-backports' if ceph_origin == 'distro' and ceph_use_distro_backports else '' }}

{{ container_exec_cmd }} ceph --cluster {{ cluster }} daemon mon.{{ ansible_hostname }} mon_status --format json

(ceph_health_raw.stdout | length > 0) and (ceph_health_raw.stdout | default('{}') | from_json)['state'] in ['leader', 'peon']

{{ _container_exec_cmd | default('') }} ceph --cluster {{ cluster }} --name mon. -k /var/lib/ceph/mon/{{ cluster }}-{{ hostvars[groups[mon_group_name][0] if running_mon is undefined else running_mon]['ansible_hostname'] }}/keyring auth get-key mon.

{{ hostvars[groups[mon_group_name][0] if running_mon is undefined else running_mon]['discovered_interpreter_python'] }} -c "import os ; import struct ; import time; import base64 ; key = os.urandom(16) ; header = struct.pack('<hiih',1,int(time.time()),0,len(key)) ; print(base64.b64encode(header + key).decode())"

{{ initial_mon_key.stdout if monitor_keyring.skipped is defined else monitor_keyring.stdout if initial_mon_key.skipped is defined }}

cp /var/lib/ceph/tmp/{{ cluster }}.mon..keyring
   /etc/ceph/{{ cluster }}.mon.keyring

{{ container_binary + ' run --net=host --rm -v /var/lib/ceph:/var/lib/ceph:z -v /etc/ceph/:/etc/ceph/:z --entrypoint=ceph-authtool ' + ceph_client_docker_registry + '/' + ceph_client_docker_image + ':' + ceph_client_docker_image_tag if containerized_deployment else 'ceph-authtool' }}

{{ ceph_authtool_cmd }}
 /var/lib/ceph/tmp/{{ cluster }}.mon..keyring --import-keyring /etc/ceph/{{ cluster }}.client.admin.keyring

{{ container_binary + ' run --rm --net=host -v /var/lib/ceph/:/var/lib/ceph:z -v /etc/ceph/:/etc/ceph/:z --entrypoint=ceph-mon ' + ceph_client_docker_registry + '/' + ceph_client_docker_image + ':' +ceph_client_docker_image_tag if containerized_deployment else 'ceph-mon' }}

{{ ceph_mon_cmd }} --cluster {{ cluster }} --setuser "{{ ceph_uid if containerized_deployment else 'ceph' }}" --setgroup "{{ ceph_uid if containerized_deployment else 'ceph' }}" --mkfs -i {{ monitor_name }} --fsid {{ fsid }} --keyring /var/lib/ceph/tmp/{{ cluster }}.mon..keyring

{{ ceph_mon_cmd }} --cluster {{ cluster }} --setuser "{{ ceph_uid if containerized_deployment else 'ceph' }}" --setgroup "{{ ceph_uid if containerized_deployment else 'ceph' }}" --mkfs -i {{ monitor_name }} --fsid {{ fsid }}

(mon_socket_stat is defined and mon_socket_stat.get('rc') != 0) or (ceph_mon_container_stat is defined and ceph_mon_container_stat.get('stdout_lines', [])|length == 0)

{{ container_exec_cmd }} ceph --cluster {{ cluster }} osd pool set {{ item[0] }} {{ item[1] }} true

ceph-mon@{{ monitor_name if not containerized_deployment else ansible_hostname }}

{{ container_exec_cmd_nfs | default('') }} radosgw-admin --cluster {{ cluster }} user info --uid={{ ceph_nfs_rgw_user }}

{{ container_exec_cmd_nfs | default('') }} radosgw-admin --cluster {{ cluster }} user create --uid={{ ceph_nfs_rgw_user }} --display-name='RGW NFS User'

{{ container_exec_cmd_nfs | default('') }} radosgw-admin --cluster {{ cluster }} user modify --uid={{ ceph_nfs_rgw_user }} --access-key={{ ceph_nfs_rgw_access_key }} --secret-key={{ ceph_nfs_rgw_secret_key }}

{{ (rgwuser.stdout | from_json)['keys'][0]['access_key'] if rgwuser_exists.get('rc', 1) != 0 else (rgwuser_exists.stdout | from_json)['keys'][0]['access_key'] }}

{{ (rgwuser.stdout | from_json)['keys'][0]['secret_key'] if rgwuser_exists.get('rc', 1) != 0 else (rgwuser_exists.stdout | from_json)['keys'][0]['secret_key'] }}

install nfs-ganesha-selinux and python3-policycoreutils on RHEL 8

{{ 'nfs-server' if ansible_os_family == 'RedHat' else 'nfsserver' if ansible_os_family == 'Suse' else 'nfs-kernel-server' if ansible_os_family == 'Debian' }}

/var/lib/ceph/radosgw/{{ cluster }}-rgw.{{ ansible_hostname }}/keyring

{{ hostvars[groups.get(mon_group_name)[0]]['container_exec_cmd'] }} ceph --cluster {{ cluster }} auth get {{ item.name }}

ceph --cluster {{ cluster }} --name client.bootstrap-rgw --keyring /var/lib/ceph/bootstrap-rgw/{{ cluster }}.keyring auth get-or-create client.rgw.{{ ansible_hostname }} osd 'allow rwx' mon 'allow rw' -o /var/lib/ceph/radosgw/{{ cluster }}-rgw.{{ ansible_hostname }}/keyring

deb {{ nfs_ganesha_stable_deb_repo }} {{ ceph_stable_distro_source | default(ansible_distribution_release) }} main

https://shaman.ceph.com/api/repos/nfs-ganesha/next/latest/{{ ansible_distribution | lower }}/{{ ansible_distribution_release }}/flavors/{{ nfs_ganesha_flavor }}/repo

{{ ceph_mirror }}/nfs-ganesha/rpm-{{ nfs_ganesha_stable_branch }}/{{ ceph_release }}/$basearch

{{ container_exec_cmd_nfs | default('') }} rados -p {{ cephfs_data_pool.name }} --cluster {{ cluster }} ls|grep {{ ceph_nfs_rados_export_index }}

{{ container_exec_cmd_nfs | default('') }} rados -p {{ cephfs_data_pool.name }} --cluster {{ cluster }} put {{ ceph_nfs_rados_export_index }} /dev/null

{{ hostvars[groups[mon_group_name][0]]['container_exec_cmd'] | default('') }} ceph --cluster {{ cluster }} auth get {{ item.name }}

{{ hostvars[groups[mon_group_name][0]]['container_exec_cmd'] | default('') }}

hostvars[groups[mon_group_name][0]]['create_crush_tree'] | default(create_crush_tree) | bool

{{ hostvars[groups[mon_group_name][0]]['container_exec_cmd'] | default('') }} ceph --cluster {{ cluster }} osd crush rule {{ 'create-replicated' if item.class is defined else 'create-simple' }} {{ item.name }} {{ item.root }} {{ item.type }} {{ item.class | default('') }}

{{ hostvars[groups[mon_group_name][0]]['crush_rules'] | default(crush_rules) | unique }}

{{ hostvars[groups[mon_group_name][0]]['container_exec_cmd'] | default('') }} ceph --cluster {{ cluster }} osd -f json crush rule dump {{ item.name }}

{{ hostvars[item]['container_exec_cmd'] | default('') }} ceph --admin-daemon /var/run/ceph/{{ cluster }}-mon.{{ hostvars[item]['monitor_name'] }}.asok config set osd_pool_default_crush_rule {{ info_ceph_default_crush_rule_yaml.rule_id }}

{{ groups[osd_group_name] | length != ansible_play_hosts_all | length }}

{{ hostvars[groups[mon_group_name][0]]['container_exec_cmd'] | default('') }} ceph --cluster {{ cluster }} osd set noup

{{ hostvars[groups[mon_group_name][0]]['container_exec_cmd'] | default('') }} ceph --cluster {{ cluster }} -s -f json

(wait_for_all_osds_up.stdout | from_json)["osdmap"]["num_osds"] | int > 0

(wait_for_all_osds_up.stdout | from_json)["osdmap"]["num_osds"] == (wait_for_all_osds_up.stdout | from_json)["osdmap"]["num_up_osds"]

hostvars[groups[mon_group_name][0]]['crush_rule_config'] | default(crush_rule_config) | bool

{{ openstack_keys_tmp|default([]) + [ { 'key': item.key, 'name': item.name, 'caps': { 'mon': item.mon_cap, 'osd': item.osd_cap|default(''), 'mds': item.mds_cap|default(''), 'mgr': item.mgr_cap|default('') } , 'mode': item.mode } ] }}

{{ hostvars[groups[mon_group_name][0]]['container_exec_cmd'] | default('') }} ceph --cluster {{ cluster }} osd pool get {{ item.name }} size

{{ hostvars[groups[mon_group_name][0]]['container_exec_cmd'] | default('') }} ceph --cluster {{ cluster }} osd pool create {{ item.0.name }} {{ item.0.pg_num | default(osd_pool_default_pg_num) if not item.0.pg_autoscale_mode | default(False) | bool else 16 }} {{ item.0.pgp_num | default(item.0.pg_num) | default(osd_pool_default_pg_num) if not item.0.pg_autoscale_mode | default(False) | bool else '' }} {%- if item.0.type | default(1) | int == 1 or item.0.type | default('replicated') == 'replicated' %} replicated {{ item.0.rule_name | default(osd_pool_default_crush_rule) }} {{ item.0.expected_num_objects | default(0) }} {%- else %} erasure {{ item.0.erasure_profile }} {%- endif %}

{{ hostvars[groups[mon_group_name][0]]['container_exec_cmd'] | default('') }} ceph --cluster {{ cluster }} osd pool set {{ item.name }} size {{ item.size | default(osd_pool_default_size) }} {{ '--yes-i-really-mean-it' if item.size | default(osd_pool_default_size) | int == 1 else '' }}

{{ hostvars[groups[mon_group_name][0]]['container_exec_cmd'] | default('') }} ceph --cluster {{ cluster }} osd pool set {{ item.name }} min_size {{ item.min_size | default(osd_pool_default_min_size) }}

{{ hostvars[groups[mon_group_name][0]]['container_exec_cmd'] | default('') }} ceph --cluster {{ cluster }} osd pool application enable {{ item.name }} {{ item.application }}

{{ '{{ container_binary }} run --rm --ulimit nofile=1024:4096 --net=host --privileged=true -v /var/run/udev/:/var/run/udev/:z -v /run/lvm/:/run/lvm/ -v /etc/ceph:/etc/ceph:z -v /dev:/dev --entrypoint=ceph-volume ' + ceph_docker_registry + '/' + ceph_docker_image + ':' + ceph_docker_image_tag if containerized_deployment else 'ceph-volume' }}

{{ ((ceph_osd_ids.stdout | default('{}') | from_json).keys() | list) + osd_ids_non_container.stdout_lines | default([]) }}

{{ 4194303 if ansible_memtotal_mb >= 49152 else default_vm_min_free_kbytes.stdout }}

{{ dedicated_devices | unique if dedicated_devices | length > 0 else omit }}

{{ bluestore_wal_devices | unique if bluestore_wal_devices | length > 0 else omit }}

ceph --cluster {{ cluster }} --name client.bootstrap-rbd-mirror --keyring /var/lib/ceph/bootstrap-rbd-mirror/{{ cluster }}.keyring auth get-or-create client.rbd-mirror.{{ ansible_hostname }} mon 'profile rbd-mirror' osd 'profile rbd' -o /etc/ceph/{{ cluster }}.client.rbd-mirror.{{ ansible_hostname }}.keyring

/etc/ceph/{{ cluster }}.client.rbd-mirror.{{ ansible_hostname }}.keyring

{{ container_exec_cmd | default('') }} rbd --cluster {{ cluster }} --keyring /etc/ceph/{{ cluster }}.client.rbd-mirror.{{ ansible_hostname }}.keyring --name client.rbd-mirror.{{ ansible_hostname }} mirror pool enable {{ ceph_rbd_mirror_pool }} {{ ceph_rbd_mirror_mode }}

{{ container_exec_cmd | default('') }} rbd --cluster {{ cluster }} --keyring /etc/ceph/{{ cluster }}.client.rbd-mirror.{{ ansible_hostname }}.keyring --name client.rbd-mirror.{{ ansible_hostname }} mirror pool info {{ ceph_rbd_mirror_pool }}

{{ container_exec_cmd | default('') }} rbd --cluster {{ cluster }} --keyring /etc/ceph/{{ cluster }}.client.rbd-mirror.{{ ansible_hostname }}.keyring --name client.rbd-mirror.{{ ansible_hostname }} mirror pool peer add {{ ceph_rbd_mirror_pool }} {{ ceph_rbd_mirror_remote_user }}@{{ ceph_rbd_mirror_remote_cluster }}

{{ container_binary }} exec ceph-rbd-mirror-{{ ansible_hostname }}

/var/lib/ceph/radosgw/{{ cluster }}-rgw.{{ ansible_hostname }}.{{ item.instance_name }}

radosgw_frontend_ssl_certificate | length > 0 and radosgw_frontend_ssl_certificate_data | length > 0

openssl x509 -in /etc/keystone/ssl/certs/ca.pem -pubkey | certutil -d {{ radosgw_nss_db_path }} -A -n ca -t 'TCu,Cu,Tuw'

openssl x509 -in /etc/keystone/ssl/certs/signing_cert.pem -pubkey | certutil -A -d {{ radosgw_nss_db_path }} -n signing_cert -t 'P,P,P'

ceph --cluster {{ cluster }} --name client.bootstrap-rgw --keyring /var/lib/ceph/bootstrap-rgw/{{ cluster }}.keyring auth get-or-create client.rgw.{{ ansible_hostname }}.{{ item.instance_name }} osd 'allow rwx' mon 'allow rw' -o /var/lib/ceph/radosgw/{{ cluster }}-rgw.{{ ansible_hostname }}.{{ item.instance_name }}/keyring

/var/lib/ceph/radosgw/{{ cluster }}-rgw.{{ ansible_hostname }}.{{ item.instance_name }}/keyring

{{ container_exec_cmd }} ceph --connect-timeout 10 --cluster {{ cluster }} osd erasure-code-profile rm {{ item.value.ec_profile }}

{{ container_exec_cmd }} ceph --connect-timeout 10 --cluster {{ cluster }} osd erasure-code-profile set {{ item.value.ec_profile }} k={{ item.value.ec_k }} m={{ item.value.ec_m }}

{{ container_exec_cmd }} ceph --connect-timeout 10 --cluster {{ cluster }} osd crush rule create-erasure {{ item.key }} {{ item.value.ec_profile }}

{{ container_exec_cmd }} ceph --connect-timeout 10 --cluster {{ cluster }} osd pool create {{ item.key }} {{ item.value.pg_num | default(osd_pool_default_pg_num) }} erasure {{ item.value.ec_profile }}

{{ container_exec_cmd }} ceph --connect-timeout 10 --cluster {{ cluster }} osd pool create {{ item.key }} {{ item.value.pg_num | default(osd_pool_default_pg_num) }} replicated

item.value.type is not defined or item.value.type == 'replicated'

{{ container_exec_cmd }} ceph --connect-timeout 10 --cluster {{ cluster }} osd pool set {{ item.key }} size {{ item.value.size | default(osd_pool_default_size) }} {{ '--yes-i-really-mean-it' if item.value.size | default(osd_pool_default_size) | int == 1 else '' }}

item.value.size | default(osd_pool_default_size) != ceph_osd_pool_default_size

{{ container_exec_cmd }} ceph --connect-timeout 10 --cluster {{ cluster }} osd pool application enable {{ item.key }} rgw

/var/lib/ceph/radosgw/{{ cluster }}-rgw.{{ ansible_hostname }}.{{ item.instance_name }}/EnvironmentFile

INST_NAME={{ item.instance_name }}
INST_PORT={{ item.radosgw_frontend_port }}

{{ container_exec_cmd }} radosgw-admin realm get --cluster={{ cluster }} --rgw-realm={{ item }}

{{ container_exec_cmd }} radosgw-admin zonegroup get --cluster={{ cluster }} --rgw-realm={{ item.realm }} --rgw-zonegroup={{ item.zonegroup }}

{{ container_exec_cmd }} radosgw-admin zone get --rgw-realm={{ item.realm }} --cluster={{ cluster }} --rgw-zonegroup={{ item.zonegroup }} --rgw-zone={{ item.zone }}

{{ secondary_realms | default([]) | union([{ 'realm': item.rgw_realm, 'endpoint': item.endpoint, 'system_access_key': item.system_access_key, 'system_secret_key': item.system_secret_key, 'is_master': hostvars[item.host]['rgw_zonemaster'] }]) }}

{{ zonegroups | default([]) | union([{ 'realm': item.rgw_realm, 'zonegroup': item.rgw_zonegroup, 'is_master': hostvars[item.host]['rgw_zonegroupmaster'] }]) }}

{{ zones | default([]) | union([{ 'realm': item.rgw_realm, 'zonegroup': item.rgw_zonegroup, 'zone': item.rgw_zone, 'is_master': hostvars[item.host]['rgw_zonemaster'], 'system_access_key': item.system_access_key, 'system_secret_key': item.system_secret_key }]) }}

{{ zone_endpoint_pairs | default([]) | union([{ 'endpoint': hostvars[item.host]['rgw_multisite_proto'] + '://' + item.radosgw_address + ':' + item.radosgw_frontend_port | string, 'rgw_zone': item.rgw_zone, 'rgw_realm': item.rgw_realm, 'rgw_zonegroup': item.rgw_zonegroup, 'rgw_zonemaster': hostvars[item.host]['rgw_zonemaster']}]) }}

{{ zone_endpoints_list | default([]) | union([{'zone': item.rgw_zone, 'zonegroup': item.rgw_zonegroup, 'realm': item.rgw_realm, 'is_master': item.rgw_zonemaster, 'endpoints': ','.join(zone_endpoint_pairs | selectattr('rgw_zone','==',item.rgw_zone) | selectattr('rgw_realm','==',item.rgw_realm) | selectattr('rgw_zonegroup', '==', item.rgw_zonegroup) | map(attribute='endpoint'))}]) }}

{{ zone_users | default([]) | union([{ 'realm': item.rgw_realm, 'zonegroup': item.rgw_zonegroup, 'zone': item.rgw_zone, 'system_access_key': item.system_access_key, 'system_secret_key': item.system_secret_key, 'user': item.rgw_zone_user, 'display_name': item.rgw_zone_user_display_name }]) }}

{{ container_exec_cmd }} radosgw-admin user info --cluster={{ cluster }} --rgw-realm={{ item.realm }} --rgw-zonegroup={{ item.zonegroup }} --rgw-zone={{ item.zone }} --uid={{ item.user }}

{{ container_exec_cmd }} radosgw-admin user create --cluster={{ cluster }} --rgw-realm={{ item.item.realm }} --rgw-zonegroup={{ item.item.zonegroup }} --rgw-zone={{ item.item.zone }} --uid={{ item.item.user }} --display-name='{{ item.item.display_name }}' --access-key={{ item.item.system_access_key }} --secret={{ item.item.system_secret_key }} --system

{{ container_exec_cmd }} radosgw-admin realm create --cluster={{ cluster }} --rgw-realm={{ item.item }} {{ '--default' if realms | length == 1 else '' }}

{{ container_exec_cmd }} radosgw-admin zonegroup create --cluster={{ cluster }} --rgw-realm={{ item.item.realm }} --rgw-zonegroup={{ item.item.zonegroup }} {{ '--default' if zonegroups | length == 1 else '' }} {{ '--master' if item.item.is_master | bool else '' }}

{{ container_exec_cmd }} radosgw-admin zone create --cluster={{ cluster }} --rgw-realm={{ item.item.realm }} --rgw-zonegroup={{ item.item.zonegroup }} --rgw-zone={{ item.item.zone }} --access-key={{ item.item.system_access_key }} --secret={{ item.item.system_secret_key }} {{ '--default' if zones | length == 1 else '' }} --master

{{ container_exec_cmd }} radosgw-admin zone modify --cluster={{ cluster }} --rgw-realm={{ item.realm }} --rgw-zonegroup={{ item.zonegroup }} --rgw-zone={{ item.zone }} --endpoints {{ item.endpoints }}

{{ container_exec_cmd }} radosgw-admin --cluster={{ cluster }} --rgw-realm={{ item.realm }} --rgw-zonegroup={{ item.zonegroup }} --rgw-zone={{ item.zone }} period update --commit

{{ container_exec_cmd }} radosgw-admin realm pull --cluster={{ cluster }} --rgw-realm={{ item.realm }} --url={{ item.endpoint }} --access-key={{ item.system_access_key }} --secret={{ item.system_secret_key }}

{{ container_exec_cmd }} radosgw-admin period get --cluster={{ cluster }} --rgw-realm={{ item.realm }}

{{ container_exec_cmd }} radosgw-admin zone create --cluster={{ cluster }} --rgw-realm={{ item.item.realm }} --rgw-zonegroup={{ item.item.zonegroup }} --rgw-zone={{ item.item.zone }} --access-key={{ item.item.system_access_key }} --secret={{ item.item.system_secret_key }} {{ '--default' if zones | length == 1 else '' }}

{{ vrrp_instances | default([]) | union([{ 'name': 'VI_' + index|string , 'vip': item }]) }}

{{ root_device }} found in either lvm_volumes or devices variable

root_device in lvm_volumes_data_devices | default([]) or root_device in _devices | default([])

{{ item.data if item.data_vg is undefined and lvm_volumes is defined else item if devices is defined else omit }}

(item.data is defined and item.data_vg is undefined) or devices is defined

{{ monitor_interface }} does not exist on {{ inventory_hostname }}

{{ monitor_interface }} is not active on {{ inventory_hostname }}

not hostvars[inventory_hostname]['ansible_' + (monitor_interface | replace('-', '_'))]['active']

{{ monitor_interface }} does not have any IPv4 address on {{ inventory_hostname }}

hostvars[inventory_hostname]['ansible_' + (monitor_interface | replace('-', '_'))]['ipv4'] is not defined

{{ monitor_interface }} does not have any IPv6 address on {{ inventory_hostname }}

hostvars[inventory_hostname]['ansible_' + (monitor_interface | replace('-', '_'))]['ipv6'] is not defined

{{ radosgw_interface }} does not exist on {{ inventory_hostname }}

{{ radosgw_interface }} is not active on {{ inventory_hostname }}

hostvars[inventory_hostname]['ansible_' + (radosgw_interface | replace('-', '_'))]['active'] == "false"

{{ radosgw_interface }} does not have any IPv4 address on {{ inventory_hostname }}

hostvars[inventory_hostname]['ansible_' + (radosgw_interface | replace('-', '_'))]['ipv4'] is not defined

{{ radosgw_interface }} does not have any IPv6 address on {{ inventory_hostname }}

hostvars[inventory_hostname]['ansible_' + (radosgw_interface | replace('-', '_'))]['ipv6'] is not defined

{{ inventory_hostname }} does not have any {{ ip_version }} address on {{ monitor_address_block }}

hostvars[inventory_hostname]['ansible_all_' + ip_version + '_addresses'] | ips_in_ranges(hostvars[inventory_hostname]['monitor_address_block'].split(',')) | length == 0

iSCSI gateways can only be deployed on Red Hat Enterprise Linux, CentOS or Fedora

you must set a list of IPs (comma separated) for gateway_ip_list

 '' in client_connections | selectattr('status', 'match', 'present') | map(attribute='chap') | list

grep -q {{ item }}=m {% if is_atomic|bool %}/usr/lib/ostree-boot{% else %}/boot{% endif %}/config-{{ ansible_kernel }}

ceph_nfs_rgw_access_key and ceph_nfs_rgw_secret_key must be set if nfs_obj_gw is True

(ceph_nfs_rgw_access_key is undefined or ceph_nfs_rgw_secret_key is undefined)

ceph-nfs packages are not available from openSUSE Leap 15.x repositories (ceph_origin = 'distro')

You must set a target_size_ratio value on following pool: {{ item.name }}.

rgw_pull_port is undefined and rgw_pullhost is undefined and rgw_pull_proto is undefined

ansible_architecture not in ['x86_64', 'ppc64le', 'armv7l', 'aarch64']

ansible_os_family not in ['Debian', 'RedHat', 'ClearLinux', 'Suse']

CentOS release not supported {{ ansible_distribution_major_version }}

Distribution not supported {{ ansible_distribution_version }} by Red Hat Ceph Storage, only RHEL >= 7.3

Distribution not supported by Ubuntu Cloud Archive: {{ ansible_distribution }}

Distribution not supported: {{ ansible_distribution }} {{ ansible_distribution_major_version }}

ansible_distribution == 'openSUSE Leap' or ansible_distribution == 'SUSE'

ceph_repository must be either 'community', 'rhcs', 'dev', 'custom' or 'uca'

ceph_repository not in ['community', 'rhcs', 'dev', 'custom', 'uca']

Either monitor_address, monitor_address_block or monitor_interface must be provided

Either radosgw_address, radosgw_address_block or radosgw_interface must be provided

verify that ceph_rhcs_cdn_debian_repo url is valid for red hat storage

ceph_rhcs_cdn_debian_repo url is invalid, please set your customername:customerpasswd

Unsupported installation method origin:{{ ceph_origin }} repo:{{ ceph_repository }}' only valid combination is ceph_origin == 'repository' and ceph_repository == 'obs'

installation can't happen on Atomic and ntpd needs to be installed

WARNING: journal_size is configured to {{ journal_size }}, which is less than 5GB. This is not recommended and can lead to severe issues.

WARNING: radosgw_civetweb_num_threads variable is deprecated. Please use radosgw_thread_pool_size instead

you must add a [grafana-server] group and add at least one node.

you must add at least one node in the [grafana-server] hosts group

you must set dashboard_admin_password and grafana_admin_password.

dashboard_admin_password is undefined or grafana_admin_password is undefined

ceph_docker_registry_username and/or ceph_docker_registry_password variables need to be set

(ceph_docker_registry_username is not defined or ceph_docker_registry_password is not defined) or (ceph_docker_registry_username | length == 0 or ceph_docker_registry_password | length == 0)

podman run --rm -v /etc/ceph:/etc/ceph --net=host --entrypoint=rbd {{ ceph_docker_registry }}/{{ ceph_docker_image }}:{{ ceph_docker_image_tag }} create --size=1024 test/rbd_test

is_atomic | bool or containerized_deployment | default(false) | bool

rbd feature disable test/rbd_test object-map fast-diff deep-flatten

podman run --rm -v /etc/ceph:/etc/ceph --net=host --entrypoint=rbd {{ ceph_docker_registry }}/{{ ceph_docker_image }}:{{ ceph_docker_image_tag }} feature disable test/rbd_test object-map fast-diff deep-flatten

podman run --rm --privileged -v /etc/ceph:/etc/ceph -v /dev:/dev --net=host --entrypoint=rbd {{ ceph_docker_registry }}/{{ ceph_docker_image }}:{{ ceph_docker_image_tag }} map test/rbd_test

podman run --rm --name=rgw_multisite_test --entrypoint=/bin/bash {{ ceph_docker_registry }}/{{ ceph_docker_image }}:{{ ceph_docker_image_tag }} -c 'dd if=/dev/urandom of=/tmp/testinfra.img bs=1M count=10; {{ s3cmd_cmd }} mb s3://testinfra; {{ s3cmd_cmd }} put /tmp/testinfra.img s3://testinfra'

dd if=/dev/urandom of=/tmp/testinfra.img bs=1M count=10; {{ s3cmd_cmd }} mb s3://testinfra; {{ s3cmd_cmd }} put /tmp/testinfra.img s3://testinfra

podman run --rm --name=rgw_multisite_test --entrypoint=/bin/bash {{ ceph_docker_registry }}/{{ ceph_docker_image }}:{{ ceph_docker_image_tag }} -c '{{ s3cmd_cmd }} info s3://testinfra/testinfra.img'

INSECURE_REGISTRY="--insecure-registry {{ ceph_docker_registry }}"

noatime,nodiratime{% if ansible_os_family == "RedHat" and ansible_distribution_major_version | int < 8 %},nobarrier{% endif %}

cobbler setting report | grep xmlrpc_port | awk '{ FS=":"; print $3 }'

{% for line in users_digest_lines %}{{ line + '
' }}{% endfor %}

server{{':'}} {% for setting in settings %}{% if setting.name == 'server' %}{{ setting.value }}{% endif %}{% endfor %}

cobbler setting edit --name={{ item.name }} --value={{ item.value}}

url={{ distro.kernel }} dest={{ kernel_path }} sha256sum={{ distro.kernel_sha256 }}

url={{ distro.initrd }} dest={{ initrd_path }} sha256sum={{ distro.initrd_sha256 }}

{{ ( kernel_stat.stat.exists or download_kernel|changed) and ( initrd_stat.stat.exists or download_initrd|changed ) }}

url={{ distro.iso }} dest={{ iso_path }} sha256sum={{ distro.sha256 }}

{% for distro in distros.keys() + extra_distros.keys() %}{{ distros[distro].update(extra_distros[distro]|default({})) }}{% endfor %}{{ distros }}

msg="Cannot specify both 'iso' and 'kernel' or 'initrd'. distro '{{ distro_name }}'"

distro.iso != '' and (distro.kernel is defined or distro.initrd is defined)

(distro.kernel is defined and distro.kernel != '') and (distro.initrd is defined and distro.initrd != '')

((profile is defined and profile.stdout == distro_name) or (import is defined and import.rc == 0))

cobbler distro add --kernel {{ kernel_path }} --initrd {{ initrd_path }} --name {{ distro_name }}

download|changed or (files_exist and profile is defined and profile.stdout == '')

cobbler profile add --name {{ distro_name }} --distro {{ distro_name }}

download|changed or (iso_stat.stat.exists and profile is defined and profile.stdout == '')

cobbler import --path={{ iso_mount }} --name={{ distro_name }} --arch={{ arch }}

cobbler profile dumpvars --name={{ distro_name }} | grep '^kernel_options :' | cut -d : -f 2

cobbler profile edit --name={{ distro_name }} --kopts='{{ distro.kernel_options }}'

cobbler profile dumpvars --name={{ distro_name }} | grep '^kernel_options_post :' | cut -d : -f 2

cobbler profile edit --name={{ distro_name }} --kopts-post='{{ distro.kernel_options_post }}'

kernel_options_post.stdout.strip() != distro.kernel_options_post

cobbler profile dumpvars --name={{ distro_name }} | grep '^kickstart :' | awk '{ print $3 }'

cobbler profile edit --name={{ distro_name }} --kickstart={{ kickstart_path }}

[{% for host in cmd_cobbler_systems.stdout.strip().split() %}'{{ host }}.{{ lab_domain }}, {% endfor %}]

{{ groups.cobbler_managed | difference(cobbler_systems_current) }}

cobbler system add --name={{ item.split('.')[0] }} --profile={{ default_profile }} --mac={{ hostvars[item].mac }} --ip-address={{ hostvars[item].ip }} --interface={{ hostvars[item].interface|default(interface) }} --hostname={{ item.split('.')[0] }}.{{ lab_domain }} --kopts="{{ hostvars[item].kernel_options|default(kernel_options) }}" --ksmeta="{{ hostvars[item].kickstart_metadata|default(kickstart_metadata) }}" --power-type={{ hostvars[item].power_type|default(power_type) }} --power-address={{ item.split('.')[0] }}.{{ ipmi_domain }} --power-user={{ hostvars[item].power_user|default(power_user) }} --power-pass={{ hostvars[item].power_pass|default(power_pass) }} --netboot-enabled false

{{ groups.cobbler_managed | intersect(cobbler_systems_current) }}

cobbler system edit --name={{ item.split('.')[0] }} --mac={{ hostvars[item].mac }} --ip-address={{ hostvars[item].ip }} --interface={{ hostvars[item].interface|default(interface) }} --hostname={{ item.split('.')[0] }}.{{ lab_domain }} --kopts="{{ hostvars[item].kernel_options|default(kernel_options) }}" --ksmeta="{{ hostvars[item].kickstart_metadata|default(kickstart_metadata) }}" --power-type={{ hostvars[item].power_type|default(power_type) }} --power-address={{ item.split('.')[0] }}.{{ ipmi_domain }} --power-user={{ hostvars[item].power_user|default(power_user) }} --power-pass={{ hostvars[item].power_pass|default(power_pass) }}

msg="Host {{ inventory_hostname }} is running {{ ansible_distribution }} {{ ansible_distribution_version }} ({{ ansible_distribution_release }})"

{{ ansible_distribution | lower }}_{{ ansible_distribution_major_version }}.yml

http://{{ mirror_host }}/lab-extras/rhel7/x86_64/nrpe-2.15-7.el7.x86_64.rpm

ansible_pkg_mgr == "yum" and (firewalld is defined and firewalld.stdout.find('running') != -1)

{{ subscription_manager_org != '' and subscription_manager_activationkey != ''}}

subscription-manager register --activationkey={{ subscription_manager_activationkey }} --org={{ subscription_manager_org }}

sudo subscription-manager repos --list | grep -B4 'Enabled:.*1' | grep 'Repo ID:' | sed -e 's/Repo ID:\s*\(.*\)/\1/' | sort

timedatectl | grep -E "Time ?zone" | sed -e "s/.*: \(.*\) (.*/\1/"

ansible_distribution_major_version == "6" and current_tz.stdout|default("") != timezone

ansible_distribution_major_version == "7" and current_tz.stdout|default("") != timezone

ansible_distribution == 'Fedora' and ansible_distribution_major_version|int >= 22

ansible_distribution == 'RedHat' and ('Beta' in ansible_lsb.description or 'Alpha' in ansible_lsb.description)

This file is managed by ansible, don't make changes here - they will be overwritten.

for file in $(grep -l {{ f2b_grep_var|quote }} /etc/fail2ban/jail.d/*); do rm -vf $file; done

{{ ansible_version.major }} >= 2 and {{ ansible_version.minor }} >= 1

paddles_address is not defined or not paddles_address.startswith('http')

postgresql+psycopg2://{{ paddles_user }}:{{ db_pass }}@localhost/paddles

install_pcp_apt|changed or install_pcp_yum|changed or install_pcp_dnf|changed

install_pmmgr_apt|changed or install_pmmgr_yum|changed or target_host|changed or target_discovery|changed or pmmgr_options|changed or update_pmlogmerge_retain|changed or update_pmlogmerge_reduce|changed

DEBIAN_FRONTEND=noninteractive apt -y install --only-upgrade .*pcp.*

pcp-webapi is only available when using upstream packages. Set upstream_repo to true.

install_pcp_webapi|changed or install_pcp_webjs|changed or enable_pmwebd|changed

cp ./supervisord_pulpito.conf {{ supervisor_conf_path }} chdir={{ pulpito_repo_path }}

pulpito_status.stdout|match('.*RUNNING.*') and pulpito_config|changed

perl -pe 'if (m{^([^#]\S*\s+/\s+\S+\s+)(\S+)(\s+.*)$}) { $_="$1$2,user_xattr$3\n" unless $2=~m{(^|,)user_xattr(,|$)}; }' -i.bak /etc/fstab

parted -m {{ drive_to_partition }} print | grep '^[0-9]:' | wc -l

parted {{ drive_to_partition }} unit '%' mkpart primary {{ item }}

ansible_distribution == "RedHat" and ansible_distribution_major_version == "7"

bounce_interface == "True" or (ansible_distribution|lower == 'ubuntu' and ansible_distribution_major_version|int >= 16)

sed -i 's/\/usr\/games"/\/usr\/games:\/usr\/sbin"/g' /etc/profile

ssh/sshd_config_{{ ansible_distribution | lower }}_{{ ansible_distribution_major_version }}

user="{{ teuthology_user }}" key=https://raw.githubusercontent.com/ceph/keys/autogenerated/ssh/@all.pub

{{ ansible_default_ipv4['address'] }} {{ ansible_fqdn }} {{ ansible_hostname }}

teuthology_user_existence is defined and teuthology_user_existence|changed

{{ ansible_distribution | lower }}_{{ ansible_distribution_version }}.yml

ceph_packages_to_remove|length > 0 or packages_to_remove|length > 0

non_aarch64_packages_to_upgrade|length > 0 and ansible_architecture != "aarch64"

{{ non_aarch64_packages|list + non_aarch64_common_packages|list }}

(repo_file is defined and repo_file|changed) or (gpg_keys is defined and gpg_keys|changed) or (version_repo_file is defined and version_repo_file|changed)

{% for new_admin in extra_admin_users -%} {% for lab_user in managed_users -%} {% if new_admin.name == lab_user.name %}{{ new_admin.update(lab_user) }}{% endif %} {%- endfor %} {%- endfor %}{{ managed_admin_users|list + extra_admin_users|list }}

[{% for lab_user in managed_users -%} {% if not managed_admin_users|selectattr('name', 'equalto', lab_user.name)|list|length %}{{ lab_user}},{% endif %} {%- endfor %}]

[{% for user in managed_users %} {% if user.name in users %}{{ user }},{%endif%} {%endfor%}]

[{% for user in managed_admin_users %} {% if user.name in users %}{{ user }},{%endif%} {%endfor%}]

[{% for user in revoked_users %} {% if user in users %}'{{ user }}',{%endif%} {%endfor%}]

{{ lookup('file', keys_repo_path + '/ssh/' + item.name + '.pub') }}

virsh pool-define-as --name default dir --target /var/lib/libvirt/images

default_pool_info is defined and default_pool_info.stdout|search("State:  *inactive")

default_pool_info is defined and default_pool_info.stdout | search("Autostart:  *no")

{%- set l = [] %} {%- for result in pool_info.results %} {%- if result.rc == 1 %} {%- set dummy = l.append(result.item) %} {%- endif %} {%- endfor -%} {{ l | list }}

virsh pool-define-as --name {{ item | quote }} --type dir --target /srv/libvirtpool/{{ item }};
virsh pool-autostart {{ item | quote }};
virsh pool-build {{ item | quote }};
virsh pool-start {{ item | quote }}

front_net is defined and front_net.stdout | search("Active:  *no")

front_net is defined and front_net.stdout | search("Autostart:  *no")

mv {{ android_sdk_dir }}/android-sdk-linux {{ android_sdk_dir }}/android-sdk_{{ android_sdk_version }}

{{ android_sdk_location }}/platforms/android-{{ android_platform_api_major_version }}

mv {{ android_sdk_location }}/platforms/android-{{ android_platform_version}} {{ android_sdk_location }}/platforms/android-{{ android_platform_api_major_version }}

{{ android_build_tools_dir }}/{{ android_build_tools_expanded_version }}

mv {{ android_build_tools_dir }}/android-{{ android_build_tools_api_version }} {{ android_build_tools_dir }}/{{ android_build_tools_expanded_version }}

dd if=/dev/zero of={{ swap_file }} bs=1M count={{ swap_file_size_mb }}

{{ extlibs }}/expat/expat-{{ expat_version | regex_replace('_','-') }}

deb [trusted=yes] http://download.tizen.org/tools/latest-release/{{ ansible_distribution }}_{{ ansible_distribution_version }}/ /

wget -r -nd -np --cut-dirs=100 -R "index.html*" http://cdn.download.tizen.org/releases/2.4/2.4-base/latest/repos/standard/packages/noarch/ -P /GBS/

wget -r -nd -np --cut-dirs=100 -R "index.html*" http://cdn.download.tizen.org/releases/2.4/2.4-base/latest/repos/standard/packages/armv7l/ -P /GBS/

wget -r -nd -np --cut-dirs=100 -R "index.html*" http://cdn.download.tizen.org/releases/2.4/2.4-mobile/latest/repos/target-TM1/packages/noarch/ -P /GBS/

wget -r -nd -np --cut-dirs=100 -R "index.html*" http://cdn.download.tizen.org/releases/2.4/2.4-mobile/latest/repos/target-TM1/packages/armv7l/ -P /GBS/

. /opt/rh/rh-postgresql96/enable && swiftbackmeup backup --mode now

. /opt/rh/rh-postgresql96/enable && . /etc/dci_db.sh && psql -w -c 'SELECT count(*) FROM users'

{{ store_file_path | default("/var/lib/dci-control-server/files") }}

. /opt/rh/rh-postgresql96/enable && postgresql-setup --initdb --debug

shared_buffers = {{Β (ansible_memtotal_mb * 0.25)|int }}MB
effective_cache_size = {{Β (ansible_memtotal_mb * 0.50)|int }}MB

host    all             all  {{ apiip }}/32            {{ item }}

{{ ansible_eth0.ipv4.address }} {{ ansible_hostname }}.{{ ansible_domain }} {{ ansible_hostname }}

keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone

keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

keystone-manage bootstrap --bootstrap-password {{ swift_ks_admin_token }} \
--bootstrap-admin-url http://{{ ansible_eth0.ipv4.address }}:5000/v3/ \
--bootstrap-internal-url http://{{ ansible_eth0.ipv4.address }}:5000/v3/ \
--bootstrap-public-url http://{{ ansible_host }}:5000/v3/ \
--bootstrap-region-id regionOne

source /home/{{ ansible_user }}/openrc
openstack project create --domain default --description "Service Project" service
openstack role create service
openstack role create swiftoperator
openstack role create user
openstack user create --project service --password {{ swift_service_password }} swift
openstack role add --project service --user swift admin
openstack role add --project service --user admin admin
openstack service create --name swift --description "OpenStack Object Storage" object-store
openstack endpoint create --region regionOne object-store public http://{{ ansible_eth0.ipv4.address }}:8080/v1/AUTH_%\(tenant_id\)s
openstack endpoint create --region regionOne object-store internal http://{{ ansible_host }}:8080/v1/AUTH_%\(tenant_id\)s
openstack endpoint create --region regionOne object-store admin http://{{ ansible_eth0.ipv4.address }}:8080/v1
openstack project create {{ store_tenant_name }}
openstack user create --project {{ store_tenant_name }} --password {{ store_password }} {{ store_username }}
openstack role add --project {{ store_tenant_name }} --user {{ store_username }} member
openstack role add --project {{ store_tenant_name }} --user {{ store_username }} user
openstack role add --project {{ store_tenant_name }} --user {{ store_username }} swiftoperator

dd if=/dev/zero of=/dev/{{ swift_volume_device }} bs=1M count=1024

swift-ring-builder /etc/swift/object.builder create 10 1 1
swift-ring-builder /etc/swift/container.builder create 10 1 1
swift-ring-builder /etc/swift/account.builder create 10 1 1
swift-ring-builder /etc/swift/object.builder add r1z1-{{ ansible_eth0.ipv4.address }}:6000/{{ swift_volume_device }} 1
swift-ring-builder /etc/swift/container.builder add r1z1-{{ ansible_eth0.ipv4.address }}:6001/{{ swift_volume_device }} 1
swift-ring-builder /etc/swift/account.builder add r1z1-{{ ansible_eth0.ipv4.address }}:6002/{{ swift_volume_device }} 1
swift-ring-builder /etc/swift/object.builder rebalance
swift-ring-builder /etc/swift/container.builder rebalance
swift-ring-builder /etc/swift/account.builder rebalance

deb [arch=amd64] https://download.docker.com/linux/ubuntu {{ansible_distribution_release}} stable

MARATHON_MASTER=zk://{{ master_ips|join(':2181,') }}:2181/mesos
MARATHON_ZK=zk://{{ master_ips|join(':2181,') }}:2181/marathon

deb http://repos.mesosphere.com/ubuntu {{ansible_distribution_release}} main

kubeadm reset --force
rm -rf /home/ubuntu/.kube
rm -rf /root/.kube

kubeadm init --apiserver-advertise-address={{ private_ip }} --pod-network-cidr=10.244.0.0/16

kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml

cd $HOME/fio/ && wget http://freecode.com/urls/3aa21b8c106cab742bf1f20d60629e3f -O fio.tar.gz

src=./etc/fio_test_job  dest={{home_dir.stdout}}/fio/fio-2.1.10/

cd $HOME/fio/fio-2.1.10  &&  sudo ./fio --output-format=json --output=$HOME/qtip_result/fio_result.json fio_test_job

cd $HOME/qtip_result &&  sudo python final_report.py FIO {{fname}}

(cd $HOME/qtip_result/; find . -maxdepth 1 -name "*.json") | cut -d'/' -f2

(cd $HOME/qtip_result/; find . -maxdepth 1 -name "*.log") | cut -d'/' -f2

(find {{Dest_dir}}/fio/fio_temp/ -name "*.json" | xargs cp -t {{Dest_dir}}/fio/)

(find {{Dest_dir}}/fio/fio_temp/ -name "*.log" | xargs cp -t {{Dest_dir}}/fio/logs)

iperf3  --time {{duration}} -b 0 G -c {{ip1}} -J -O10 >> {{home_dir.stdout}}/qtip_result/iperf_raw.json

iperf3  --time {{duration}} -b 0 G -c {{privateip1}} -J -O10 >> {{home_dir.stdout}}/qtip_result/iperf_raw.json

cd $HOME/qtip_result &&  sudo python final_report.py IPERF {{fname}}

(find {{Dest_dir}}/iperf/iperf_temp/ -name "*.json" | xargs cp -t {{Dest_dir}}/iperf/)

( find {{Dest_dir}}/iperf/iperf_temp/ -name "*.log" | xargs cp -t {{Dest_dir}}/iperf/logs)

dest=/etc/profile.d/proxy.sh state=present create=yes owner=root group=root mode=0644 regexp="export http_proxy={{ http_proxy }}" insertafter=EOF line="export http_proxy={{ http_proxy }}"

dest=/etc/profile.d/proxy.sh state=present create=yes owner=root group=root mode=0644 regexp="export https_proxy={{ https_proxy }}" insertafter=EOF line="export https_proxy={{ https_proxy }}"

dest=/etc/profile.d/proxy.sh state=present create=yes owner=root group=root mode=0644 regexp="{{ no_proxy }}" insertafter=EOF line="export no_proxy={{ no_proxy }}"

dest=/etc/wgetrc state=present regexp="http_proxy={{ http_proxy }}" insertafter="^#http_proxy" line="http_proxy={{ http_proxy }}"

dest=/etc/wgetrc state=present regexp="https_proxy={{ https_proxy }}" insertafter="^#https_proxy" line="https_proxy={{ https_proxy }}"

dest=/etc/yum.conf state=present regexp="proxy={{ http_proxy }}" insertafter=EOF line="proxy={{ http_proxy }}"

dest=/etc/apt/apt.conf state=present create=yes regexp="Acquire::http::Proxy \"{{ http_proxy }}\";" insertafter=EOF line="Acquire::http::Proxy \"{{ http_proxy }}\";"

dest=/etc/apt/apt.conf state=present create=yes regexp="Acquire::https::Proxy \"{{ https_proxy }}\";" insertafter=EOF line="Acquire::https::Proxy \"{{ https_proxy }}\";"

repo='deb https://apt.dockerproject.org/repo ubuntu-xenial main' state=present filename='docker'

ansible_distribution == "Ubuntu" and ansible_distribution_version == "16.04"

ansible_distribution == "Ubuntu" and ansible_distribution_version== "16.04"

repo='deb https://apt.dockerproject.org/repo ubuntu-trusty main' state=present filename='docker'

ansible_distribution == "Ubuntu" and ansible_distribution_version == "14.04"

src={{ item }}.conf.j2 dest=/etc/nginx/sites-enabled/{{ item }}.conf

{{ lookup('ini', '{{ item }} section=client default='' file={{ output }}/ceph.conf')  }}

lsblk -d -o name,rota |awk '{if ($2 == 0)  printf "%s SSD \n",$1 }'

netstat -nr |grep  "U" | awk '{printf "interface %s network %s mask  %s \n",$8,$1, $3 }'

{{ lookup('ini', '{{ item }} section=global default='' file={{ output }}/ceph.conf')  }}

nDPI throughput:\s+?(?P<dpi_pps>\d+.\d+.*) pps \/ (?P<dpi_bps>\d+.\d+.*)b/sec$

source {{ ansible_env.HOME}}/stackrc && openstack baremetal list --fields instance_uuid properties provision_state --format json

source {{ ansible_env.HOME }}/stackrc && openstack server list --format json

deb http://archive.ubuntu.com/ubuntu/ {{ansible_distribution_release}}-backports  main restricted universe multiverse

deb http://archive.ubuntu.com/ubuntu/ {{ansible_distribution_release}} main restricted universe multiverse

./Run -i {{ iterations }} -c {{ parallel_copies }} dhrystone whetstone

^Dhrystone 2 using register variables\s+(\d+\.\d+)\s+(?P<dhrystone_lps>\d+\.\d+)\s+(\d+\.\d+)

{{ ANSIBLE_REPO_PATH }}/configs/{{ env_type }}/env_secret_vars.yml

aws cloudformation describe-stacks --stack-name {{project_tag}} --region {{item}}

{{ANSIBLE_REPO_PATH}}/workdir/{{ env_type }}.{{ guid }}.{{cloud_provider}}_cloud_template

az group deployment show --name {{env_type}}.{{guid}} --resource-group {{az_resource_group}}

az resource delete --ids {{ids|join(' ')}} --resource-group {{az_resource_group}}

az login --service-principal -u {{azure_service_principal}} -p {{azure_password}} --tenant {{azure_tenant}}

az group create --name "{{az_resource_group}}" --location "{{azure_region}}"

{
  "adminUsername": { "value": "{{remote_user}}" },
  "sshKeyData": { "value": "{{ssh_key_data}}"},
  "DNSZone": { "value": "{{HostedZoneId}}"},
  "guid": { "value": "{{guid}}"},
}

az group deployment validate --template-file {{t_dest}} --resource-group {{az_resource_group}} --parameters @{{params_dest}}

az group deployment create --name {{env_type}}.{{guid}} --template-file {{t_dest}} --resource-group {{az_resource_group}} --parameters @{{params_dest}}

{{subzone_ns | json_query('ansible_facts.azure_dnsrecordset[0].properties.NSRecords[*].{entry: nsdname}')}}

az vm list --resource-group "{{az_resource_group}}" --show-details

tag_{{stack_tag}}_{{item.tags.AnsibleGroup | default('unknowns')}}

tag_{{stack_tag}}_ostype_{{item.tags.ostype | default('unknown')}}

{{item.tags.internaldns | d(item.osProfile.computerName) |d(item.name)}}

az vm restart --resource-group {{az_resource_group}} --name '{{inventory_hostname}}'

{{ windows_password | default(hostvars['localhost'].generated_windows_password) }}

{{ ANSIBLE_REPO_PATH }}/workdir/{{ env_type }}_{{ guid }}_ssh_conf

{{ ANSIBLE_REPO_PATH }}/workdir/{{ env_type }}_{{ guid }}_ssh_known_hosts

##### {mark} ADDED BASTION PROXY HOST {{ env_type }}-{{ guid }} ######

Host {{ bastion_hostname }} {{ hostvars[bastion_hostname].shortname |d('')}}
  Hostname {{ hostvars[bastion_hostname].public_dns_name }}
  IdentityFile {{ ssh_key | default(ansible_ssh_private_key_file) }}
  IdentitiesOnly yes
  User {{ remote_user }}
  ControlMaster auto
  ControlPath /tmp/{{ guid }}-%r-%h-%p
  ControlPersist 5m
  StrictHostKeyChecking no
  ConnectTimeout 60
  ConnectionAttempts 10
  UserKnownHostsFile {{ansible_known_host}}

##### {mark} ADDED Node Proxy Config  {{ item }} {{ env_type }}-{{ guid }} ######

Host {{ item }} {{  hostvars[item].public_ip_address | default('') }} {{ hostvars[item].shortname |d('')}}
  Hostname {{ hostvars[item].private_ip_address }}
  ProxyCommand ssh -F {{ ansible_ssh_config }} {{ bastion_hostname }} -W %h:%p

{{ ansible_ssh_extra_args|d() }} -F {{ hostvars['localhost'].ansible_ssh_config }}

{{ ansible_ssh_extra_args|d() }} -F {{ ANSIBLE_REPO_PATH }}/workdir/{{ env_type }}_{{ guid }}_ssh_conf

https://{{ ansible_tower_ip }}/api/v1/job_templates/{{ job_template_id }}/launch/

{{ ANSIBLE_REPO_PATH }}/configs/{{ env_type }}/files/cloud_providers/{{cloud_provider}}_cloud_template.j2

{{ ANSIBLE_REPO_PATH }}/workdir/{{cloud_provider}}_cloud_template.{{ env_type }}.{{ guid }}.template

{{ ANSIBLE_REPO_PATH }}/inventory/{{ cloud_provider }}.py  --list {{ app_results.app_name }}

{{ ANSIBLE_REPO_PATH }}/cloud_providers/{{cloud_provider}}_ssh_config_setup.yml

{{ ravello_groups | json_query('_meta.hostvars."bastion-REPL.rhpds.opentlc.com".externalFqdn') }}

#!/bin/bash
ssh -i {{ ANSIBLE_REPO_PATH }}/workdir/{{ guid }}key cloud-user@{{ bastion_hostname.external }}

Host {{ bastion_hostname.external }}
  Hostname {{ bastion_hostname.external }}
  IdentityFile {{ ANSIBLE_REPO_PATH }}/workdir/{{ env_authorized_key }}
  ControlPath /tmp/%h-%r

{{ ANSIBLE_REPO_PATH }}/configs/{{ env_type }}/add_hosts_ssh_config.yml

cd {{ANSIBLE_REPO_PATH}}/workdir ; terraform init ; terraform destroy -force

{{ANSIBLE_REPO_PATH}}/workdir/{{ env_type }}.{{ guid }}.{{cloud_provider}}.tf

cd {{ANSIBLE_REPO_PATH}}/workdir ; terraform init ; terraform apply chdir="{{ANSIBLE_REPO_PATH}}/workdir" -auto-approve

{{ ANSIBLE_REPO_PATH }}/configs/{{ env_type }}/files/cloud_providers/aws.tf.j2

{{ terraform_working_dir }}/{{ workshop_prefix }}/terraform.tfvars

{{ ANSIBLE_REPO_PATH }}/configs/{{ env_type }}/files/cloud_providers/terraform.tfvars.j2

terraform apply chdir="{{ terraform_working_dir }}/{{ workshop_prefix }}"

ssh-keygen -b 2048 -t rsa -f {{ ANSIBLE_REPO_PATH }}/workdir/{{env_authorized_key}} -q -N ""

{{ lookup('file', '{{ ANSIBLE_REPO_PATH }}/workdir/{{ env_authorized_key }}.pub') | regex_replace(' ' + my_login_domain, '') }}

ssh-keygen -b 2048 -t rsa -f "{{ ANSIBLE_REPO_PATH }}/workdir/{{env_authorized_key}}" -q -N ""

{{ ANSIBLE_REPO_PATH }}/workdir/{{ env_type }}_{{guid}}_windows_password.txt

Read windows password from workdir/[...]_windows_password.txt file

cat '{{ ANSIBLE_REPO_PATH }}/workdir/{{ env_type }}_{{guid}}_windows_password.txt'

{{ ANSIBLE_REPO_PATH }}/roles/infra-{{cloud_provider}}-template-destroy

ssh-keygen -y -f "{{ ANSIBLE_REPO_PATH }}/workdir/{{env_authorized_key}}" > "{{ ANSIBLE_REPO_PATH }}/workdir/{{env_authorized_key}}.pub"

[default]
aws_access_key_id = {{ item.aws_access_key_id }}
aws_secret_access_key = {{ item.aws_secret_access_key }}

[{{item.name}}]

{{ ANSIBLE_REPO_PATH }}/configs/{{ env_type }}/files/Sync_Repositories.sh

openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout {{ httpd_ssl_key }} -out {{ httpd_ssl_cert }} -subj '/CN={{provisioner_public_dns}}/O=Red Hat/C=US'

{{ terraform_working_dir }}/{{ workshop_prefix }}/{{ workshop_prefix }}-tower

{{ ANSIBLE_REPO_PATH }}/configs/{{ env_type }}/files/labs_hosts_template.j2

{{ ANSIBLE_REPO_PATH }}/workdir/labs_hosts-{{ env_type }}-{{ guid }}

/usr/sbin/ipa-client-install --domain=OPENTLC.COM -w {{ipa_host_password}} -N -U --mkhomedir --no-dns-sshfp --hostname={{bastion_public_dns_chomped}}

Step 000 Pre Infrastructure - There are no pre_infrastructure tasks defined

oc login  master.{{subdomain_base}} -u {{admin_user}} -p {{admin_user_password}} --insecure-skip-tls-verify=true

oc new-app https://github.com/StefanoPicozzi/cotd.git   -n envtests

cloudformation_out.stack_outputs.S3UserSecretAccessKey is defined

{{ANSIBLE_REPO_PATH}}/workdir/{{ env_type }}.{{ guid }}.s3user.credentials

* S3 Bucket for registry: {{s3user}}
** S3User access key: {{s3user_access_key}}
** S3User secret key: {{s3user_secret_access_key}}

{{ cloudformation_out.stack_outputs.Route53UserSecretAccessKey }}

cloudformation_out.stack_outputs.Route53UserAccessKey is defined

cloudformation_out.stack_outputs.Route53UserSecretAccessKey is defined

{{ANSIBLE_REPO_PATH}}/workdir/{{ env_type }}.{{ guid }}.route53user.credentials

* Route53 User for Let's Encrypt: {{ route53user }}
** Route53User access key: {{ route53user_access_key }}
** Route53User secret key: {{ route53user_secret_access_key }}

parted -m /dev/sda print all 2>/dev/null | grep unknown | grep /dev/sd | cut -d':' -f1 | sed -n '{{ (instances|json_query(query)|int) + 1}}p'

[?name == 'support']|[].volumes[?purpose=='glusterfs'].lun|[0][0]

[?name == 'infranode']|[].volumes[?purpose=='docker'].lun|[0][0]

oc patch storageclass glusterfs-storage -p '{"metadata": {"annotations": {"storageclass.kubernetes.io/is-default-class": "true"}}}'

changesc_r.stdout.find('storageclass "glusterfs-storage" not patched') == -1

changesc_r.stdout.find('storageclass "glusterfs-storage" patched') != -1

changesc_r.stdout.find('storageclass "glusterfs-storage-block" patched') != -1

changesc_r.stdout.find('storageclass "glusterfs-storage-block" not patched') == -1

oc patch storageclass glusterfs-storage-block -p '{"metadata": {"annotations": {"storageclass.kubernetes.io/is-default-class": "false"}}}'

oc set env dc/router ROUTER_ALLOW_WILDCARD_ROUTES=true -n default

oc adm policy add-cluster-role-to-user cluster-admin {{ admin_user }}

oc adm new-project {{admin_project}} --admin {{admin_user}} --node-selector='env=infra'

oc adm policy add-scc-to-group anyuid system:serviceaccounts:{{admin_project}}

oc patch scc/anyuid --patch '{"requiredDropCapabilities":["MKNOD","SYS_CHROOT"]}'

oc annotate namespace openshift-template-service-broker openshift.io/node-selector="" --overwrite

oc annotate -n default --overwrite clusterrolebinding.rbac self-provisioners rbac.authorization.kubernetes.io/autoupdate=false

oadm policy remove-cluster-role-from-group self-provisioner system:authenticated system:authenticated:oauth

oadm policy add-cluster-role-to-group self-provisioner OPENTLC-PROJECT-PROVISIONERS

oc create -f /root/project-template.yml -n default || oc replace -f /root/project-template.yml -n default

oc tag --source=docker registry.access.redhat.com/openshift3/jenkins-2-rhel7:v{{ repo_version }} openshift/jenkins:v{{ repo_version }} -n openshift

oc tag openshift/jenkins:v{{ repo_version }} openshift/jenkins:latest -n openshift

docker pull registry.access.redhat.com/openshift3/ose-recycler:latest

docker tag registry.access.redhat.com/openshift3/ose-recycler:latest registry.access.redhat.com/openshift3/ose-recycler:v{{ osrelease }}

oc patch daemonset dockergc --patch='"spec": { "template": { "spec": { "containers": [ { "command": [ "/usr/bin/oc" ], "name": "dockergc" } ] } } }' -n default

oc delete pod $(oc get pods -n default|grep dockergc|awk -c '{print $1}') -n default

{{ ANSIBLE_REPO_PATH }}/configs/{{ env_type }}/files/ocp_report.adoc.j2

{{ ANSIBLE_REPO_PATH }}/workdir/ocp_report_{{ env_type }}-{{ guid }}.adoc

{{ ANSIBLE_REPO_PATH }}/configs/{{ env_type }}/files/hosts_template.j2

{{ ANSIBLE_REPO_PATH }}/workdir/scaleup_hosts-{{ env_type }}-{{ guid }}

aws route53 list-hosted-zones-by-name --region={{aws_region_final|d(aws_region)}} --dns-name={{guid}}.internal. --output text --query='HostedZones[*].Id' | awk -F'/' '{print $3}'

aws route53 change-resource-record-sets --hosted-zone-id {{internal_zone_id}}  --change-batch file://{{ ANSIBLE_REPO_PATH }}/workdir/internal_dns-{{ env_type }}-{{ guid }}_DELETE.json --region={{aws_region}}

"{{env_type}}-{{guid}}" in hostvars[item].{{cloud_provider}}_tag_Project

  image-gc-high-threshold:
    - "90"
  image-gc-low-threshold:
    - "80"

{{ ANSIBLE_REPO_PATH }}/workdir/internal_dns-{{ env_type }}-{{ guid }}.json

{{ ANSIBLE_REPO_PATH }}/workdir/internal_dns-{{ env_type }}-{{ guid }}_DELETE.json

aws route53 list-hosted-zones-by-name --region={{aws_region}} --dns-name={{guid}}.internal. --output text --query='HostedZones[*].Id' | awk -F'/' '{print $3}'

aws route53 change-resource-record-sets --hosted-zone-id {{internal_zone_id}}  --change-batch file://{{ ANSIBLE_REPO_PATH }}/workdir/internal_dns-{{ env_type }}-{{ guid }}.json --region={{aws_region}}

aws route53 change-resource-record-sets --hosted-zone-id {{internal_zone_id}}  --change-batch file://{{ ANSIBLE_REPO_PATH }}/workdir/internal_dns-{{ env_type }}-{{ guid }}_DELETE.json --region={{aws_region_final|d(aws_region)}}

{{ ANSIBLE_REPO_PATH }}/workdir/ec2_cloud_template.{{ env_type }}.{{ guid }}.json

{{ ANSIBLE_REPO_PATH }}/cloud_providers/{{ cloud_provider }}/save_environment.yml

{{ ANSIBLE_REPO_PATH }}/cloud_providers/{{ cloud_provider }}/delete_application.yml

aws route53 change-resource-record-sets --hosted-zone-id {{internal_zone_id}}  --change-batch file://{{ ANSIBLE_REPO_PATH }}/workdir/internal_dns-{{ env_type }}-{{ guid }}.json --region={{aws_region_final|d(aws_region)}}

{{ ANSIBLE_REPO_PATH }}/configs/{{ env_type }}/files/opentlc-sample-config.sh.j2

{{ ANSIBLE_REPO_PATH }}/workdir/ssh-config-{{ env_type }}-{{ guid }}

{{ ANSIBLE_REPO_PATH }}/workdir/{{ cloud_provider }}_cloud_template.{{ env_type }}.{{ guid }}.json

{{ hostvars[ groups[ ('tag_' ~ env_type ~ '_' ~ guid ~ '_bastion') | replace('-', '_') ].0 ]['ec2_public_dns_name'] }}

{{ hostvars[ groups[ ('tag_' ~ env_type ~ '_' ~ guid ~ '_support') | replace('-', '_') ].0 ]['ec2_public_dns_name'] }}

{{ oc_path }} create -f /root/pvs-{{ env_type }}-{{ guid }}.yml || {{ oc_path }} update -f /root/pvs-{{ env_type }}-{{ guid }}.yml

{{ oc_path }} create -f /root/userpvs-{{ env_type }}-{{ guid }}.yml || {{ oc_path }} update -f /root/userpvs-{{ env_type }}-{{ guid }}.yml

{{ oc_path }} adm policy add-cluster-role-to-user cluster-admin admin

{{ oc_path }} adm new-project workshop-infra --admin admin --node-selector='env=infra'

{{ oc_path }} adm pod-network make-projects-global workshop-infra

{{ oc_path }} adm policy add-scc-to-group anyuid system:serviceaccounts:workshop-infra

{{ oc_path }} patch scc/anyuid --patch '{"requiredDropCapabilities":["MKNOD","SYS_CHROOT"]}'

{{ oc_path }} create -f /root/openjdk-is.yaml -n openshift || {{ oc_path }} replace -f /root/openjdk-is.yaml -n openshift

{{ oc_path }} create -f /root/java-s2i-is.yaml -n openshift || {{ oc_path }} replace -f /root/java-s2i-is.yaml -n openshift

{{ oc_path }} create -f https://raw.githubusercontent.com/openshift-roadshow/nationalparks/1.0.0/ose3/pipeline-template.yaml -n openshift || {{ oc_path }} replace -f https://raw.githubusercontent.com/openshift-roadshow/nationalparks/1.0.0/ose3/pipeline-template.yaml -n openshift

{{ oc_path }} process -f /root/gitlab-template.yaml -v APPLICATION_HOSTNAME=gitlab-ce-workshop-infra.{{ cloudapps_suffix }} -v GITLAB_ROOT_PASSWORD=password | {{ oc_path }} create -f - -n workshop-infra

{{ oc_path }} annotate service gitlab-ce service.alpha.openshift.io/dependencies='[{"name":"gitlab-ce-postgresql","namespace":"","kind":"Service"},{"name":"gitlab-ce-redis","namespace":"","kind":"Service"}]' --overwrite -n workshop-infra

{{ oc_path }} new-app --name=labs jboss-eap70-openshift~{{ lab_url }}#{{ lab_tag }} -e ROUTER_ADDRESS={{cloudapps_suffix}} -e CONSOLE_ADDRESS=master.{{subdomain_base}} -e DEFAULT_LAB=roadshow -e NODES={{ num_nodes }} -e NUM_USERS={{ user_vols }} -e WORKSHOPS_URLS={{ lab_content }} -n workshop-infra; {{ oc_path }} expose service labs -n workshop-infra

{{ oc_path }} create -f /root/project-template.yaml -n default || {{ oc_path }} replace -f /root/project-template.yaml -n default

ansible-playbook -i localhost /root/userprovision.yaml -e config={{ env_type }} -e user={{ item }} -e root_token={{ root_token }} -e gitlab_hostname={{ gitlab_hostname }}

{{ oc_path }} new-app --name=mysql-pad --template=mysql-ephemeral -p MYSQL_USER=etherpad -p MYSQL_PASSWORD=etherpad -p MYSQL_DATABASE=etherpad -p DATABASE_SERVICE_NAME=mysql-pad -n workshop-infra

{{ oc_path }} new-app --name=etherpad centos/etherpad -e DB_HOST=mysql-pad -e DB_DBID=etherpad -e DB_PASS=etherpad -e DB_USER=etherpad -e DB_PORT=3306 -n workshop-infra

{{ oc_path }} annotate service etherpad service.alpha.openshift.io/dependencies='[{"name":"mysql-pad","namespace":"","kind":"Service"}]' --overwrite -n workshop-infra

confirm=false&email={{ item }}@example.com&username={{ item }}&name={{ item }}&password=openshift3

http://{{ gitlab_hostname }}/api/v3/projects/{{ item }}%2Fnationalparks

{{ oc_path }} new-project explore-{{user}} --as=user{{user}} --skip-config-write

http://{{ gitlab_hostname }}/api/v3/projects/user{{user}}%2Fnationalparks

{{ aws_region_final|d(aws_region) | default(region) | default('us-east-1')}}

{{ aws_region_final|d(aws_region) | default(region) | default('us-east-1') }}

{{ aws_region_final | d(aws_region) | d(region) | d('us-east-1') }}

ssh-keygen -b 2048 -t rsa -f "{{ ANSIBLE_REPO_PATH }}/workdir/{{ env_authorized_key }}" -q -N ""

ssh-keygen -y -f "{{ ANSIBLE_REPO_PATH }}/workdir/{{ env_authorized_key }}" > "{{ ANSIBLE_REPO_PATH }}/workdir/{{ env_authorized_key }}.pub"

/bin/ansible-playbook -i /etc/ansible/hosts -e hosts_to_apply="masters" /root/openshift-psap/playbooks/nvidia-driver-install.yaml

/bin/ansible-playbook -i /etc/ansible/hosts -e hosts_to_apply="masters" /root/openshift-psap/playbooks/nvidia-container-runtime-hook.yaml

/bin/ansible-playbook -i /etc/ansible/hosts -e hosts_to_apply="masters" -e gpu_hosts="nodes" /root/openshift-psap/playbooks/nvidia-device-plugin.yaml

oc get daemonset -n nvidia-device-plugin nvidia-deviceplugin-daemonset -o jsonpath --template='{.status.numberReady}'

oc get node {{ item }} -o jsonpath --template='{.status.capacity.nvidia\.com/gpu}'

cat /root/openshift-psap/blog/gpu/device-plugin/cuda-vector-add.yaml | grep -v "namespace: nvidia" | oc create -n nvidia-device-plugin -f -

oc get pod -n nvidia-device-plugin cuda-vector-add -o jsonpath --template='{.status.phase}'

{{ cloudformation_out_final.stack_outputs.S3UserSecretAccessKey }}

cloudformation_out_final.stack_outputs.S3UserAccessKey is defined

cloudformation_out_final.stack_outputs.S3UserSecretAccessKey is defined

{{ cloudformation_out_final.stack_outputs.Route53UserAccessKey }}

{{ cloudformation_out_final.stack_outputs.Route53UserSecretAccessKey }}

cloudformation_out_final.stack_outputs.Route53UserAccessKey is defined

cloudformation_out_final.stack_outputs.Route53UserSecretAccessKey is defined

oc create -f /root/pvs-{{ env_type }}-{{ guid }}.yml || oc replace -f /root/pvs-{{ env_type }}-{{ guid }}.yml

oc create -f /root/userpvs-{{ env_type }}-{{ guid }}.yml || oc replace -f /root/userpvs-{{ env_type }}-{{ guid }}.yml

oc adm new-project {{admin_project}} --admin {{admin_user}} --node-selector='node-role.kubernetes.io/infra=true'

oc adm policy remove-cluster-role-from-group self-provisioner system:authenticated system:authenticated:oauth

oc adm policy add-cluster-role-to-group self-provisioner OPENTLC-PROJECT-PROVISIONERS

oc tag openshift/jenkins:v{{ repo_version }} openshift/jenkins:2 -n openshift

docker tag registry.access.redhat.com/openshift3/ose-recycler:latest registry.access.redhat.com/openshift3/ose-recycler:v1.10.0

ansible-playbook -i /etc/ansible/hosts /usr/share/ansible/openshift-ansible/playbooks/openshift-grafana/config.yml

oc policy add-role-to-user admin {{admin_user}} -n openshift-grafana

-A OS_FIREWALL_ALLOW -p tcp -m state --state NEW -m tcp --dport 9100 -j ACCEPT

ansible-playbook -i /etc/ansible/scaleup_hosts /usr/share/ansible/openshift-ansible/playbooks/openshift-node/scaleup.yml

{{ openshift_cli }} new-project {{ project_name }} --description='DO NOT REMOVE THIS PROJECT. NEEDED FOR COOLSTORE DEMO'

{{ openshift_cli }} process -f {{ pipeline_template }} --param=GITHUB_ACCOUNT={{ github_account }} --param=GITHUB_REF={{ github_ref }} --param=MAVEN_MIRROR_URL={{ maven_mirror_url }} -n {{ project_name }} | {{ openshift_cli }} create -f - -n {{ project_name }}

{{ ANSIBLE_REPO_PATH }}/configs/{{env_type}}/create_oc_config.yml

maven_mirror_url is not defined or maven_mirror_url is none or maven_mirror_url|trim() == ""

http://gogs-{{ project_cicd }}.{{ apps_hostname_suffix }}/{{ gogs_user }}/coolstore-microservice

http://hystrix-dashboard-{{ project_prod }}.{{ apps_hostname_suffix }}

{{ openshift_cli }} delete project {{ project_cicd }} {{ project_prod }} {{ project_stage }} {{ project_test }} {{ project_dev }}

{{ openshift_cli }} scale --replicas={{ item.metadata.annotations['idling.alpha.openshift.io/previous-scale'] }} dc {{ item.metadata.name }} -n {{ project_default }}

{{ deploymentconfigs_list.stdout|from_json|json_query('items') }}

result|success and item.metadata.annotations is defined and item.metadata.annotations['idling.alpha.openshift.io/previous-scale'] is defined and item.metadata.annotations['idling.alpha.openshift.io/previous-scale'] is not none and item.metadata.annotations['idling.alpha.openshift.io/previous-scale']|trim() != ""

{{ openshift_cli }} scale --replicas={{ item.metadata.annotations['idling.alpha.openshift.io/previous-scale'] }} dc {{ item.metadata.name }} -n {{ project_cicd }}

{{ openshift_cli }} scale --replicas={{ item.metadata.annotations['idling.alpha.openshift.io/previous-scale'] }} dc {{ item.metadata.name }} -n {{ project_prod }}

{{ openshift_cli }} scale --replicas={{ item.metadata.annotations['idling.alpha.openshift.io/previous-scale'] }} dc {{ item.metadata.name }} -n {{ project_stage }}

{{ openshift_cli }} scale --replicas={{ item.metadata.annotations['idling.alpha.openshift.io/previous-scale'] }} dc {{ item.metadata.name }} -n {{ project_test }}

{{ openshift_cli }} scale --replicas={{ item.metadata.annotations['idling.alpha.openshift.io/previous-scale'] }} dc {{ item.metadata.name }} -n {{ project_dev }}

oc get pods -n {{ project_cicd }} -l comp-type=database | grep '\-deploy\s' | grep 'Running'

oc get pods -n {{ project_prod }} -l comp-type=database | grep '\-deploy\s' | grep 'Running'

oc get pods -n {{ project_test }} -l comp-type=database | grep '\-deploy\s' | grep 'Running'

oc get pods -n {{ project_dev }} -l comp-type=database | grep '\-deploy\s' | grep 'Running'

oc get pods -n {{ project_cicd }} -l comp-type!=database | grep '\-deploy\s' | grep 'Running'

oc get pods -n {{ project_prod }} -l comp-type!=database | grep '\-deploy\s' | grep 'Running'

oc get pods -n {{ project_stage }} -l comp-type!=database | grep '\-deploy\s' | grep 'Running'

oc get pods -n {{ project_test }} -l comp-type!=database | grep '\-deploy\s' | grep 'Running'

oc get pods -n {{ project_dev }} -l comp-type!=database | grep '\-deploy\s' | grep 'Running'

{{ openshift_cli }} get dc -l {{ selector }} -o jsonpath='{.items[*].metadata.name}' -n {{ project_cicd }}

{{ openshift_cli }} get dc {{ deploymentconfigs_list.stdout }} -o json -n {{ project_cicd }}

{{ openshift_cli }} rollout cancel dc/{{ dc.metadata.name }} -n {{ project_cicd }} | true
sleep 30
{{ openshift_cli }} rollout latest dc/{{ dc.metadata.name }} -n {{ project_cicd }}
{{ openshift_cli }} rollout status dc/{{ dc.metadata.name }} -n {{ project_cicd }}

{{ openshift_cli }} get dc -l {{ selector }} -o jsonpath='{.items[*].metadata.name}' -n {{ project_prod }}

{{ openshift_cli }} get dc {{ deploymentconfigs_list.stdout }} -o json -n {{ project_prod }}

{{ openshift_cli }} rollout cancel dc/{{ dc.metadata.name }} -n {{ project_prod }} | true
sleep 30
{{ openshift_cli }} rollout latest dc/{{ dc.metadata.name }} -n {{ project_prod }}
{{ openshift_cli }} rollout status dc/{{ dc.metadata.name }} -n {{ project_prod }}

{{ openshift_cli }} get dc -l {{ selector }} -o jsonpath='{.items[*].metadata.name}' -n {{ project_stage }}

{{ openshift_cli }} get dc {{ deploymentconfigs_list.stdout }} -o json -n {{ project_stage }}

{{ openshift_cli }} rollout cancel dc/{{ dc.metadata.name }} -n {{ project_stage }} | true
sleep 30
{{ openshift_cli }} rollout latest dc/{{ dc.metadata.name }} -n {{ project_stage }}
{{ openshift_cli }} rollout status dc/{{ dc.metadata.name }} -n {{ project_stage }}

{{ openshift_cli }} get dc -l {{ selector }} -o jsonpath='{.items[*].metadata.name}' -n {{ project_test }}

{{ openshift_cli }} get dc {{ deploymentconfigs_list.stdout }} -o json -n {{ project_test }}

{{ openshift_cli }} rollout cancel dc/{{ dc.metadata.name }} -n {{ project_test }} | true
sleep 30
{{ openshift_cli }} rollout latest dc/{{ dc.metadata.name }} -n {{ project_test }}
{{ openshift_cli }} rollout status dc/{{ dc.metadata.name }} -n {{ project_test }}

{{ openshift_cli }} get dc -l {{ selector }} -o jsonpath='{.items[*].metadata.name}' -n {{ project_dev }}

{{ openshift_cli }} get dc {{ deploymentconfigs_list.stdout }} -o json -n {{ project_dev }}

{{ openshift_cli }} rollout cancel dc/{{ dc.metadata.name }} -n {{ project_dev }} | true
sleep 30
{{ openshift_cli }} rollout latest dc/{{ dc.metadata.name }} -n {{ project_dev }}
{{ openshift_cli }} rollout status dc/{{ dc.metadata.name }} -n {{ project_dev }}

'database', 'redis' and 'quay_enterprise' groups must be specified

'redis' not in groups or groups['redis']| length == 0 or 'database' not in groups or groups['database']| length == 0 or 'quay_enterprise' not in groups or groups['quay_enterprise']| length == 0

docker exec -i {{ postgresql_container.stdout }} /bin/bash -c 'PGPASSWORD={{ database_admin_password }} psql {{ database_name }} -c "CREATE EXTENSION pg_trgm;"'

{{ hostvars[groups['database'][0]]['ansible_eth0']['ipv4']['address'] }}

{{ hostvars[groups['redis'][0]]['ansible_eth0']['ipv4']['address'] }}

Host {{ item }}
  Hostname {{ item }}
  ProxyCommand ssh {{ remote_user }}@{{ bastion_hostname.external }} -W %h:%p

aws route53 change-resource-record-sets --hosted-zone-id {{internal_zone_id}} --change-batch file://{{ ANSIBLE_REPO_PATH }}/workdir/internal_dns-{{ env_type }}-{{ guid }}_DELETE.json --region={{aws_region_final|d(aws_region)}}

{{ ANSIBLE_REPO_PATH }}/cloud_providers/ravello/ssh_env_keygen.yml

command  /usr/bin/glance image-upload --file {{ glance_image_location }}/{{ item.dst }}

command nova boot --image {{ item.name }} --flavor {{ item.flavor }} {{ item.name }}

src="{{ item }}" dest="/home/{{ system_user }}/" owner="{{ system_user }}" group="{{ system_user }}"

dest="/home/{{ system_user }}/ansible.cfg" src=ansible.cfg.j2 owner="{{ system_user }}" group="{{ system_user }}"

src="{{ item.src }}" dest="/home/{{ system_user }}/walkthrough/{{ item.dest }}" mode=0755 owner="{{ system_user }}" group="{{ system_user }}"

url=http://releases.ansible.com/ansible-tower/setup/ansible-tower-setup-latest.tar.gz dest=/tmp/ansible-tower-setup-latest.tar.gz   validate_certs=false

tower-cli organization create --name {{ item.org_name }} --description {{ item.org_description }}

tower-cli team create --name {{ item.team_name }} --description {{ item.team_description }} --organization {{ item.team_org_name }}

tower-cli user create  --username {{ item.username }}  --first-name {{ item.first_name }}  --last-name {{ item.last_name }}  --email {{ item.email }}  --password {{ item.password }}   --is-superuser "{{ item.superuser | bool }}"  --is-system-auditor "{{ item.auditor | bool }}"

tower-cli team associate --user {{ item.username }} --team "Lab-Team"

tower-cli organization associate --user {{ item.username }} --organization "Lab-Organization"

{{ ANSIBLE_REPO_PATH }}/configs/{{ env_type }}/files/repos_template.j2

/usr/bin/yum -y localinstall http://{{satellite_url}}/pub/katello-ca-consumer-latest.noarch.rpm

subscription-manager repos --enable=rhel-7-server-satellite-tools-6.2-rpms

/usr/bin/subscription-manager list --all --available --matches="*OpenShift Container Platform*" | awk '/Pool ID/ {print $3}' | head -1

/usr/bin/subscription-manager attach --pool={{ pool_id.stdout }}

dest=/etc/hosts state=present insertafter=EOF line='209.132.183.44   xmlrpc.rhn.redhat.com'

dest=/etc/hosts state=present insertafter=EOF line='23.204.148.218   content-xmlrpc.rhn.redhat.com'

dest=/etc/hosts state=present insertafter=EOF line='209.132.183.49   subscription.rhn.redhat.com'

dest=/etc/hosts state=present insertafter=EOF line='209.132.182.63   registry.access.redhat.com'

dest=/etc/hosts state=present insertafter=EOF line='209.132.182.33   repository.jboss.org'

subscription-manager register --username="{{ username }}" --password="{{ password }}" --force

subscription-manager repos --list-enabled | egrep 'rhel-7-server-extras-rpms|rhel-7-server-optional-rpms|rhel-7-server-rpms' | wc -l

subscription-manager repos --enable="rhel-7-server-rpms" --enable="rhel-7-server-extras-rpms" --enable="rhel-7-server-optional-rpms"

template src={{ role_path }}/files/bastion_ssh_config.j2 dest={{ ANSIBLE_REPO_PATH }}/workdir/ssh-config-{{ env_type }}-{{ guid }}

/usr/sbin/ipa-client-install --domain=OPENTLC.COM -w '{{ipa_host_password}}' -N -U --mkhomedir --no-dns-sshfp --hostname={{bastion_public_dns_chomped}} {{ipa_additional_options|d('')}}

/usr/sbin/ipa-client-install --uninstall; rm -f /var/lib/ipa-client/sysrestore.state; /usr/sbin/ipa-client-install --domain=OPENTLC.COM -w '{{ipa_host_password}}' -N -U --mkhomedir --no-dns-sshfp --hostname={{bastion_public_dns_chomped}} {{ipa_additional_options|d('')}}

/usr/sbin/ipa-client-install --domain=OPENTLC.COM -p {{ipa_kerberos_user}} -w '{{ipa_kerberos_password}}' -N -U --mkhomedir --no-dns-sshfp --hostname={{bastion_public_dns_chomped}} {{ipa_additional_options|d('')}}

/usr/sbin/ipa-client-install --uninstall; rm -f /var/lib/ipa-client/sysrestore.state; /usr/sbin/ipa-client-install --domain=OPENTLC.COM -p {{ipa_kerberos_user}} -w '{{ipa_kerberos_password}}' -N -U --mkhomedir --no-dns-sshfp --hostname={{bastion_public_dns_chomped}} {{ipa_additional_options|d('')}}

/usr/bin/subscription-manager list --all --available --matches="*{{rhn_pool_id_string}}*" | awk '/Pool ID/ {print $3}' | head -1

-A INPUT -p TCP -m state --state NEW -m TCP --dport {{ mysql_host_port }} -j ACCEPT

{{ lookup('password', '/dev/null length=5 chars=ascii_letters') | lower }}

mysql_root_username is undefined and mysql_root_username|trim == ""

{{ lookup('password', '/dev/null length=10 chars=ascii_letters,digits,hexdigits') }}

mysql_root_password is undefined and mysql_root_password|trim == ""

-A INPUT -p TCP -m state --state NEW -m TCP --dport {{ postgresql_port }} -j ACCEPT

postgresql_username is undefined and postgresql_username|trim == ""

postgresql_password is undefined and postgresql_password|trim == ""

postgresql_admin_user is undefined and postgresql_admin_user|trim == ""

postgresql_admin_password is undefined and postgresql_admin_password|trim == ""

{{ remote_container_credentials_file.content| b64decode | from_json }}

{ '{{quay_registry_server}}':{ 'email': '{{ quay_registry_email }}', 'auth': '{{ quay_registry_auth }}' } }

{{ container_credentials_file_content | combine(quay_container_credentials, recursive=True) }}

-A INPUT -p TCP -m state --state NEW -m TCP --dport {{ item }} -j ACCEPT

Invalid Database Type. 'database_type' must be 'postgresql' or 'mysql'

(quay_registry_server | trim != "") and ((quay_registry_auth | trim != "") or (quay_registry_email | trim != ""))

openssl req -nodes -x509 -newkey rsa:4096 -keyout {{ ssl_remote_tmp_dir.stdout }}/ssl.key -out {{ ssl_remote_tmp_dir.stdout }}/ssl.cert -subj "/C={{ quay_ssl_generate_country }}/ST={{ quay_ssl_generate_state }}/L={{ quay_ssl_generate_city }}/O={{ quay_ssl_generate_organization }}/OU={{ quay_ssl_generate_organizational_unit }}/CN={{ quay_ssl_generate_hostname }}" -days {{ quay_ssl_generate_days_validity }}

-A INPUT -p TCP -m state --state NEW -m TCP --dport {{ redis_port }} -j ACCEPT

ansible-playbook -i /etc/ansible/hosts /root/openshift-ansible/playbooks/byo/config.yml

ansible-playbook -i /etc/ansible/hosts /usr/share/ansible/openshift-ansible/playbooks/byo/config.yml

ansible-playbook -i /etc/ansible/hosts /root/openshift-ansible/playbooks/prerequisites.yml

ansible-playbook -i /etc/ansible/hosts /usr/share/ansible/openshift-ansible/playbooks/prerequisites.yml

ansible-playbook -i /etc/ansible/hosts /root/openshift-ansible/playbooks/deploy_cluster.yml

ansible-playbook -i /etc/ansible/hosts /usr/share/ansible/openshift-ansible/playbooks/deploy_cluster.yml

for i in $(seq 40); do
  docker pull {{item}}:v{{osrelease}}
  RET=$?
  [ $RET = 0 ] && exit 0
  sleep 5
done
exit $RET

  docker pull {{item}}
  RET=$?
  sleep 5
done
exit $RET

  docker pull openshift3/{{item}}
  RET=$?
  sleep 5
done
exit $RET

(install_idm is defined and install_idm == "ldap") or 'ldap' in install_idms|d([])

  IdentityFile {{ ssh_key | default(ansible_ssh_private_key_file) | default(default_key_name)}}

{{ aws_region_final | default(aws_region) | default(region) | default('us-east-1')}}

{{ aws_region_loop | d(aws_region) | d(region) | d('us-east-1')}}

cloudformation_out is succeeded or cloudformation_out.output in ["Stack CREATE complete", "Stack is already up-to-date."]

{{ANSIBLE_REPO_PATH}}/workdir/{{ env_type }}.{{ guid }}.{{cloud_provider}}_cloud_template-orig

jq -c . < {{ ANSIBLE_REPO_PATH }}/workdir/{{ env_type }}.{{ guid }}.{{cloud_provider}}_cloud_template-orig >  ../workdir/{{ env_type }}.{{ guid }}.{{cloud_provider}}_cloud_template

cp {{ ANSIBLE_REPO_PATH }}/workdir/{{ env_type }}.{{ guid }}.{{cloud_provider}}_cloud_template-orig ../workdir/{{ env_type }}.{{ guid }}.{{cloud_provider}}_cloud_template

aws cloudformation validate-template --region {{ aws_region_final | d(aws_region) | default(region) | default('us-east-1')}} --template-body file://../workdir/{{ env_type }}.{{ guid }}.{{cloud_provider}}_cloud_template

oc new-project aws-service-broker --node-selector='node-role.kubernetes.io/infra=true'

AWS_ACCESS_KEY_ID="{{ hostvars['localhost'].route53user_access_key }}"

/root/acme.sh/acme.sh {{ acme_args|d('') }} --issue -d {{ master_lb_dns }} -d *.{{ cloudapps_suffix }} --dns dns_aws

/root/acme.sh/acme.sh {{ acme_args|d('') }} --issue -d {{ master_lb_dns }} -d *.{{ cloudapps_suffix }} --dns dns_azure

/root/acme.sh/acme.sh {{ acme_args|d('') }} --cron --home /root/.acme.sh > /dev/null

oc new-app -f /root/nexus-template.yaml --param=VOLUME_CAPACITY=10Gi --param=MAX_MEMORY=8Gi -n {{desired_project}}

oc process -f https://raw.githubusercontent.com/apache/incubator-openwhisk-deploy-openshift/master/persistent-template.yml|oc create -f - -n openwhisk

oc process -f https://raw.githubusercontent.com/apache/incubator-openwhisk-deploy-openshift/master/persistent-template.yml > /root/openwhisk.json

oc label node infranode1.{{ chomped_zone_internal_dns }} prometheus-host=true --overwrite

oc new-project prometheus --display-name="Prometheus Monitoring" && oc project default

oc set env dc router -n default --list|grep STATS_PASSWORD|awk -F"=" '{print $2}'

oc new-app -f https://raw.githubusercontent.com/wkulhanek/openshift-prometheus/{{ prometheus_tag }}/prometheus.yaml --param ROUTER_PASSWORD={{ router_password.stdout }} -n prometheus

oc adm policy add-scc-to-user privileged system:serviceaccount:prometheus:prometheus

oc adm policy add-scc-to-user privileged system:serviceaccount:prometheus:default

oc new-app -f https://raw.githubusercontent.com/wkulhanek/openshift-prometheus/{{ prometheus_tag }}/node-exporter/node-exporter.yaml -n prometheus

oc new-app -f https://raw.githubusercontent.com/wkulhanek/openshift-prometheus/{{ prometheus_tag }}/alertmanager/alertmanager.yaml --param "WEBHOOK_URL={{ webhook_url }}" -n prometheus

oc patch dc alertmanager --patch '{ "spec": { "template": { "spec": { "nodeSelector": { "env":"infra"}}}}}' -n prometheus

oc new-app -f https://raw.githubusercontent.com/wkulhanek/docker-openshift-grafana/{{ grafana_tag }}/grafana.yaml -n prometheus

oc patch dc grafana --patch '{ "spec": { "template": { "spec": { "nodeSelector": { "env":"infra"}}}}}' -n prometheus

-A OS_FIREWALL_ALLOW -p tcp -m state --state NEW -m tcp --dport 1936 -j ACCEPT

inventory_hostname not in groups['support'] and inventory_hostname not in groups['bastions']

tower-cli credential create --credential-type 'Amazon Web Services' --name "AWS Access Key"  --organization Default --inputs @/tmp/read_only.json

ip addr show eth0 | grep 'inet ' | awk '{print $2}' | cut -d/ -f1

ipa-server-install -U --setup-dns --ip-address={{local_ip.stdout}} --hostname={{ ipa_public_dns_chomped }} --domain={{ ipa_domain }} --realm={{ ipa_realm }} --ds-password={{ ipa_directory_manager_password }} --admin-password={{ ipa_principal_user_password }}  --no-forwarders

nodejs_package_json_path is defined and nodejs_package_json_path

deb https://deb.nodesource.com/node_{{ nodejs_version }} {{ ansible_distribution_release }} main

deb-src https://deb.nodesource.com/node_{{ nodejs_version }} {{ ansible_distribution_release }} main

name=nodejs={{ nodejs_version|regex_replace('x', '') }}* state=present

http://rpm.nodesource.com/{{ nodejs_rhel_rpm_dir }}/el/{{ ansible_distribution_major_version }}/{{ ansible_architecture }}/nodesource-release-el{{ ansible_distribution_major_version }}-1.noarch.rpm

https://rpm.nodesource.com/{{ nodejs_rhel_rpm_dir }}/el/{{ ansible_distribution_major_version }}/{{ ansible_architecture }}/nodesource-release-el{{ ansible_distribution_major_version }}-1.noarch.rpm

name=nodejs-{{ nodejs_version[0] }}.* state=present enablerepo='epel,nodesource'

curl --insecure -X POST 'https://secure-sso-{{sso_project}}.{{ocp_apps_domain}}/auth/realms/master/protocol/openid-connect/token' -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=keyadmin' -d 'password=keypassword' -d 'grant_type=password' -d 'client_id=admin-cli'

curl --insecure 'https://secure-sso-{{sso_project}}.{{ocp_apps_domain}}/auth/admin/realms/insurance/clients' -H 'Content-Type: application/json' -H 'Authorization: Bearer {{TKN}}'

curl --insecure 'https://secure-sso-{{sso_project}}.{{ocp_apps_domain}}/auth/admin/realms/insurance/clients/1/service-account-user' -H 'Content-Type: application/json' -H 'Authorization: Bearer {{TKN}}'

curl --insecure 'https://secure-sso-{{sso_project}}.{{ocp_apps_domain}}/auth/admin/realms/insurance/users/{{IdUser}}/role-mappings/clients/{{IdClient}}/available' -H 'Content-Type: application/json' -H 'Authorization: Bearer {{TKN}}'

curl --insecure -X POST 'https://secure-sso-{{sso_project}}.{{ocp_apps_domain}}/auth/admin/realms/insurance/users/{{IdUser}}/role-mappings/clients/{{IdClient}}' -H 'Content-Type: application/json' -H 'Authorization: Bearer {{TKN}}' -d '{{IdRole | to_json}}'

curl --insecure 'https://secure-sso-{{sso_project}}.{{ocp_apps_domain}}/auth/admin/realms/insurance/clients/1/client-secret' -H 'Content-Type: application/json' -H 'Authorization: Bearer {{TKN}}'

oc get dc system-app -o jsonpath='{.spec.template.spec.containers[?(@.name=="system-provider")].env[?(@.name=="ADMIN_ACCESS_TOKEN")].value}' -n {{ threescale_project }}

access_token={{access_token}}&endpoint={{ ('https://accidentalert-production.amp.' + guid + '.' + ocp_apps_domain + ':443') | urlencode }}&api_backend={{ ('http://accidentalert-backend-' + service_project + '.' +  ocp_apps_domain + ':80') | urlencode }}&sandbox_endpoint={{ ('https://accidentalert-staging.amp.' + guid + '.' + ocp_apps_domain + ':443') | urlencode }}&oidc_issuer_endpoint={{ ('http://3scale-admin:' + client_secret + '@sso-' + sso_project + '.' + ocp_apps_domain + '/auth/realms/insurance') | urlencode }}

oc delete clusterresourcequota clusterquota-{{ocp_username}}-{{guid}}

oc new-project {{sso_project}} --display-name='Red Hat Single Sign On'

oc create -f https://raw.githubusercontent.com/jboss-openshift/application-templates/{{sso_version}}/secrets/sso-app-secret.json -n {{sso_project}}

oc policy add-role-to-user view system:serviceaccount:{{sso_project}}:sso-service-account -n {{sso_project}}

oc new-app sso71-https -p HTTPS_NAME=jboss -p HTTPS_PASSWORD=mykeystorepass -p SSO_ADMIN_USERNAME=keyadmin -p SSO_ADMIN_PASSWORD=keypassword -n {{sso_project}}

oc new-project {{service_project}} --display-name='Alert Center Backend Service'

oc process -f https://raw.githubusercontent.com/jbossdemocentral/3scale-security-oidc-demo/master/support/templates/amq63-basic-template.json -p MQ_USERNAME=admin -p MQ_PASSWORD=admin | oc create -n {{service_project}} -f -

oc process -f https://raw.githubusercontent.com/jbossdemocentral/3scale-security-oidc-demo/master/support/templates/accidentalert-backend-template.json -p APP_NAME=accidentalert-backend -p GIT_REPO=https://github.com/jbossdemocentral/3scale-security-oidc-demo.git -p GIT_REF=master -p CONTEXT_DIR=/projects/myaccidentalert -p ACTIVEMQ_BROKER_USERNAME=admin -p ACTIVEMQ_BROKER_PASSWORD=admin -p CPU_REQUEST=1 -p MEMORY_REQUEST=512Mi -p MEMORY_LIMIT=1024Mi | oc create -n {{service_project}} -f -

oc new-project {{www_project}} --display-name='Alert Center Web Application'

oc process -f https://raw.githubusercontent.com/jbossdemocentral/3scale-security-oidc-demo/master/support/templates/accidentalert-ui-template.json -p SSO_URL='http://sso-{{sso_project}}.{{ocp_apps_domain}}' -p BACKEND_URL='http://accidentalert-backend-{{service_project}}.{{ocp_apps_domain}}' -p APPLICATION_HOSTNAME='www-accidentalert-{{guid}}.{{ocp_apps_domain}}' | oc -n {{www_project}} create -f -

oc new-project {{threescale_project}} --display-name='3scale API Management'

oc new-app -f https://raw.githubusercontent.com/jbossdemocentral/3scale-security-oidc-demo/master/support/templates/amp-template.json --param WILDCARD_DOMAIN={{guid}}.{{ocp_apps_domain}} --param ADMIN_PASSWORD=password --param WILDCARD_POLICY=Subdomain -n {{threescale_project}}

oc policy add-role-to-user admin {{ocp_username}} -n {{sso_project}}

oc policy add-role-to-user admin {{ocp_username}} -n {{threescale_project}}

oc policy add-role-to-user admin {{ocp_username}} -n {{service_project}}

oc policy add-role-to-user admin {{ocp_username}} -n {{www_project}}

oc create clusterquota clusterquota-"{{ocp_username}}-{{guid}}" \
--project-annotation-selector=openshift.io/requester="{{ocp_username}}" \
--hard requests.cpu="{{quota_requests_cpu}}" \
--hard limits.cpu="{{quota_limits_cpu}}"  \
--hard requests.memory="{{quota_requests_memory}}" \
--hard limits.memory="{{quota_limits_memory}}" \
--hard configmaps="{{quota_configmaps}}" \
--hard pods="{{quota_pods}}" \
--hard persistentvolumeclaims="{{quota_persistentvolumeclaims}}"  \
--hard services="{{quota_services}}" \
--hard secrets="{{quota_secrets}}" \
--hard requests.storage="{{quota_requests_storage}}"

item.metadata.annotations['openshift.io/requester'] == "{{ocp_username}}"

items[?  (status.phase != 'Complete') ].metadata.annotations."openshift.io/build-config.name"

build_state.stdout |from_json |json_query(query) |intersect(build_to_wait) |length == 0

rc_state.stdout |from_json |json_query('items[?  (status.readyReplicas == ""|| status.readyReplicas == `0`) ].metadata.annotations."openshift.io/deployment-config.name"') |intersect(pod_to_wait) |length == 0

oc new-app -f "{{ modified_template_path }}" \
           -p "ADMIN_PASSWORD={{ amp_admin_passwd }}" \
           -p "TENANT_NAME={{ocp_project}}" \
           -p "MASTER_NAME={{ocp_project}}-master" \
           -p "MASTER_PASSWORD={{master_passwd}}" \
           -p "MASTER_ACCESS_TOKEN={{master_access_token}}" \
           -p "WILDCARD_DOMAIN={{ ocp_apps_domain }}" \
           -n "{{ ocp_project }}" \
           > {{new_app_output}}

Creation of tenants complete.  output files available at {{tenant_output_dir}}

ansible-playbook -i "enmasse," -c local {{enmasse_dest_dir}}/ansible/playbooks/openshift/{{enmasse_template_file}} \
-e namespace={{namespace}} \
-e multitenant=true \
-e address_space_type=standard \
-e address_space_plan=unlimited-standard \
> /tmp/{{namespace}}/enmasse_install_standard.log

oc annotate namespace {{namespace}} openshift.io/requester={{ocp_username}} --overwrite

oc policy add-role-to-user admin {{ocp_username}} -n {{namespace}}

oc create clusterresourcequota clusterquota-"{{ocp_username}}-{{guid}}" \

oc policy add-role-to-user view {{ocp_username}} -n {{gpte_jenkins_project}}

oc policy remove-role-from-user view {{ocp_username}} -n {{gpte_jenkins_project}}

oc policy add-role-to-user admin {{ocp_username}} -n {{ocp_constraints_project}}

oc delete limitrange {{ocp_constraints_project}}-core-resource-limits -n {{ocp_constraints_project}}

oc annotate namespace {{ocp_constraints_project}} openshift.io/requester={{ocp_username}} --overwrite

oc create -f https://raw.githubusercontent.com/gpe-mw-training/bxms_decision_mgmt_foundations_lab/master/resources/rhdm7-full-ng.yaml -n {{ocp_project}}

oc new-app --name=dm-demo -n {{ocp_project}} --template=rhdm7-full-ng \
-p RHT_IMAGE_STREAM_NAMESPACE={{ocp_project}} \
-p KIE_ADMIN_PWD=test1234! \
-p MAVEN_REPO_PASSWORD=test1234! \
-p CLUSTER={{ocp_apps_domain}} \
-p PROJECT={{ocp_project}} \
-p APPLICATION_NAME=gpte > /tmp/{{guid}}/gpte-dm-demo.txt

oc annotate namespace {{ocp_project}} openshift.io/requester={{ocp_username}} --overwrite

oc policy add-role-to-user admin {{ocp_username}} -n {{ocp_project}}

oc create -f /tmp/{{guid}}/rhpam70-image-streams.yaml -n {{ocp_project}}

oc new-app --template={{pam_secrets_template_name}} \
-p SECRET_NAME={{kserver_app_secret}} \
-n {{ocp_project}}

-p SECRET_NAME={{bcentral_app_secret}} \

oc new-app --name=pam-lab -n {{ocp_project}} --template={{pam_template_name}} \
-p IMAGE_STREAM_NAMESPACE={{ocp_project}} \
-p KIE_ADMIN_PWD={{kie_admin_passwd}} \
-p MAVEN_REPO_URL={{MAVEN_REPO_URL}} \
-p APPLICATION_NAME={{app_name}} \
-p BUSINESS_CENTRAL_HTTPS_SECRET={{bcentral_app_secret}} \
-p KIE_SERVER_HTTPS_SECRET={{kserver_app_secret}} \
-n {{ocp_project}} > /tmp/{{guid}}/gpte-pam-lab.txt

item.metadata.annotations['openshift.io/requester'] == ocp_username

item.metadata.labels is not defined or item.metadata.labels['AAD'] is not defined

oc new-project {{ocp_project}} \
--display-name="Client Onboarding" \
--description="Red Hat JBoss BPM Suite & Entando 'Client Onboarding' FSI Demo"

oc create -f https://raw.githubusercontent.com/jboss-openshift/application-templates/master/processserver/processserver64-image-stream.json -n {{ocp_project}}

oc create -f https://raw.githubusercontent.com/jboss-openshift/application-templates/master/processserver/processserver64-postgresql-s2i.json -n {{ocp_project}}

oc process -f /tmp/{{guid}}/secrets-and-accounts.yaml | oc create -n {{ocp_project}} -f  -

oc policy add-role-to-user view system:serviceaccount:{{ocp_project}}:processserver-service-account

oc new-app https://github.com/entando/fsi-customer-openshift --name fsi-customer -n {{ocp_project}}

oc expose svc fsi-customer --name=entando-fsi-customer --path=/fsi-customer/ -n {{ocp_project}}

oc new-app entando-base-image-432:latest~https://github.com/entando/fsi-backoffice-openshift --name fsi-backoffice --strategy=docker --allow-missing-imagestream-tags -n {{ocp_project}}

oc expose svc fsi-backoffice --name=entando-fsi-backoffice --path=/fsi-backoffice/ -n {{ocp_project}}

oc process \
-f "/tmp/{{guid}}/client-onboarding-process.yaml" \
-p GIT_URI="https://github.com/entando/fsi-onboarding-bpm" \
-p GIT_REF="master" \
-p ENTANDO_BASE_URL="http://{{fsi_customer_route}}/fsi-customer/" \
-n {{ocp_project}} | oc create -f - -n {{ocp_project}}

oc patch bc/co --type="json" \
-p="[{'op': 'replace', 'path': '/spec/strategy/sourceStrategy/from/namespace', 'value': '{{ocp_project}}'}]"

oc new-app {{ignite_template_name}} \
-p ROUTE_HOSTNAME=fuse.{{ocp_project}}.{{ocp_apps_domain}} \
-p OPENSHIFT_MASTER=https://master.{{ocp_domain}} \
-p OPENSHIFT_PROJECT={{ocp_project}} \
-p POSTGRESQL_MEMORY_LIMIT={{POSTGRESQL_MEMORY_LIMIT}} \
-p PROMETHEUS_MEMORY_LIMIT={{PROMETHEUS_MEMORY_LIMIT}} \
-p META_MEMORY_LIMIT={{META_MEMORY_LIMIT}} \
-p SERVER_MEMORY_LIMIT={{SERVER_MEMORY_LIMIT}} \
-p OPENSHIFT_OAUTH_CLIENT_SECRET=$(oc sa get-token syndesis-oauth-client -n {{ocp_project}}) \
-p MAX_INTEGRATIONS_PER_USER={{MAX_INTEGRATIONS_PER_USER}} \

oc rollout resume dc/syndesis-oauthproxy dc/syndesis-db -n {{ocp_project}}

oc create configmap app-config --from-file=/tmp/{{ocp_project}}/app-config.yaml -n {{ocp_project}}

oc new-app \
-f /tmp/{{ocp_project}}/coolstore-catalog-mongodb-persistent.yaml \
-p CATALOG_DB_USERNAME=mongo \
-p CATALOG_DB_PASSWORD=mongo \
-n {{ocp_project}} 

oc create -f {{fuse_artifact_base_url}}/quickstarts/{{item}} -n openshift

--display-name="IoT Demo - {{guid}}" \
--description="Industry 4.0 IoT Demo"

oc adm policy add-scc-to-user anyuid -z default -n {{ocp_project}}

oc create -f /tmp/{{guid}}/redhat-iot-rhpds-secret.yml -n {{ocp_project}}

oc create secret generic ec-db --from-literal=name=ecdb --from-literal=username=redhat --from-literal=password=RedHat123 -n {{ocp_project}}

openssl req -new
  -x509
  -nodes
  -days {{ item.days | default(3650) }}
  -subj "/C={{ item.country | default('') }}/ST={{ item.state | default('') }}/L={{ item.city | default('') }}/O={{ item.organization | default('') }}/OU={{ item.unit | default('') }}/CN={{ item.name }}/emailAddress={{ item.email | default('') }}"
  -newkey rsa:2048
  -keyout /tmp/{{guid}}/certs/key.pem
  -out /tmp/{{guid}}/certs/cert.pem

oc create secret generic ec-crt --from-file=crt=/tmp/{{guid}}/certs/cert.pem --from-file=key=/tmp/{{guid}}/certs/key.pem --from-file=ca=/tmp/{{guid}}/certs/cert.pem -n {{ocp_project}}

oc new-app -e MYSQL_USER=redhat -e MYSQL_PASSWORD=RedHat123 -e MYSQL_DATABASE=ecdb -e MYSQL_LOWER_CASE_TABLE_NAMES=1 -e NAMESPACE=openshift -e VOLUME_CAPACITY=1Gi -e MARIADB_VERSION=10.2 mariadb:10.2 -n {{ocp_project}}

oc new-app -e 'ES_JAVA_OPTS=-Des.cluster.name=kapua-datastore -Des.http.cors.enabled=true -Des.http.cors.allow-origin=* -Xms256m -Xmx256m' elasticsearch:5.4 -n {{ocp_project}}

oc new-app -f /tmp/{{guid}}/broker.yml -p IMAGE_VERSION=5.0.0 -p NAMESPACE={{ocp_project}} -p EC_SECRET_DB=ec-db -p DISABLE_SSL=true -n {{ocp_project}}

oc new-app -f /tmp/{{guid}}/console.yml -p 'IMAGE_VERSION=5.0.0' -p 'NAMESPACE={{ocp_project}}' -p 'EC_SECRET_DB=ec-db' -n {{ocp_project}}

oc new-app -f /tmp/{{guid}}/api.yml -p 'IMAGE_VERSION=5.0.0' -p 'NAMESPACE={{ocp_project}}' -p 'EC_SECRET_DB=ec-db' -n {{ocp_project}}

EC Console is running at http://ec-console-{{ocp_project}}.{{ocp_apps_domain}}

EC Broker is running at: mqtt://ec-broker-mqtt.{{ocp_project}}.{{ocp_apps_domain}}:1883

oc new-project {{ocp_project_completed}} \
--display-name="Parksmap (completed)" \
--description="Project with the Parksmap demo completed (and guides)"

oc apply -f /tmp/{{guid}}/workshop-parksmap.yaml -n {{ocp_project_completed}}

oc apply -f /tmp/{{guid}}/workshop-nationalparks.yaml -n {{ocp_project_completed}}

oc apply -f /tmp/{{guid}}/workshop-mlbparks.yaml -n {{ocp_project_completed}}

oc apply -f /tmp/{{guid}}/workshopper-template.yaml -n {{ocp_project_completed}}

oc new-app starter-guides \
-p CONSOLE_ADDRESS={{ocp_master}} \
-p ROUTER_ADDRESS={{ocp_apps_domain}} \
-p USER_PROJECT={{ocp_project}} \
-p INFRA_PROJECT={{ocp_project_completed}} \
-n "{{ocp_project_completed}}"

Guide has been installed in http://guides-{{ocp_project_completed}}.{{ocp_apps_domain}}

git clone https://github.com/openshift-roadshow/nationalparks.git

git remote add developer http://developer:developer@{{ gogs_hostname }}/developer/nationalparks.git
git config --local user.email "developer@example.com"
git config --local user.name "developer"
git push -f --all developer

oc annotate namespace {{ocp_project_completed}} openshift.io/requester={{ocp_username}} --overwrite

oc policy add-role-to-user admin {{ocp_username}} -n {{ocp_project_completed}}

--display-name="Parksmap" \
--description="Project to exercise the Parksmap demo"

rs_state.stdout |from_json |json_query('items[?  (status.readyReplicas == ""|| status.readyReplicas == `0`) ].metadata.labels."deployment"') |intersect(pod_to_wait) |length == 0

oc adm policy add-scc-to-group anyuid system:authenticated -n istio-system

oc expose svc istio-ingressgateway -n istio-system && \ 
oc expose svc servicegraph -n istio-system && \
oc expose svc grafana -n istio-system && \
oc expose svc prometheus -n istio-system && \
oc expose svc tracing -n istio-system

oc adm policy add-role-to-user edit {{ocp_username}} -n istio-system

oc adm policy add-scc-to-user privileged -z default -n {{ocp_project}} 

oc create configmap app-config --from-file=/tmp/app-config.yaml -n {{ocp_project}}

-f /tmp/coolstore-catalog-mongodb-persistent.yaml \

oc patch deployment/catalog-service \
   -p "{\"spec\":{\"template\":{\"spec\":{\"containers\":[{\"name\":\"catalog-service\",\"image\":\"{{docker_registry_url}}/{{ocp_project}}/catalog-service\"}]}}}}" \
   -n {{ocp_project}}

{{ openshift_cli }} apply -f /tmp/{{guid}}/etherpad-template.yml -n {{ admin_project }}

{{ openshift_cli }} apply -f /tmp/{{guid}}/guides-template.yml -n {{ admin_project }}

{{ openshift_cli }} new-app etherpad --name=etherpad -n {{ admin_project }} --dry-run -o yaml > etherpad.yml

{{ openshift_cli }} apply -f etherpad.yml -n {{ admin_project }}

{{ openshift_cli }} new-app guide -p HOSTNAME={{ guide_hostname }} -p CONSOLE_ADDRESS={{ openshift_master }} -p ROUTER_ADDRESS={{ ocp_apps_domain }} -p GITLAB_URL_PREFIX={{ gogs_urlprefix }} -p ETHERPAD_URL_PREFIX={{ etherpad_urlprefix }} -n {{ admin_project }} --dry-run -o yaml > guide.yml

check if workshop user's project for user "{{ my_user }}" exists

Annotate the project as requested by user for user "{{ my_user }}"

{{ openshift_cli }} annotate namespace {{my_user}} openshift.io/requester={{my_user}} --overwrite

{{ openshift_cli }} adm policy add-role-to-user admin {{ my_user }} -n {{ my_user }}

{{ openshift_cli }} create clusterquota clusterquota-"{{my_user}}" --project-annotation-selector=openshift.io/requester="{{my_user}}" --hard requests.cpu="{{quota_requests_cpu}}" --hard limits.cpu="{{quota_limits_cpu}}"  --hard requests.memory="{{quota_requests_memory}}" --hard limits.memory="{{quota_limits_memory}}" --hard configmaps="{{quota_configmaps}}" --hard pods="{{quota_pods}}" --hard persistentvolumeclaims="{{quota_persistentvolumeclaims}}" --hard services="{{quota_services}}" --hard secrets="{{quota_secrets}}" --hard requests.storage="{{quota_requests_storage}}" --dry-run -o yaml > clusterquota-{{ my_user }}.yml

http://{{ gogs_hostname }}/api/v1/repos/{{ my_user }}/{{ reponame_local }}

git remote add {{ my_user }} http://{{ my_user }}:{{ user_gogs_password }}@{{ gogs_hostname }}/{{ my_user }}/{{ reponame_local }}.git
git config --local user.email "{{ my_user }}@example.com"
git config --local user.name "{{Β my_user }}"
git push -f --all {{ my_user }}

start={{user_count_start}} end={{ user_count_end }} format={{ user_format }}

git clone https://github.com/openshift-roadshow/{{ reponame }}.git

for tag in `git branch -a | grep "origin" | grep "\." | cut -d "/" -f 3`
do
  git checkout -b $tag remotes/origin/$tag
done

{{ openshift_cli }} get configmap broker-config -n openshift-ansible-service-broker

{{ openshift_cli }} delete configmap broker-config -n openshift-ansible-service-broker

{{ openshift_cli }} create configmap broker-config --from-file=broker-config=/tmp/broker-config.yml -n openshift-ansible-service-broker

{{ openshift_cli }} rollout cancel dc/asb -n openshift-ansible-service-broker

{{ openshift_cli }} rollout latest dc/asb -n openshift-ansible-service-broker

# avoid 'change-back dir' permission errors
cd /tmp/ 
#set -ue -o pipefail
# temporarly store password in cache
cat <<EOF | sudo -u {{ item.0.name }} git credential-cache store
url={{ item.1.repo }}
username={{ item.1.user }}
password={{ item.1.password }}
EOF
if [ -n "{{ item.1.dest }}" -a -d "{{ item.1.dest }}" ]; then
  cd "{{ item.1.dest }}"
  sudo -u {{ item.0.name }} git reset --hard HEAD
  sudo -u {{ item.0.name }} git pull
  sudo -u {{ item.0.name }} git checkout {{ item.1.version|default('master') }}
else
  sudo -u {{ item.0.name }} git clone "{{ item.1.repo }}" "{{ item.1.dest }}"
fi

ipa-getcert request
  -f /etc/pki/tls/certs/smtp-{{inventory_hostname}}.crt 
  -k /etc/pki/tls/private/smtp-{{inventory_hostname}}.key
  -g 2048 -K smtp/{{inventory_hostname}}
  -I {{inventory_hostname}}_SMTP_CERT

# Client SSL configuration. Outbound only.
#smtp_tls_loglevel = 2
smtp_tls_security_level = encrypt
smtp_tls_mandatory_ciphers = high
smtp_tls_ciphers = $smtp_tls_mandatory_ciphers
smtp_tls_mandatory_protocols = !SSLv2:!SSLv3
smtp_tls_protocols = $smtp_tls_mandatory_protocols
smtp_tls_CAfile = /etc/ipa/ca.crt
smtp_tls_cert_file = /etc/pki/tls/certs/smtp-{{inventory_hostname}}.crt
smtp_tls_key_file = /etc/pki/tls/private/smtp-{{inventory_hostname}}.key
# Relay host
relayhost = mx00.opentlc.com:19587
smtp_fallback_relay = mx01.opentlc.com:19587

rpm -Uvh {{satellite_url}}/pub/katello-ca-consumer-latest.noarch.rpm

subscription-manager register --org="{{satellite_org}}" --activationkey="{{ satellite_activationkey }}"

{{ lookup('file', '{{ ANSIBLE_REPO_PATH }}/workdir/{{env_authorized_key}}.pub') }}

template src={{ role_path }}/files/host_ssh_config.j2 dest={{ ANSIBLE_REPO_PATH }}/workdir/ssh-config-{{ env_type }}-{{ guid }}

tower-cli setting modify LICENSE '{{ tower_license }}' -u admin -p "{{ tower_admin_password }}"

tower-cli credential create --organization="{{ org_name }}" --kind=scm --username=test --password=test --name="{{ scm_cred_name }}"

tower-cli project create --organization="{{ org_name }}" --scm-type=git --scm-branch="{{ scm_branch }}" --scm-credential="{{ scm_cred_name }}" --scm-url="{{ scm_url }}" --scm-update-on-launch=True -n "{{ proj_name }}"

tower-cli inventory create  -n "{{ inv_name }}" --organization="{{ org_name }}"

tower-manage inventory_import --inventory-name={{ inv_name }} --source=/etc/ansible/hosts

tower-cli credential create --name="{{ ssh_cred_name }}" --username="{{ user_cred_name }}" --organization="{{ org_name }}" --kind=ssh --ssh-key-data="{{ user_cred_path }}" --become-method=sudo

tower-cli job_template create --name 3tier_app_demo  --project="{{ proj_name }}" --inventory="{{ inv_name }}" --job-type=run --playbook='{{ playbook_name }}' --machine-credential="{{ ssh_cred_name }}"

cp cert.pem /home/{{ system_user }}/.ssh/ chdir="/etc/letsencrypt/live/{{ workshop_prefix | lower }}.{{ hostvars[inventory_hostname]['ec2_tag_Index'] }}.{{ domain_name }}/"

cp privkey.pem /home/{{ system_user }}/.ssh/ chdir="/etc/letsencrypt/live/{{ workshop_prefix | lower }}.{{ hostvars[inventory_hostname]['ec2_tag_Index'] }}.{{ domain_name }}/"

  -x509
  -nodes
  -keyout /home/{{ system_user }}/.ssh/privkey.pem
  -out /home/{{ system_user }}/.ssh/cert.pem

HostMetadata={{ zabbix_auto_registration_keyword }} {{zabbix_auto_registration_pass}}

-A OS_FIREWALL_ALLOW -p tcp -m state --state NEW -m tcp --dport 10050 -j ACCEPT

oc adm policy add-cluster-role-to-user cluster-reader system:serviceaccount:default:zabbix -n default

{% raw %}oc get sa/zabbix -n default --template='{{range .secrets}}{{ .name }} {{end}}' | xargs -n 1 oc get secret --template='{{ if .data.token }}{{ .data.token }}{{end}}' | head -n 1 | base64 -d - > /tmp/zabbix.token{% endraw %}

oc get route/hawkular-metrics -n openshift-infra --template='{% raw %}{{ .spec.host }}{% endraw %}'

UserParameter=lvm.data[*],LVM_SUPPRESS_FD_WARNINGS=1 sudo lvs --no-heading -o lv_name,$2|awk '$$1 == "$1" { print $$2 }'

UserParameter=openshift_node.requests[*],/opt/monitoring/requests.sh $1

{{ ansible_pkg_mgr }} name={{ item }} state=present update_cache=yes

{{ ANSIBLE_REPO_PATH }}/configs/{{ env_type }}/files/hosts_template.{{ osrelease }}.j2

ansible masters[0] -b -m fetch -a "src=/root/.kube/config dest=/root/.kube/config flat=yes"

[general]
host = tower1.{{guid}}.example.opentlc.com
username = admin
password = {{tower_admin_password}}

oc create -f /root/proj_template.yml -n default || oc replace -f /root/proj_template.yml -n default

oc process -f {{ ANSIBLE_REPO_PATH }}/config/cicd-template.yaml --param BUILD_PROJECT=tasks-build --param DEV_PROJECT=tasks-dev --param STAGE_PROJECT=tasks-test --param PROD_PROJECT=tasks-prod --param=WITH_CHE=false --param=EPHEMERAL=false | oc create -f - -n {{ cicd_project }}

oc get nodes -lenv=app -o custom-columns=NAME:.metadata.name --sort-by=.metadata.name --no-headers=true 2>/dev/null

{{ ANSIBLE_REPO_PATH }}/scripts/label_node {{ item.0 }} {{ item.1 }}

oc new-project {{ item.item.proj }} --display-name='{{ item.item.display }}' >/dev/null 2>&1

{{ ANSIBLE_REPO_PATH }}/scripts/set_node_selector_any {{ item.proj }}

{{ ANSIBLE_REPO_PATH }}/scripts/set_node_selector {{ item.proj }} {{ item.client }}

oc label namespace {{ item.item.proj }} client={{ item.item.client }}

oc create identity htpasswd_auth:{{ item.item.key }} >/dev/null 2>&1

oc create useridentitymapping htpasswd_auth:{{ item.key }} {{ item.key }} >/dev/null 2>&1

oc adm policy add-cluster-role-to-user cluster-admin {{ item.key }} >/dev/null 2>&1

oc adm groups add-users client-group-{{ item.0.client }} {{ item.1 }}

oc adm policy add-role-to-group admin client-group-{{ item.client }} -n {{ item.proj }}

oc policy add-role-to-user edit system:serviceaccount:{{ cicd_project }}:jenkins -n {{ item.proj }} >/dev/null 2>&1

oc adm pod-network join-projects --to={{ cicd_project }} {{ item.proj }} >/dev/null 2>&1

oc delete resourcequotas core-resource-quota -n {{ cicd_project }} >/dev/null 2>&1

{{ ANSIBLE_REPO_PATH }}/config/hosts_template.{{ osrelease }}.j2

{{ ANSIBLE_REPO_PATH }}/scripts/restrict_node {{ item.0 }} {{ item.1 }}

echo 'Manual zergling restart required' && cd /opt/galaxy/ && source /opt/galaxy/.bashrc  && sudo -u galaxy /usr/bin/galaxy-sync-to-nfs && systemctl restart galaxy-handler@* && systemctl restart galaxy-zergling@*

echo 'Manual zergling restart required' && cd /opt/galaxy/ && source /opt/galaxy/.bashrc  && sudo -u galaxy /usr/bin/galaxy-sync-to-nfs && systemctl restart galaxy-handler@* && systemctl restart galaxy-workflow-scheduler@*

bash -c "test -e /usr/bin/python || (apt -qqy update && apt install -qqy python2.7 python)"

{{ ansible_distribution }}_{{ ansible_distribution_major_version }}.yml

{{ ansible_os_family }}_{{ ansible_distribution_major_version }}.yml

src='revoked_keys.j2' dest='/etc/ssh/revoked_keys' mode=0600 owner="{{ ssh_owner }}" group="{{ ssh_group }}"

src='opensshd.conf.j2' dest='/etc/ssh/sshd_config' mode=0600 owner="{{ ssh_owner }}" group="{{ ssh_group }}" validate="/usr/sbin/sshd -T -f %s"

src='openssh.conf.j2' dest='/etc/ssh/ssh_config' mode=0644 owner="{{ ssh_owner }}" group="{{ ssh_group }}"

awk '$5 >= {{ sshd_moduli_minimum }}' /etc/ssh/moduli > /etc/ssh/moduli.new ; [ -r /etc/ssh/moduli.new -a -s /etc/ssh/moduli.new ] && mv /etc/ssh/moduli.new /etc/ssh/moduli || true

ansible_os_family == 'RedHat' or ansible_os_family == 'Oracle Linux'

ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'

ssh_use_pam and ssh_password_module.stdout.find('ssh_password') == 0

telegraf_plugins_extra is defined and telegraf_plugins_extra is iterable and item.value.state|default('present') != 'absent'

telegraf_plugins_extra is defined and telegraf_plugins_extra is iterable and item.value.state|default('present') == 'absent'

deb [arch=amd64] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable

{{ docker_daemon_option_list }} + [ '--tlsverify --tlscacert=/etc/docker/ca.pem --tlscert=/etc/docker/server-cert.pem --tlskey=/etc/docker/server-key.pem' ]

{{ docker_daemon_listen_network | default('tcp://0.0.0.0:2376') }}

{{ docker_daemon_option_list }} + [ '{{ "-H=unix:///var/run/docker.sock -H=" + docker_daemon_listen_network }}' ]

{{ docker_daemon_option_list }} + [ '{{ "--bip=" + docker_daemon_bip }}' ]

##
## This file is managed by Ansible.  ALL CHANGES WILL BE OVERWRITTEN.
##
[Service]
ExecStart=
ExecStart=/usr/bin/dockerd {{ docker_daemon_option_list | join(" ") }}

{% if proftpd_display_connect_context == 'global' %}
<Global>
{% endif -%}
DisplayConnect {{ proftpd_config_dir }}/proftpd_display_connect.txt
</Global>

proftpd_conf_ssl_certificate is defined and proftpd_conf_ssl_certificate_key is defined

{{ proftpd_config_include_dir }}/15_virtualhost_{{ item.id }}.conf

ssl_cert_group_available is defined and ssl_cert_group_available

{{ '1.5' if '1.5.' in haproxy_version_result.stdout else '1.4' }}

not ansible_check_mode and selinuxCheckOut.stdout_lines == "Enforcing"

{{ nginx_vhost_path }}/{{ item.filename|default(item.server_name.split(' ')[0] ~ '.conf') }}

[htcondor-stable]
name=HTCondor Stable RPM Repository for RHEL7
baseurl=http://research.cs.wisc.edu/htcondor/yum/stable/rhel7
enabled=1
gpgcheck=1

yum_list.results | selectattr("yumstate", "match", "installed") | list | length != 0

https://usegalaxy.eu/static/vgcn/apollo-{{ apollo_version }}.war

[default]
aws_access_key_id={{ item.access_key }}
aws_secret_access_key={{ item.secret_key }}

influx -ssl -host influxdb.galaxyproject.eu -execute "show users"

influx -ssl -host influxdb.galaxyproject.eu -execute "CREATE USER {{ influxdb.admin.username }} WITH PASSWORD '{{ influxdb.admin.password }}' WITH ALL PRIVILEGES"

not ansible_check_mode and "unable to parse authentication credentials" not in should_create_admin.stdout

telegraf ALL=(ALL) NOPASSWD: /usr/bin/monitor-condor-utilisation-split

telegraf ALL=(ALL) NOPASSWD: /usr/bin/monitor-condor-utilisation

{{ postgres_host }}:{{ postgres_port }}:*:{{ postgres_user }}:{{ postgres_pass }}

docker-compose exec -T web sentry createuser --email admin@local.host --password password --superuser

("'already_member' not in rabbitmq_output.stderr") and rabbitmq_output.rc != 0

{{ hostvars[item].rabbitmq_cluster_ip_address | default(hostvars[item].ansible_default_ipv4.address) }} {{ hostvars[item].ansible_hostname }}

deb https://packages.erlang-solutions.com/{{ ansible_distribution | lower }} {{ ansible_distribution_release | lower }} contrib

https://www.rabbitmq.com/releases/rabbitmq-server/v{{ rabbitmq_version.split('-')[0] }}/rabbitmq-server_{{ rabbitmq_version }}{% if rabbitmq_version | version_compare('3.6.6', '>=') %}{% endif %}_all.deb

ansible_selinux.mode == "enforcing" and update_fcontexts.changed

ssh-keygen -s /tmp/server_ca -I key_for_test1 -h -V +520w /etc/ssh/ssh_host_{{ item }}_key.pub

Please add the following to your known_hosts file: @cert-authority <ip-range|*.domain> {{ lookup('file', 'server_ca.pub')  }}

cd /data/0/incoming/ && find . -type f -not -newermt "3 months ago" -exec rm '{}' +

. {{ galaxy_root }}/.bashrc
journalctl -u galaxy-handler@* --since '20 hour ago' | \
    grep "Caught exception while attempting to fail job" | \
    egrep -o '\([0-9]+\) Caught' | \
    sed 's/ Caught//g;s/(//g;s/)//g' | \
    sort -u | \
    xargs -I{} -n1 --no-run-if-empty -P1 gxadmin mutate fail-job {} --commit > /dev/null;
gxadmin mutate fail-terminal-datasets --commit > /dev/null;

gxadmin mutate generate-unset-api-keys --commit

for user in $(gxadmin mutate oidc-role-find-affected); do
    gxadmin mutate oidc-role-fix $user;
done;

journalctl -u galaxy-handler@* --since '20 minutes ago' | \
    grep 'failure running job' | \
    awk '{print $13}' | \
    sort -u | \
    xargs -I{} -n1 --no-run-if-empty -P1 gxadmin mutate fail-job {} --commit;

# Workflows are currently being assigned to _default_ which is wrong
# https://github.com/galaxyproject/galaxy/issues/8209
while true; do
        psql -c "COPY (update workflow_invocation set handler = 'handler_main_' || (random() * 12)::integer where (state = 'new' and handler = '_default_') returning workflow_invocation.id) to STDOUT with CSV DELIMITER ',';" | ts
        sleep 5;
done

pgrep -f /usr/bin/galaxy-fix-unscheduled-workflows > /dev/null || /usr/bin/galaxy-fix-unscheduled-workflows &

cd {{ galaxy_server_dir }}
python scripts/set_user_disk_usage.py -c {{ galaxy_config_file }}

. {{ grt_dir }}/config/env.sh && {{ grt_dir }}/venv/bin/python {{ grt_dir }}/code/manage.py import_data

cd {{ grt_queries_dir }}  && . {{ grt_dir }}/config/env.sh && {{ grt_dir }}/venv/bin/python {{ grt_dir }}/code/manage.py queries

ansible_selinux.mode == "enforcing" and update_fcontexts2.changed

{{ grt_dir }}/venv/bin/python {{ grt_dir }}/code/manage.py collectstatic --noinput

{{ grt_dir }}/venv/bin/python {{ grt_dir }}/code/manage.py migrate --no-input

{{ grt_group.system | default(grt_user.system) | default('true') }}

{{ (grt_group | default({})).name | default(grt_group) | default(omit) }}

{{ galaxy_interactive_environment_dir }}/interactive_environments.dtd

{{ galaxy_server_dir }}/config/plugins/interactive_environments/common

{{ galaxy_server_dir }}/config/plugins/interactive_environments/{{ item.name }}/static

{{ galaxy_server_dir }}/config/plugins/interactive_environments/{{ item.name }}/templates

{{ galaxy_interactive_environment_dir }}/{{ item.name }}/templates

{{ galaxy_interactive_environment_dir }}/{{ item.name }}/config/allowed_images.yml

{{ galaxy_interactive_environment_dir }}/{{ item.name }}/config/{{ item.name }}.ini

{{ galaxy_server_dir }}/config/plugins/interactive_environments/{{ item.name }}/config/{{ item.name }}.xml

{{ galaxy_interactive_environment_dir }}/{{ item.name }}/config/{{ item.name }}.xml

location /{{ google_site_verification_id }} {
    root /usr/share/nginx/html;
}

. {{ galaxy_venv_dir }}/bin/activate
python {{ galaxy_server_dir }}/scripts/grt/export.py -g {{ galaxy_config_dir }}/grt.yml -r {{ galaxy_mutable_data_dir }}/reports/ -b 10000 -c {{ galaxy_config_dir }}/galaxy.ini

journalctl --vacuum-time=1d -u galaxy-zergling@* galaxy-handler@* 2>/dev/null

cd {{ galaxy_root }};
for dir in {custom-tools,dynamic_rules,interactive_environments,mutable-config,mutable-data,server,venv,tool-data}; do
    if [ -d $dir ]; then
        echo "Syncing $dir"
        rsync -avr --delete --exclude client/node_modules $dir/ {{ galaxy_nfs_location }}/$dir/
    else
        echo "Skipping $dir"
    fi
done;
if [ -d shed_tools-local ]; then
    echo "Syncing shed_tools-local"
    rsync -avr --delete shed_tools-local/ {{ galaxy_nfs_location }}/shed_tools/
else
    echo "Skipping shed_tools-local"
fi

{{ multisite_dir }}/{{ item.domain | default([item.name, '.usegalaxy.eu'] | join) }}.html

{{ multisite_dir }}/{{ item.domain | default([item.name, '.usegalaxy.eu'] | join) }}-custom.css

cat {{ galaxy_server_dir }}/static/style/blue/base.css {% if galaxy_custom_site_base_css is defined %}{{ multisite_dir }}/usegalaxy.eu-custom.css {% endif %} > {{ multisite_dir }}/usegalaxy.eu.css

__galaxy_git_update_result is changed or (galaxy_custom_site_base_css is defined and base_css is changed)

cat {{ galaxy_server_dir }}/static/style/blue/base.css {{ multisite_dir }}/{{ item.domain | default([item.name, '.usegalaxy.eu'] | join) }}-custom.css > {{ multisite_dir }}/{{ item.domain | default([item.name, '.usegalaxy.eu'] | join) }}.css

tmpwatch 30d /data/1/galaxy_db/tmp /data/2/galaxy_db/tmp  /data/7/galaxy_db/tmp /data/dnb01/galaxy_db/tmp /data/dnb02/galaxy_db/tmp

all_using_limit_{{ (ansible_play_batch | length) != (groups['all'] | length) }}

enable_openvswitch_{{ enable_openvswitch | bool }}_enable_ovs_dpdk_{{ enable_ovs_dpdk | bool }}

enable_mariadb | bool or enable_external_mariadb_load_balancer | bool

{{ node_config_directory }}/{{ item.key }}/{{ aodh_policy_file }}

{{ node_custom_config }}/aodh/{{ inventory_hostname }}/aodh.conf

set -o pipefail && \ docker exec -t barbican_api openstack \ --os-auth-url={{ openstack_auth.auth_url }} \ --os-password={{ openstack_auth.password }} \ --os-username={{ openstack_auth.username }} \ --os-project-name={{ openstack_auth.project_name }} \ secret store -f value -p kolla | head -1

docker exec -t barbican_api openstack --os-auth-url={{ openstack_auth.auth_url }} --os-password={{ openstack_auth.password }} --os-username={{ openstack_auth.username }} --os-project-name={{ openstack_auth.project_name }} secret get -f value -p {{ barbican_store_secret.stdout }}

docker exec -t barbican_api openstack --os-auth-url={{ openstack_auth.auth_url }} --os-password={{ openstack_auth.password }} --os-username={{ openstack_auth.username }} --os-project-name={{ openstack_auth.project_name }} secret delete {{ barbican_store_secret.stdout }}

{{ node_custom_config }}/barbican-api/{{ inventory_hostname }}/barbican-api.ini

{{ node_config_directory }}/barbican-api/vassals/barbican-api.ini

{{ node_custom_config }}/barbican/{{ inventory_hostname }}/barbican.conf

{{ node_config_directory }}/{{ item.key }}/{{ barbican_policy_file }}

{{ 'deltarpm' if ansible_distribution_major_version == '7' else 'drpm' }}

{{ virtualenv is none | ternary(omit, virtualenv_site_packages) }}

{{ virtualenv is none | ternary('pip' ~ host_python_major_version, omit) }}

{{ virtualenv is none | ternary(omit, 'python' ~ host_python_version) }}

docker_custom_option is deprecated in favor of docker_custom_config

{{ docker_config | combine({'insecure-registries': registries}) }}

{{ docker_config | combine({'storage-driver': docker_storage_driver}) }}

{{ docker_config | combine({'data-root': docker_runtime_directory}) }}

docker_custom_option | length > 0 or docker_configure_for_zun|bool

{% for host in groups['baremetal'] %}
{% set api_interface = hostvars[host]['api_interface'] %}
{% if host not in groups['bifrost'] or 'ansible_' + api_interface in hostvars[host] %}
{% set hostnames = [hostvars[host]['ansible_nodename'], hostvars[host]['ansible_hostname']] %}
{{ 'api' | kolla_address(host) }} {{ hostnames | unique | join(' ') }}
{% endif %}

inventory_hostname not in groups['bifrost'] or 'ansible_' + hostvars[inventory_hostname]['api_interface'] in hostvars[inventory_hostname]

docker exec bifrost_deploy bash -c 'mkdir -p /var/log/kolla/ironic && chown ironic:ironic /var/log/kolla/ironic && mkdir -p /var/log/kolla/ironic-inspector && chown ironic:ironic /var/log/kolla/ironic-inspector && mkdir -p /var/log/kolla/nginx && chown {{ nginx_user }}:{{ nginx_user }} /var/log/kolla/nginx'

docker exec bifrost_deploy bash -c 'source /bifrost/env-vars && ansible-playbook -vvvv -i /bifrost/playbooks/inventory/target /bifrost/playbooks/install.yaml -e @/etc/bifrost/bifrost.yml -e @/etc/bifrost/dib.yml -e  skip_package_install=true'

docker exec bifrost_deploy bash -c 'mkdir /root/.ssh ; mkdir /home/ironic/.ssh; cp -f /etc/bifrost/id_rsa /root/.ssh/id_rsa && cp -f /etc/bifrost/id_rsa.pub /root/.ssh/id_rsa.pub && cp -f /etc/bifrost/ssh_config /root/.ssh/config && cp -f /etc/bifrost/id_rsa /home/ironic/.ssh/id_rsa && cp -f /etc/bifrost/id_rsa.pub /home/ironic/.ssh/id_rsa.pub && cp -f /etc/bifrost/ssh_config /home/ironic/.ssh/config && chmod 600 /root/.ssh/id_rsa && chmod 600 /root/.ssh/id_rsa.pub && chmod 600 /root/.ssh/config && chmod 600 /home/ironic/.ssh/id_rsa && chmod 600 /home/ironic/.ssh/id_rsa.pub && chmod 600 /home/ironic/.ssh/config && chown ironic:ironic /home/ironic/.ssh/id_rsa && chown ironic:ironic /home/ironic/.ssh/id_rsa.pub && chown ironic:ironic /home/ironic/.ssh/config'

docker exec bifrost_deploy bash -c 'source /bifrost/env-vars && export BIFROST_INVENTORY_SOURCE=/etc/bifrost/servers.yml && ansible-playbook -vvvv -i /bifrost/playbooks/inventory/bifrost_inventory.py /bifrost/playbooks/enroll-dynamic.yaml -e @/etc/bifrost/bifrost.yml'

docker exec bifrost_deploy bash -c 'source /bifrost/env-vars && export BIFROST_INVENTORY_SOURCE=/etc/bifrost/servers.yml && ansible-playbook -vvvv -i /bifrost/playbooks/inventory/bifrost_inventory.py /bifrost/playbooks/deploy-dynamic.yaml -e @/etc/bifrost/bifrost.yml'

docker exec {{ item.name }} /usr/local/bin/kolla_set_configs --check

config_strategy == "COPY_ONCE" or item[1]['KOLLA_CONFIG_STRATEGY'] == 'COPY_ONCE'

docker exec kolla_toolbox openstack --os-interface internal --os-auth-url {{ openstack_auth.auth_url }} --os-identity-api-version 3 --os-project-domain-name {{ openstack_auth.domain_name }} --os-project-name {{ openstack_auth.project_name }} --os-username {{ openstack_auth.username }} --os-password {{ openstack_auth.password }} --os-user-domain-name {{ openstack_auth.user_domain_name }} --os-region-name {{ openstack_region_name }} {% if openstack_cacert != '' %}--os-cacert {{ openstack_cacert }}{% endif %} aggregate create {{ blazar_aggregate_pool_name }}

{{ node_custom_config }}/blazar/{{ inventory_hostname }}/blazar.conf

{{ node_config_directory }}/{{ item.key }}/{{ blazar_policy_file }}

{{ ceilometer_notification.volumes|reject('equalto', '')|list }}

{{ node_custom_config }}/ceilometer/{{ ceilometer_custom_meters_local_folder }}

{{ ceilometer_custom_meters_folder.stat.exists and ceilometer_custom_meters_folder.stat.isdir }}

{{ custom_meter_folder_exist and ceilometer_custom_meters_folder_found_files.matched > 0 }}

{{ node_custom_config }}/ceilometer/{{ ceilometer_custom_meters_local_folder }}/

{{ node_config_directory }}/{{ item.key }}/gnocchi_resources.yaml

{{ node_custom_config }}/ceilometer/{{ inventory_hostname }}/ceilometer.conf

{{ node_config_directory }}/ceilometer-notification/event_definitions.yaml

{{ node_config_directory }}/ceilometer-notification/event_pipeline.yaml

{{ node_custom_config }}/panko/{{ inventory_hostname }}/panko.conf

{{ node_config_directory }}/{{ item.key }}/{{ ceilometer_policy_file }}

creates="{{ item }}" openssl req -new -nodes -sha256 -x509 \ -config {{ certificates_dir }}/openssl-kolla.cnf \ -days 3650 \ -extensions v3_req \ -key {{ certificates_dir }}/private/external/external.key \ -out {{ item }}

creates="{{ item }}" openssl req -new -nodes -sha256 -x509 \ -config {{ certificates_dir }}/openssl-kolla-internal.cnf \ -days 3650 \ -extensions v3_req \ -key {{ certificates_dir }}/private/internal/internal.key \ -out {{ item }}

{{ node_custom_config }}/chrony/{{ inventory_hostname }}/chrony.conf

{{ node_custom_config }}/cinder/{{ inventory_hostname }}/cinder-wsgi.conf

{{ node_custom_config }}/cinder/{{ inventory_hostname }}/cinder.conf

{{ node_config_directory }}/{{ item.key }}/{{ cinder_policy_file }}

{{ node_custom_config }}/cinder/{{ inventory_hostname }}/nfs_shares.j2

{{ node_custom_config }}/cinder/{{ inventory_hostname }}/nfs_shares

{{ not enable_cinder_backend_nfs | bool and not enable_cinder_backend_hnas_nfs | bool }}

{{ node_custom_config }}/cinder/cinder-volume/{{ ceph_cinder_keyring }}

{{ node_custom_config }}/cloudkitty/{{ cloudkitty_custom_metrics_yaml_file }}

{{ node_config_directory }}/{{ item.key }}/{{ cloudkitty_custom_metrics_yaml_file }}

{{ node_custom_config }}/cloudkitty/{{ inventory_hostname }}/cloudkitty.conf

{{ node_config_directory }}/{{ item.key }}/{{ cloudkitty_policy_file }}

{{ node_custom_config }}/collectd/{{ inventory_hostname }}/collectd.conf

{{ docker_runtime_directory or '/var/lib/docker' }}/volumes/kolla_logs/_data

{{ fluentd_labels.images.0.ContainerConfig.Labels.fluentd_binary }}

{{ find_custom_fluentd_inputs.files | map(attribute='path') | map('basename') | list }}

{{ node_config_directory }}/fluentd/input/{{ item.path | basename }}

{{ ( enable_elasticsearch | bool or ( elasticsearch_address != kolla_internal_vip_address )) and not enable_monasca | bool }}

{{ find_custom_fluentd_outputs.files | map(attribute='path') | map('basename') | list }}

{{ node_config_directory }}/fluentd/output/{{ item.path | basename }}

{{ find_custom_fluentd_format.files | map(attribute='path') | map('basename') | list }}

{{ node_config_directory }}/fluentd/format/{{ item.path | basename }}

{{ find_custom_fluentd_filters.files | map(attribute='path') | map('basename') | list }}

{{ fluentd_labels.images.0.ContainerConfig.Labels.fluentd_version | default('0.12') }}

{{ '01-rewrite-0.14' if fluentd_version == '0.14' else '01-rewrite-0.12' }}

{{ node_config_directory }}/fluentd/filter/{{ item.path | basename }}

{{ node_config_directory }}/kolla-toolbox/rabbitmq-erlang.cookie

RABBITMQ_CTL_ERL_ARGS="-proto_dist inet6_tcp"
export ERL_INETRC=/etc/rabbitmq/erl_inetrc

{{ node_custom_config }}/congress/{{ inventory_hostname }}/congress.conf

{{ node_config_directory }}/{{ item.key }}/{{ congress_policy_file }}

{{ node_config_directory }}/{{ item.key }}/{{ cyborg_policy_file }}

{{ node_custom_config }}/cyborg/{{ inventory_hostname }}/cyborg.conf

{{ node_custom_config }}/designate/{{ inventory_hostname }}/designate.conf

{{ node_custom_config }}/designate/designate-backend-bind9/{{ inventory_hostname }}/named.conf

{{ node_custom_config }}/designate/designate-backend-bind9/named.conf

designate_backend == 'bind9' and designate_backend_external == 'no'

{{ node_config_directory }}/{{ item.key }}/{{ designate_policy_file }}

docker exec -t designate_worker designate-manage pool update --file /etc/designate/pools.yaml

{{ node_custom_config }}/elasticsearch/elasticsearch-curator-actions.yml

{{ node_config_directory }}/elasticsearch-curator/elasticsearch-curator.crontab

{{ internal_protocol }}://{{ kolla_internal_fqdn | put_address_in_context('url') }}:{{ elasticsearch_port }}/_cluster/settings

{{ internal_protocol }}://{{ kolla_internal_fqdn | put_address_in_context('url') }}:{{ elasticsearch_port }}/_flush/synced

{{ node_custom_config }}/freezer/{{ inventory_hostname }}/{{ item.key }}.conf

{{ node_config_directory }}/{{ item.key }}/{{ freezer_policy_file }}

inventory_hostname in groups[freezer_services['freezer-api']['group']]

{{ node_custom_config }}/glance/{{ inventory_hostname }}/{{ item.key }}.conf

{{ node_custom_config }}/glance/{{ inventory_hostname }}/glance-cache.conf

{{ node_custom_config }}/glance/{{ inventory_hostname }}/glance-swift.conf

{{ node_config_directory }}/{{ item.key }}/{{ glance_policy_file }}

{{ node_config_directory }}/glance-api/{{ ceph_glance_keyring }}

{{ glance_services.values()|map(attribute='container_name')|list }}

{{ node_custom_config }}/gnocchi/{{ inventory_hostname }}/gnocchi.conf

{{ node_config_directory }}/{{ item.key }}/{{ gnocchi_policy_file }}

{{ node_config_directory }}/{{ item }}/{{ ceph_gnocchi_keyring }}

{{ node_custom_config }}/grafana/{{ inventory_hostname }}/{{ item.key }}.ini

{{ node_custom_config }}/grafana/{{ inventory_hostname }}/prometheus.yaml

{{ internal_protocol }}://{{ kolla_internal_fqdn | put_address_in_context('url') }}:{{ grafana_server_port }}/login

{{ internal_protocol }}://{{ kolla_internal_fqdn | put_address_in_context('url') }}:{{ grafana_server_port }}/api/datasources

response.status not in [200, 409] or response.status == 409 and ("Data source with same name already exists" not in response.json.message|default(""))

{{ internal_protocol }}://{{ kolla_internal_fqdn | put_address_in_context('url') }}:{{ grafana_server_port }}/api/user/helpflags/1

{{ node_custom_config }}/haproxy/{{ inventory_hostname }}/haproxy_main.cfg

{{ node_custom_config }}/keepalived/{{ inventory_hostname }}/keepalived.conf

{{ node_custom_config }}/haproxy/{{ inventory_hostname }}/haproxy_run.sh

External haproxy certificate file is not found. It is configured via 'kolla_external_fqdn_cert'

Internal haproxy certificate file is not found. It is configured via 'kolla_internal_fqdn_cert'

msg='Please check the kolla_external_vip_interface property - interface {{ kolla_external_vip_interface }} not found'

msg='Please check the kolla_external_vip_interface settings - interface {{ kolla_external_vip_interface }} is not active'

not hostvars[inventory_hostname]['ansible_' + kolla_external_vip_interface]['active']

( ip_addr_output is failed or
 kolla_internal_vip_address | ipaddr(ip_addr_output.stdout.split()[3]) is none)

echo "show stat" | docker exec -i haproxy socat unix-connect:/var/lib/kolla/haproxy/haproxy.sock stdio

{{ 'ipv6' if api_address_family == 'ipv6' else 'ipv4_secondaries' }}

{{ hostvars[inventory_hostname]['ansible_' + api_interface].get(key, []) | map(attribute='address') | list }}

{{ node_custom_config }}/haproxy-config/{{ inventory_hostname }}/{{ haproxy_service_template }}

{{ node_custom_config }}/haproxy-config/{{ haproxy_service_template }}

{{ node_config_directory }}/haproxy/services.d/{{ item.key }}.cfg

{{ node_custom_config }}/heat/{{ inventory_hostname }}/heat.conf

{{ node_config_directory }}/{{ item.key }}/{{ heat_policy_file }}

{{ node_custom_config }}/horizon/{{ inventory_hostname }}/horizon.conf

{{ node_custom_config }}/horizon/{{ inventory_hostname }}/local_settings

{{ node_custom_config }}/horizon/{{ inventory_hostname }}/custom_local_settings

{{ supported_policy_format_list | map('regex_replace', '(.+)', '{{ project_name }}_\1') | list }}

{{ custom_policy }} + [ '{{ overwritten_files.results.0.stat.path }}' ]

{{ node_custom_config }}/influxdb/{{ inventory_hostname }}/influxdb.conf

{{ upgrade_environment if ironic_enable_rolling_upgrade|bool else bootstrap_environment }}

{{ node_custom_config }}/ironic/{{ inventory_hostname }}/ironic.conf

{{ node_custom_config }}/ironic-inspector/{{ inventory_hostname }}/inspector.conf

{{ node_custom_config }}/ironic/{{ inventory_hostname }}/ironic-dnsmasq.conf

{{ node_custom_config }}/ironic/{{ inventory_hostname }}/pxelinux.default

{{ node_custom_config }}/ironic/{{ inventory_hostname }}/ironic_pxe_uefi.default

{{ node_custom_config }}/ironic/{{ inventory_hostname }}/inspector.ipxe

{{ node_config_directory }}/{{ item.key }}/{{ ironic_policy_file }}

'No chain/target/match by that name' not in ironic_inspector_chain.stderr

(not enable_ironic_ipxe | bool and inventory_hostname in groups['ironic-pxe']) or (enable_ironic_ipxe | bool and inventory_hostname in groups['ironic-ipxe'])

The SCSI target daemon tgtd is not supported on CentOS/RHEL 8 and later

ansible_distribution_major_version is version_compare('8', '>=')

{{ node_custom_config }}/{{ item.key }}/{{ inventory_hostname }}/kafka.server.properties

{{ node_config_directory }}/{{ item.key }}/kafka.server.properties

{{ node_custom_config }}/karbor/{{ inventory_hostname }}/karbor.conf

{{ node_custom_config }}/karbor/{{ service_name }}/providers.d/*

{{ node_custom_config }}/karbor/{{ service_name }}/providers.d/openstack-infra.conf

{{ node_config_directory }}/{{ service_name }}/providers.d/openstack-infra.conf

keystone_fernet_{{ container_facts['keystone_fernet'].State | default('bootstrap') }}

bash -c 'sudo -E kolla_set_configs && keystone-manage --config-file /etc/keystone/keystone.conf fernet_setup --keystone-user {{ keystone_username }} --keystone-group {{ keystone_groupname }} && ls -l /etc/keystone/fernet-keys/'

{{ node_custom_config }}/keystone/{{ inventory_hostname }}/keystone.conf

{{ node_config_directory }}/{{ item.key }}/{{ keystone_policy_file }}

{{ node_custom_config }}/keystone/{{ inventory_hostname }}/wsgi-keystone.conf

{{ ansible_playbook_python }} {{ role_path }}/files/fernet_rotate_cron_generator.py -t {{ (fernet_key_rotation_interval | int) // 60 }} -i {{ groups['keystone'].index(inventory_hostname) }} -n {{ (groups['keystone'] | length) }}

{% if groups['keystone_fernet_running'] is defined -%} {{ groups['keystone_fernet_running'][0] }} {%- else -%}{{ groups['keystone'][0] }}{%- endif %}

awk '/^fernet_token_expiry/ { print $2 }' "{{ node_config }}/globals.yml"

result.stdout | regex_replace('(60|120|180|240|300|360|600|720|900|1200|1800|3600|7200|10800|14400|21600|28800|43200|86400|604800)', '')  is search(".+")

docker exec keystone kolla_keystone_bootstrap {{ openstack_auth.username }} {{ openstack_auth.password }} {{ openstack_auth.project_name }} admin {{ keystone_admin_url }} {{ keystone_internal_url }} {{ keystone_public_url }} {{ item }}

{{ node_custom_config }}/kibana/{{ inventory_hostname }}/kibana.yml

{{ internal_protocol }}://{{ kolla_internal_fqdn | put_address_in_context('url') }}:{{ elasticsearch_port }}/.kibana

result.get('json', {}).get('error', {}).get('type') != 'index_already_exists_exception'

{{ internal_protocol }}://{{ kolla_internal_fqdn | put_address_in_context('url') }}:{{ elasticsearch_port }}/.kibana/config/*

{{ internal_protocol }}://{{ kolla_internal_fqdn | put_address_in_context('url') }}:{{ elasticsearch_port }}/.kibana/index-pattern/{{ kibana_default_index_pattern }}

kibana_default_indexes['.kibana']['mappings']['config']['properties']['defaultIndex'] is not defined

{{ node_custom_config }}/kuryr/{{ inventory_hostname }}/{{ item.key }}.conf

{{ node_config_directory }}/{{ item.key }}/{{ kuryr_policy_file }}

{{ node_custom_config }}/magnum/{{ inventory_hostname }}/magnum.conf

{{ node_config_directory }}/{{ item.key }}/{{ magnum_policy_file }}

{{ node_custom_config }}/manila/{{ inventory_hostname }}/manila.conf

{{ node_config_directory }}/{{ item.key }}/{{ manila_policy_file }}

{{ node_config_directory }}/manila-share/{{ ceph_manila_keyring }}

check_cephfs.rc != 0 and check_cephfs.stderr.find('No such file or directory') == -1

docker exec manila_share ceph mon dump -c /etc/ceph/ceph.conf --name client.manila -f json

{{ ceph_monitor_dump.stdout | from_json | json_query(query) | map('regex_search', regex) | join(',') }}:/

docker exec manila_share ceph-authtool -p /etc/ceph/ceph.client.manila.keyring -n client.manila

docker exec -u 0 manila_share mount -t ceph {{ cephfs_addr }} /tmp/cephfs -o name=manila,secret={{ manila_keyring.stdout }}

docker exec -u 0 manila_share chown manila:manila /tmp/cephfs/volumes

docker exec {{ mariadb_service.container_name }} mysql -uroot -p{{ database_password }} --silent --skip-column-names -e 'SHOW STATUS LIKE "wsrep_local_state_comment"'

groups.mariadb_port_alive_True.index(inventory_hostname) % 4 == item

bootstrap_host is not defined or bootstrap_host != inventory_hostname

bash -c 'sudo -E kolla_set_configs && /usr/local/bin/kolla_mariadb_backup.sh'

{{ node_config_directory }}/mariabackup/:{{ container_config_directory }}/:ro

docker exec mariadb mysql -h {{ database_address }} -P {{ database_port }} -u haproxy -e 'show databases;'

{{ node_custom_config }}/mariadb/{{ inventory_hostname }}/backup.my.cnf

{{ node_custom_config }}/mariadb/{{ inventory_hostname }}/galera.cnf

MariaDB cluster exists but is stopped. Please start it using kolla-ansible mariadb_recovery

MariaDB cluster is not synced. Please wait for WSREP sync before proceeding.

groups.mariadb_sync_status_Synced is not defined or groups.mariadb_port_alive_True | sort != groups.mariadb_sync_status_Synced | sort

docker cp {{ mariadb_service.container_name }}:/var/log/kolla/mariadb/mariadb.log /tmp/mariadb_tmp.log

tail -n 200 /tmp/mariadb_tmp.log | awk -F" " '$0~/Recovered position/{print $NF;exit;}' | awk -F":" '{print $2}'

if [[ ! -z {{ hostvars[inventory_hostname]['seqno'] }} && ! -z {{ hostvars[item]['seqno'] }} &&
{{ hostvars[inventory_hostname]['seqno'] }} =~ ^[0-9]+$ && {{ hostvars[item]['seqno'] }} =~ ^[0-9]+$ &&
{{ hostvars[inventory_hostname]['seqno'] }} -lt {{ hostvars[item]['seqno'] }} ]]; then echo {{ hostvars[item]['seqno'] }}; fi

seqno_compare.results | map(attribute='stdout') | join('') == ""

{{ lookup('file', '/tmp/kolla_mariadb_recover_inventory_name') }}

docker cp {{ mariadb_service.container_name }}:/var/lib/mysql/grastate.dat /tmp/kolla_mariadb_grastate.dat

docker cp /tmp/kolla_mariadb_grastate.dat mariadb:/var/lib/mysql/grastate.dat

docker exec {{ mariadb_service.container_name }} mysql -uroot -p{{ database_password }} -e "SET GLOBAL wsrep_provider_options='pc.bootstrap=yes';"

docker exec {{ mariadb_service.container_name }} mysql -uroot -p{{ database_password }} --silent --skip-column-names -e 'SHOW STATUS LIKE "wsrep_evs_state"'

*.*:CREATE TABLESPACE,RELOAD,PROCESS,SUPER,LOCK TABLES,REPLICATION CLIENT

not mariadb_cluster_exists or (groups.mariadb_port_alive_True is defined and inventory_hostname in groups.mariadb_port_alive_True)

{{ node_config_directory }}/{{ item }}/{{ masakari_policy_file }}

{{ node_custom_config }}/masakari/{{ inventory_hostname }}/masakari.conf

{{ node_custom_config }}/masakari/{{ inventory_hostname }}/masakari-monitors.conf

{{ node_config_directory }}/{{ item.key }}/masakari-monitors.conf

{{ node_custom_config }}/masakari/masakari-api/masakari-api-paste.ini

{{ node_custom_config }}/mistral/{{ inventory_hostname }}/mistral.conf

{{ node_config_directory }}/{{ item.key }}/{{ mistral_policy_file }}

{{ node_config_directory }}/mistral-event-engine/event_definitions.yaml

{{ node_custom_config }}/mistral/{{ inventory_hostname }}/event_definitions.yaml

{{ monasca_database_name }}.*:ALL/{{ monasca_grafana_database_name }}.*:ALL

docker exec influxdb influx -host {{ monasca_influxdb_address }} -port {{ monasca_influxdb_http_port }} -execute 'show databases'

docker exec influxdb influx -host {{ monasca_influxdb_address }} -port {{ monasca_influxdb_http_port }} -execute 'CREATE DATABASE {{ monasca_influxdb_name }} WITH DURATION {{ monasca_influxdb_retention_policy.duration }} REPLICATION  {{ monasca_influxdb_retention_policy.replication_count }} NAME {{ monasca_influxdb_retention_policy.name }}'

monasca_influxdb_name not in monasca_influxdb_database.stdout_lines

{{ node_custom_config }}/monasca/{{ inventory_hostname }}/{{ item }}

{{ node_custom_config }}/monasca/{{ inventory_hostname }}/agent_plugins/

{{ node_config_directory }}/monasca-agent-collector/plugins/{{ item.path | basename }}

{{ node_config_directory }}/monasca-log-transformer/log-transformer.conf

{{ node_custom_config }}/monasca/{{ inventory_hostname }}/log-transformer.conf

{{ role_path }}/templates/monasca-log-transformer/log-transformer.conf.j2

{{ node_config_directory }}/monasca-log-transformer/logstash_patterns

{{ node_config_directory }}/monasca-log-transformer/logstash_patterns/{{ item.path | basename }}

{{ node_config_directory }}/monasca-log-persister/log-persister.conf

{{ node_custom_config }}/monasca/{{ inventory_hostname }}/log-persister.conf

{{ role_path }}/templates/monasca-log-persister/log-persister.conf.j2

{{ node_config_directory }}/monasca-log-persister/elasticsearch-template.json

{{ node_custom_config }}/monasca/{{ inventory_hostname }}/elasticsearch-template.json

{{ role_path }}/templates/monasca-log-persister/elasticsearch-template.json

{{ node_config_directory }}/monasca-log-metrics/log-metrics.conf

{{ node_custom_config }}/monasca/{{ inventory_hostname }}/log-metrics.conf

{{ role_path }}/templates/monasca-log-metrics/log-metrics.conf.j2

{{ node_custom_config }}/monasca/{{ inventory_hostname }}/thresh-config.yml

{{ node_custom_config }}/monasca/{{ inventory_hostname }}/storm.yml

notification_templates.stat.exists and notification_templates.stat.isdir

{{ internal_protocol }}://{{ kolla_internal_fqdn | put_address_in_context('url') }}:{{ monasca_grafana_server_port }}/login

{{ monasca_control_plane_project }}@{{ default_project_domain_id }}

{{ internal_protocol }}://{{ kolla_internal_fqdn | put_address_in_context('url') }}:{{ monasca_grafana_server_port }}/api/orgs

monasca_grafana_control_plane_org not in monasca_grafana_orgs.json|map(attribute='name')|unique

{{ internal_protocol }}://{{ kolla_internal_fqdn | put_address_in_context('url') }}:{{ monasca_grafana_server_port }}/api/orgs/name/{{ monasca_grafana_control_plane_org }}

{{ internal_protocol }}://{{ kolla_internal_fqdn | put_address_in_context('url') }}:{{ monasca_grafana_server_port }}/api/orgs/{{ monasca_grafana_conf_org.json.id }}/users

monasca_grafana_add_user_response.status not in [200, 409] or monasca_grafana_add_user_response.status == 409 and ("User is already" not in  monasca_grafana_add_user_response.json.message|default(""))

{{ internal_protocol }}://{{ kolla_internal_fqdn | put_address_in_context('url') }}:{{ monasca_grafana_server_port }}/api/user/using/{{ monasca_grafana_conf_org.json.id }}

{{ internal_protocol }}://{{ kolla_internal_fqdn | put_address_in_context('url') }}:{{ monasca_grafana_server_port }}/api/datasources

monasca_grafana_datasource_response.status not in [200, 409] or monasca_grafana_datasource_response.status == 409 and ("Data source with same name already exists" not in  monasca_grafana_datasource_response.json.message|default(""))

{{ monasca_services.values()|map(attribute='container_name')|list }}

inventory_hostname in groups[monasca_services['monasca-api']['group']]

inventory_hostname in groups[monasca_services['monasca-log-api']['group']]

inventory_hostname in groups[monasca_services['monasca-agent-statsd']['group']]

inventory_hostname in groups[monasca_services['monasca-grafana']['group']]

docker exec -t mongodb mongo --host {{ 'api' | kolla_address }} --port {{ mongodb_port }} --quiet --eval rs.status().ok

{{ node_config_directory }}/mongodb/:{{ container_config_directory }}/:ro

docker exec -t mongodb mongo --host {{ api_interface_address }} --port {{ mongodb_port }} --quiet --eval '{{ lookup('file','/tmp/mongodb_bootstrap_replication_set.js') }}'

{{ node_custom_config }}/mongodb/{{ inventory_hostname }}/{{ item.key }}.conf

MongoDB deployment role is deprecated in Ussuri and will be removed in Victoria. Please read release notes for more background.

{{ node_config_directory }}/murano-api/:{{ container_config_directory }}/:ro

{{ node_custom_config }}/murano/{{ inventory_hostname }}/murano.conf

{{ node_config_directory }}/{{ item.key }}/{{ murano_policy_file }}

docker exec murano_api murano --os-username {{ openstack_auth.username }} --os-password {{ keystone_admin_password }} --os-project-name {{ openstack_auth.project_name }} --os-auth-url {{ keystone_admin_url }} --murano-url {{ admin_protocol }}://{{ api_interface_address | put_address_in_context('url') }}:{{ murano_api_port }} package-list

docker exec murano_api murano --os-username {{ openstack_auth.username }} --os-password {{ keystone_admin_password }} --os-project-name {{ openstack_auth.project_name }} --os-auth-url {{ keystone_admin_url }} --murano-url {{ admin_protocol }}://{{ api_interface_address | put_address_in_context('url') }}:{{ murano_api_port }} package-import --exists-action u --is-public /io.murano.zip

status.stdout.find("io.murano") == -1 or kolla_action == "upgrade"

docker exec murano_api murano --os-username {{ openstack_auth.username }} --os-password {{ keystone_admin_password }} --os-project-name {{ openstack_auth.project_name }} --os-auth-url {{ keystone_admin_url }} --murano-url {{ admin_protocol }}://{{ api_interface_address | put_address_in_context('url') }}:{{ murano_api_port }} package-import --exists-action u --is-public /io.murano.applications.zip

status.stdout.find("io.murano.applications") == -1 or kolla_action == "upgrade"

(kolla_action == "deploy") or (not neutron_enable_rolling_upgrade | bool)

{{ node_config_directory }}/neutron-openvswitch-agent-fake-{{ item }}

{{ node_config_directory }}/neutron-openvswitch-agent-fake-{{ item }}/config.json

{{ node_custom_config }}/neutron/{{ inventory_hostname }}/neutron.conf

{{ node_config_directory }}/neutron-openvswitch-agent-fake-{{ item }}/neutron.conf

{{ node_custom_config }}/neutron/{{ inventory_hostname }}/openvswitch_agent.ini

{{ node_config_directory }}/neutron-openvswitch-agent-fake-{{ item }}/openvswitch_agent.ini

neutron_services | select_services_enabled_and_mapped_to_host | list | intersect([ "neutron-l3-agent", "neutron-linuxbridge-agent", "neutron-openvswitch-agent" ]) | list | length > 0

(neutron_l3_agent.enabled | bool and neutron_l3_agent.host_in_groups | bool)

{{ node_custom_config }}/neutron/{{ inventory_hostname }}/neutron_vpnaas.conf

{{ node_custom_config }}/neutron/{{ inventory_hostname }}/ml2_conf.ini

{{ node_custom_config }}/neutron/{{ inventory_hostname }}/linuxbridge_agent.ini

{{ node_config_directory }}/{{ service_name }}/linuxbridge_agent.ini

{{ node_config_directory }}/{{ service_name }}/openvswitch_agent.ini

{{ lookup('file', xenapi_facts_root + '/' + inventory_hostname + '/' + xenapi_facts_file) | from_json }}

{{ node_custom_config }}/neutron/{{ inventory_hostname }}/openvswitch_agent_xenapi.ini

{{ node_custom_config }}/neutron/{{ service_name }}/openvswitch_agent_xenapi.ini

{{ node_custom_config }}/neutron/{{ inventory_hostname }}/sriov_agent.ini

{{ node_custom_config }}/neutron/{{ inventory_hostname }}/dhcp_agent.ini

{{ node_custom_config }}/neutron/{{ inventory_hostname }}/dnsmasq.conf

{{ node_custom_config }}/neutron/{{ inventory_hostname }}/l3_agent.ini

{{ node_config_directory }}/{{ service_name }}/metadata_agent.ini

{{ node_config_directory }}/{{ service_name }}/metering_agent.ini

{{ node_config_directory }}/{{ service_name }}/ironic_neutron_agent.ini

{{ node_custom_config }}/neutron/{{ inventory_hostname }}/nsx.ini

neutron_plugin_agent in ['vmware_nsxv', 'vmware_nsxv3', 'vmware_dvs']

{{ node_config_directory }}/{{ service_name }}/neutron-l3-agent-wrapper.sh

{{ node_config_directory }}/{{ service_name }}/{{ item.2.path | basename }}

Number of network agents are less than two when enabling agent ha

groups['neutron-dhcp-agent'] | length < 2 or groups['neutron-l3-agent'] | length < 2

{{ neutron_type_drivers.replace(' ', '').split(',') | reject('equalto', '') | list }}

{{ neutron_tenant_network_types.replace(' ', '').split(',') | reject('equalto', '') | list }}

Tenant network type '{{ item }}' is not in type drivers [{{ neutron_type_drivers }}]

Ironic must be enabled when using networking-baremetal/ironic-neutron-agent

docker exec -t neutron_server neutron-db-manage --subproject {{ item }} has_offline_migrations

{{ hostvars[first_neutron_server_host]['neutron_check_contract_db_stdout'] }}

{{ results_of_check_pending_contract_scripts | json_query(filter_rc) }}

{{ nova_api_bootstrap_default_volumes + nova_api_bootstrap_extra_volumes }}

{{ node_custom_config }}/nova/{{ inventory_hostname }}/nova.conf

{{ node_config_directory }}/{{ item.key }}/{{ nova_policy_file }}

mysql+pymysql://{{ nova_cell0_database_user }}:{{ nova_cell0_database_password }}@{{ nova_cell0_database_address }}/{{ nova_cell0_database_name }}

bash -c 'sudo -E kolla_set_configs && nova-manage cell_v2 map_cell0 --database_connection {{ nova_cell0_connection }}'

kill -HUP `docker inspect -f '{% raw %}{{ .State.Pid }}{% endraw %}' nova_scheduler`

See the detail at https://docs.openstack.org/nova/latest/cli/nova-status.html#nova-status-checks

hostvars[first_nova_api_host]['nova_upgrade_check_stdout']['rc'] not in [0, 1]

{{ node_config_directory }}/nova-compute-fake-{{ item }}/:{{ container_config_directory }}/:ro

{{ nova_cell_bootstrap_default_volumes + nova_cell_bootstrap_extra_volumes }}

xenapi_bootstrap -i {{ xenserver_himn_ip }} -u {{ xenserver_username }} -p {{ xenserver_password }} -f {{ xenapi_facts_path }}

{{ node_custom_config }}/nova/nova-libvirt/{{ inventory_hostname }}/{{ file }}

{{ node_config_directory }}/nova-compute-fake-{{ item }}/config.json

{{ node_config_directory }}/nova-compute-fake-{{ item }}/nova.conf

{{ node_custom_config }}/nova_compute/{{ inventory_hostname }}/release

bash -c 'sudo -E kolla_set_configs && nova-manage cell_v2 create_cell{% if nova_cell_name %} --name {{ nova_cell_name }}{% endif %}'

inventory_hostname == groups[nova_conductor.group][0] | default(None)

mysql+pymysql://{{ nova_cell_database_user }}:{{ nova_cell_database_password }}@{{ nova_cell_database_address | put_address_in_context('url') }}:{{ nova_cell_database_port }}/{{ nova_cell_database_name }}

bash -c 'sudo -E kolla_set_configs && nova-manage cell_v2 update_cell --cell_uuid {{ nova_cell_settings.cell_uuid }}'

nova_cell_settings.cell_message_queue != nova_cell_notify_transport_url or nova_cell_settings.cell_database != nova_cell_database_url

{{ groups[nova_cell_compute_group] |
   intersect(ansible_play_batch) |
   map('extract', hostvars, 'ansible_nodename') |
   list }}

{{ (groups[nova_cell_compute_ironic_group] |
    intersect(ansible_play_batch) |
    map('extract', hostvars, 'ansible_hostname') |
    map('regex_replace', '^(.*)$', '\1-ironic') |
    list)
   if nova_cell_services['nova-compute-ironic'].enabled | bool else [] }}

inventory_hostname == groups[nova_cell_conductor_group][0] | default(None)

docker exec kolla_toolbox openstack --os-interface internal --os-auth-url {{ keystone_admin_url }} --os-identity-api-version 3 --os-project-domain-name {{ openstack_auth.domain_name }} --os-tenant-name {{ openstack_auth.project_name }} --os-username {{ openstack_auth.username }} --os-password {{ keystone_admin_password }} --os-user-domain-name {{ openstack_auth.domain_name }} --os-region-name {{ openstack_region_name }} {% if openstack_cacert != '' %}--os-cacert {{ openstack_cacert }}{% endif %} compute service list --format json --column Host --service nova-compute

(nova_compute_services.stdout | from_json | map(attribute='Host') | list) is superset(expected_compute_service_hosts)

Unable to find settings for {{ nova_cell_name or 'the default cell' }}.

docker exec nova_conductor nova-manage cell_v2 discover_hosts --by-service --cell_uuid {{ nova_cell_settings.cell_uuid }}

{{ node_config_directory }}/nova-libvirt/secrets/{{ item.uuid }}.xml

{{ lookup('file', nova_cephx_keyring_file.stat.path) | regex_search('key\s*=.*$', multiline=True) | regex_replace('key\s*=\s*(.*)\s*', '\1') }}

{{ lookup('file', cinder_cephx_keyring_file.stat.path) | regex_search('key\s*=.*$', multiline=True) | regex_replace('key\s*=\s*(.*)\s*', '\1') }}

{{ node_config_directory }}/nova-libvirt/secrets/{{ item.uuid }}.base64

bash -c 'sudo -E kolla_set_configs && nova-manage cell_v2 list_cells --verbose'

At least 1 compute node required in inventory when ironic is disabled.

{{ node_custom_config  }}/nova-hyperv/{{ inventory_hostname }}/nova_hyperv.conf

{{ node_custom_config  }}/nova-hyperv/{{ inventory_hostname }}/neutron_hyperv_agent.conf

{{ node_custom_config  }}/nova-hyperv/{{ inventory_hostname }}/wsgate.ini

Nova Hyper-V deployment role is deprecated in Ussuri and will be removed in Victoria. Please read release notes for more background.

{{ node_config_directory }}/{{ item.key }}/{{ octavia_policy_file }}

{{ node_custom_config }}/octavia/{{ inventory_hostname }}/octavia.conf

{{ node_config_directory }}/openvswitch-db-server/start-ovsdb-server

docker exec openvswitch_db /usr/local/bin/kolla_ensure_openvswitch_configured {{ item.0 }} {{ item.1 }}

inventory_hostname in groups["network"] or (inventory_hostname in groups["compute"] and computes_need_external_bridge | bool )

docker exec "{{ service.container_name }}" ovs-vsctl --no-wait show

docker exec {{ service.container_name }} /bin/sh -c 'CONFIG_FILE={{ container_config_directory }}/ovs-dpdkctl.conf {{ container_config_directory }}/ovs-dpdkctl.sh init'

(inventory_hostname in groups['compute'] or (enable_manila | bool and inventory_hostname in groups['manila-share']) or inventory_hostname in groups['neutron-dhcp-agent'] or inventory_hostname in groups['neutron-l3-agent'] or inventory_hostname in groups['neutron-metadata-agent'])

docker exec -t mongodb mongo --host {{ mongodb_replication_set_name }}/{{ panko_database_mongodb_address }} --eval 'db = db.getSiblingDB("{{ panko_database_name }}"); db.createUser({user':' "{{ panko_database_user }}", pwd':' "{{ panko_database_password }}", roles':' [ "readWrite", "dbAdmin" ]})'

{{ node_custom_config }}/panko/{{ inventory_hostname }}/{{ item.key }}.conf

{{ node_config_directory }}/{{ item.key }}/{{ panko_policy_file }}

{{ node_custom_config }}/placement/{{ inventory_hostname }}/placement.conf

{{ node_config_directory }}/placement-api/placement-api-wsgi.conf

{{ placement_config_directory }}/{{ item.key }}/{{ placement_policy_file }}

The {{ item }} host is not accessible from {{ inventory_hostname }}

The {{ database_address }} host is not accessible from {{ inventory_hostname }}

Host OS distribution {{ ansible_distribution }} is not supported. Supported distributions are: {{ host_os_distributions.keys() | join(', ') }}

{{ ansible_distribution }} release {{ ansible_distribution_release }} version {{ ansible_distribution_version }} is not supported. Supported releases are: {{ host_os_distributions[ansible_distribution] | join(', ') }}

ansible_distribution_release not in host_os_distributions[ansible_distribution]

ansible_distribution_version not in host_os_distributions[ansible_distribution]

ansible_distribution_major_version not in host_os_distributions[ansible_distribution]

{{ ansible_python.executable }} -c "import docker; print(docker.__version__)"

result is failed or result.stdout is version(docker_py_version_min, '<')

Ansible version should be between {{ ansible_version_min }} and {{ ansible_version_max }}. Current version is {{ ansible_version.full }} which is not supported.

ansible_version_host is version(ansible_version_min, '<') or ansible_version_host is version(ansible_version_max, '>')

msg='Please check the api_interface property - interface {{ api_interface }} not found'

msg='Please check the api_interface settings - interface {{ api_interface }} is not active'

not hostvars[inventory_hostname]['ansible_' + api_interface]['active']

msg='Please check the api_interface settings - interface {{ api_interface }} ip address problem'

result is failed or result.stdout | regex_replace('.*(\\d+\\.\\d+\\.\\d+).*', '\\1')  is version(docker_version_min, '<')

result.stdout | regex_replace('(.*ssh_key.*)', '')  is search(":")

Service nscd is running. This is known to cause issues with Docker's user namespaces in
Kolla. Please disable it before proceeding.

kolla_external_vip_address and kolla_internal_vip_address must not be the same when only one network has TLS enabled

kolla_enable_tls_external | bool or kolla_enable_tls_internal | bool

not (kolla_enable_tls_external | bool and kolla_enable_tls_internal | bool)

We are sorry but enable_ceph is no longer supported. Please use external ceph support.

{{ node_config_directory }}/prometheus-server/{{ item.path | basename }}

service.enabled | bool and enable_prometheus_alertmanager | bool

prometheus_alert_rules is defined and prometheus_alert_rules.files | length > 0

{{ node_custom_config }}/prometheus/{{ inventory_hostname }}/prometheus.yml

{{ node_config_directory }}/prometheus-alertmanager/prometheus-alertmanager.yml

{{ node_custom_config }}/prometheus/{{ inventory_hostname }}/prometheus-alertmanager.yml

{{ node_custom_config }}/prometheus-mysqld-exporter/{{ inventory_hostname }}/my.cnf

{{ node_config_directory }}/prometheus-openstack-exporter/clouds.yml

{{ node_custom_config }}/prometheus-openstack-exporter/{{ inventory_hostname }}/clouds.yml

{{ node_custom_config }}/prometheus-openstack-exporter/clouds.yml

{{ node_custom_config }}/prometheus/{{ inventory_hostname }}/prometheus-blackbox-exporter.yml

{{ node_custom_config }}/prometheus/prometheus-blackbox-exporter.yml

container_facts['prometheus_elasticsearch_exporter'] is not defined

inventory_hostname in groups['prometheus-elasticsearch-exporter']

set -o pipefail && \ echo {{ qdrouterd_password }} | \ docker exec -u root -i qdrouterd saslpasswd2 -c -p -f /var/lib/qdrouterd/qdrouterd.sasldb -u AMQP {{ qdrouterd_user }}

{{ node_custom_config }}/qdrouterd/{{ inventory_hostname }}/qdrouterd.conf

{{ node_custom_config }}/qdrouterd/{{ inventory_hostname }}/qdrouterd-sasl.conf

{{ 'ahostsv4' if api_address_family == 'ipv4' else 'ahostsv6' }}

getent {{ nss_database }} {{ hostvars[item]['ansible_hostname'] }}

{{ node_custom_config }}/qinling/{{ inventory_hostname }}/qinling.conf

{{ node_config_directory }}/{{ item.key }}/{{ qinling_policy_file }}

{{ node_custom_config }}/qinling/qinling-engine/kubernetes_ca.crt

docker exec {{ service.container_name }} rabbitmqctl wait {{ rabbitmq_pid_file }}

{{ node_config_directory }}/{{ project_name }}/rabbitmq-env.conf

{{ node_custom_config }}/rabbitmq/{{ inventory_hostname }}/rabbitmq-env.conf

{{ node_custom_config }}/rabbitmq/{{ inventory_hostname }}/rabbitmq.conf

{{ node_custom_config }}/rabbitmq/{{ inventory_hostname }}/erl_inetrc

{{ node_custom_config }}/rabbitmq/{{ inventory_hostname }}/definitions.json

Hostname has to resolve uniquely to the IP address of api_interface

not item.1 is match('^'+('api' | kolla_address(item.0.item))+'\\b')

{{ node_config_directory }}/{{ item.key }}/{{ rally_policy_file }}

docker exec redis redis-cli -h {{ api_interface_address }} -a {{ redis_master_password }} ping

{{ node_custom_config }}/sahara/{{ inventory_hostname }}/sahara.conf

{{ node_config_directory }}/{{ item.key }}/{{ sahara_policy_file }}

{{ node_custom_config }}/searchlight/{{ inventory_hostname }}/searchlight.conf

{{ node_config_directory }}/{{ item.key }}/{{ searchlight_policy_file }}

{{ node_custom_config }}/senlin/{{ inventory_hostname }}/senlin.conf

{{ node_config_directory }}/{{ item.key }}/{{ senlin_policy_file }}

{{ service_ks_register_users | map(attribute='project') | unique | list }}

{{ service_ks_register_users | map(attribute='role') | unique | list + service_ks_register_roles }}

{{ service_ks_register_users + service_ks_register_user_roles }}

{{ service_rabbitmq_users | map(attribute='vhost') | unique | reject('equalto', '/') | list }}

{{ node_custom_config }}/solum/{{ inventory_hostname }}/solum.conf

{{ node_custom_config }}/storm/{{ inventory_hostname }}/storm.yml

start={{ storm_worker_port_range.start|int }} end={{ storm_worker_port_range.end|int }}

docker exec -t kolla_toolbox ansible localhost -m kolla_sanity -a "service=swift project=service user={{ openstack_auth.username }} password={{ swift_keystone_password }} role=admin region_name={{ openstack_region_name }} auth={{ '{{ openstack_swift_auth }}' }} {% if openstack_cacert != '' %}cacert={{ openstack_cacert }}{% endif %}" -e "{'openstack_swift_auth':{{ openstack_swift_auth }}}"

swift_sanity.stdout.find('localhost | SUCCESS => ') != -1 and (swift_sanity.stdout.split('localhost | SUCCESS => ')[1]|from_json).changed

{{ node_custom_config }}/swift/{{ inventory_hostname }}/{{ item }}/swift.conf

{{ node_custom_config }}/swift/{{ inventory_hostname }}/{{ item }}.conf

inventory_hostname in groups['swift-account-server'] or inventory_hostname in groups['swift-container-server'] or inventory_hostname in groups['swift-object-server']

Swift ring files do not exist. Ensure .builder and .gz are available for each of account/container/object under {{ node_custom_config }}/swift before deploying Swift.

docker exec -u root {{ item.name }} /usr/local/bin/kolla_set_configs --check

{{ node_config_directory }}/swift-proxy-server/:{{ container_config_directory }}/:ro

docker exec -t kolla_toolbox sudo -E ansible localhost -m find_disks -a "name={{ swift_devices_name }} match_mode={{ swift_devices_match_mode }}"

swift_disk_lookup.stdout.find('localhost | SUCCESS => ') != -1 and (swift_disk_lookup.stdout.split('localhost | SUCCESS => ')[1]|from_json).changed

{{ (swift_disk_lookup.stdout.split('localhost | SUCCESS => ')[1]|from_json).disks|from_json }}

{{ node_config_directory }}/swift-rsyncd/:{{ container_config_directory }}/:ro

{{ swift_devices_mount_point }}:{{ swift_devices_mount_point }}:shared

{{ node_config_directory }}/swift-account-server/:{{ container_config_directory }}/:ro

{{ node_config_directory }}/swift-account-auditor/:{{ container_config_directory }}/:ro

{{ node_config_directory }}/swift-account-replication-server/:{{ container_config_directory }}/:ro

{{ node_config_directory }}/swift-account-replicator/:{{ container_config_directory }}/:ro

{{ node_config_directory }}/swift-account-reaper/:{{ container_config_directory }}/:ro

{{ node_config_directory }}/swift-container-server/:{{ container_config_directory }}/:ro

{{ node_config_directory }}/swift-container-auditor/:{{ container_config_directory }}/:ro

{{ node_config_directory }}/swift-container-replication-server/:{{ container_config_directory }}/:ro

{{ node_config_directory }}/swift-container-replicator/:{{ container_config_directory }}/:ro

{{ node_config_directory }}/swift-container-updater/:{{ container_config_directory }}/:ro

{{ node_config_directory }}/swift-object-server/:{{ container_config_directory }}/:ro

{{ node_config_directory }}/swift-object-auditor/:{{ container_config_directory }}/:ro

{{ node_config_directory }}/swift-object-replication-server/:{{ container_config_directory }}/:ro

{{ node_config_directory }}/swift-object-replicator/:{{ container_config_directory }}/:ro

{{ node_config_directory }}/swift-object-updater/:{{ container_config_directory }}/:ro

{{ node_config_directory }}/swift-object-expirer/:{{ container_config_directory }}/:ro

inventory_hostname in groups['swift-proxy-server'] and run_start_swift_proxy_server | bool

( inventory_hostname in groups['swift-account-server'] or inventory_hostname in groups['swift-container-server'] or inventory_hostname in groups['swift-object-server'] ) and 'swift_rsyncd' not in skip_stop_containers

{{ node_custom_config }}/tacker/{{ inventory_hostname }}/tacker.conf

{{ node_config_directory }}/{{ item.key }}/{{ tacker_policy_file }}

In Train, Tacker started using local filesystem to store VNF packages and CSAR files. Kolla Ansible provides no shared filesystem capabilities, hence only one instance of each Tacker service is deployed and all on the same host. Previous multinode deployments will be descaled when running upgrade.

{{ node_custom_config }}/telegraf/{{ inventory_hostname }}/telegraf.conf

{{ node_custom_config }}/trove/{{ inventory_hostname }}/{{ item.key }}.conf

{{ node_custom_config }}/trove/{{ inventory_hostname }}/trove.conf

{{ node_config_directory }}/{{ item.key }}/{{ trove_policy_file }}

{{ node_config_directory }}/config/vitrage/{{ inventory_hostname }}/vitrage.conf

{{ node_config_directory }}/{{ item.key }}/{{ vitrage_policy_file }}

{{ node_custom_config }}/watcher/{{ inventory_hostname }}/watcher.conf

{{ node_config_directory }}/{{ item.key }}/{{ watcher_policy_file }}

{{ node_custom_config }}/{{ item.key }}/{{ inventory_hostname }}/{{ item.key }}.cfg

{{ node_config_directory }}/{{ item.key }}/{{ zun_policy_file }}

{{ managed_network_prefix }}{{ groups['all'].index(inventory_hostname) + 1 }}

{{ managed_interface_address }}/{{ managed_network_prefix_length }}

ip address add {{ managed_network_cidr }} broadcast {{ managed_network_broadcast_address }} dev {{ managed_interface_name }}

ip address add {{ managed_interface_address }}/{{ managed_network_prefix_length }} dev {{ managed_interface_name }}

{{ 'ping' if managed_network_address_family == 'ipv4' else 'ping6' }}

{{ ping_command }} -c1 {{ hostvars[item].managed_interface_address }}

The nodepool private IP address {{ nodepool.private_ipv4 }} is not assigned

ip link add {{ vxlan_interface_name }} type vxlan id {{ vxlan_vni }} local {{ tunnel_local_address }} dstport {{ vxlan_dstport }}

{{ ansible_interfaces |
    map('extract', ansible_facts) |
    selectattr('ipv4.address', 'defined') |
    selectattr('ipv4.address', 'equalto', tunnel_local_address) |
    first }}

bridge fdb append 00:00:00:00:00:00 dev {{ vxlan_interface_name }} dst {{ dest_ip }}

{{ ansible_os_family == 'RedHat' and ansible_distribution_major_version | int == 8 }}

{{ ansible_env.PWD }}/src/{{ zuul.project.canonical_hostname }}/openstack/kolla-ansible

{{ zuul.executor.work_root }}/src/{{ zuul.project.canonical_hostname }}/openstack/kolla-ansible

{{ scenario in ['core', 'ceph-ansible', 'zun', 'cells', 'swift', 'linuxbridge'] }}

{{ '2' if is_upgrade and previous_release == 'train' and not is_centos8 else '3' }}

{{ ceph_storetype if scenario in ['ceph-ansible'] else scenario }}

git checkout stable/{{ previous_release | lower }}
echo "kolla-ansible checked out to:"
git log --pretty=oneline  -1

{{ scenario == 'ceph-ansible' and is_previous_release and previous_release == 'train' }}

python{{ playbook_python_version }} -m ara.setup.callback_plugins

{{ kolla_ansible_local_src_dir }}/tests/templates/ansible.cfg.j2

{{ (passwords_yml.content | b64decode | from_yaml).kolla_ssh_key.private_key }}

{{ (passwords_yml.content | b64decode | from_yaml).kolla_ssh_key.public_key }}

ansible all -i {{ kolla_inventory_path }} -e ansible_user={{ ansible_user }} -m setup > /tmp/logs/ansible/initial-setup

{{ build_image_tag if need_build_image else zuul.branch | basename }}

{{ docker_image_prefix }}{{ base_distro }}-{{ install_type }}-swift-base:{{ docker_image_tag }}

{{ groups['all'] | map('extract', hostvars, ['ansible_'+api_interface_name, 'ipv4', 'address']) | join(' ') }}

projects/{{ gcp_project }}/locations/us-central1/keyRings/key-key-ring

results['resources'] | map(attribute='name') | select("match", ".*{{ resource_name }}.*") | list | length == 1

{{ cert_dir }}/{{ ipxe_ca_filename }},{{ cert_dir }}/{{ cert_file_filename }}

make clean
make CROSS_COMPILE=aarch64-linux-gnu- ARCH=arm64 \
EMBED={{ bootloader_filename }} \
     TRUST={{ trust_files }} \
     bin-arm64-efi/snp.efi

{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower }}.yml

{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower }}.yml

{{ ansible_os_family | lower }}-{{ ansible_distribution_major_version | lower }}.yml

make clean
make EMBED={{ bootloader_filename }} \
     bin-x86_64-efi/ipxe.efi \
     bin-x86_64-efi/snp.efi \
     bin-x86_64-efi/snponly.efi

mkdir -p efi_tmp
dd if=/dev/zero of=efi_tmp/ipxe.img count=2880
mformat -i efi_tmp/ipxe.img -m 0xf8 -f 2880
mmd -i efi_tmp/ipxe.img ::efi ::efi/boot
mcopy -i efi_tmp/ipxe.img bin-x86_64-efi/ipxe.efi ::efi/boot/bootx64.efi
genisoimage -o ipxe-efi.eiso -eltorito-alt-boot -eltorito-boot ipxe.img -no-emul-boot efi_tmp

truncate -s 3MiB ipxe-efi.usb
mkfs.vfat ipxe-efi.usb
mmd -i ipxe-efi.usb "::/efi"
mmd -i ipxe-efi.usb "::/efi/boot"
mcopy -i ipxe-efi.usb bin-x86_64-efi/ipxe.efi "::/efi/boot/bootx64.efi"

make clean
make EMBED={{ bootloader_filename }} TRUST={{ trust_files }} bin/ipxe.dsk bin/ipxe.iso bin/ipxe.lkrn bin/ipxe.usb bin/ipxe.kpxe bin/undionly.kpxe

{{ netbootxyz_root }}/ipxe/{{ bootloader_filename }}-undionly.kpxe

{{ netbootxyz_root }}/custom/{{ item.path | regex_replace('.j2','') }}

openssl cms -sign -binary -noattr -in {{ netbootxyz_root }}/{{ item }} \
-signer {{ codesign_cert_filename }} -inkey {{ codesign_key_filename }} -certfile {{ cert_file_filename }} -outform DER \
-out {{ sigs_dir }}/{{ item }}.sig

ansible-galaxy install -r "{{ requirements_path }}" -p "{{ ANSIBLE_REPO_PATH }}/configs/{{ env_type }}/roles"

{{ subzone_ns | json_query('ansible_facts.azure_dnsrecordset[0].properties.NSRecords[*].{entry: nsdname}') }}

{{ instances | json_query("
    [?name == '" + instance_canonical_name + "']
    | [].volumes[]
  ")
}}

{{ hostvars[lab_host]['ansible_host'] | default(hostvars[lab_host]['ansible_ssh_host']) | default(hostvars[lab_host]['inventory_hostname']) }}

https://{{ ansible_tower_ip }}/api/v2/hosts?name={{ lab_host_hostname }}

https://{{ ansible_tower_ip }}/api/v2/organizations?name={{ tower_org_name }}

https://{{ ansible_tower_ip }}/api/v2/projects?name={{ tower_project_name }}

https://{{ ansible_tower_ip }}/api/v2/inventories?name={{ tower_inventory_name }}

https://{{ ansible_tower_ip }}/api/v2/credentials?name={{ tower_credential_name }}

https://{{ ansible_tower_ip }}/api/v2/job_templates?name={{ tower_job_template_name }}

generate user info string for email when a workshop, create_login_page set to true, S3 bucket

generate S3 bucket URL for user email when ec2_region is us-east-1

user.info: https://s3.amazonaws.com/{{ guid }}.{{ workshop_dns_zone }}/{{ guid }}-index.html

generate S3 bucket URL for user email when ec2_region is NOT us-east-1

user.info: https://s3-{{ ec2_region }}.amazonaws.com/{{ guid }}.{{ workshop_dns_zone }}/{{ guid }}-index.html

user.info: Login is ssh student1@{{ hostvars[groups['control_nodes'][0]]['ansible_host'] }}

/bin/ansible-playbook -i /etc/ansible/hosts -e hosts_to_apply="masters" -e cuda_driver_repo_base_url="http://admin.na.shared.opentlc.com/repos/nvidia/" -e cuda_driver_repo_suffix="cuda/" /root/openshift-psap/playbooks/nvidia-driver-install.yaml

/bin/ansible-playbook -i /etc/ansible/hosts -e hosts_to_apply="masters" -e nvidia_container_hook_repo_base_url="http://admin.na.shared.opentlc.com/repos/nvidia/" -e libnvidia_container_suffix="libnvidia-container" -e libnvidia_container_repo_gpgcheck="false" -e nvidia_container_runtime_suffix="nvidia-container-runtime" -e nvidia_container_runtime_repo_gpgcheck="false" /root/openshift-psap/playbooks/nvidia-container-runtime-hook.yaml

{{ ANSIBLE_REPO_PATH }}/configs/{{ env_type }}/files/labs_hosts_template.{{ osrelease }}.j2

{{ ANSIBLE_REPO_PATH }}/configs/{{ env_type }}/files/prometheus_alerts_rules.yml

{{ lookup('sequence', 'start=1 end={{ user_count|int }}', wantlist=true) | map('int') | list }}

'quay_database', 'redis' and 'quay_enterprise' groups must be specified

'redis' not in groups or groups['redis']| length == 0 or 'quay_database' not in groups or groups['quay_database']| length == 0 or 'quay_enterprise' not in groups or groups['quay_enterprise']| length == 0

'clair' and 'clair_database' groups must be defined when quay_clair_enable=True

'clair' not in groups or groups['clair']|length == 0 or 'clair_database' not in groups or groups['clair_database']|length == 0

qe_quay_ssl_key_file is undefined or qe_quay_ssl_cert_file is undefined

{{ qe_quay_ssl_lets_encrypt_renew_automatically|d(False)|bool }}

docker ps --filter=name="{{ qe_quay_database_service_name | d('postgresql-quay') }}" -q

docker exec -i {{ postgresql_container.stdout }} /bin/bash -c 'PGPASSWORD={{ qe_quay_database_admin_password }} psql {{ qe_quay_database_name }} -c "CREATE EXTENSION pg_trgm;"'

qe_quay_ssl_cert_file is not defined or qe_quay_ssl_cert_file|trim == ""

{{ (qe_quay_ssl_enable|bool)| ternary('https','http') }}://{{ qe_quay_hostname }}.{{ subdomain_base }}

infranode_cluster_1 is not defined or infranode_cluster_2 is not defined or infranode_cluster_1 == "" or infranode_cluster_2 == ""

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport {{ item }} -j ACCEPT

ansible-playbook -i localhost, -c local /root/ansible_agnostic_deployer/ansible/configs/ocp-workloads/ocp-workload.yml -e"ANSIBLE_REPO_PATH=/root/ansible_agnostic_deployer/ansible" -e"ocp_username=developer" -e"ocp_workload={{ item }}" -e"guid=a1001" -e"ocp_user_needs_quota=false" -e"ocp_domain=https://{{ hostname }}:8443" -e"subdomain_base={{ ansible_hostname}}.{{subdomain_base}}" -e"ACTION=create"

{{ANSIBLE_REPO_PATH}}/workdir/{{ env_type }}.{{ guid }}.AutoScalingGroupClientVM

{{ lookup('sequence', 'start=1 end={{ num_users|int }}', wantlist=true) | map('int') | list }}

{{ hostvars[item].private_ip_address}} {{ hostvars[item].internaldns }}

Password needs to be provided to the role as parameter 'student_password'

quay_enterprise_address is undefined or quay_enterprise_address|trim == ""

http://{{ hostvars[inventory_hostname]['ansible_eth0']['ipv4']['address'] }}

-A INPUT -p tcp -m state --state NEW -m tcp --dport {{ postgresql_host_port }} -j ACCEPT

quay_enterprise_hostname is undefined or quay_enterprise_hostname|trim == ""

{{ quay_http_protocol }}://{{ quay_server_hostname }}/api/v1/superuser/config/createsuperuser?_csrf_token={{ token.stdout | urlencode }}

Invalid Database Type. 'quay_database_type' must be 'postgres' or 'mysql'

quay_clair_enable is defined and quay_clair_enable|bool and (quay_clair_endpoint is not defined or quay_clair_endpoint|trim == "")

quay_ssl_enable|bool and (quay_ssl_key_file|trim != "" and quay_ssl_cert_file|trim != "")

quay_ssl_enable|bool and (quay_ssl_key_file|trim == "" or quay_ssl_cert_file|trim == "")

quay_ssl_remote_tmp_dir is not defined and quay_ssl_remote_tmp_dir|trim == ""

{{ quay_ssl_remote_tmp_dir if quay_ssl_remote_tmp_dir is defined and quay_ssl_remote_tmp_dir|trim == '' else quay_ssl_remote_tmp_dir_mktemp.stdout }}

openssl req -nodes -x509 -newkey rsa:4096 -keyout {{ quay_ssl_remote_tmp_dir }}/ssl.key -out {{ quay_ssl_remote_tmp_dir }}/ssl.cert -subj "/C={{ quay_ssl_generate_country }}/ST={{ quay_ssl_generate_state }}/L={{ quay_ssl_generate_city }}/O={{ quay_ssl_generate_organization }}/OU={{ quay_ssl_generate_organizational_unit }}/CN={{ quay_server_hostname }}" -days {{ quay_ssl_generate_days_validity }}

not quay_config_stat_result.stat.exists and quay_superuser_username is defined and quay_superuser_username|trim != "" and quay_superuser_password is defined and quay_superuser_password|trim != "" and quay_superuser_email is defined and quay_superuser_email|trim != ""

-A INPUT -p tcp -m state --state NEW -m tcp --dport {{ redis_host_port }} -j ACCEPT

(git_installed_version.rc == 0) and (git_installed_version.stdout | regex_replace("^.*?([0-9\.]+)$", "\\1") | version_compare(git_version, operator="!="))

https://www.kernel.org/pub/software/scm/git/git-{{ git_version }}.tar.gz

make prefix={{ git_install_path }} {{ item }} chdir={{ workspace }}/git-{{ git_version }}

(git_install_from_source == false) and (ansible_os_family == 'RedHat')

(git_install_from_source == false) and (ansible_os_family == 'Debian')

{{ ansible_distribution|title }}-{{ ansible_distribution_version.split('.')[0] }}.yml

jenkins_protocol variable is undefined or has a wrong value. Available options: http, https

curl -D - --silent --max-time 5 {{ jenkins_protocol }}://{{ jenkins_hostname }}:{{ jenkins_port }}{{ jenkins_url_prefix }}/cli/ -k

(result.stdout.find("403 Forbidden") != -1) or (result.stdout.find("200 OK") != -1) and (result.stdout.find("Please wait while") == -1)

{{ jenkins_protocol }}://{{ jenkins_hostname }}:{{ jenkins_port }}{{ jenkins_url_prefix }}/jnlpJars/jenkins-cli.jar

'OK' in jarfile_get.msg or 'file already exists' in jarfile_get.msg or 'Not Modified' in jarfile_get.msg

{{ adminpasswordfile['stdout'] | default(jenkins_admin_password) }}

{{ jenkins_protocol }}://{{ jenkins_hostname }}:{{ jenkins_port }}{{ jenkins_url_prefix }}

openssl req -x509 -new -nodes -key {{ jenkins_ca_key_path }} -sha256 -days {{ jenkins_cert_expiration_days }} -out {{ jenkins_ca_cert_path }} -subj "{{ jenkins_ca_subject_value }}"

openssl req -new -subj "{{ jenkins_ca_subject_value }}" -key {{ jenkins_key_path }} -out {{ jenkins_csr_path }}

openssl x509 -req -in {{ jenkins_csr_path }} -CA {{ jenkins_ca_cert_path }} -CAkey {{ jenkins_ca_key_path }} -CAcreateserial -out {{ jenkins_cert_path }} -sha256 -days {{ jenkins_cert_expiration_days }}

(jenkins_users_config is defined and jenkins_users_config.changed) or (jenkins_http_config is defined and jenkins_http_config.changed) or (jenkins_https_config is defined and jenkins_https_config.changed) or (jenkins_keystore_config is defined and jenkins_keystore_config.changed) or (jenkins_keystore_pass_config is defined and jenkins_keystore_pass_config.changed) or (jenkins_https_listen_address_config is defined and jenkins_https_listen_address_config.changed) or (jenkins_home_config is defined and jenkins_home_config.changed)

openssl pkcs12 -export -out {{ jenkins_pkcs12_path }} -passout pass:{{ jenkins_keystore_pass }} -inkey {{ jenkins_key_path }} -in {{ jenkins_cert_path }} -certfile {{ jenkins_ca_cert_path }} -name {{ jenkins_target_domain }}

keytool -importkeystore -srckeystore {{ jenkins_pkcs12_path }} -srcstoretype pkcs12 -srcstorepass {{ jenkins_keystore_pass }} -srcalias {{ jenkins_target_domain }} -destkeystore {{ jenkins_keystore_path }} -deststoretype jks -deststorepass {{ jenkins_keystore_pass }} -destalias {{ jenkins_target_domain }}

{{ jenkins_https_keystore_password_param }}={{ jenkins_keystore_pass }}

{{ jenkins_https_listen_address_param }}={{ jenkins_https_listen_address }}

{{ jenkins_pkg_url }}/jenkins-{{ jenkins_version }}-1.1.noarch.rpm

deb http://ftp.debian.org/debian {{ ansible_distribution_release }}-backports main

AWS Credentials are required when requesting certificates for a wildcard domain

(acme_aws_access_key is not defined or acme_aws_access_key|trim == "" or acme_aws_secret_access_key is not defined or acme_aws_secret_access_key|trim == "")

{{ (acme_wildcard_domain|length|int>0)|ternary('true','false') }}

cacert.stat.exists|bool == false or acme_force_issue|d(False)|bool

SAVED_AWS_SECRET_ACCESS_KEY_ID='{{ acme_aws_secret_access_key }}'

not cache_archive_file.stat.exists|bool or acme_force_issue|d(False)|bool

Both Certificate and Key file need to be provided - proceeding with full setup

not (cache_cert_file.stat.exists|bool and cache_key_file.stat.exists|bool)

{{ acme_remote_dir }}/.acme.sh/{{ acme_domain }}/{{ acme_domain }}.cer

{{ acme_remote_dir }}/.acme.sh/{{ acme_domain }}/{{ acme_domain }}.key

{{ acme_remote_dir }}/acme.sh/acme.sh {{ (acme_production|bool)|ternary('','--staging') }} {{ acme_additional_args|d('') }} --issue -d {{ acme_domain }} {{ (acme_wildcard_domain|length>0)|ternary('-d','')}} {{ (acme_wildcard_domain|length>0)|ternary(acme_wildcard_domain,'')}} {{ (acme_wildcard_certs|bool)|ternary('--dns dns_aws', '--standalone') }}

acme_cache_cert_file is defined and acme_cache_cert_file|trim != ""

acme_cache_key_file is defined and acme_cache_key_file|trim != ""

{{ ANSIBLE_REPO_PATH }}/configs/{{env_type}}/files/htpasswd.openshift

sg_map -x | awk '($2 == 5 && $5 == {{ disk_map_device.lun }}) {print $7}'

{{ disk_map_device.name }}  (LUN={{ disk_map_device.lun }}) : {{ result.stdout }}

{% if hostvars[item].isolated %}
  Hostname {{ hostvars[item].public_ip_address }}
{% else %}
{% endif %}

cloudformation_out is succeeded and (
  'output' in cloudformation_out
  and cloudformation_out.output in ["Stack CREATE complete", "Stack is already up-to-date."]
)

cloudformation_out_s3 is succeeded and (
  'output' in cloudformation_out_s3
  and cloudformation_out_s3.output in ["Stack CREATE complete", "Stack is already up-to-date."]
)

aws cloudformation validate-template --region {{ aws_region_final | d(aws_region) | default(region) | default('us-east-1')}} --template-url https://s3.amazonaws.com/{{bucket_templates}}/{{env_type}}.{{guid}}.{{cloud_provider}}_cloud_template

oc adm new-project aws-service-broker --node-selector='env=infra'

oc adm new-project aws-service-broker --node-selector='node-role.kubernetes.io/infra=true'

oc create configmap webconsole-customization --from-file=custom-categories.js=/root/custom-categories.js -n openshift-web-console

oc new-app nginx:1.12~https://github.com/siamaksade/web-console-customization.git --name=static -n openshift-web-console

oc set volume dc/static --add --name=custom --configmap-name=webconsole-customization --mount-path=/opt/app-root/src/custom -n openshift-web-console

oc get route/static -n openshift-web-console -o jsonpath='{ .spec.host }'

oc get cm/webconsole-config -n openshift-web-console -o jsonpath='{ .data.webconsole-config\.yaml }' > /tmp/webconsole-config.yaml

  scriptURLs:
  - https://{{ webconsole_url.stdout }}/custom/custom-categories.js

oc create configmap webconsole-config --from-file=webconsole-config.yaml=/tmp/webconsole-config.yaml -n openshift-web-console --dry-run -o yaml | oc replace -f -

oc delete pod -l app=openshift-web-console -n openshift-web-console

{{ openshift_cli }} new-app -f {{ installer_product }} --param=OPENSHIFT_ISTIO_MASTER_PUBLIC_URL={{ openshift_master_public }} -n istio-operator

{{ openshift_cli }} new-app -f {{ installer_community }} --param=OPENSHIFT_ISTIO_MASTER_PUBLIC_URL={{ openshift_master_public }} -n istio-operator

{{ openshift_cli }} create -f /tmp/istio-cr.yaml -n istio-operator

{{ openshift_cli }} get deployment istio-sidecar-injector -o jsonpath='{.status.availableReplicas}' -n istio-system

oc new-project {{ nexus_project }} --display-name='{{ nexus_project_display_name }}'

oc new-app -f /root/nexus-template.yaml --param=VOLUME_CAPACITY={{ nexus_volume_capacity }} --param=MEMORY_LIMIT={{ nexus_memory_limit }} --param=MEMORY_REQUEST={{ nexus_memory_request }} --param=CPU_LIMIT={{ nexus_cpu_limit }} --param=CPU_REQUEST={{ nexus_cpu_request}} --param=NEXUS_VERSION={{ nexus_version }} -n {{ nexus_project }}

oc create clusterquota clusterquota-"{{ocp_username}}-{{lab_name}}" \

oc delete clusterresourcequota clusterquota-{{ocp_username}}-{{lab_name}}

oc new-project {{ocp_project}} --description='{{project_description}}' --display-name={{ocp_project}}

oc policy add-role-to-user view system:serviceaccount:{{ocp_project}}:sso-service-account

oc new-app --template=sso72-x509-mysql-persistent --param=SSO_ADMIN_USERNAME={{SSO_ADMIN_USERNAME}} --param=SSO_ADMIN_PASSWORD={{SSO_ADMIN_PASSWORD}}  --param=HOSTNAME_HTTP={{SSO_HOSTNAME_HTTP}} --param=HOSTNAME_HTTPS={{SSO_HOSTNAME_HTTPS}} -n {{ocp_project}}

oc process -f {{sso_oauth_realm_template_url}}  --param=OPENSHIFT_MASTER={{OPENSHIFT_MASTER}} --param=KEYCLOAK_ROUTE_HOSTNAME={{SSO_HOSTNAME_HTTP}} --param=MICROCKS_ROUTE_HOSTNAME={{MICROCKS_ROUTE_HOSTNAME}} --param=APICURIO_UI_ROUTE_HOSTNAME=http://{{APICURIO_UI_ROUTE}} --param=OPENSHIFT_OAUTH_CLIENT_NAME={{OPENSHIFT_OAUTH_CLIENT_NAME}} -n {{ocp_project}}| oc create -f - -n {{ocp_project}} 

oc create -f {{apibiz_url}}/apicurio-template.yml -n {{ocp_project}}

oc new-app --template=apicurio-studio --param=AUTH_ROUTE=http://{{SSO_HOSTNAME_HTTP}}/auth --param=UI_ROUTE={{APICURIO_UI_ROUTE}} --param=API_ROUTE={{APICURIO_API_ROUTE}} --param=WS_ROUTE={{APICURIO_WS_ROUTE}} --param=API_JVM_MAX=2000m --param=API_MEM_LIMIT=3000Mi --param=WS_JVM_MAX=2000m --param=WS_MEM_LIMIT=2500Mi --param=UI_JVM_MAX=1800m --param=UI_MEM_LIMIT=2500Mi -n {{ocp_project}}

oc create -f {{apibiz_url}}/microcks-persistent-no-keycloak-template.yml -n {{ocp_project}}

oc new-app --template=microcks-persistent-no-keycloak --param=APP_ROUTE_HOSTNAME={{MICROCKS_ROUTE_HOSTNAME}} --param=KEYCLOAK_ROUTE_HOSTNAME={{KEYCLOAK_ROUTE_HOSTNAME}} -n {{ocp_project}}

ACTION == "tenant_mgmt" or ACTION == "create" or ACTION == "provision"

oc create clusterquota clusterquota-"{{admin_username}}-{{ocp_project}}" \
--project-annotation-selector=openshift.io/requester="{{admin_username}}" \

create API Gateways for each tenant = {{create_gws_with_each_tenant}}

oc delete clusterresourcequota clusterquota-{{admin_username}}-{{ocp_project}}

oc annotate namespace {{ocp_project}} openshift.io/requester={{admin_username}} --overwrite

rc_state.stdout | from_json | json_query('items[?  (status.readyReplicas == ""|| status.readyReplicas == `0`) ].metadata.annotations[? "openshift.io/deployment.cancelled"==''true'']."openshift.io/deployment-config.name"') | intersect(pod_to_wait) | length == 0

oc process -f {{pam_template_yml}} -p IMAGE_STREAM_NAMESPACE={{ocp_project}} -p KIE_ADMIN_PWD={{kie_admin_passwd}} -p APPLICATION_NAME={{app_name}} -p BUSINESS_CENTRAL_HTTPS_SECRET={{bcentral_app_secret}} -p KIE_SERVER_HTTPS_SECRET={{kserver_app_secret}} > /tmp/{{guid}}/{{pam_template_name}}.json

oc create -f /tmp/{{guid}}/{{pam_template_name}}.json -n {{ocp_project}}

oc create configmap products-cm --from-file=/tmp/{{guid}}/products.txt -n {{ocp_project}}

oc volume dc/{{app_name}}-kieserver -n {{ocp_project}} \ --overwrite --add -t configmap -m /data --name=products-volume --configmap-name=products-cm

-p OPENSHIFT_MASTER=https://master.{{subdomain_base}} \

git clone --branch {{ release_tag }} https://github.com/integr8ly/installation.git {{ install_dir }}

ansible-playbook -i "{{ inventory_hosts_file }}" \
playbooks/uninstall.yml

playbooks/install.yml -e eval_self_signed_certs="{{ self_signed_certs_enabled }}"

oc get route/tutorial-web-app -o template --template \{\{.spec.host\}\} -n "{{ webapp_namespace }}"

user.info: Cluster Admin User: {{ admin_username }} / {{ admin_password }}

user.info: Evaluation User: {{ evals_username }} / {{ evals_password }}

user.info: Pre-seeded Evaluation Users: evals{01..50}@example.com / {{ evals_password }}

oc secrets link default redhat-iot-rhpds-pull-secret --for=pull -n {{ocp_project}}

oc new-app -f /tmp/{{guid}}/broker.yml -p 'MQTT_NODE_PORT={{mqtt_port}}' -p 'MQTTS_NODE_PORT={{mqtts_port}}' -p IMAGE_VERSION=5.0.0 -p NAMESPACE={{ocp_project}} -p EC_SECRET_DB=ec-db -p DISABLE_SSL=true -n {{ocp_project}}

user.info: Dashboard: http://dashboard-{{ocp_project}}.{{ocp_apps_domain}}

user.info: EC Console: http://ec-console-{{ocp_project}}.{{ocp_apps_domain}} UserID: ec-sys Password: ec-password

user.info: EC Broker MQTT: mqtt://ec-broker-mqtt.{{ocp_project}}.{{ocp_apps_domain}}:{{mqtt_port}} Account: Red-Hat Login: ec-sys Password: ec-password

oc new-app -f /tmp/{{guid}}/dashboard-proxy.yml -p 'BROKER_USERNAME=ec-sys' -p 'BROKER_PASSWORD=ec-password'

oc new-app -f /tmp/{{guid}}/dashboard.yml -p 'BROKER_HOSTNAME=ec-broker-ws-{{ocp_project}}' -p 'BROKER_PASSWORD=ec-password' -p 'BROKER_USERNAME=ec-sys' -p 'DASHBOARD_PROXY_HOSTNAME=dashboard-proxy-{{ocp_project}}'

user.info: ESF Virtual Gateway: http://esf-{{ocp_project}}.{{ocp_apps_domain}} UserID: admin Password: admin

oc create clusterquota clusterquota-"{{admin_username}}-{{lab_name}}" \

oc delete clusterresourcequota clusterquota-{{admin_username}}-{{lab_name}}

oc adm policy add-scc-to-group anyuid system:authenticated -n {{ocp_project}}

oc get deployment istio-sidecar-injector -o jsonpath='{.status.availableReplicas}' -n istio-system

oc policy add-role-to-user admin {{admin_username}} -n {{ocp_project}}

realm_management_log_file = {{realm_output_dir}}/{{realm_provisioning_log_file}}

Management of realms complete.  output files available at {{realm_output_dir}}

    --template={{rhsso_template_name}} \
    --param=SSO_ADMIN_USERNAME={{SSO_SITE_ADMIN_USERNAME}} \
    --param=SSO_ADMIN_PASSWORD={{SSO_SITE_ADMIN_PASSWORD}} \
    --param=MEMORY_LIMIT=2Gi \
    -n {{ocp_project}} \
    > /tmp/sso_provision.txt

rc_state.stdout |from_json | json_query("items[? (kind == 'ReplicationController')].metadata.annotations.\"openshift.io/deployment-config.name\"") |intersect(item) |length >= 1

rc_state.stdout |from_json |json_query("items[? ((status.readyReplicas == \"\" || status.readyReplicas == '`0`') && (metadata.annotations.\"openshift.io/deployment.cancelled\" != 'true'))].metadata.annotations.\"openshift.io/deployment-config.name\"") |intersect(pod_to_wait) |length == 0

--display-name="RHPAM 7 Order IT Hardware Demo" \
--description="Red Hat Process Automation Manager 7 Order IT Hardware Demo"

oc patch is/rhpam71-kieserver-openshift --type='json' -p '[{"op": "replace", "path": "/spec/tags/0/from/name", "value": "registry.access.redhat.com/rhpam-7/rhpam71-kieserver-openshift:1.0"}]'

oc process -f {{pam_secrets_template_yml}} -p SECRET_NAME=businesscentral-app-secret | oc create -f - -n {{ocp_project}}

oc process -f {{pam_secrets_template_yml}} -p SECRET_NAME=kieserver-app-secret | oc create -f - -n {{ocp_project}}

oc create serviceaccount businesscentral-service-account -n {{ocp_project}}

oc create serviceaccount kieserver-service-account -n {{ocp_project}}

oc secrets link --for=mount businesscentral-service-account businesscentral-app-secret -n {{ocp_project}}

oc secrets link --for=mount kieserver-service-account kieserver-app-secret -n {{ocp_project}}

oc create configmap rhpam-bc-setup-config-map --from-file=/tmp/{{guid}}/bc-clone-git-repository.sh,/tmp/{{guid}}/provision-properties-static.sh -n {{ocp_project}}

oc process -f /tmp/{{guid}}/rhpam71-businesscentral-openshift-with-users.yaml -p DOCKERFILE_REPOSITORY="https://github.com/jbossdemocentral/rhpam7-order-it-hw-demo-rhpamcentr" -p DOCKERFILE_REF="master" -p DOCKERFILE_CONTEXT="." -n {{ocp_project}} | oc create -n {{ocp_project}} -f -

oc new-app --template=rhpam71-authoring \
  -p APPLICATION_NAME="rhpam7-oih" \
  -p KIE_ADMIN_USER="adminUser" \
  -p KIE_ADMIN_PWD="test1234!" \
  -p KIE_SERVER_CONTROLLER_USER="controllerUser" \
  -p KIE_SERVER_CONTROLLER_PWD="test1234!" \
  -p KIE_SERVER_USER="executionUser" \
  -p KIE_SERVER_PWD="test1234!" \
  -p BUSINESS_CENTRAL_HTTPS_SECRET="businesscentral-app-secret" \
  -p KIE_SERVER_HTTPS_SECRET="kieserver-app-secret" \
  -p MAVEN_REPO_URL="http://nexus:8081/content/groups/public/" \
  -p MAVEN_REPO_USERNAME="deployment" \
  -p MAVEN_REPO_PASSWORD="deployment123" \
  -p BUSINESS_CENTRAL_MAVEN_USERNAME="mavenUser" \
  -p BUSINESS_CENTRAL_MAVEN_PASSWORD="test1234!" \
  -p BUSINESS_CENTRAL_MEMORY_LIMIT="2Gi" \
  -p IMAGE_STREAM_NAMESPACE={{ocp_project}} -n {{ocp_project}}

oc volume dc/rhpam7-oih-rhpamcentr --add --name=config-volume --configmap-name=rhpam-bc-setup-config-map --mount-path=/tmp/config-files

oc set deployment-hook dc/rhpam7-oih-rhpamcentr --post -c rhpam7-oih-rhpamcentr -e BC_URL="http://rhpam7-oih-rhpamcentr:8080" -v config-volume --failure-policy=abort -- /bin/bash /tmp/config-files/bc-clone-git-repository.sh

oc patch dc/rhpam7-oih-rhpamcentr --type='json' -p '[{"op": "replace", "path": "/spec/triggers/0/imageChangeParams/from/name", "value": "rhpam71-businesscentral-openshift-with-users:latest"}]'

oc new-app java:8~https://github.com/jbossdemocentral/rhpam7-order-it-hw-demo-springboot-app \
  --name rhpam7-oih-order-app \
  -e JAVA_OPTIONS="-Dorg.kie.server.repo=/data -Dorg.jbpm.document.storage=/data/docs -Dorder.service.location=http://rhpam7-oih-order-mgmt-app:8080 -Dorg.kie.server.controller.user=controllerUser -Dorg.kie.server.controller.pwd=test1234! -Dspring.profiles.active=openshift-rhpam" \
  -e KIE_MAVEN_REPO_USER=mavenUser \
  -e KIE_MAVEN_REPO_PASSWORD=test1234! \
  -e KIE_MAVEN_REPO=http://rhpam7-oih-rhpamcentr:8080/maven2 \
  -e GC_MAX_METASPACE_SIZE=192 -n {{ocp_project}}

oc create configmap rhpam7-oih-order-app-settings-config-map --from-file=/tmp/{{guid}}/settings.xml -n {{ocp_project}}

oc volume dc/rhpam7-oih-order-app --add -m /home/jboss/.m2 -t configmap --configmap-name=rhpam7-oih-order-app-settings-config-map -n {{ocp_project}}

oc volume dc/rhpam7-oih-order-app --add --claim-size 100Mi --mount-path /data --name rhpam7-oih-order-app-data -n {{ocp_project}}

oc create configmap rhpam7-oih-order-app-properties-config-map --from-file=/tmp/{{guid}}/application-openshift-rhpam.properties -n {{ocp_project}}

oc volume dc/rhpam7-oih-order-app --add -m /deployments/config -t configmap --configmap-name=rhpam7-oih-order-app-properties-config-map -n {{ocp_project}}

oc new-app java:8~https://github.com/jbossdemocentral/rhpam7-order-it-hw-demo-vertx-app \
  --name rhpam7-oih-order-mgmt-app \
  -e JAVA_OPTIONS='-Duser=maciek -Dpassword=maciek1!' \
  -e JAVA_APP_JAR=order-mgmt-app-1.0.0-fat.jar \
  -n {{ocp_project}}

oc policy add-role-to-user admin system:serviceaccount:{{ocp_project_pipelines}}:jenkins -n {{item}}

oc process openshift//jenkins-ephemeral -n {{ ocp_project_pipelines }}| oc apply -f- -n {{ ocp_project_pipelines }} 

oc process -f {{ springboot_noun_project_deployment_template_url }} -p APPLICATION_NAME=springboot-noun-service -p NAMESPACE={{ ocp_project_dev }} -p SA_NAMESPACE={{ ocp_project_pipelines }} -n {{ ocp_project_dev }}| oc apply -f- -n {{ ocp_project_dev }}

oc process -f {{ springboot_noun_project_deployment_template_url }} -p APPLICATION_NAME=springboot-noun-service -p NAMESPACE={{ ocp_project_tst }} -p SA_NAMESPACE={{ ocp_project_pipelines }} -n {{ ocp_project_tst }}| oc apply -f- -n {{ ocp_project_tst }}

oc process -f {{ springboot_noun_project_build_template_url }} -p APPLICATION_NAME=springboot-noun-service -p NAMESPACE={{ ocp_project_pipelines }} -p SOURCE_REPOSITORY_URL={{ springboot_src_repo_url }} -p SOURCE_REPOSITORY_REF=master -n {{ ocp_project_pipelines }}| oc apply -f- -n {{ ocp_project_pipelines }}

oc process -f {{ wildflyswarm_adjective_project_deployment_template_url }} -p APPLICATION_NAME=wildflyswarm-adj -p NAMESPACE={{ ocp_project_dev }} -p SA_NAMESPACE={{ ocp_project_pipelines }} -n {{ ocp_project_dev }}| oc apply -f- -n {{ ocp_project_dev }}

oc process -f {{ wildflyswarm_adjective_project_deployment_template_url }} -p APPLICATION_NAME=wildflyswarm-adj -p NAMESPACE={{ ocp_project_tst}} -p SA_NAMESPACE={{ ocp_project_pipelines }} -n {{ ocp_project_tst }}| oc apply -f- -n {{ ocp_project_tst }}

oc process -f {{ wildflyswarm_adjective_project_build_template_url }} -p APPLICATION_NAME=wildflyswarm-adj -p NAMESPACE={{ ocp_project_pipelines }} -p SOURCE_REPOSITORY_URL={{ wildfltswarm_src_repo_url }} -p SOURCE_REPOSITORY_REF=master -n {{ ocp_project_pipelines }}| oc apply -f- -n {{ ocp_project_pipelines }}

oc process -f {{ vertx_adjective_project_deployment_template_url }} -p APPLICATION_NAME=vertx-adjective-service -p NAMESPACE={{ ocp_project_dev }} -p SA_NAMESPACE={{ ocp_project_pipelines }} -n {{ ocp_project_dev }}| oc apply -f- -n {{ ocp_project_dev }}

oc process -f {{ vertx_adjective_project_deployment_template_url }} -p APPLICATION_NAME=vertx-adjective-service -p NAMESPACE={{ ocp_project_tst }} -p SA_NAMESPACE={{ ocp_project_pipelines }} -n {{ ocp_project_tst }}| oc apply -f- -n {{ ocp_project_tst }}

oc process -f {{ vertx_adjective_project_build_template_url }} -p APPLICATION_NAME=vertx-adjective-service -p NAMESPACE={{ ocp_project_pipelines }} -p SOURCE_REPOSITORY_URL={{ vertx_adj_src_repo_url }} -p SOURCE_REPOSITORY_REF=master -n {{ ocp_project_pipelines }}| oc apply -f- -n {{ ocp_project_pipelines }}

oc process -f {{ vertx_gateway_project_deployment_template_url }} -p APPLICATION_NAME=vertx-insult-gateway -p NAMESPACE={{ ocp_project_dev }} -p SA_NAMESPACE={{ ocp_project_pipelines }} -n {{ ocp_project_dev }}| oc apply -f- -n {{ ocp_project_dev }}

oc process -f {{ vertx_gateway_project_deployment_template_url }} -p APPLICATION_NAME=vertx-insult-gateway -p NAMESPACE={{ ocp_project_tst}} -p SA_NAMESPACE={{ ocp_project_pipelines }} -n {{ ocp_project_tst }}| oc apply -f- -n {{ ocp_project_tst }}

oc process -f {{ vertx_gateway_project_build_template_url }} -p APPLICATION_NAME=vertx-insult-gateway -p NAMESPACE={{ ocp_project_pipelines }} -p SOURCE_REPOSITORY_URL={{ vertx_gateway_src_repo_url }} -p SOURCE_REPOSITORY_REF=master -n {{ ocp_project_pipelines }}| oc apply -f- -n {{ ocp_project_pipelines }}

oc create -f "{{ modified_nodejs_template_path }}" -n openshift

           -p "APPLICATION_NAME={{ APPLICATION_NAME }}" \
           -p "KIE_ADMIN_USER={{ KIE_ADMIN_USER }}" \
           -p "KIE_ADMIN_PWD={{ KIE_ADMIN_USER }}" \
           -p "KIE_SERVER_USER={{ KIE_SERVER_USER }}" \
           -p "KIE_SERVER_PWD={{ KIE_SERVER_PWD }}" \
           -p "KIE_SERVER_CONTAINER_DEPLOYMENT={{ KIE_SERVER_CONTAINER_DEPLOYMENT }}" \
           -p "SOURCE_REPOSITORY_URL={{ SOURCE_REPOSITORY_URL }}" \
           -p "SOURCE_REPOSITORY_REF={{ SOURCE_REPOSITORY_REF }}" \
           -p "CONTEXT_DIR={{ CONTEXT_DIR }}" \

oc create clusterquota "{{cluster_quota_name}}" \

oc adm policy add-role-to-user view {{ocp_username}} -n istio-system

oc adm policy add-cluster-role-to-user sudoer {{ocp_username}} --as=system:admin

oc new-project {{ocp_1_project}} --display-name={{ocp_1_project}}

oc new-project {{ocp_2_project}} --display-name={{ocp_2_project}}

oc adm policy add-scc-to-user privileged -z default -n {{ocp_1_project}} 

oc create configmap app-config --from-file=/tmp/app-config.yaml -n {{ocp_1_project}}

-n {{ocp_1_project}} 

-f /tmp/coolstore-gateway.yaml \
-n {{ocp_2_project}} 

oc annotate namespace {{ocp_1_project}} openshift.io/requester={{ocp_username}} --overwrite

oc policy add-role-to-user admin {{ocp_username}} -n {{ocp_1_project}}

oc create clusterquota clusterquota-"{{ocp_project}}" \

oc new-app --template {{ spark_dc }} -p APPLICATION_NAME={{ spark_app_2 }} -p APP_MAIN_CLASS=com.redhat.gpte.App -p GIT_URI={{ spark_git }} -p APP_FILE=spark-drools.jar -p OSHINKO_DEL_CLUSTER=false -n {{lab_3_name}}

oc new-app --template=$namespace/apache-zeppelin-openshift -p APPLICATION_NAME={{ spark_app_3 }} -p GIT_URI={{ zeppelin_git }} -p ZEPPELIN_INTERPRETERS=md -n {{lab_4_name}}

oc new-app --template radanalytics-jupyter-notebook -p JUPYTER_NOTEBOOK_PASSWORD=developer -n {{lab_5_name}}

oc new-app --template=$namespace/apache-zeppelin-openshift -p APPLICATION_NAME={{ spark_app_3 }} -p GIT_URI={{ zeppelin_git }} -p ZEPPELIN_INTERPRETERS=md -n {{lab_6_name}}

oc policy add-role-to-user admin {{ocp_username}} -n {{lab_1_name}}

oc apply -f {{ clusteroperator_rolebinding_yaml }} -n {{lab_1_name}}

oc apply -f {{ topicoperator_rolebinding_yaml }} -n {{lab_1_name}}

oc apply -f {{clusteroperator_deployment_yaml}} -n {{lab_1_name}}

subscription-manager register --org="{{satellite_org}}" --activationkey="{{ satellite_activationkey }}" --force

subscription-manager repos --enable=rhel-7-server-satellite-tools-6.3-rpms

https://releases.ansible.com/ansible-tower/setup/ansible-tower-setup-{{ tower_setup_version | default('latest') }}.tar.gz

hostnamectl --machine="{{ inventory_hostname }}" status | awk '/Machine ID/ {print $3}'

common-tasks/os-{{ container_tech | default('lxc') }}-container-setup.yml

{{ haproxy_default_services + haproxy_extra_services|default([]) }}

item.value.bridge in hostvars[physical_host]['ansible_interfaces']

External and Internal LB vip addresses are the same.
Run with -e vipcheck=False if you want to bypass this check.

Misconfigured keepalived IP, the carrying interface {{ item }} doesn't exist

Misconfigured keepalived: The vip {{ item }} is not an IP address, but a network

http://{{ hostvars[item]['container_address'] }}:{{ repo_server_port }}/{{ repo_requirements_file }}

echo stats | nc -w 3 {{ hostvars[memcached_host]['container_address'] }} {{ memcached_port }}

{{ venv_path }}/bin/python2 {{ venv_path }}/rabbitmq-test.py {{ hostvars[groups['rabbitmq_all'][0]]['container_address'] }}

{{ keystone_service_internaluri_insecure | ternary(false, true) }}

[?name == '{{ nova_vm.name }}'].addresses.{{ nova_vm.network }}[] | [?contains(*,'floating')].addr

scp -o StrictHostKeyChecking=no -i {{ ssh_key }} cirros@{{ _floating_ip[0] }}:/etc/fstab /tmp/fstab

Ensure systemd-journal-remote socket is enabled on receiving host

{{ ((((groups['hosts'] | length) * 1.5) + (groups['hosts'] | length)) // 1) | int }}

{{ (ansible_host != systemd_journal_remote_target) | ternary('no', 'yes') }}

{{ (ansible_host != systemd_journal_remote_target) | ternary('stopped', 'started') }}

{{ systemd_utils_prefix }}/systemd-journal-remote --listen-http=-3 --split-mode=host --compress --seal --output=/var/log/journal/remote/

{{ (ansible_host == systemd_journal_remote_target) | ternary('no', 'yes') }}

{{ (ansible_host == systemd_journal_remote_target) | ternary('stopped', 'started') }}

{{ systemd_utils_prefix }}/systemd-journal-upload --save-state --merge --url=http://{{ systemd_journal_remote_target }}:19532

{% for host in ansible_play_hosts %}
hostname: {{ host }}
listening_ports:
{% for port in hostvars[host].listening_ports['stdout_lines'] %}
{{ port }}

if which apt-get >/dev/null && ! which python >/dev/null ; then
  if ! which python3 >/dev/null ; then
    apt-get -y install python3
  fi
  update-alternatives --install /usr/bin/python python /usr/bin/python3 10
  exit 2
else
  exit 0
fi

(ansible_distribution == 'Debian' and ansible_distribution_release == 'stretch') or (ansible_distribution == 'Debian' and ansible_distribution_release == 'buster') or (ansible_distribution == 'Ubuntu' and ansible_distribution_release == 'bionic') or (ansible_os_family == 'RedHat' and ansible_distribution_major_version == '7') or (ansible_os_family == 'Suse' and ansible_distribution_major_version in ['15', '42'])

The only supported platforms for this release are Debian Stretch or Buster, Ubuntu 18.04 LTS (Bionic),  CentOS 7 (WIP) and openSUSE Leap 42.X and openSUSE Leap 15.X

{{ (groups['cinder_all'] | map('extract', hostvars, ['ansible_local', 'openstack_ansible', 'cinder', 'venv_tag'])) | list }}

{{ (cinder_all_software_versions | select('defined')) | list == cinder_all_software_versions }}

{{ ((cinder_all_software_versions | unique) | length == 1) and (cinder_all_software_deployed | bool) }}

ansible_local['openstack_ansible']['cinder']['need_service_restart'] | bool

{{ (groups['glance_all'] | map('extract', hostvars, ['ansible_local', 'openstack_ansible', 'glance', 'venv_tag'])) | list }}

{{ (glance_all_software_versions | select('defined')) | list == glance_all_software_versions }}

{{ ((glance_all_software_versions | unique) | length == 1) and (glance_all_software_deployed | bool) }}

ansible_local['openstack_ansible']['glance']['need_service_restart'] | bool

{{ ((gnocchi_storage_driver | default('file')) == 'swift') | ternary(true, false)}}

{{ (groups['keystone_all'] | map('extract', hostvars, ['ansible_local', 'openstack_ansible', 'keystone', 'venv_tag'])) | list }}

{{ (keystone_all_software_versions | select('defined')) | list == keystone_all_software_versions }}

{{ ((keystone_all_software_versions | unique) | length == 1) and (keystone_all_software_deployed | bool) }}

ansible_local['openstack_ansible']['keystone']['need_db_contract'] | bool

{{ (groups['nova_all'] | map('extract', hostvars, ['ansible_local', 'openstack_ansible', 'nova', 'venv_tag'])) | list }}

{{ (nova_all_software_versions | select('defined')) | list == nova_all_software_versions }}

{{ ((nova_all_software_versions | unique) | length == 1) and (nova_all_software_deployed | bool) }}

{{ ['nova-placement-api.service', 'nova-novncproxy.service', 'nova-spicehtml5proxy.service' ] + nova_service_negate | default([]) }}

ansible_local['openstack_ansible']['nova']['need_service_restart'] | bool

ansible_local['openstack_ansible']['nova']['need_online_data_migrations'] | bool

(not (tempest_install | default(false)) | bool) or (not (tempest_run | default(false)) | bool)

{{ requirements_git_url | default('https://opendev.org/openstack/requirements/raw/' ~ requirements_git_install_branch | default('master') ~ '/upper-constraints.txt') }}

{{ (utility_distro_packages | default([])) + _utility_distro_openstack_clients_packages[utility_distro_openstack_clients_python_version|int] }}

{{ (ansible_pkg_mgr in ['apt', 'zypper']) | ternary('yes', omit) }}

{%- set package_list = [] %} {%- for l in _abs_reqs.content.split('\n') %} {%-   if (l is match('^python-.*client==.*$')) or
         (l is match('^(aodh|gnocchi)client==.*$')) or
         (l is match('^osc-placement==.*$'))
%} {%-     set _ = package_list.append(l | regex_replace('==.*$', '')) %} {%-   endif %} {%- endfor %} {{- package_list }}

{{ utility_venv_python_executable | default(openstack_venv_python_executable) }}

{%- set binary_list = [] %} {%- for l in _openstack_client_list %} {%-   set _ = binary_list.append(l | regex_replace('^(?:python-)?(\w*)(?:client)$', '\\1')) %} {%- endfor %} {{- binary_list }}

../common-tasks/os-{{ container_tech | default('lxc') }}-container-setup.yml

not ( 'cinder_volume' in group_names and cinder_backend_lvm_inuse | bool )

{% if item.value.volume_group is defined %}
if [ "$(pvdisplay | grep -B1 {{ item.value.volume_group }} | awk '/PV/ {print $3}')" ];then
  for device in `pvdisplay | grep -B1 {{ item.value.volume_group }} | awk '/PV/ {print $3}'`
    do lxc-device -n {{ container_name }} add $device
  done
fi
{% else %}
echo "{{ item.key }} volume_group not defined"
{% endif %}

(glance_nfs_client is not defined) or (glance_nfs_client | length == 0)

(glance_default_store != "file") or (glance_nfs_client is defined)

{{ (ansible_pkg_mgr == 'apt') | ternary('/lib/modules', '/usr/lib/modules') }}

{{ True in groups['cinder_volume'] | map('extract', hostvars, 'cinder_backend_rbd_inuse') }}

inventory_hostname == ((groups['nova_compute'] | intersect(ansible_play_hosts)) | list)[0]

for i in /dev/nbd*;do
  lxc-device -n {{ container_name }} add $i $i
done

lxc-device -n {{ container_name }} add /dev/net/tun /dev/net/tun

{{ hostvars['localhost']['nova_cinder_rbd_inuse'] | default(False) }}

{{ network_address }}={{ hostvars[inventory_hostname] | json_query(query) }}

container_networks.{{ network_address }}.address || ansible_host

"ansible_{{ hostvars[inventory_hostname] | json_query(find_bridge) | replace('-','_') }}".ipv4.address || {{ non_metal_query }}

{{ lxc_default_bind_mounts | default([{"bind_dir_path": "/var/log", "mount_path": "/openstack/log/" ~ inventory_hostname}]) }}

lxc.mount.entry = {{ item['mount_path'] }} {{ item['bind_dir_path'].lstrip('/') }} none bind,create=dir 0 0

{{ extra_container_config_no_restart | default(['lxc.start.order=100']) }}

(_mc is defined and _mc is changed) or (_ec is defined and _ec is changed)

lxc-stop --name {{ inventory_hostname }} --logfile {{ lxc_container_log_path }}/lxc-{{ inventory_hostname }}.log --logpriority {{ (debug | bool) | ternary('DEBUG', 'INFO') }}

lxc-start --daemon --name {{ inventory_hostname }} --logfile {{ lxc_container_log_path }}/lxc-{{ inventory_hostname }}.log --logpriority {{ (debug | bool) | ternary('DEBUG', 'INFO') }}

grep -w '^ExecStart=/usr/bin/systemd-nspawn' /etc/systemd/system/systemd-nspawn@$(/usr/bin/systemd-escape {{ inventory_hostname }}).service

{{ _ec_old_start.stdout.split('ExecStart=/usr/bin/systemd-nspawn')[-1] }}

{% for item in list_of_bind_mounts %} --bind={{ item['mount_path'] }}:{{ item['bind_dir_path'] }}{% endfor %}

{{ nspawn_flags.split() | union(nspawn_extra_flags.split()) | unique }}

/etc/systemd/system/systemd-nspawn@{{ systemd_escape.stdout }}.service

ExecStart=/usr/bin/systemd-nspawn {{ nspawn_flag_list | join(' ') }}

(_ec is defined and _ec is changed) or (add_bind is defined and add_bind is changed)

proxy=http://{{ internal_lb_vip_address }}:{{ repo_pkg_cache_port | default('3142') }}

sed -i -e '/proxy = http:\/\/{{ internal_lb_vip_address }}:{{ repo_pkg_cache_port | default('3142') }}/d' /etc/yum.repos.d/*

proxy="http://{{ internal_lb_vip_address }}:{{ repo_pkg_cache_port | default('3142') }}"

systemctl list-unit-files --state=enabled --type=service | awk '/^{{ service_name }}.* enabled$/ {print $1}'

{{ (_enabled_services.stdout_lines | difference(service_negate | default([]))) | list }}

{% set _var = [] %}
{% for host in groups[resolvconf_resolver_group] %}
{%   if physical_host is defined and
        hostvars[host]['physical_host'] is defined
        and physical_host == hostvars[host]['physical_host'] %}
{%     set _prio = 100 %}
{%   else %}
{%     set _prio = 50 %}
{%   endif %}
{%   set _ = _var.append({
       'host': hostvars[host]['ansible_host'],
       'priority': _prio
     })
%}
{{ _var |
   sort(reverse=true, attribute='priority') |
   map(attribute='host') |
   list
}}

physical_host in hostvars['localhost']['unbound_physical_hosts']

{{ item.path | default(role_path_default) }}/{{ item.name | default(item.src | basename) }}

(item.path | default(role_path_default) ~ '/' ~ item.name | default(item.src | basename) ~ '/.git') is not directory

{{ zuul_src_path }}/{{ item.item.src.split('/')[-3:] | join('/') }}

{{ item.item.path | default(role_path_default) }}/{{ item.item.name | default(item.item.src | basename) }}

The following roles were not cloned automatically by Zuul,
make sure that they're included in required-projects {{ uncloned_roles|join(',') }}

{{ zuul_roles.results | rejectattr('stat.exists') | map(attribute='item') | map(attribute='src') | select('match', 'opendev.org') | list }}

{{ (zuul_roles.results | default([]) | selectattr('stat', 'defined') | rejectattr('stat.exists') | map(attribute='item') | list) | default(required_roles, True) }}

set -e
exit_code=0
if [[ -e {{ openstack_config_dir }}/env.d ]]; then
  for f in $(diff --brief --report-identical-files {{ openstack_config_dir }}/env.d {{ openstack_clone_root }}/inventory/env.d | awk '/identical/ {print $2}' 2>/dev/null); do
    echo "Deleting ${f} because it is identical to the defaults."
    rm -f ${f}
    exit_code=2
  done
fi
exit ${exit_code}

There are files in /etc/openstack_deploy/env.d which override the default inventory
layout in {{ repo_root_dir }}/inventory/env.d. The difference between these files
should be carefully reviewed to understand whether the changes are still necessary
and applicable to the environment. If all the user-space env.d files are necessary,
then please export SKIP_CUSTOM_ENVD_CHECK=true and re-run the playbook or
run-upgrade.sh script.

grep '^[a-zA-Z]' {{ repo_root_dir }}/etc/openstack_deploy/user_secrets.yml

not (user_secrets.stdout | regex_search('((^|\n)' ~ item ~ ')'))

{{ repo_root_dir }}/scripts/pw-token-gen.py --file {{ openstack_config_dir }}/user_secrets.yml

{{ playbook_dir }}/../playbooks/defaults/repo_packages/openstack_services.yml

(bootstrap_host_container_tech | default('unknown')) != 'nspawn'

(ansible_distribution == 'Debian' and ansible_distribution_release == 'stretch') or (ansible_distribution == 'Debian' and ansible_distribution_release == 'buster') or (ansible_distribution == 'Ubuntu' and ansible_distribution_release == 'bionic') or (ansible_os_family == 'RedHat' and ansible_distribution_major_version == '7') or (ansible_os_family == 'Suse' and ansible_distribution_major_version in ['42', '15'])

The only supported platforms for this release are Debian Stretch, Ubuntu 18.04 LTS (Bionic), Centos 7, openSUSE Leap 42.X and openSUSE Leap 15.X

{{ (bootstrap_host_scenario is search('distro')) and (bootstrap_host_scenario is search('source')) }}

The scenario key words 'distro' and 'source' are mutually exclusive.

{{ (bootstrap_host_scenario is search('lxc')) and (bootstrap_host_scenario is search('nspawn')) }}

The scenario key words 'lxc' and 'nspawn' are mutually exclusive.

{{ (bootstrap_host_scenario is search('lxc')) and (bootstrap_host_scenario is search('metal')) }}

The scenario key words 'lxc' and 'metal' are mutually exclusive.

{{ (bootstrap_host_scenario is search('metal')) and (bootstrap_host_scenario is search('nspawn')) }}

The scenario key words 'metal' and 'nspawn' are mutually exclusive.

{{ (bootstrap_host_scenario is search('metal')) and (bootstrap_host_scenario is search('haproxy')) }}

The scenario key words 'metal' and 'haproxy' are mutually exclusive.

if [[ $(df -T / | tail -n 1 | awk '{print $2}') == "btrfs" ]]; then
    btrfs fi usage --kbytes / | awk '/^.*Free / {print $3}'| sed 's/\..*//'
else
    df -BK / | awk '!/^Filesystem/ {print $4}' | sed 's/K//'
fi

{{ (ansible_devices[bootstrap_host_data_disk_device]['sectors'] | int) }}

{{ (ansible_devices[bootstrap_host_data_disk_device]['sectorsize'] | int) }}

{{ ((host_data_disk_sectors | int) * (host_data_disk_sectorsize | int)) | int }}

{{ ((bootstrap_host_data_disk_min_size | int) * 1024**3) | int }}

{{ ((host_root_space_available_bytes | int ) / 1024**3) | round(2, 'floor') }}

{{ ((host_data_disk_size_bytes | int ) / 1024**3) | round(2, 'floor') }}

Not enough space available in /.
Found {{ root_gb_available }} GB, required {{ bootstrap_host_data_disk_min_size }} GB)

(host_root_space_available_bytes | int) < (host_data_disk_min_size_bytes | int)

Not enough disk space available.
Found {{ disk_gb_available }} GB, required {{ bootstrap_host_data_disk_min_size }} GB)

(host_data_disk_size_bytes | int) < (host_data_disk_min_size_bytes | int)

lsblk -brndo NAME,TYPE,RO,SIZE | awk '/d[b-z]+ disk 0/{ if ($4>m && $4>={{ bootstrap_host_data_disk_min_size }}){m=$4; d=$1}}; END{print d}'

{{ bootstrap_host_aio_config_path }}/conf.d/{{ item.item }}.yml.aio

{{ bootstrap_host_aio_config_path }}/openstack_user_config.yml.{{ (bootstrap_host_container_tech == 'nspawn') | ternary('aio-nspawn', 'aio') }}.j2

/etc/openstack_deploy/{{ bootstrap_host_user_secrets_filename }}

/opt/ansible-runtime/bin/python {{ bootstrap_host_aio_script_path }}/pw-token-gen.py --file /etc/openstack_deploy/{{ bootstrap_host_user_secrets_filename }}

source /etc/ci/mirror_info.sh
NODEPOOL_OVERRIDES="/etc/openstack_deploy/user_openstackci.yml"
echo "uca_apt_repo_url: '${NODEPOOL_UCA_MIRROR}'" >> ${NODEPOOL_OVERRIDES}
echo "openstack_hosts_centos_mirror_url: '${NODEPOOL_CENTOS_MIRROR}'" >> ${NODEPOOL_OVERRIDES}
echo "opensuse_mirror: '${NODEPOOL_OPENSUSE_MIRROR}'" >> ${NODEPOOL_OVERRIDES}
echo "centos_epel_mirror: '${NODEPOOL_EPEL_MIRROR}'" >> ${NODEPOOL_OVERRIDES}
echo "galera_percona_xtrabackup_repo_host: '${NODEPOOL_PERCONA_PROXY}'" >> ${NODEPOOL_OVERRIDES}
echo "galera_repo_host: '${NODEPOOL_MIRROR_HOST}:8080'" >> ${NODEPOOL_OVERRIDES}
echo "lxc_centos_package_baseurl: 'http://${NODEPOOL_MIRROR_HOST}:8080/copr-lxc2/epel-7-x86_64/'" >> ${NODEPOOL_OVERRIDES}
echo "lxc_centos_package_key: 'http://${NODEPOOL_MIRROR_HOST}:8080/copr-lxc2/pubkey.gpg'" >> ${NODEPOOL_OVERRIDES}
echo "nova_virt_type: 'qemu'" >> ${NODEPOOL_OVERRIDES}

# NOTE(mnaser): We need to make sure we pull the latest RDO mirror
#               which is hashed to avoid cache going stale during CI.
export DLRN_BASE=${DLRN_BASE:-centos7-master/puppet-passed-ci}
rdo_dlrn=`curl --silent ${NODEPOOL_RDO_PROXY}/${DLRN_BASE}/delorean.repo | grep baseurl | cut -d= -f2`
if [[ -z "$rdo_dlrn" ]]; then
    echo "Failed to parse dlrn hash"
    exit 1
fi
RDO_MIRROR_HOST=${rdo_dlrn/https:\/\/trunk.rdoproject.org/$NODEPOOL_RDO_PROXY}
echo "openstack_hosts_rdo_repo_url: '${RDO_MIRROR_HOST}'" >> ${NODEPOOL_OVERRIDES}

Implement hard-coded hosts entries for consistently failing name

91.189.91.21 images.linuxcontainers.org us.images.linuxcontainers.org

91.189.88.37 images.linuxcontainers.org uk.images.linuxcontainers.org

/etc/openstack_deploy/{{ bootstrap_host_user_variables_filename }}

{{ playbook_dir }}/../etc/openstack_deploy/env.d/calico.yml.example

truncate -s {{ bootstrap_host_loopback_ceph_size }}G /openstack/{{ item }}.img

/bin/bash -c "/sbin/losetup $(/sbin/losetup -f) /openstack/{{ loopback_var }}.img"

/bin/bash -c "losetup -d $(losetup -l | awk '/{{ loopback_var }}.img/ {print $1}')"

---
lvm_volumes:
{% for d in ceph_create_loopback | json_query('results[].stdout') %}
  - data_vg: vg-{{ d | basename }}
    data: lv-{{ d | basename }}
cinder_backends:
  "RBD":
    volume_driver: cinder.volume.drivers.rbd.RBDDriver
    rbd_pool: volumes
    rbd_ceph_conf: /etc/ceph/ceph.conf
    rbd_store_chunk_size: 8
    volume_backend_name: rbddriver
    rbd_user: cinder
    rbd_secret_uuid: "{% raw %}{{ cinder_ceph_client_uuid }}{% endraw %}"
    report_discard_supported: true

parted --script -l -m | egrep -q ':{{ bootstrap_host_data_disk_fs_type }}:openstack-data[12]:;$'

{{ (bootstrap_host_data_disk_device | regex_replace('!','/')).strip() }}

parted --script /dev/{{ _bootstrap_host_data_disk_device }} mklabel gpt

parted --align optimal --script /dev/{{ _bootstrap_host_data_disk_device }} mkpart openstack-data1 {{ bootstrap_host_data_disk_fs_type }} 0% 40%

parted --align optimal --script /dev/{{ _bootstrap_host_data_disk_device }} mkpart openstack-data2 {{ bootstrap_host_data_disk2_fs }} 40% 100%

{{ bootstrap_host_format_options[bootstrap_host_data_disk_fs_type] | default(omit) }}

{{ bootstrap_host_format_options[bootstrap_host_data_disk2_fs] | default(omit) }}

{{ bootstrap_host_data_mount_options[bootstrap_host_data_disk_fs_type] }}

zpool create pool "/dev/{{ _bootstrap_host_data_disk_device }}2"

(zfs list | grep lxc) || zfs create -o mountpoint=/var/lib/lxc pool/lxc

pvcreate /dev/{{ _bootstrap_host_data_disk_device }}2 && touch /openstack/lxc.pvcreate

127.0.0.1 localhost
172.29.236.100 aio1.openstack.local aio1

# The following lines are desirable for IPv6 capable hosts
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

truncate -s {{ bootstrap_host_loopback_btrfs_size }}G /openstack/lxc-btrfs.img

truncate -s {{ bootstrap_host_loopback_cinder_size }}G /openstack/cinder.img

/bin/bash -c "/sbin/losetup $(/sbin/losetup -f) /openstack/cinder.img"

/bin/bash -c "losetup -d $(losetup -l | awk '/cinder.img/ {print $1}')"

pvcreate {{ cinder_losetup.stdout }} && touch /openstack/cinder.pvcreate

truncate -s {{ bootstrap_host_loopback_machines_size }}G /openstack/machines.img

truncate -s {{ bootstrap_host_loopback_manila_size }}G /openstack/manila.img

/bin/bash -c "/sbin/losetup $(/sbin/losetup -f) /openstack/manila.img"

/bin/bash -c "losetup -d $(losetup -l | awk '/manila.img/ {print $1}')"

pvcreate {{ manila_losetup.stdout }} && touch /openstack/manila.pvcreate

truncate -s {{ bootstrap_host_loopback_nova_size }}G /openstack/nova.img

dd if=/dev/zero of=/openstack/swap.img bs=1M count={{ bootstrap_host_loopback_swap_size }}

truncate -s {{ bootstrap_host_loopback_swift_size }}G /openstack/{{ item }}.img

truncate -s {{ bootstrap_host_loopback_zfs_size }}G /openstack/lxc-zfs.img

(zfs list | grep lxc) || zfs create -o mountpoint=/var/lib/lxc osa-test-pool/lxc

-{{ bootstrap_host_iptables_path }} -t nat -A POSTROUTING -o {{ bootstrap_host_public_interface }} -j MASQUERADE

-{{ bootstrap_host_ethtool_path }} -K br-mgmt gso off sg off tso off tx off

-{{ bootstrap_host_ethtool_path }} -K br-vxlan gso off sg off tso off tx off

-{{ bootstrap_host_ethtool_path }} -K br-storage gso off sg off tso off tx off

-{{ bootstrap_host_ethtool_path }} -K br-vlan gso off sg off tso off tx off

-{{ bootstrap_host_ethtool_path }} -K br-dbaas gso off sg off tso off tx off

-{{ bootstrap_host_ethtool_path }} -K br-lbaas gso off sg off tso off tx off

-{{ bootstrap_host_ethtool_path }} -K eth12 gso off sg off tso off tx off

-{{ bootstrap_host_ethtool_path }} -K eth13 gso off sg off tso off tx off

-{{ bootstrap_host_ethtool_path }} -K eth14 gso off sg off tso off tx off

{{ bootstrap_host_iptables_path }} -t nat -D POSTROUTING -o {{ bootstrap_host_public_interface }} -j MASQUERADE

not ssh_key_public.stat.exists or not ssh_key_private.stat.exists

{{ ansible_user_dir }}/src/opendev.org/openstack/openstack-ansible

{{ ansible_user_dir }}/src/opendev.org/openstack/openstack-ansible/logs

{{ (ansible_pkg_mgr == 'dnf') | ternary('/etc/dnf/dnf.conf', '/etc/yum.conf') }}

{% set _scenario = [] %}
{# Add the scenarios based on the job name #}
{# ex. openstack-ansible-deploy-$scenario1_$scenario2-$os #}
{% if zuul.job is match('^openstack-ansible-(deploy|upgrade)-([^-]+)-.*$') %}
{%   set _ = _scenario.extend(
       (zuul.job |
        regex_replace('^openstack-ansible-[a-z]*-([^-]+)-.*$', '\\1')).split('_')
     )
%}
{#   If testing a role, add the role service name to the scenario list #}
{%   if zuul.project.short_name is match('^openstack-ansible-os_(.*)$') %}
{%     set role_service_name = zuul.project.short_name |
                             regex_replace('^openstack-ansible-os_(.*)$', '\\1')
%}
{%     set _ = _scenario.append(role_service_name) %}
{#     Add special scenarios based on the project name #}
{%     if role_service_name in scenario_map %}
{%       set _ = _scenario.append(scenario_map[role_service_name]) %}
{%     endif %}
{%   endif %}
{% endif %}
{# If running linters we need to provide name of the role as a scenario w/o splitting #}
{% if zuul.job is match('^openstack-ansible-linters-.*$') %}
{%   for prefix in ['openstack-ansible', 'ansible-role'] %}
{%     if zuul.project.short_name is match('^' ~ prefix ~ '-([^-]+)$') %}
{%        set _ = _scenario.append(
            zuul.project.short_name | regex_replace('^' ~ prefix ~'-([^-]+)$', '\\1')
          )
%}
{%     endif%}
{%   endfor %}
{% endif %}
{{ _scenario | join('_') }}

{{ zuul.job | regex_replace('^openstack-ansible-([^-]+)-.*$', '\1') }}

Running gate-check-commit with the following arguments:
Scenario: {{ scenario }}
Action: {{ action }}
Install Method: {{ install_method }}
Zuul project name: {{ zuul.project.short_name }}

scripts/gate-check-commit.sh {{ scenario | quote }} {{ action | quote }} {{ install_method | quote }}

. {{ ansible_env.HOME }}/openrc
openstack compute service delete {{ results.stdout }}

neutron agent-delete {{ item }}

python /opt/openstack-ansible/scripts/inventory-manage.py -r {{ host_to_be_removed }}

{{ swift_vars.mount_point | default(swift.mount_point) }}/{{ item.name }}

{{ ansible_python_requirement_file | default('python-requirements.txt') }}

{{ default_ansible_venv_path }}/inventory/openstack_inventory.sh

lxc.mount.entry=/openstack/{{ inventory_hostname }} var/lib/influxdb none bind 0 0

deb https://repos.influxdata.com/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} stable

influx -username {{ influxdb_db_root_name }} -password {{ influxdb_db_root_password }} -execute "{{ item }}"

CREATE RETENTION POLICY {{ influxdb_db_retention_policy }} ON {{ influxdb_db_name }} DURATION {{ influxdb_db_retention }} REPLICATION {{ influxdb_db_replication }}

CREATE USER {{ influxdb_db_metric_user }} WITH PASSWORD '{{ influxdb_db_metric_password }}'

GRANT ALL ON {{ influxdb_db_name }} TO {{ influxdb_db_metric_user }}

{{ (groups['nova_compute'] | default([]) | length) > 0 and (nova_virt_type | default('qemu') in ['kvm', 'qemu']) }}

{{ influxdb_protocol|default('http') }}://{{ influxdb_host|default(hostvars[groups['cluster-metrics'][0]]['ansible_host']) }}:{{ influxdb_port }}

kapacitord config > /etc/kapacitor/kapacitor.conf;kapacitord -config /etc/kapacitor/kapacitor.conf -log-file /var/log/kapacitor/kapacitor.log &

chmod 755 /opt/kapacitor/kapacitor_files/*.*;bash /opt/kapacitor/kapacitor_files/run_all.sh

[[ ! -d "/var/lib/elasticsearch" ]] && mkdir -p "/var/lib/elasticsearch"
[[ ! -d "/var/lib/elasticsearch-olddata" ]] && mkdir -p "/var/lib/elasticsearch-olddata"

lxc.mount.entry=/openstack/{{ inventory_hostname }} var/lib/elasticsearch none bind 0 0

name='oracle-java8-installer' question='shared/accepted-oracle-license-v1-1' value='true' vtype='select'

name=oracle-java8-installer state=present install_recommends=yes update_cache=yes

repo='deb http://packages.elastic.co/elasticsearch/2.x/debian stable main' state=present

src=templates/rotate-topbeatdata.sh dest=/root/rotate-topbeatdata.sh mode=0755

name="compress old topbeat data" minute="55" hour="23" job="/root/rotate-topbeatdata.sh"

repo='deb http://packages.elastic.co/kibana/4.4/debian stable main' state=present

repo='deb http://packages.elastic.co/logstash/2.2/debian stable main' state=present

repo='deb https://packages.elastic.co/beats/apt stable main' state=present

curl -XPUT 'http://localhost:{{ elastic_port }}/_template/topbeat' -d@topbeat.template.json

path=/etc/nginx/htpasswd.users name={{ kibana_username }} password={{ kibana_password }} owner=root mode=0644

{{ (_elastic_refresh_interval > 0) | ternary(30, _elastic_refresh_interval) }}

{% set beat_indexes = [] %}
{% for key, value in elastic_beat_retention_policy_hosts.items() %}
{%   if ((value.hosts | length) > 0) and (value.make_index | default(false) | bool) %}
{%
       set _index = {
         'name': key,
         'index_options': {
           'settings': {
             'index': {
               'codec': 'best_compression',
               'mapping': {
                 'total_fields': {
                   'limit': '10000'
                 }
               },
               'refresh_interval': elastic_refresh_interval
             }
           }
         }
       }
%}
{%     set _ = beat_indexes.append(_index) %}
{%   endif %}
{{ beat_indexes }}

{{ ((elastic_refresh_interval | int) > 30) | ternary(30, elastic_refresh_interval) }}s

{{
  (elastic_beat_retention_policy_hosts.keys() | list)
    | map('regex_replace', '(.*)', '\1-' ~ '*')
    | list
}}

http://127.0.0.1:5601/api/saved_objects/index-pattern/{{ item.name }}

{%   if (value.hosts | length) > 0 %}
{%
           'attributes': {}
         }
       }
%}
{%     if 'beat' in key %}
{%       set _ = _index.index_options.attributes.__setitem__('title', (key ~ '-*')) %}
{%     else %}
{%       set _ = _index.index_options.attributes.__setitem__('title', (key ~ '*')) %}
{%     endif %}
{%     if value.timeFieldName is defined %}
{%       set _ = _index.index_options.attributes.__setitem__('timeFieldName', (value.timeFieldName | string)) %}
{%     endif %}
{%   endif %}
{% set _ = beat_indexes.append({'name': 'default', 'index_options': {'attributes': {'title': '*'}}}) %}

http://127.0.0.1:{{ kibana_port }}/api/index_patterns/_fields_for_wildcard?pattern={{ index_pattern }}&meta_fields=["_source","_id","_type","_index","_score"]

{{ index_fields_return['json']['saved_objects'][0]['attributes'] }}

http://127.0.0.1:{{ kibana_port }}/api/saved_objects/index-pattern/{{ index_pattern }}

Index pattern refresh was not possible at this time. Either there are no dashboards loaded or the index being refreshed does not exist. While the task failed, this is not a fatal error, so the play has been rescued.

openstack_release is defined and openstack_release is version('18.0.0', 'lt')

physical_host is defined and physical_host != inventory_hostname

physical_host is undefined or physical_host == inventory_hostname

not (journal_dir.stat.exists | bool) or (ansible_service_mgr != 'systemd')

inventory_hostanme in ( (groups['nova_compute'] | default([])) | union(groups['utility_all'] | default([])) | union(groups['memcached_all'] | default([])) | union(groups['memcached_all'] | default([])) )

{{
  inventory_hostname in (groups['nova_compute'] | default([]))
}}

--host {{ (monitorstack_memcached_access.stdout_lines[0] | default("127.0.0.1:11211")).split(":")[0] }} --port {{ (monitorstack_memcached_access.stdout_lines[0] | default("127.0.0.1:11211")).split(":")[1] }}

{{
  inventory_hostname in (groups['memcached_all'] | default([]))
}}

{{
  (clouds_config.stat.exists | bool) and
  (inventory_hostname in (groups['utility_all'] | default([]))) and
  (inventory_hostname == (groups['utility_all'] | default([null]))[0])
}}

(openstack_release.stat.exists | bool) or (rhosp_release.stat.exists | bool)

{{ monitorstack_distro_packages[(ansible_distribution | lower)] }}

virtualenv --no-setuptools --system-site-packages /var/lib/monitorstack/venv

git+https://github.com/openstack/monitorstack@{{ monitorstack_release | default('master') }}

[elasticsearch]
hosts = {{ elasticsearch_data_hosts | join(',') }}
port = {{ elastic_port }}

{% set services = [] %}
{% for item in monitorstack_config_enabled %}
{%   if item.condition | bool %}
{%
   set check = {
     "service_name": ("monitorstack-" ~ item.check),
     "execstarts": ("/var/lib/monitorstack/venv/bin/monitorstack --format elasticsearch --config-file /etc/monitorstack/monitorstack.ini " ~ item.check ~ ' ' ~ item.options),
     "timer": {
       "state": "started",
       "options": {
         "OnBootSec": "5min",
         "OnUnitActiveSec": "10m",
         "Persistent": true
       }
     }
   }
%}
{%     set _ = services.append(check) %}
{%   endif %}
{{ services }}

/opt/elasticdump/node_modules/elasticdump/bin/elasticdump --input=/tmp/openstack-log-dashboard.json --output={{ kibana_index_on_elasticsearch }} --type=data

Elastic Node config:    master: {{ master_node }}    data: {{ data_node }}

/usr/share/elasticsearch/bin/elasticsearch-plugin remove --verbose {{ item }}

/usr/share/elasticsearch/bin/elasticsearch-plugin install --batch --verbose {{ item }}

{{ ansible_os_family | lower }}-{{ ansible_distribution_version.split('.')[0] }}.yml

vars_{{ ((inventory_hostname in (groups['kibana'] | default([])) and not inventory_hostname in (groups['elastic-logstash']) | default([]))) | ternary('kibana', 'default') }}.yml

{{ auditbeat_service_state in ['running', 'started', 'restarted'] }}

To use this role the variable `coordination_nodes` must be defined.

To use this role the variable `elastic_beat_name` must be defined.

{% if item == '--dashboards' %}
  sed -i 's@\\\"index\\\": \\\"{{ elastic_beat_name }}-\*\\\"@\\\"index\\\": \\\"{{ elastic_beat_name }}\\\"@g' /usr/share/{{ elastic_beat_name }}/kibana/6/dashboard/*.json
  sed -i 's@"id": "{{ elastic_beat_name }}\-\*",@"id": "{{ elastic_beat_name }}",@g' /usr/share/{{ elastic_beat_name }}/kibana/6/index-pattern/*.json
{% endif %} {{ elastic_beat_name }} setup {{ item }} {{ elastic_beat_setup_options }} -e -v

((ansible_local['elastic']['setup'][elastic_beat_name + '_loaded_templates'] is undefined) or (not (ansible_local['elastic']['setup'][elastic_beat_name + '_loaded_templates'] | bool))) or ((elk_package_state | default('present')) == "latest") or (elk_beat_setup | default(false) | bool)

{{ ((elk_package_state | default('present')) != 'absent') | ternary(true, false) }}

/opt/elasticsearch-curator/bin/curator --config /var/lib/curator/curator.yml /var/lib/curator/actions-age.yml

/opt/elasticsearch-curator/bin/curator --config /var/lib/curator/curator.yml /var/lib/curator/actions-size.yml

virtualenv --never-download --no-site-packages /opt/elasticsearch-curator

The general user creation task failed. This typically means that the user already exists and something in the user configuration provided is changing the system user in way that is simply not possible at this time. The playbooks will now simply ensure the user exists and before carrying on to the next task. While it's not required, it may be benificial to schedule a maintenance where the elastic services are stopped.

The service data directory [ /var/lib/{{ service_name }} ] already exists. To ensure no data is lost, the linked directory path to [ /openstack/{{ inventory_hostname }}/{{ service_name }} ] will not be created for this host.

[[ ! -d "/var/lib/{{ service_name }}" ]] && mkdir -p "/var/lib/{{ service_name }}"

{{ elastic_lxc_template_config[(lxc_major_version | int)]['mount'] }}=/openstack/{{ inventory_hostname }}/{{ service_name }} var/lib/{{ service_name }} none bind 0 0

{{ elastic_lxc_template_config[(lxc_major_version | int)]['aa_profile'] }}=unconfined

update-alternatives --query java | awk -F':' '/{{ elastic_java_version }}/ && /Alternative/ {print $2}'

{{ filebeat_service_state in ['running', 'started', 'restarted'] }}

{{ heartbeat_service_state in ['running', 'started', 'restarted'] }}

{{ journalbeat_service_state in ['running', 'started', 'restarted'] }}

{{ (inventory_hostname in logstash_nodes) | ternary('restarted', 'stopped') }}

/usr/local/bin/logstash --modules arcsight {{ (ansible_local['arcsight'][item.host] is defined) | ternary('', '--setup') }}
  -M "arcsight.var.input.smartconnector.bootstrap_servers={{ item.host }}:{{ item.port }}"
  -M "arcsight.var.elasticsearch.hosts=localhost:{{ elastic_port }}"
  -M "arcsight.var.kibana.host={{ hostvars[groups['kibana'][0]]['ansible_host'] }}:{{ kibana_port }}"

  -M "arcsight.var.input.eventbroker.bootstrap_servers={{ item.host }}:{{ item.port }}"

{{ logstash_arcsight_smart_connectors | union(logstash_arcsight_event_brokers) }}

/var/lib/logstash/{{ logstash_kafka_ssl_keystore_location | basename }}

/var/lib/logstash/{{ logstash_kafka_ssl_truststore_location | basename }}

The logstash collectd plugin was enabled with security enabled however the authentication file was not found.

{{ _logstash_block_device.stdout.split('/')[-1] | regex_replace('[0-9]$','') }}

{{ ((_logstash_device_info['rotational'] | int) != 1) | ternary('persisted', 'memory') }}

size={{ (elastic_memory_lower_limit | int) // 2 }}m,uid={{ logstash_uid.stdout }},gid={{ logstash_gid.stdout }},nodev,nodiratime,noatime

logstash_arcsight_smart_connectors or logstash_arcsight_event_brokers

{% set ceph_stats = [] %}
{% if (ceph_mons is defined) and (ceph_mons | length > 0) %}
{%   for mon in ceph_mons %}
{%     set _ = ceph_stats.insert(loop.index, (mon + ":5000")) %}
{% else %}
{%   set ceph_stats = [ ansible_hostname + ":5000" ] %}
{% endif %}
{{ ceph_stats }}

{{ (apache2.stat.exists | bool) or (httpd.stat.exists | bool) }}

{% set ceph_detect = false %}
{% if ceph_restapi_listening is defined %}
{%   if (ceph_mons is defined) and (ceph_mons | length > 0) and (inventory_hostname in groups[ceph_metricbeat_group])  %}
{%     set ceph_detect = true %}
{%   else %}
{%     set ceph_detect = ceph.stat.exists | bool %}
{%   endif %}
{% endif %}
{{ ceph_detect }}

{% if ceph_prometheus_listening is defined and (inventory_hostname in groups[ceph_metricbeat_group])  %}
{%   set ceph_detect = true %}
{% endif %}

The apache2 module was not enabled because of an error within the enablement process. Check the host to ensure apache2 is really available and resolve the noted errors before continuing.

{{ metricbeat_service_state in ['running', 'started', 'restarted'] }}

{{ packetbeat_service_state in ['running', 'started', 'restarted'] }}

http://{{ coordination_nodes[0] }}/_nodes/{{ (data_nodes | map('extract', hostvars, 'ansible_host') | list) | join(',') }}/stats/fs

calculate_index_retention_{{ elastic_index_retention_algorithm }}.yml

(ansible_local['elastic']['retention']['cluster_nodes'] is undefined) or ((groups['elastic-logstash'] | length) != (ansible_local['elastic']['retention']['cluster_nodes'] | int)) or ((ansible_local['elastic']['retention']['elastic_beat_retention_policy_keys'] is defined) and ((ansible_local['elastic']['retention']['elastic_beat_retention_policy_keys'] | from_yaml) != (elastic_beat_retention_policy_hosts.keys() | list | sort))) or (elastic_retention_refresh | bool)

http://{{ coordination_nodes[0] }}/_xpack/rollup/job/rollup_{{ index_name }}

An existing rollup job was found for {{ index_name }}. In order to re-create this rollup job the old job will need to be purged. If you're OK with the old rollup job being purged, add the following option `elastic_allow_rollup_purge=yes` to the command line and rerun the playbook.

{% set index_retention = [] %}
{% for item in ansible_play_hosts %}
{%   set _ = index_retention.append(ansible_local['elastic']['retention']['elastic_' + index_name + '_retention'] | int) %}
{{ index_retention | min }}

{{ ((min_days_until_rollup | int) > 1) | ternary(((min_days_until_rollup | int) - 1), min_days_until_rollup) }}

http://{{ coordination_nodes[0] }}/_xpack/rollup/job/rollup_{{ index_name }}/_stop

http://{{ coordination_nodes[0] }}/_xpack/rollup/job/rollup_{{ index_name }}/_start

check_rollup['json']['jobs'] | length < 1 or elastic_allow_rollup_purge | bool

${HOME}/ansible_venv/bin/ansible-galaxy install --force --ignore-errors --roles-path=${HOME}/ansible_venv/repositories/roles -r ansible-role-requirements.yml

${HOME}/ansible_venv/bin/ansible-playbook -i {{ inventory_file }} -e @test-vars.yml _key-setup.yml

ansible_service_mgr != 'systemd' or not (container_inventory | bool)

${HOME}/ansible_venv/bin/ansible-playbook -i {{ inventory_file }} -e @test-vars.yml _container-setup.yml

${HOME}/ansible_venv/bin/ansible-playbook -i tests/{{ inventory_file }} -e @tests/test-vars.yml site.yml

${HOME}/ansible_venv/bin/ansible-playbook -i tests/{{ inventory_file }} -e @tests/test-vars.yml showElasticCluster.yml

{% set masters = 0 %}
{% if (item | int) < 3 %}
{%   set masters = 1 %}
{% elif (item | int) == 3 %}
{%   set masters = 3 %}
{% else %}
{%   set masters = (item | int ) // 2 %}
{%   if ((masters | int) % 2 == 0) %}
{%     set masters = (masters | int) + 1 %}
{%   endif %}
{% endif %}
{{ masters }}

{{ masters|default([]) + [ { 'nodes': item.item, 'masters': (item.ansible_facts.master_node_count|int) } ] }}

{{ (elasticsearch_beat_settings.number_of_replicas | int) * 5 }}

{% for key, value in elastic_beats.items() %}
{%
             'index': {
                 }
               },
             }
           }
         }
       }
%}
{%   endif %}

{{
  (elastic_beats.keys() | list)
    | list
}}

{%
         }
       }
%}
{%     else %}
{%     endif %}
{%     endif %}
{%   endif %}
{% set _ = beat_indexes.append({'name': 'default', 'index_options': {'attributes': {'timeFieldName': '@timestamp', 'title': '*'}}}) %}

{{ groups['heartbeat'] | default(groups['heartbeat_deployment_targets'] | default([])) }}

{{ groups['journalbeat'] | default(groups['all_journalbeat_deployments']) }}

{{ groups['metricbeat'] | default( (groups['hosts'] | default([])) + (groups['all_containers'] | default([]))) }}

{% endif %} {{ elastic_beat_name }} setup {% if elastic_beat_name == "heartbeat" and item == "--index-management" -%}
  --template
{%- else -%}
  {{ item }}
{%- endif %} {{ elastic_beat_setup_options }} -e -v

(((ansible_local['elastic']['setup'][elastic_beat_name + '_loaded_templates'] is undefined) or (not (ansible_local['elastic']['setup'][elastic_beat_name + '_loaded_templates'] | bool))) or ((elk_package_state | default('present')) == "latest") or (elk_beat_setup | default(false) | bool)) and not (elastic_beat_name == "heartbeat" and item == "--pipelines")

http://{{ elasticsearch_data_node_details[0] }}/_ilm/policy/{{ ilm_policy_name }}

check_policy.status == 200 and ilm_policy_name is defined and ilm_policy is defined and (elk_package_state | default('present')) != "latest"

check_policy.status == 404 and ilm_policy_name is defined and ilm_policy is defined and (elk_package_state | default('present')) != "latest"

http://{{ elasticsearch_data_node_details[0] }}/_template/{{ ilm_policy_template }}/

template.status == 200 and ilm_policy_template is defined and ilm_policy_name is defined

{{ ((ansible_facts.services['haproxy.service'] | default({}) )['state'] | default('')) == 'running' }}

{{ ((ansible_facts.services['mdmonitor.service'] | default({}) )['state'] | default('')) == 'running' }}

{{ ansible_user_dir }}/src/opendev.org/openstack/openstack-ansible-ops/

/tmp/traefik/{{ ansible_architecture }}/{{ traefik_binary_url | basename }}

{{ hostvars[inventory_hostname]['ansible_' ~ (ansible_default_ipv4['interface'] | replace('-', '_') | string)]['ipv4']['address'] }}

{% set nodes = [] %}
{% for target in groups['kibana'] %}
{%   set node = {} %}
{%   set _ = node.__setitem__('name', 'elasticsearch' ~ loop.index) %}
{%   set _ = node.__setitem__('address', hostvars[target]['ansible_host']) %}
{%   set _ = node.__setitem__('weight', (100 - loop.index)) %}
{%   set _ = node.__setitem__('port', "9200") %}
{%   set _ = nodes.append(node) %}
{{ nodes }}

{{ groups['graylog_hosts'] | map('extract', hostvars, 'ansible_host') | map('regex_replace', '^(.*)$', 'http://\1:9200') | join(', ') }}

find /etc/openstack_deploy/ansible_facts/ -type f -exec rm {} \;

(is_metal is defined and is_metal != true) or container_name != physical_host

In order to continue you must perform a manual migration of the cinder volume container [ {{ container_name }} ] to the physical host [ {{ physical_host }} ]. The leap upgrade can NOT continue until this task has been accomplished.

uses_lvm | default(false) == true and in_container | default(false) == true

mysql -e "SELECT T.table_schema, T.table_name FROM information_schema.`TABLES` T,
 information_schema.`COLLATION_CHARACTER_SET_APPLICABILITY` CCSA
 WHERE CCSA.collation_name = T.table_collation AND CCSA.CHARACTER_SET_NAME = 'utf8'
 AND CCSA.COLLATION_NAME = 'utf8_unicode_ci';"

mysql -e
  "ALTER TABLE {{ item.split()[1] }} CONVERT TO CHARACTER SET utf8 COLLATE utf8_general_ci;"
  {{ item.split()[0] }}

mysql -e "SELECT SCHEMA_NAME FROM information_schema.SCHEMATA
 WHERE DEFAULT_CHARACTER_SET_NAME = 'utf8' AND DEFAULT_COLLATION_NAME = 'utf8_unicode_ci';"

mysql -e "ALTER DATABASE {{ item }} CHARACTER SET utf8 COLLATE utf8_general_ci;"

{{ venv_path }}/bin/nova-manage db null_instance_uuid_scan --delete

{{ venv_path }}/bin/neutron-db-manage --config-file {{ neutron_db_config }} --config-file {{ neutron_db_plugin }} upgrade {{ neutron_db_revision }}

{{ venv_path }}/bin/neutron-db-manage history | grep -w 'Revision ID: {{ neutron_db_revision }}'

{{ venv_path }}/bin/neutron-db-manage --config-file {{ neutron_db_config }} --config-file {{ neutron_db_plugin }} stamp {{ neutron_db_revision }}

mysql --unbuffered -sNL -e 'drop database {{ horizon_galera_database | default('dash') }}'

mysql -Be 'select `binary`,`host` from services;' cinder | awk '{if (NR!=1) {print $1, $2}}'

mysql --verbose --unbuffered -e "desc image_locations_keystone_v3_mig_pre_liberty" glance

mysql --verbose --unbuffered -e "create table image_locations_keystone_v3_mig_pre_liberty (select * from image_locations);" glance

mysql --verbose --unbuffered -e "update image_locations set value=replace(value, '{{ keystone_service_port }}/v2.0/', '{{ keystone_service_port }}/v3/')
 where value like 'swift%{{ internal_lb_vip_address }}:{{ keystone_service_port }}/v2.0/%' and status='active';" glance

mysql -sNL \
      --unbuffered \
      -e "SELECT network_id, network_type, physical_network FROM ml2_network_segments WHERE network_type IN ('vlan','flat','vxlan','gre') AND network_id IN (select id from networks where mtu=0);" {{ neutron_galera_database | default('neutron') }} | tr "\t" "|"

{% for item in networks.stdout_lines %}
{% set network_mtu = [] %}
{%-   for pn in provider_networks %}
{%     if not network_mtu %}
{%       if pn['network']['net_name'] is defined and
            pn['network']['net_name'] == item.split('|')[-1] and
            pn['network']['container_mtu'] is defined %}
{%         if not network_mtu %}
{%           if network_mtu.append(pn['network']['container_mtu']) %}{% endif %}
{%         endif %}
# Defined network mtu: {{ network_mtu }} {{ item.split('|')[-1] }}
{%       endif %}
{%     endif %}

{%-  if neutron_network_device_mtu is defined and not network_mtu %}
{%       if not network_mtu %}
{%         if network_mtu.append(neutron_network_device_mtu) %}{% endif %}
{%       endif %}
# Global Defined network mtu: {{ network_mtu }} {{ item.split('|')[-1] }}
{%  endif %}

{%-   if not network_mtu %}
{%     if item.split('|')[1] == 'vlan' or item.split('|')[1] == 'flat' %}
{%         if network_mtu.append('1500') %}{% endif %}
{%       endif %}
# Using standard fallback MTU of 1500 for {{ item.split('|')[1] }} type network
{%     elif item.split('|')[1] == 'gre' %}
{%         if network_mtu.append('1476') %}{% endif %}
{%       endif %}
# Using gre fallback MTU of 1476 for {{ item.split('|')[1] }} type network
{%     elif item.split('|')[1] == 'vxlan' or item.split('|')[1] == 'NULL' %}
{%         if network_mtu.append('1450') %}{% endif %}
{%       endif %}
# Using vxlan fallback MTU of 1450 for {{ item.split('|')[1] }} type network
{%     endif %}
{%   endif %}

{%-   if network_mtu %}
mysql -sNL --unbuffered -e "UPDATE networks SET mtu={{ network_mtu[0] }} WHERE id='{{ item.split('|')[0] }}';" {{ neutron_galera_database | default('neutron') }}
{%   endif %}

. /root/openrc
/opt/neutron-ha-tool.py --l3-agent-migrate --now --insecure
/opt/neutron-ha-tool.py --replicate-dhcp --now --insecure

mv /var/lib/libvirt/qemu/save/{{ item }} {{ nova_libvirt_save_path }}/{{ item }}

/opt/leap42/openstack-ansible-{{ release_version }}/global-requirement-pins.txt

/usr/bin/python /opt/get-pip.py \
    --force-reinstall \
    --upgrade \
    --isolated \
    --constraint /tmp/global-requirement-pins.txt

    --requirement /tmp/upgrade-requirements.txt \

{{ item.name }} {{ openrc_insecure |default(false) |bool |ternary('--insecure','') }} {{ item.list_command}} | awk '{{ item.awk_filter }}{print {{ item.awk_print_column }} }'

We will delete the following item for {{ item.0.item.name }}: {{ item.1 }}

{{ item.0.item.name }} {{ openrc_insecure |default(false) |bool |ternary('--insecure','') }} {{ item.0.item.delete_command }} {{ item.1 }}
{{ item.0.item.post_command | default('')}}

. /openstack/venvs/cinder-{{openstack_release}}/bin/activate
cinder-manage {{ openrc_insecure |default(false) |bool |ternary('--insecure','') }} service list \
  | awk '/.*_container.*XXX/{print $1" "$2}'\
  | while read line; do
    cinder-manage {{ openrc_insecure |default(false) |bool |ternary('--insecure','') }} service remove $line;
    done

  | awk '/volume.*_container.*XXX/{print $2 }'\
  | while IFS=@ read cinderhost cinderbackend; do
    cinder-manage {{ openrc_insecure |default(false) |bool |ternary('--insecure','') }} volume update_host \
      --currenthost $cinderhost@$cinderbackend \
      --newhost ${cinderhost//_/-}@$cinderbackend;
    done

neutron {{ openrc_insecure |default(false) |bool |ternary('--insecure','') }} port-list -c id -c device_owner -c binding:host_id -c status \
  -c network_id  -f value | sort -k 5 -k 4 -r | \
  awk '/dhcp.*BUILD/{net=$5}; /dhcp.*ACTIVE/{if(net==$5){print $1}}' | \
  while read portid; do
    neutron {{ openrc_insecure |default(false) |bool |ternary('--insecure','') }} port-update --admin-state-up False $portid
    sleep 1
    neutron {{ openrc_insecure |default(false) |bool |ternary('--insecure','') }} port-delete $portid
    done

for i in $(ls /etc/init /etc/init.d | grep "{{ item }}"); do
  service ${i%".conf"*} stop || true;
done

for i in $(ls /etc/init /etc/init.d | grep "swift"); do
done

virtualenv-tools --update-path=auto /opt/{{ file_name.split('.tgz')[0] }}

INTERFACES=""
INTERFACES+="\$(awk '/auto/ {print \$2}' /etc/network/interfaces) "
INTERFACES+="\$(ls -1 /etc/network/interfaces.d/ | awk -F'.cfg' '{print \$1}')"
for i in \${INTERFACES}; do
  ifdown \$i || true
  ifup \$i || true
done

if [ ! -h "/var/log/{{ item }}" ] && [ -d "/var/log/{{ item }}" ];then
  mv /var/log/{{ item }} /openstack/log/{{ inventory_hostname }}-{{ item }}
  ln -s /openstack/log/{{ inventory_hostname }}-{{ item }} /var/log/{{ item }}
else
  # Exit 99 when nothing found to change
  exit 99
fi

UBUNTU_RELEASE=$(lsb_release -sc)
UBUNTU_REPO=$(awk "/^deb .*ubuntu\/? ${UBUNTU_RELEASE} main/ {print \$2; exit}" /etc/apt/sources.list)
UBUNTU_BACKPORTS="deb ${UBUNTU_REPO} ${UBUNTU_RELEASE}-backports main restricted universe multiverse"
if ! grep "^$UBUNTU_BACKPORTS" /etc/apt/sources.list; then
  echo $UBUNTU_BACKPORTS | tee -a /etc/apt/sources.list
  apt-get update
else
  exit 1
fi

grep '^[a-zA-Z]' {{ osa_playbook_dir }}/etc/openstack_deploy/user_secrets.yml

if ! grep '^{{ item }}' /etc/openstack_deploy/user_secrets.yml; then
  echo {{ item }} | tee -a /etc/openstack_deploy/user_secrets.yml
fi

{{ osa_playbook_dir }}/scripts/pw-token-gen.py --file /etc/openstack_deploy/user_secrets.yml

{{ playbook_dir }}/../scripts/add_new_neutron_env.py {{ repo_root_dir }}

{{ playbook_dir }}/../scripts/migrate_openstack_vars.py {{ item }} {{ (item | basename)[:-4] }}

/etc/openstack_deploy.KILO/VARS_MIGRATED_{{ (item | basename)[:-4] }}

neutron_ml2_conf_ini_overrides:
  ml2:
    extension_drivers: ''

deb https://mirror.rackspace.com/mariadb/repo/10.0/ubuntu trusty main

echo 'flush_all' | nc $(awk '/^\-l/ {print $2}' /etc/memcached.conf) $(awk '/^\-p/ {print $2}' /etc/memcached.conf)

/etc/openstack_deploy.LIBERTY/VARS_MIGRATED_{{ (item | basename)[:-4] }}

127.0.1.1 {{ rfc_1034_1035_name }}.{{ domain_name }} {{ rfc_1034_1035_name }} {{ inventory_hostname }} {{ ansible_hostname }}

127.0.1.1 {{ rfc_1034_1035_name }}.{{ domain_name }} {{ rfc_1034_1035_name }} {{ ansible_hostname }}

127.0.1.1 {{ rfc_1034_1035_name }}.{{ domain_name }} {{ rfc_1034_1035_name }} {{ inventory_hostname }}

mysql --verbose --unbuffered -e "delete from service where host like '%\_%';" heat

rsync -avun "{{ repo_root_dir }}/playbooks/inventory/env.d/" "/etc/openstack_deploy/env.d/" | grep "yml$"

msg="All new env.d files are placed in the stock repo. No new changes"

/etc/openstack_deploy.NEWTON/VARS_MIGRATED_{{ (item | basename)[:-4] }}

LBaaS v1 has been removed from OpenStack in Newton and there is no migration path for it.
Please implement LBaaS v2.
https://docs.openstack.org/openstack-ansible-os_neutron/latest/configure-network-services.html#special-notes-about-lbaas

echo 'flush_all' | nc $(awk '/^\-l/ {print $2}' /etc/memcached.conf | awk -F, '{ print $1 }') $(awk '/^\-p/ {print $2}' /etc/memcached.conf)

grep '^[a-zA-Z]' /etc/openstack_deploy/{{ _osa_secrets_file_name }}

{{ osa_playbook_dir }}/scripts/pw-token-gen.py --file /etc/openstack_deploy/{{ _osa_secrets_file_name }}

{{ playbook_dir }}/vars/{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower }}.yml

{{ playbook_dir }}/vars/{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower }}.yml

{{ playbook_dir }}/vars/{{ ansible_os_family | lower }}-{{ ansible_distribution_major_version | lower }}.yml

curl https://www.centos.org/download/full-mirrorlist.csv | sed 's/^.*"http:/http:/' | sed 's/".*$//' | grep ^http >/etc/apt-cacher-ng/centos_mirrors
echo "http://mirror.centos.org/centos/" >>/etc/apt-cacher-ng/centos_mirrors

{{ os_ops_repo | default('https://opendev.org/openstack/openstack-ansible-ops') }}

tmux send-keys "cd /opt/openstack-ansible-ops/elk_metrics_6x" C-m

ELK deploy running. To check on the state of this deployment, login
to the {{ groups['deploy_hosts'][0] }} VM and attach to the "build-osa" tmux session.

{{ osa_repo | default('https://opendev.org/openstack/openstack-ansible') }}

rsync -av --include='*.yml' --include='*/' --exclude='*' /opt/openstack-ansible/etc/openstack_deploy/ /etc/openstack_deploy/

./scripts/pw-token-gen.py --file /etc/openstack_deploy/user_secrets.yml

tmux send-keys "openstack-ansible setup-hosts.yml setup-infrastructure.yml setup-openstack.yml" C-m

OSA deploy running. To check on the state of this deployment, login

/var/www/pxe/networking/{{ hostvars[item]['server_hostname'] }}-bridges.cfg

/var/lib/tftpboot/ipxe/{{ hostvars[item]['server_mac_address'] | replace(':', '-') | lower }}

pxe/configs/{{ images[default_vm_image]['image_type'] | lower }}/vm.config.j2

pxe/configs/{{ images[default_vm_image]['image_type'] | lower }}/vm-compute.config.j2

{{ _virt_pools.pools.default.path | default('/data/images') }}/{{ item }}.img

qemu-img create -f qcow2 {% if hostvars[item]['vm_use_snapshot'] | bool %} -b {{ hostvars[item]['virt_pools'].pools.default.path | default('/data/images') }}/{{ server_hostname }}-base.img {% endif %} {{ hostvars[item]['virt_pools'].pools.default.path | default('/data/images') }}/{{ server_hostname }}.img {{ default_vm_storage }}m

virt-sysprep --enable customize --ssh-inject root:file:/root/.ssh/id_rsa.pub --add {{ virt_pools.pools.default.path | default('/data/images') }}/{{ hostvars[item]['server_hostname'] }}.img

'Image preparation completed.' not in _galera_prepare.stdout_lines

{%- if hostvars[item]['vm_use_snapshot'] | bool %} {{ lookup('file', hostvars[item]['virt_pools'].pools.default.path | default('/data/images') ~ '/' ~ server_hostname ~ '.xml') }} {%- else %} {{ lookup('template', 'kvm/kvm-vm.xml.j2') }} {%- endif %}

{{ hostvars[item]['ansible_host'] }} {{ hostvars[item]['server_hostname'] }}

{% for item in _manifest_content.files %}
{{ manifest_url | regex_replace('/[^/]*$', '') }}/{{ item.path | basename}}
  dir={{ item.path | dirname }}
  checksum=sha-1={{ item.checksum }}

aria2c --input-file=/tmp/aria2c.input --log={{ aria2c_log_path }}/aria2c.log {{ aria2c_parameters }}

source openrc ; openstack security group list -f yaml | awk '/ID/ {print $2}'

if [[ -e {{ item }}.img ]]; then
  if [[ -e {{ item }}-base.img ]]; then
    qemu-img commit {{ item }}.img
  else
    qemu-img convert -O qcow2 -c {{ item }}.img {{ item }}-base.img
    qemu-img create -f qcow2 -b {{ item }}-base.img {{ item }}.img
  fi
  exit 2
fi

{ 'openstack-ansible-ops_SHA1': '{{ _repo_sha.stdout }}', 'files': {{ _manifest_files.files | json_query('[*].{path: path, checksum: checksum}') | sort(attribute='path') }} }

{{ _virt_pools.pools.default.path | default('/data/images') }}/manifest.json

(ansible_distribution == 'Ubuntu' and ansible_distribution_release == 'xenial') or (ansible_distribution == 'Ubuntu' and ansible_distribution_release == 'bionic')

The only supported host platforms for this tooling are Ubuntu 16.04 LTS (Xenial) and Ubuntu 18.04 LTS (Bionic). Patches to add support for other distributions are most welcome.

set -e
TEST_FILE_PATH='/usr/lib/x86_64-linux-gnu/guestfs/supermin.d/zz-dash-packages'
if [[ ! -e ${TEST_FILE_PATH} ]] || ! grep -q dash ${TEST_FILE_PATH}; then
  echo dash > ${TEST_FILE_PATH}
  rm -rf /var/tmp/.guestfs*
  exit 2
fi

(_libguestfs_version.stdout is version('1.38.1', '<')) or ((_libguestfs_version.stdout is version('1.39.0', '>=')) and (_libguestfs_version.stdout is version('1.39.1', '<')))

set -e
INTEL_NESTED=/sys/module/kvm_intel/parameters/nested
if grep -q kvm_intel /proc/modules; then
  echo "Intel CPU found. Checking for nested virtualization capabilities."
  if [ -f ${INTEL_NESTED} ]; then
    echo "Nested virtualization capability found. Checking if it is enabled."
    v=$(cat ${INTEL_NESTED})
    if [ "x${v}" != "xY" ]; then
      echo "Nested virtualization not enabled. Enabling it now."
      rmmod kvm_intel && modprobe kvm_intel
      exit 2
    else
      echo "Nested virtualization already enabled."
    fi
  else
    echo "Nested virtualization capability not found."
    exit 3
  fi
else
  echo "Intel CPU not found."
  exit 3
fi

if ! iptables -w -t {{ item.table }} -C {{ item.rule }};then
  iptables -w -t {{ item.table }} -I {{ item.rule }}
fi

POSTROUTING -s 10.0.2.0/22 -o vm-br-dhcp -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill

if ! iptables -w -t nat -C PREROUTING -p tcp -d {{ ansible_default_ipv4.address }} --dport {{ item.host_port }} -j DNAT --to {{ item.vm_ip }}:{{ item.vm_port }};then
  iptables -w -t nat -I PREROUTING -p tcp -d {{ ansible_default_ipv4.address }} --dport {{ item.host_port }} -j DNAT --to {{ item.vm_ip }}:{{ item.vm_port }}
fi

Locate the largest writable data disk if mnaio_data_disk is not set

lsblk -brndo NAME,TYPE,FSTYPE,RO,SIZE | awk '/d[b-z]+ disk +0/{ if ($4>m){m=$4; d=$1}}; END{print d}'

/dev/{{ mnaio_data_disk }}{{ mnaio_data_disk_suffix | default('1') }}

<pool type='dir'>
  <name>default</name>
  <target>
    <path>/data/images</path>
    <permissions>
      <mode>0755</mode>
      <owner>0</owner>
      <group>0</group>
    </permissions>
  </target>
</pool>

for mod in $(find /lib/modules/$(uname -r) -type f -name 'virtio*.ko'); do
  module=$(echo $(basename $mod) | sed 's/\.ko//g')
  modprobe ${module}
  if ! grep ${module} /etc/modules; then
    echo ${module} | tee -a /etc/modules
  fi
done

pxe/configs/{{ ansible_os_family | lower }}/systemd-networkd-bridges-netdev.j2

pxe/configs/{{ ansible_os_family | lower }}/systemd-networkd-bridges-network.j2

{{ inventory_hostname }} is not responding and cannot be rescued

The root password for the galera cluster is not defined. To proceed with this installation define the variable `kolide_galera_root_password` in line or within a variable file.

The DB password for the Kolide / Fleet cluster is not defined. To proceed with this installation define the variable `kolide_fleet_db_password` in line or within a variable file.

The shared token for the Kolide / Fleet cluster is not defined. To proceed with this installation define the variable `kolide_fleet_jwt_key` in line or within a variable file.

The admin password for the Kolide / Fleet cluster is not defined. To proceed with this installation define the variable `kolide_fleet_admin_password` in line or within a variable file.

/usr/local/bin/fleetctl convert -f {{ item }} > /tmp/{{ item | basename }}.yaml

/usr/local/bin/fleetctl apply -f /tmp/{{ item | basename }}.yaml

/usr/local/bin/fleet prepare db --config=/etc/fleet/fleet_config.yml  --no-prompt

/usr/local/bin/fleetctl config set --address https://127.0.0.1:{{ kolide_fleet_port }} --tls-skip-verify

/usr/local/bin/fleetctl setup --email {{ kolide_fleet_admin_email }} --password {{ kolide_fleet_admin_password }}

/usr/local/bin/fleetctl login --email {{ kolide_fleet_admin_email }} --password {{ kolide_fleet_admin_password }}

{{ kolide_fleet_url }}/{{ kolide_fleet_version }}/fleet_{{ kolide_fleet_version }}.zip

osqueryi --config_path /etc/osquery/osquery.conf --config_check --verbose

ln -f /var/www/pxe/{{ default_pxelinux_short_name }}/bios/com32/elflink/ldlinux/ldlinux.c32 /var/lib/tftpboot/ldlinux.c32
ln -f /var/www/pxe/{{ default_pxelinux_short_name }}/bios/core/pxelinux.0 /var/lib/tftpboot/pxelinux.0
ln -f /var/www/pxe/{{ default_pxelinux_short_name }}/bios/com32/lib/libcom32.c32 /var/lib/tftpboot/boot-screens/libcom32.c32
ln -f /var/www/pxe/{{ default_pxelinux_short_name }}/bios/com32/libutil/libutil.c32 /var/lib/tftpboot/boot-screens/libutil.c32
ln -f /var/www/pxe/{{ default_pxelinux_short_name }}/bios/com32/menu/vesamenu.c32 /var/lib/tftpboot/boot-screens/vesamenu.c32

/var/lib/tftpboot/pxelinux.cfg/01-{{ hostvars[item]['server_mac_address'] | replace(':', '-') | upper }}

templates/pxe/{{ item.value.image_type }}/{{ item.value.image_preseed }}-post-install-script.sh.j2

/var/www/pxe/scripts/{{ item.value.image_preseed }}-post-install-script.sh

templates/pxe/{{ item.value.image_type }}/{{ item.value.image_preseed }}.preseed.j2

/var/lib/tftpboot/preseed/{{ item.value.image_preseed }}.preseed

# Fix perms if needed
find /var/lib/tftpboot -type d -exec chmod 0755 {} \;
find /var/lib/tftpboot -type f -exec chmod 0644 {} \;
find /var/www/pxe -type d -exec chmod 0755 {} \;

{{ racadm }} config -g cfgServerInfo -o cfgServerFirstBootDevice HDD

{{ racadm }} config -g cfgServerInfo -o cfgServerFirstBootDevice PXE

{{ racadm }} config -g cfgLanNetworking -o cfgDNSServersFromDHCP 0

{{ racadm }} config -g cfgLanNetworking -o cfgDNSRacName {{ server_hostname }}

{{ racadm }} config -g cfgLanNetworking -o cfgNicIpAddress {{ server_obm_ip }}

{{ racadm }} config -g cfgLanNetworking -o cfgDNSServer1 {{ server_gateway }}

{{ racadm }} config -g cfgLanNetworking -o cfgDNSServer2 {{ server_dns }}

{{ racadm }} config -g cfgLanNetworking -o cfgNicNetmask {{ server_netmask }}

{{ racadm }} config -g cfgLanNetworking -o cfgNicGateway {{ server_gateway }}

{{ racadm }} config -g cfgLanNetworking -o cfgDNSDomainName {{ server_domain_name }}

{{ racadm }} config -g cfgLanNetworking -o cfgDNSDomainNameFromDHCP 0

{{ racadm }} config -g cfgIpmiLan -o cfgIpmiEncryptionKey 0000000000000000000000000000000000000000

{{ racadm }} config -g cfgIpmiLan -o cfgIpmiPetCommunityName public

/tmp/skydive/{{ ansible_architecture }}/{{ item.path | basename }}

/tmp/traefik/{{ ansible_architecture }}/{{ item.path | basename }}

((skydive_service_setup_host is defined) and (skydive_service_setup_host | ipaddr)) or (skydive_service_setup_host not in groups['all']) or (skydive_service_setup_host not in groups['skydive_all'])

/tmp/skydive/{{ ansible_architecture }}/{{ skydive_binary_url | basename }}

{{ openstack_service_setup_host | default(groups['skydive_analyzers'][0]) }}

skydive client status --username {{ skydive_username }} --password {{ skydive_password }}

GOROOT=/opt/go{{ go_download_version }}/go
GOPATH=/usr/local
PATH=${PATH}:${GOROOT}/bin

{{ skydive_build_project_path }}/github.com/skydive-project/skydive

source /etc/default/go
export PATH="{{ skydive_build_go_path }}/bin:${PATH}"
export GOPATH="{{ skydive_build_go_path }}"
make static {{ skydive_build_use_flags }}

export PATH="{{ traefik_build_go_path }}/bin:${PATH}"
export GOPATH="{{ traefik_build_go_path }}"
go get github.com/containous/go-bindata/...

{{ traefik_build_project_path }}/github.com/containous/traefik/traefik

go generate

go build ./cmd/traefik

{{ (ansible_local['skydive']['skydive']['needs_restart_agent'] | bool) | ternary('restarted', skydive_agent_service_state) }}

{{ skydive_agent_service_state in ['running', 'started', 'restarted'] }}

{{ (ansible_local['skydive']['skydive']['needs_restart_analyzers'] | bool) | ternary('restarted', skydive_analyzer_service_state) }}

{{ skydive_analyzer_service_state in ['running', 'started', 'restarted'] }}

The skydive password is undefined. Set the `skydive_password` option before continuing.

The elasticsearch backend for skydive is undefined. Set the `skydive_elasticsearch_servers` option before continuing.

{{ skydive_elasticsearch_proto }}://{{ skydive_elasticsearch_servers.split(',')[0] }}:{{ skydive_elasticsearch_port }}

The following variable "{{ item.default }}" is undefined and no known value was defined in the "{{ skydive_os_cloud_file }}" file.

clouds_yaml['clouds'][skydive_os_cloud]['auth'][item.cfg] is undefined

skydive_service_setup_host_python_interpreter == '/opt/skydive/bin/python'

{{ _skydive_basic_auth_users | combine(skydive_basic_auth_users) }}

{{ (skydive_template_create is changed) or (skydive_basic_auth_create is changed) }}

{{ (inventory_hostname in groups['skydive_agents']) and (skydive_needs_restart | bool) }}

{{ (inventory_hostname in groups['skydive_analyzers']) and (skydive_needs_restart | bool) }}

openssl req -new -nodes -x509 -subj "{{ skydive_ssl_ca_subject }}" -days 3650 -keyout {{ skydive_ssl_ca_key }} -out {{ skydive_ssl_ca_cert }}

openssl req -new -nodes -sha256 -subj "{{ skydive_ssl_signed_subject }}" -days 3650 -keyout {{ skydive_ssl_key }} -out {{ skydive_ssl_csr }} -config {{ skydive_ssl_cnf }}

openssl x509 -req -days 3650 -in {{ skydive_ssl_csr }} -CA {{ skydive_ssl_ca_cert }} -CAkey {{ skydive_ssl_ca_key }} -out {{ skydive_ssl_cert }} -set_serial 01 -extensions v3_req -extfile {{ skydive_ssl_cnf }}

{{ traefik_analyzer_service_state in ['running', 'started', 'restarted'] }}

${HOME}/ansible_venv/bin/ansible-playbook -i tests/{{ inventory_file }} -e @tests/test-vars.yml installElastic.yml

Switching installation methods for OpenStack services is not supported

ansible_local.openstack_ansible.mistral.install_method is defined

ansible_local.openstack_ansible.mistral.install_method != mistral_install_method

{% for service in filtered_mistral_services %}
{%
  set _ = service.update(
    {
      'enabled': 'yes',
      'state': 'started',
      'config_overrides': service.init_config_overrides
    }
  )
%}
{%   set _ = service.pop('init_config_overrides') -%}
{%   set _ = services.append(service) -%}

{{ mistral_pip_packages |
     union(mistral_user_pip_packages) |
       union(((mistral_oslomsg_amqp1_enabled | bool) | ternary(mistral_optional_oslomsg_amqp1_pip_packages, []))) }}

(install_packages is changed) or ('need_service_restart' not in ansible_local['openstack_ansible']['mistral'])

(_oslomsg_configure_rpc | default(_oslomsg_rpc_transport is defined))

(_oslomsg_rpc_transport is defined) and (_oslomsg_rpc_transport == 'rabbit')

{{ _oslomsg_rpc_policies | default([]) + oslomsg_rpc_policies }}

(_oslomsg_configure_notify | default(_oslomsg_notify_transport is defined))

(_oslomsg_notify_transport is defined) and (_oslomsg_notify_transport == 'rabbit')

(_oslomsg_rpc_vhost is undefined) or (_oslomsg_notify_vhost != _oslomsg_rpc_vhost)

{{ _oslomsg_notify_policies | default([]) + oslomsg_notify_policies }}

(_oslomsg_rpc_userid is undefined) or (_oslomsg_notify_userid != _oslomsg_rpc_userid)

(_oslomsg_rpc_transport is defined) and (_oslomsg_rpc_transport == 'amqp')

echo {{ _oslomsg_rpc_password }} | saslpasswd2 -c -p -f /var/lib/qdrouterd/qdrouterd.sasldb -u AMQP {{ _oslomsg_rpc_userid }}

for ns_pid in $(pgrep neutron-ns-meta); do
  echo $(readlink -f "/proc/$ns_pid/exe") | grep -qv "{{ neutron_venv_tag }}"
  if [ $? -eq 0 ]; then
    if kill -9 "$ns_pid"; then
      logger -s "old metadata proxy pid found and has been cleaned up on: \"$ns_pid\""
    fi
  fi
done

'neutron-metadata-agent' in (filtered_neutron_services | map(attribute='service_key') | list)

ansible_local['openstack_ansible']['neutron']['need_db_contract'] | bool

inventory_hostname == ((groups[neutron_services['neutron-server']['group']] | intersect(ansible_play_hosts)) | list)[0]

{{ ovs_nsh_support | ternary(ovs_nsh_apt_pinned_packages, omit) }}

group_names | intersect([ neutron_services['calico-dhcp-agent']['group'], neutron_services['calico-felix']['group'], neutron_services['neutron-server']['group'] ]) | length > 0

{%- set services = [] -%}
{%- for service in filtered_neutron_services -%}
{%-   set _ = service.update(
        {
          'enabled': 'yes',
          'state': 'started',
          'config_overrides': service.init_config_overrides
        }
      )
-%}
{%-   set _ = service.pop('init_config_overrides') -%}
{%-   set _ = services.append(service) -%}
{%- endfor %}
{{- services -}}

# empty line to workaround bug in EnvVarsInCommandRule.py lint test
# https://github.com/willthames/ansible-lint/issues/275
set -o pipefail
if aa-status | grep -q {{ item.process  }} ; then
   aa-disable {{ item.profile }}
   if [[ $? == 0 ]]; then
     exit_code=2
   fi
fi

FWaaS v1 and v2 cannot be enabled at the same time.
Verify that your neutron_plugin_base variable is correct.

ansible_local.openstack_ansible.neutron.install_method is defined

ansible_local.openstack_ansible.neutron.install_method != neutron_install_method

ansible_local['openstack_ansible']['neutron']['need_db_expand'] | bool

'Need to apply migrations' not in _offline_migrations_check.stdout

(install_packages is changed) or (ansible_local is not defined) or ('openstack_ansible' not in ansible_local) or ('neutron' not in ansible_local['openstack_ansible']) or ('need_db_expand' not in ansible_local['openstack_ansible']['neutron']) or ('need_db_contract' not in ansible_local['openstack_ansible']['neutron'])

{%- set apparmor_hosts = [] -%}
{%- set physical_hosts = [] -%}
{%- for host in groups[neutron_role_project_group] -%}
{%-   if hostvars[host]['physical_host'] is defined -%}
{%-     set phost = hostvars[host]['physical_host'] -%}
{%-     if phost not in physical_hosts -%}
{%-       set _ = apparmor_hosts.append(host) -%}
{%-       set _ = physical_hosts.append(phost) -%}
{%-     endif -%}
{%-   else -%}
{%-     set _ = apparmor_hosts.append('localhost') -%}
{%-   endif -%}
{%- endfor -%}
{{ apparmor_hosts | unique }}

{{ neutron_conf_dir }}/plugins/{{ neutron_plugin_type.split('.')[0] }}

{{ neutron_conf_dir }}/{{ neutron_plugins[neutron_plugin_type].plugin_ini }}

{{ neutron_plugins[neutron_plugin_type].plugin_conf_ini_overrides }}

neutron_install_method == 'distro' and ansible_os_family == 'RedHat'

neutron_conf_dir_stat.stat.isdir is defined and neutron_conf_dir_stat.stat.isdir

{{ (neutron_install_method == 'distro') | ternary(neutron_conf_dir, (neutron_bin | dirname) + '/etc/neutron') }}

{{ neutron_bin | dirname | regex_replace('^/', '../') }}/etc/neutron

neutron_services['neutron-ovn-controller']['group'] in group_names

neutron_services['neutron-ovn-northd']['group'] in group_names or neutron_services['neutron-ovn-controller']['group'] in group_names

neutron_services['neutron-openvswitch-agent']['group'] in group_names

{{ neutron_provider_networks.network_interface_mappings.split(',') }}

neutron_provider_networks.network_interface_mappings is defined and (neutron_provider_networks.network_interface_mappings|length > 0)

ovs-vsctl --no-wait set Open_vSwitch . other_config:dpdk-lcore-mask={{ ovs_dpdk_lcore_mask }}

ovs-vsctl --no-wait set Open_vSwitch . other_config:pmd-cpu-mask={{ ovs_dpdk_pmd_cpu_mask }}

ovs-vsctl --no-wait set Open_vSwitch . other_config:dpdk-socket-mem={{ ovs_dpdk_socket_mem }}

ovs-vsctl --no-wait set Open_vSwitch . other_config:dpdk-init=true

bridge {{ bridge_mapping.split(':')[1] }} datapath_type={{ ovs_datapath }}

Interface {{ interface_mapping.split(':',1)[1] }} type=dpdk options:dpdk-devargs='{{ interface_mapping.split(':',1)[1] }}'

{{ neutron_bin }}/neutron-odl-ovs-hostconfig --noovs_dpdk {% if neutron_provider_networks.network_mappings is defined and 'odl-router_v2' in neutron_plugin_base or 'odl-router' in neutron_plugin_base %}--datapath_type=system --bridge_mappings={{ neutron_provider_networks.network_mappings }} {% endif %}

ovs-vsctl set Open_vSwitch . other_config:local_ip={{ neutron_local_ip }}

ovs-vsctl set Open_vSwitch . other_config:provider_mappings={{ neutron_provider_networks.network_mappings }}

(neutron_plugin_base == 'odl-router' or neutron_plugin_base == 'odl-router_v2')

ovs-vsctl set open_vswitch . external-ids:hostname='{{ ansible_hostname }}'

(neutron_services['neutron-ovn-northd']['group'] in group_names) or (neutron_services['neutron-ovn-controller']['group'] in group_names)

ovn-nbctl set-connection ptcp:6641:0.0.0.0 -- set connection . inactivity_probe=60000

ovn-sbctl set-connection ptcp:6642:0.0.0.0 -- set connection . inactivity_probe=60000

ovs-vsctl set open . external-ids:ovn-cms-options=enable-chassis-as-gw

ovs-vsctl set open . external-ids:ovn-remote=tcp:{{ neutron_ovn_ip }}:6642

ovs-vsctl set open . external-ids:ovn-encap-ip={{ neutron_local_ip }}

ovs-vsctl set open . external-ids:ovn-bridge-mappings={{ neutron_provider_networks.network_mappings }}

ansible_nodename in (calico_felix_agent.stdout
                    | from_json
                    | selectattr('Binary', 'equalto', 'calico-felix')
                    | map(attribute='Host') | list)

TCP and TLS connectivity are currently enabled for libvirtd. This
combination prevents libvirtd from starting properly since this role
does not generate TLS certificates for libvirtd at this time.

To enable TCP connectivity without TLS, set the following variables:

    nova_libvirtd_listen_tcp: 1
    nova_libvirtd_listen_tls: 0

Please note that this configuration does not encrypt communication with
libvirtd.

ansible_local.openstack_ansible.nova.install_method != nova_install_method

{% for service in filtered_nova_services %}
{%
    {
    }
  )
%}

{{ hostvars[nova_conductor_setup_host]['nova_bin'] | default(nova_bin) }}

{{ _wait_nova_bin }}/openstack --os-cloud default compute service list --service nova-compute --format value --column Host

{{ hostvars[nova_conductor_setup_host]['nova_system_user_name'] | default(nova_system_user_name) }}

{{ _db_nova_bin }}/nova-manage cell_v2 discover_hosts{{ (debug | bool) | ternary(' --verbose', '') }}{{ (nova_virt_type == 'ironic') | ternary(' --by-service', '') }}

{{ nova_bin }}/nova-manage cell_v2 map_cell0
  --database_connection mysql+pymysql://{{ nova_api_galera_user }}:{{ nova_api_container_mysql_password }}@{{ nova_api_galera_address }}/{{ nova_cell0_database }}?charset=utf8

{{ nova_bin }}/nova-manage cell_v2 create_cell
  --name {{ nova_cell1_name }}
  --database_connection mysql+pymysql://{{ nova_galera_user }}:{{ nova_container_mysql_password }}@{{ nova_galera_address }}/{{ nova_galera_database }}?charset=utf8

{{ nova_bin }}/nova-manage cell_v2 list_cells | grep ' {{ nova_cell1_name }} '

{{ nova_bin }}/nova-manage cell_v2 map_instances --cell_uuid {{ cell1_uuid['stdout'].split()[3] }}

{{ (nova_services['nova-compute']['group'] in group_names and nova_virt_type != 'ironic') | ternary(nova_compute_kvm_packages_to_symlink, []) }}

item.service in ansible_facts.services and item.type != nova_console_type

(install_packages is changed) or (ansible_local is not defined) or ('openstack_ansible' not in ansible_local) or ('nova' not in ansible_local['openstack_ansible']) or ('need_online_data_migrations' not in ansible_local['openstack_ansible']['nova']) or ('need_service_restart' not in ansible_local['openstack_ansible']['nova'])

item.key not in hostvars[inventory_hostname] or item.key is undefined

nova_conf_dir_stat.stat.isdir is defined and nova_conf_dir_stat.stat.isdir

{{ (nova_install_method == 'distro') | ternary('/etc/nova', (nova_bin | dirname) + '/etc/nova') }}

cpuinfo_contents.stdout.find('vmx') != -1 or cpuinfo_contents.stdout.find('svm') != -1 or cpuinfo_contents.stdout.find('PowerNV') != -1 or (cpuinfo_contents.stdout.find('pSeries') != -1 and cpuinfo_contents.stdout.find('qemu') != -1 and ansible_architecture == 'ppc64le') or (dev_kvm.stat.ischr is defined and dev_kvm.stat.ischr and ansible_architecture == 'aarch64')

EXIT_CODE=0
FOLDER_PATH="/usr/share/novnc"
if [[ -e ${FOLDER_PATH} ]]; then
  if [[ ! -d "${FOLDER_PATH}/.git" ]]; then
    echo "${FOLDER_PATH} is not a git repo, deleting..."
    EXIT_CODE=2
  elif test -n "$(cd ${FOLDER_PATH}; git status --porcelain)"; then
    echo "${FOLDER_PATH} is a dirty git repo, deleting..."
  fi
  if [[ "${EXIT_CODE}" == "2" ]]; then
    rm -rf ${FOLDER_PATH}
  fi
fi
exit ${EXIT_CODE}

command cat {{ nova_console_user_ssl_cert }} {{ nova_console_user_ssl_ca_cert is defined | ternary(nova_console_user_ssl_ca_cert,'') }}

FOLDER_PATH="/usr/share/spice-html5"
  fi
  fi
fi

nova_libvirt_inject_key | bool or nova_libvirt_inject_password | bool

{{ (ansible_os_family == 'RedHat') | ternary('/usr/share/OVMF/OVMF_CODE.secboot.fd', '/usr/share/qemu/ovmf-x86_64-ms-code.bin') }}

{{ kernels.files | map(attribute='path') | sort(reverse=True) | first }}

dpkg-statoverride --update --add root nova 0640 {{ latest_kernel }}

'an override for \'{{ latest_kernel }}\' already exists; aborting' not in dpkg_statoverride_result.stderr

(dpkg_statoverride_result.rc != 0) and ('an override for \'{{ latest_kernel }}\' already exists; aborting' not in dpkg_statoverride_result.stderr)

(add_rabbitmq_repos is mapping and add_rabbitmq_repos is changed) or (add_erlang_repos is mapping and add_erlang_repos is changed)

The only supported rabbitmq_install_method for RedHat is 'external_repo'.

The only supported rabbitmq_install_method for openSUSE is 'external_repo'.

rabbitmqctl -q cluster_status | sed 's/ //g' | grep -oP '(?<=Clustername:).*'

rabbitmqctl join_cluster "rabbit@{{ rabbitmq_primary_cluster_node.split('.')[0] }}"

{{ (rabbitmq_apply_openstack_policies | bool) | ternary(rabbitmq_openstack_policies + rabbitmq_policies, rabbitmq_policies) }}

openssl req -new -nodes -sha256 -x509 -subj "{{ rabbitmq_ssl_self_signed_subject }}" -days 3650 -keyout {{ rabbitmq_ssl_key }} -out {{ rabbitmq_ssl_cert }} -extensions v3_ca creates={{ rabbitmq_ssl_cert }}

{{ hostvars[groups[rabbitmq_host_group][0]]['rabbitmq_ssl_key_fact'] | b64decode }}

{{ hostvars[groups[rabbitmq_host_group][0]]['rabbitmq_ssl_cert_fact'] | b64decode }}

To install a new major/minor version of RabbitMQ set '-e rabbitmq_upgrade=true'.

not installed_rabbitmq.stdout is search(rabbitmq_package_version)

cat /tmp/{{ manifest }}.yaml > /tmp/logs/armada/{{ manifest }}.yaml

set -xe;
./tools/deployment/common/000-install-packages.sh
./tools/deployment/common/005-deploy-k8s.sh
sudo -H pip install yq bandit

set -xe;
make all
mkdir -p python-files
./tools/gate/template-python.sh

find . -not -path "*/\.*" -not -path "*/doc/build/*" -not -name "*.tgz" -type f -exec egrep -l " +$" {} \;

set -e; [ "x$($(type -p helm) version --client --short | awk '{ print $NF }' | awk -F '+' '{ print $1 }')" == "x${HELM_VERSION}" ] || exit 1

TMP_DIR=$(mktemp -d)
curl -sSL ${GOOGLE_HELM_REPO_URL}/helm-${HELM_VERSION}-linux-amd64.tar.gz | tar -zxv --strip-components=1 -C ${TMP_DIR}
sudo mv ${TMP_DIR}/helm /usr/bin/helm
rm -rf ${TMP_DIR}

set -e
docker build \
  --network host \
  --force-rm \
  --tag "{{ images.kubernetes.kubeadm_aio }}" \
  --file tools/images/kubeadm-aio/Dockerfile \
  --build-arg KUBE_VERSION="{{ version.kubernetes }}" \
  --build-arg CNI_VERSION="{{ version.cni }}" \
  --build-arg HELM_VERSION="{{ version.helm }}" \
  --build-arg CHARTS="calico,flannel,tiller,kube-dns,kubernetes-keystone-webhook" \
  --build-arg GOOGLE_KUBERNETES_REPO_URL="{{ url.google_kubernetes_repo }}" \
  --build-arg GOOGLE_HELM_REPO_URL="{{ url.google_helm_repo }}" \
  --build-arg CNI_REPO_URL="{{ url.cni_repo }}" \
  --build-arg HTTP_PROXY="{{ proxy.http }}" \
  --build-arg HTTPS_PROXY="{{ proxy.https }}" \
  --build-arg NO_PROXY="{{ proxy.noproxy }}" \
  {% if zuul_site_mirror_fqdn is defined and zuul_site_mirror_fqdn %}
  --build-arg UBUNTU_URL="http://{{ zuul_site_mirror_fqdn }}/ubuntu/" \
  --build-arg ALLOW_UNAUTHENTICATED="true" \
  --build-arg PIP_INDEX_URL="http://{{ zuul_site_mirror_fqdn }}/pypi/simple" \
  --build-arg PIP_TRUSTED_HOST="{{ zuul_site_mirror_fqdn }}" \
  {% endif %}
  .

set -e
  {% endif %}
  .

set -xe
systemctl enable apparmor
systemctl start apparmor
systemctl status apparmor.service

ansible_distribution == 'CentOS' or ansible_distribution == 'Red Hat Enterprise Linux' or ansible_distribution == 'Fedora'

ansible_distribution == 'CentOS' or ansible_distribution == 'Red Hat Enterprise Linux'

remove requests and urllib3 distro packages to fix docker removal issue with ansible's docker_container on centos

restore requests and urllib3 distro packages to fix docker removal issue with ansible's docker_container on centos

( ansible_distribution == 'CentOS' or ansible_distribution == 'Red Hat Enterprise Linux' ) and ( need_docker is failed )

( ansible_distribution == 'Fedora' ) and ( need_docker is failed )

( ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu' ) and ( need_docker is failed )

ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu' or ansible_distribution == 'Fedora'

CONTAINER_NAME="kubeadm-{{ kubeadm_aio_action }}" ACTION="{{ kubeadm_aio_action }}" KUBE_BIND_DEVICE="{{ kubernetes_default_device }}" USER_UID="{{ playbook_user_id }}" USER_GID="{{ playbook_group_id }}" USER_HOME="{{ playbook_user_dir }}" CNI_ENABLED="{{ kubernetes_cluster_cni }}" PVC_SUPPORT_CEPH=true PVC_SUPPORT_NFS=true NET_SUPPORT_LINUXBRIDGE=true KUBE_NET_POD_SUBNET="{{ kubernetes_cluster_pod_subnet }}" KUBE_NET_DNS_DOMAIN="{{ kubernetes_cluster_domain }}" CONTAINER_RUNTIME=docker

{% if nodes.labels.all is defined %}{% set comma = joiner(",") %}{% for item in nodes.labels.all %}{{ comma() }}{{ item.name }}={{ item.value }}{% endfor %}{% else %}""{% endif %}

{% set comma = joiner(",") %}{% for group in group_names %}{% if nodes.labels[group] is defined %}{% for item in nodes.labels[group] %}{{ comma() }}{{ item.name }}={{ item.value }}{% endfor %}{% else %}""{% endif %}{% endfor %}

{% set comma = joiner(",") %}{% for item in kubeadm_kubelet_labels_node %}{{ comma() }}{{ item }}{% endfor %}

{{ hostvars[(groups['primary'][0])]['ansible_default_ipv4']['address'] }}

kubernetes_network_default_device is defined and kubernetes_network_default_device

CONTAINER_NAME="kubeadm-{{ kubeadm_aio_action }}" ACTION="{{ kubeadm_aio_action }}" KUBE_BIND_DEVICE="{{ kubernetes_default_device }}" KUBE_BIND_ADDR="{{ kubernetes_default_address }}" USER_UID="{{ playbook_user_id }}" USER_GID="{{ playbook_group_id }}" USER_HOME="{{ playbook_user_dir }}" CNI_ENABLED="{{ kubernetes_cluster_cni }}" PVC_SUPPORT_CEPH=true PVC_SUPPORT_NFS=true NET_SUPPORT_LINUXBRIDGE=true KUBE_NET_POD_SUBNET="{{ kubernetes_cluster_pod_subnet }}" KUBE_NET_DNS_DOMAIN="{{ kubernetes_cluster_domain }}" CONTAINER_RUNTIME=docker KUBELET_NODE_LABELS="{{ kubeadm_kubelet_labels }}" KUBE_SELF_HOSTED="{{ kubernetes_selfhosted }}" KUBE_KEYSTONE_AUTH="{{ kubernetes_keystone_auth }}" GATE_FQDN_TEST="{{ gate_fqdn_test }}" GATE_FQDN_TLD="{{ gate_fqdn_tld }}" GATE_INGRESS_IP="{{ primary_node_default_ip }}"

kubectl get node "{{ kube_node_hostname }}" -o jsonpath="{$.status.conditions[?(@.reason=='KubeletReady')]['type']}" || echo "Not registered yet"

kubeadm_cluster_join_command="{{ kubeadm_aio_action_logs.stdout }}"

CONTAINER_NAME="kubeadm-{{ kubeadm_aio_action }}" ACTION="{{ kubeadm_aio_action }}" KUBEADM_JOIN_COMMAND="{{ kubeadm_aio_join_command }}"

test -e /usr/bin/python || (sudo apt -y update && sudo apt install -y python-minimal) || (sudo yum install -y python) || (sudo dnf install -y python2)

( pip_version_output is failed ) and ( ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu' )

( pip_version_output is failed ) and ( ansible_distribution == 'CentOS' or ansible_distribution == 'Red Hat Enterprise Linux' )

ensuring epel-release package is present for centos as python-pip is in the epel repo

( pip_version_output is failed ) and ( ansible_distribution == 'Fedora' )

set -ex
wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add -
sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list'
wget --directory-prefix=/tmp/ https://chromedriver.storage.googleapis.com/2.44/chromedriver_linux64.zip

set -e
export OBJECT_TYPE=node,clusterrole,clusterrolebinding,storageclass,namespace
export PARALLELISM_FACTOR=2

function list_objects () {
  printf ${OBJECT_TYPE} | xargs -d ',' -I {} -P1 -n1 bash -c 'echo "$@"' _ {}
}
export -f list_objects

function name_objects () {
  export OBJECT=$1
  kubectl get ${OBJECT} -o name | xargs -L1 -I {} -P1 -n1 bash -c 'echo "${OBJECT} ${1#*/}"' _ {}
}
export -f name_objects

function get_objects () {
  input=($1)
  export OBJECT=${input[0]}
  export NAME=${input[1]#*/}
  echo "${OBJECT}/${NAME}"
  DIR="{{ logs_dir }}/objects/cluster/${OBJECT}"
  mkdir -p ${DIR}
  kubectl get ${OBJECT} ${NAME} -o yaml > "${DIR}/${NAME}.yaml"
  kubectl describe ${OBJECT} ${NAME} > "${DIR}/${NAME}.txt"
}
export -f get_objects

list_objects | \
  xargs -r -n 1 -P ${PARALLELISM_FACTOR} -I {} bash -c 'name_objects "$@"' _ {} | \
  xargs -r -n 1 -P ${PARALLELISM_FACTOR} -I {} bash -c 'get_objects "$@"' _ {}

set -e
export OBJECT_TYPE=configmaps,cronjobs,daemonsets,deployment,endpoints,ingresses,jobs,networkpolicies,pods,podsecuritypolicies,persistentvolumeclaims,rolebindings,roles,secrets,serviceaccounts,services,statefulsets
function get_namespaces () {
  kubectl get namespaces -o name | awk -F '/' '{ print $NF }'
}

function list_namespaced_objects () {
  export NAMESPACE=$1
  printf ${OBJECT_TYPE} | xargs -d ',' -I {} -P1 -n1 bash -c 'echo "${NAMESPACE} $@"' _ {}
}
export -f list_namespaced_objects

  export NAMESPACE=${input[0]}
  export OBJECT=${input[1]}
  kubectl get -n ${NAMESPACE} ${OBJECT} -o name | xargs -L1 -I {} -P1 -n1 bash -c 'echo "${NAMESPACE} ${OBJECT} $@"' _ {}
}

  export NAME=${input[2]#*/}
  echo "${NAMESPACE}/${OBJECT}/${NAME}"
  DIR="{{ logs_dir }}/objects/namespaced/${NAMESPACE}/${OBJECT}"
  kubectl get -n ${NAMESPACE} ${OBJECT} ${NAME} -o yaml > "${DIR}/${NAME}.yaml"
  kubectl describe -n ${NAMESPACE} ${OBJECT} ${NAME} > "${DIR}/${NAME}.txt"
}

get_namespaces | \
  xargs -r -n 1 -P ${PARALLELISM_FACTOR} -I {} bash -c 'list_namespaced_objects "$@"' _ {} | \

set -o xtrace
# Some providers inject dynamic network config statically. Work around this
# for DNS nameservers. This is expected to fail on some nodes so remove -e.
set +e
sed -i -e 's/^\(DNS[0-9]*=[.0-9]\+\)/#\1/g' /etc/sysconfig/network-scripts/ifcfg-*
sed -i -e 's/^NETCONFIG_DNS_POLICY=.*/NETCONFIG_DNS_POLICY=""/g' /etc/sysconfig/network/config
set -e
echo 'nameserver 208.67.222.222' > /etc/resolv.conf
echo 'nameserver 8.8.8.8' >> /etc/resolv.conf
exit 0

set -x
systemd-cgls --full --all --no-pager > {{ logs_dir }}/system/systemd-cgls.txt
ip addr > {{ logs_dir }}/system/ip-addr.txt
ip route > {{ logs_dir }}/system/ip-route.txt
lsblk > {{ logs_dir }}/system/lsblk.txt
mount > {{ logs_dir }}/system/mount.txt
docker images > {{ logs_dir }}/system/docker-images.txt
brctl show > {{ logs_dir }}/system/brctl-show.txt
ps aux --sort=-%mem > {{ logs_dir }}/system/ps.txt

set -e
PARALLELISM_FACTOR=2
}
function get_pods () {
  NAMESPACE=$1
  kubectl get pods -n ${NAMESPACE} -o name | awk -F '/' '{ print $NF }' | xargs -L1 -P 1 -I {} echo ${NAMESPACE} {}
}
export -f get_pods
function get_pod_logs () {
  NAMESPACE=${1% *}
  POD=${1#* }
  INIT_CONTAINERS=$(kubectl get pod $POD -n ${NAMESPACE} -o json | jq -r '.spec.initContainers[]?.name')
  CONTAINERS=$(kubectl get pod $POD -n ${NAMESPACE} -o json | jq -r '.spec.containers[].name')
  for CONTAINER in ${INIT_CONTAINERS} ${CONTAINERS}; do
    echo "${NAMESPACE}/${POD}/${CONTAINER}"
    mkdir -p "{{ logs_dir }}/pod-logs/${NAMESPACE}/${POD}"
    mkdir -p "{{ logs_dir }}/pod-logs/failed-pods/${NAMESPACE}/${POD}"
    kubectl logs ${POD} -n ${NAMESPACE} -c ${CONTAINER} > "{{ logs_dir }}/pod-logs/${NAMESPACE}/${POD}/${CONTAINER}.txt"
    kubectl logs --previous ${POD} -n ${NAMESPACE} -c ${CONTAINER} > "{{ logs_dir }}/pod-logs/failed-pods/${NAMESPACE}/${POD}/${CONTAINER}.txt"
  done
}
export -f get_pod_logs
  xargs -r -n 1 -P ${PARALLELISM_FACTOR} -I {} bash -c 'get_pods "$@"' _ {} | \
  xargs -r -n 2 -P ${PARALLELISM_FACTOR} -I {} bash -c 'get_pod_logs "$@"' _ {}

set -e
NAMESPACES=$(kubectl get namespaces -o json | jq -r '.items[].metadata.name')
for NS in $NAMESPACES; do
  SERVICES=$(kubectl get svc -l component=metrics -n $NS -o json | jq -r '.items[].metadata.name')
  for SVC in $SERVICES; do
    PORT=$(kubectl get svc $SVC -n $NS -o json | jq -r '.spec.ports[].port')
    curl "$SVC.$NS:$PORT/metrics" >> "{{ logs_dir }}"/prometheus/$NS-$SVC.txt || true
  done
done

set -e
curl tiller-deploy.kube-system:44135/metrics >> "{{ logs_dir }}"/prometheus/kube-system-tiller-deploy.txt

set -e
mgr_endpoints=$(kubectl get endpoints -n ceph -l component=manager -o json | jq -r '.items[].subsets[].addresses[].ip')
echo "ceph-mgr endpoints: $mgr_endpoints"
for endpoint in $mgr_endpoints; do
  echo "checking ceph-mgr at $endpoint"
  metrics_curl="curl $endpoint:9283/metrics"
  op=$(eval "$metrics_curl")
  if [[ -n $op ]]; then
    curl $endpoint:9283/metrics >> "{{ logs_dir }}"/prometheus/ceph-ceph-mgr.txt
    break
  else
    echo "$endpoint is a standby ceph-mgr. Trying next endpoint"
  fi
done

set -e
helm status {{ helm_released }}  >> {{ logs_dir }}/helm/releases/{{ helm_release }}.txt
helm get values {{ helm_released }}  >> {{ logs_dir }}/helm/values/{{ helm_release }}.yaml

{{ zuul_osh_infra_relative_path | default('../openstack-helm-infra/') }}

MY_CONTAINER_ID=$(docker inspect --format {% raw %}'{{ .Id }}'{% endraw %} "{{ my_container_name }}"); docker ps --all --no-trunc --quiet | awk '!'"/${MY_CONTAINER_ID}/ { print \$1 }" | xargs -r -l1 -P16 docker rm -f

for MOUNT in $(findmnt --df --output TARGET | grep "^/var/lib/kubelet"); do
 umount --force $MOUNT
done

echo $(cat /sys/class/net/$(sudo ip -4 route list 0/0 | awk '{ print $5; exit }')/mtu)

echo '{"CN":"server","hosts":[""],"key":{"algo":"rsa","size":2048}}' | cfssl gencert -ca=ca.crt -ca-key=ca.key -config=ca-config.json -profile=server -hostname="{{ cluster.cni_host_ip }},127.0.0.1,localhost" - | cfssljson -bare server
echo '{"CN":"client","hosts":[""],"key":{"algo":"rsa","size":2048}}' | cfssl gencert -ca=ca.crt -ca-key=ca.key -config=ca-config.json -profile=client - | cfssljson -bare client

kubectl label --overwrite nodes {{ kubeadm_node_hostname }} node-role.kubernetes.io/master=

helm install /opt/charts/calico --name calico --namespace kube-system --set networking.podSubnet="{{ k8s.networking.podSubnet }}" --set conf.node.IP_AUTODETECTION_METHOD="can-reach={% if k8s.api.advertiseAddress is defined %}{{ k8s.api.advertiseAddress }}{% else %}{% if k8s.api.advertiseAddressDevice is defined %}{{ hostvars[inventory_hostname]['ansible_'+k8s.api.advertiseAddressDevice].ipv4.address }}{% else %}{{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }}{% endif %}{% endif %}" --set networking.mtu="{{ cni_default_device_mtu.stdout }}" --values="/etc/kubernetes/pki/calico/calico_certs.yaml" --set monitoring.prometheus.calico_node.port="{{ calico.prometheus_port }}" --wait --timeout=600

helm install /opt/charts/flannel --name flannel --namespace kube-system --set networking.podSubnet="{{ k8s.networking.podSubnet }}" --wait --timeout=600

helm install /opt/charts/tiller --name tiller --namespace kube-system --set monitoring.prometheus.enabled=true --wait

helm install /opt/charts/kube-dns --name kube-dns --namespace kube-system --set networking.dnsDomain={{ k8s.networking.dnsDomain }} --wait

helm upgrade --install kubernetes-keystone-webhook /opt/charts/kubernetes-keystone-webhook --namespace=kube-system --set endpoints.identity.namespace=openstack --set endpoints.kubernetes.auth.api.tls.crt='{{ kubeadm_kubeapi_cert.stdout }}' --set endpoints.kubernetes.auth.api.tls.key='{{ kubeadm_kubeapi_key.stdout }}'

# TODO(lamt): Clean up this way of restarting the kube-apiserver. Preferably,
# the setting is in place when the kube-apiserver comes up. Currently, the
# kube-apiserver does not start whenever the webhook fails.
cat /etc/kubernetes/manifests/kube-apiserver.yaml > /tmp/kube-apiserver.yaml
sed -i '/etcd-keyfile/a \ \ \ \ -\ --authentication-token-webhook-config-file=/etc/kubernetes/pki/webhook.kubeconfig\n \ \ \ \- --authorization-webhook-config-file=/etc/kubernetes/pki/webhook.kubeconfig' /tmp/kube-apiserver.yaml
sed -i -e 's/Node,RBAC/Node,Webhook,RBAC/g' /tmp/kube-apiserver.yaml
sed -i '/hostNetwork: true/a\ \ dnsPolicy: ClusterFirstWithHostNet' /tmp/kube-apiserver.yaml
mv /tmp/kube-apiserver.yaml /etc/kubernetes/manifests/kube-apiserver.yaml

{% if ansible_domain is defined %}{{ ansible_fqdn }}{% else %}{{ ansible_hostname }}.node.{{ k8s.networking.dnsDomain }}{% endif %}

kubeadm init phase certs etcd-ca --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubeadm init phase certs etcd-server --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubeadm init phase certs etcd-peer --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubeadm init phase certs etcd-healthcheck-client --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubeadm init phase certs ca --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubeadm init phase certs apiserver --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubeadm init phase certs apiserver-etcd-client --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubeadm init phase certs apiserver-kubelet-client --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubeadm init phase certs front-proxy-ca --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubeadm init phase certs front-proxy-client --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubeadm init phase kubeconfig admin --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubeadm init phase kubeconfig kubelet --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubeadm init phase kubeconfig controller-manager --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubeadm init phase kubeconfig scheduler --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubeadm init phase etcd local --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubeadm init phase control-plane apiserver --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubeadm init phase control-plane controller-manager --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubeadm init phase control-plane scheduler --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubectl get node "{{ kubeadm_node_hostname }}" --no-headers | gawk '{ print $2 }' | grep -q '\(^Ready\)\|\(^NotReady\)'

kubeadm init phase addon kube-proxy --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubectl get node "{{ kubeadm_node_hostname }}" --no-headers | gawk '{ print $2 }' | grep -q '^Ready'

kubeadm init phase upload-config kubeadm --kubeconfig /mnt/rootfs/etc/kubernetes/admin.conf --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubeadm init phase upload-config kubelet --kubeconfig /mnt/rootfs/etc/kubernetes/admin.conf --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

kubeadm init phase bootstrap-token --kubeconfig /mnt/rootfs/etc/kubernetes/admin.conf

kubectl --kubeconfig /mnt/rootfs/etc/kubernetes/admin.conf get ns kube-public

kubectl --kubeconfig /mnt/rootfs/etc/kubernetes/admin.conf create ns kube-public

kubectl --kubeconfig /mnt/rootfs/etc/kubernetes/admin.conf delete -f /etc/kubernetes/cluster-info.yaml --ignore-not-found

kubectl --kubeconfig /mnt/rootfs/etc/kubernetes/admin.conf create -f /etc/kubernetes/cluster-info.yaml

kubectl --kubeconfig /mnt/rootfs/etc/kubernetes/admin.conf -n kube-public get role system:bootstrap-signer-clusterinfo

kubectl --kubeconfig /mnt/rootfs/etc/kubernetes/admin.conf -n kube-public create role system:bootstrap-signer-clusterinfo --verb get --resource configmaps

kubectl --kubeconfig /mnt/rootfs/etc/kubernetes/admin.conf -n kube-public get rolebinding kubeadm:bootstrap-signer-clusterinfo

kubectl --kubeconfig /mnt/rootfs/etc/kubernetes/admin.conf -n kube-public create rolebinding kubeadm:bootstrap-signer-clusterinfo --role system:bootstrap-signer-clusterinfo --user system:anonymous

kubectl --kubeconfig=/mnt/rootfs/etc/kubernetes/admin.conf  label --overwrite namespace {{ item }} name={{ item }}

kubeadm init phase selfhosting convert-from-staticpods --kubeconfig /mnt/rootfs/etc/kubernetes/admin.conf --config /mnt/rootfs/etc/kubernetes/kubeadm-conf.yaml

{% if kubelet.bind_device is defined %}{{ hostvars[inventory_hostname]['ansible_'+kubelet.bind_device].ipv4.address }}{% else %}{{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }}{% endif %} {% if ansible_domain is defined %}{{ ansible_fqdn }}{% else %}{{ ansible_hostname }}.node.{{ k8s.networking.dnsDomain }}{% endif %} {{ ansible_hostname }}

^{{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }}{% if kubelet.bind_device is defined %}|{{ hostvars[inventory_hostname]['ansible_'+kubelet.bind_device].ipv4.address }}{% endif %}

127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4

ansible_distribution == 'Ubuntu' and ansible_distribution_release == 'xenial'

ansible_distribution == 'Debian' or ( ansible_distribution == 'Ubuntu' and ansible_distribution_release == 'bionic' )

{{ lookup('ini', 'dns section=main file=/etc/NetworkManager/NetworkManager.conf') }}

if ! [[ $(ip -4 route list 0/0 | head -c1 | wc -c) -ne 0 ]]; then exit 1; fi

wget -q -O- 'https://download.ceph.com/keys/release.asc' | sudo apt-key add -

deb https://download.ceph.com/debian-nautilus/ {{ ansible_lsb.codename }} main

find . \! \( -path "*/\.*" -o -path "*/doc/build/*" -o -name "*.tgz" -o -name "*.png" \) -type f -exec egrep -l " +$" {} \;

{% set _var = [] -%} {% for item in groups['all_containers'] | default([]) -%} {%   if item not in ['ceph_all','rsyslog_all','elasticsearch_all','mons'] -%} {%     if hostvars[item]['physical_host'] | default(false) != item -%} {%       if _var.append(hostvars[item]['physical_host']) -%} {%       endif -%} {%     endif -%} {%   endif -%} {% endfor -%} {{ _var | unique }}

/openstack/backup/control-plane/{{ openstack_release }}-{{ inventory_hostname }}_config.tgz

/openstack/backup/control-plane/{{ openstack_release }}-{{ inventory_hostname }}.tar.tgz

mv -f /openstack/backup/control-plane/{{ inventory_hostname }}.tar.tgz /openstack/backup/control-plane/{{ openstack_release }}-{{ inventory_hostname }}.tar.tgz

tar czf /openstack/backup/control-plane/{{ openstack_release }}-{{ inventory_hostname }}_config.tgz {{ container_config.results[0].stdout |replace('\n', ' ') }}

echo '' |update-alternatives --config editor |grep 'mode' |grep '*'

cat /sys/devices/system/cpu/cpu{{ item }}/cpufreq/scaling_governor

neutron {{ openrc_insecure |default(false) |bool |ternary('--insecure','') }} security-group-list | /bin/grep -w "rpc-support"

neutron {{ openrc_insecure |default(false) |bool |ternary('--insecure','') }} security-group-create rpc-support

neutron {{ openrc_insecure |default(false) |bool |ternary('--insecure','') }} security-group-rule-create \
        --direction ingress \
        --protocol tcp \
        --port-range-min {{ item }} \
        --port-range-max {{ item }} \
        --remote-ip-prefix 0.0.0.0/0 \
        rpc-support

         --direction ingress \
         --protocol icmp \
         --remote-ip-prefix 0.0.0.0/0 \
         rpc-support

echo unattended-upgrades unattended-upgrades/enable_auto_updates boolean {{ apt_autoupdate_enabled |default(0) |bool |lower }} | debconf-set-selections

ansible_service_mgr == "systemd" or ansible_service_mgr == "upstart"

\1 hugepagesz={{ hugepage_size |default('2M') }} hugepages={{ hugepage_nr }} transparent_hugepages={{ transparent_hugepage_mode |default('never') }}

kernel/mm/transparent_hugepage/enabled = {{ tp_hugepage_mode |default('always') }}

This playbook fixes potential LXC container bind mounts and restarts all containers automatically.
Please load the Ansible SSH key into a SSH agent prior to executing this playbook. Proceed?

{{ lxc_default_bind_mounts | default([{"bind_dir_path": "/var/log", "mount_path": "/openstack/log/{{ inventory_hostname }}"}]) }}

old_designate_pools_config is defined and old_designate_pools_config.stat.exists |bool

designate_pools_config is not defined or not designate_pools_config.stat.exists |bool

msg="Skipping installation of designate_pools.yml as already present"

/opt/{{ ops_holland_service_name }}_{{ ops_holland_git_install_branch | replace('/', '_') }}

ops_holland_git_dest is defined and ops_holland_git_repo_plugins is defined

{{ ops_holland_venv_bin }}/python2.7 {{ ops_holland_venv_bin }}/holland bk

find /var/backup/holland_backups/rpc_support -iregex '.*/[0-9]+_[0-9]+/backup.xb' -type f -size +3M

support_key_check.stat.exists |bool or support_key_create|changed

ssh-keygen -lf /root/.ssh/rpc_support.pub |awk '/(RSA|DSA)/ {print $2}'

ssh-keygen -l -E md5 -f /root/.ssh/rpc_support.pub |awk -F'MD5:' '/(RSA|DSA)/ {print substr($2,1,48)}'

{{ ops_venv }}/bin/nova keypair-list | grep rpc_support

{{ ops_venv }}/bin/nova keypair-delete rpc_support

nova_support_key.rc == 0 and support_key_fingerprint.stdout not in nova_support_key.stdout

{{ ops_venv }}/bin/nova keypair-add --pub-key /root/.ssh/rpc_support.pub rpc_support

{{ hostvars[groups['shared-infra_hosts'][0]]['support_key'].content | b64decode }}

{{ hostvars[groups['shared-infra_hosts'][0]]['support_pub_key'].content | b64decode }}

hostvars[groups['shared-infra_hosts'][0]]['support_pub_key'].content |default('') |length > 64

hostvars[groups['shared-infra_hosts'][0]]['support_key'].content |b64decode |hash('sha1') != local_support_key_check.stat.checksum |default('')

blkid -n xfs /dev/sd* |awk '/LABEL=\"disk/ { split($0,blkid,"\n"); for (n in blkid) { if (substr(blkid[n],0,5) == "/dev/") { device=$1; pos=match(blkid[n],"LABEL="); if (pos > 0) { str=device","substr(blkid[n],pos+7,6); gsub(":|\"","",str); print str } } } }'

{{ item.split(',')[1] not in ( exclude_drive_labels | default ({}) ) }}

mkfs.xfs -L {{ item.split(',')[1] }} -f -i size={{ xfs_inode_size |default('1024') | int }} {{ xfs_format_options |default('') }} {{ item.split(',')[0] }}

{{ item.split(',')[1] not in ( exclude_drive_labels_format_option | default ({}) ) }}

mkfs.xfs -L {{ item.split(',')[1] }} -f -i size={{ xfs_inode_size |default('1024') | int }} {{ item.split(',')[0] }}

{{ item.split(',')[1] in ( exclude_drive_labels_format_option | default ({}) ) }}

{{ xfs_mount_options |default('rw,noatime,nodiratime,nobarrier,logbufs=8,noquota') }}

{{ screen_binary.stdout }} -d -m -L -t "hp_firmware_update" bash -c "source {{ ops_venv + '/bin/activate' }} || true; /usr/local/bin/update_hp_firmware.py -f {{ firmware_use_meltdown | default(false) | bool | ternary('--meltdown', '') }}"

awk -F= '/^DISTRIB_RELEASE/ {print $2}' {{ osa_release_file.stat.path }} | tr -d \"\'

{{ osa_release_output is defined |ternary(osa_release_output.stdout,osp_release_output.stdout) |default('0.0.0') }}

{{ osa_release_output is defined |ternary('RPCO','OSP') |default('RPCO') }}

{{ (pip_install_upper_constraints is defined) | ternary('--constraint ' + pip_install_upper_constraints | default(''),'') }} {{ pip_install_options | default('') }}

ops_pip_dependencies is defined and not (pip_install is success)

# Allow user to ssh into localhost
ssh-keygen -f ~/.ssh/id_rsa -N ""
cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys
ssh-keyscan localhost >> ~/.ssh/known_hosts
ssh-keyscan 127.0.0.1 >> ~/.ssh/known_hosts

{{ zuul.projects['opendev.org/opendev/system-config'].src_dir }}/applytest/

{{ zuul.projects['opendev.org/opendev/system-config'].src_dir }}

echo "" | sudo tee -a /etc/ssh/sshd_config
echo "Match address 127.0.0.1" | sudo tee -a /etc/ssh/sshd_config
echo "    PermitRootLogin without-password" | sudo tee -a /etc/ssh/sshd_config
echo "Match address ::1" | sudo tee -a /etc/ssh/sshd_config
mkdir -p ~/.ssh
ssh-keygen -f ~/.ssh/id_rsa -b 2048 -P ""
sudo mkdir -p /root/.ssh
cat ~/.ssh/id_rsa.pub | sudo tee -a /root/.ssh/authorized_keys
if [ -f /usr/bin/yum ]; then
    sudo systemctl reload sshd
elif [ -f /usr/bin/apt-get ]; then
    sudo service ssh restart
fi

    yum install ruby-devel gcc-c++ -y
    apt-get install ruby-dev -y
fi

gem install bundler --no-ri --no-rdoc --verbose --version '<2.0.0'
$GEM_HOME/bin/bundle install --retry 3
export BEAKER_set={{ nodeset }}
export BEAKER_debug=yes
export BEAKER_color=no
$GEM_HOME/bin/bundle exec rspec spec/acceptance

zuul ALL = NOPASSWD:/usr/local/jenkins/slave_scripts/zuul-sudo-grep.sh

{{ zuul.executor.work_root }}/artifacts/$ZUUL_SHORT_PROJECT_NAME

set -eux

# TODO: fedora
YUM=${YUM:-yum}

VERSION=1.6.22.3
SRC_VERSION=${VERSION}-1
SRC_RPM=openafs-${SRC_VERSION}.src.rpm
SRC_URL=https://www.openafs.org/dl/openafs/${VERSION}/${SRC_RPM}

UPSTREAM_BASE=https://tarballs.openstack.org/project-config/package-afs-centos7
UPSTREAM_CHECK=${UPSTREAM_BASE}/openafs-client-${SRC_VERSION}.el7.x86_64.rpm
if wget -O/dev/null -q $UPSTREAM_CHECK; then
    echo "Found existing upstream RPM build, nothing to do"
    # scp should just publish nothing
    exit 0
fi

# some common prereqs
sudo yum -y groupinstall "Development Tools" "Development Libraries"
sudo yum -y install rpm-build kernel-devel createrepo

wget $SRC_URL
# install the build dependencies for the package
sudo yum-builddep -y ./${SRC_RPM}

# install source-rpm
# (this installs to ~/rpmbuild)
rpm -i ./${SRC_RPM}

# build everything
pushd ~/rpmbuild/SPECS/
rpmbuild -ba ./openafs.spec
popd

# create final repo for copying
createrepo ~/rpmbuild/RPMS/x86_64

set -eux

VERSION=1.8.4

UPSTREAM_BASE=https://tarballs.openstack.org/project-config/package-afs-centos8
UPSTREAM_CHECK=${UPSTREAM_BASE}/openafs-client-${SRC_VERSION}.el8.x86_64.rpm
    exit 0
fi

sudo dnf -y group install "Development Tools"
sudo dnf -y install rpm-build kernel-devel createrepo

sudo dnf builddep -y ./${SRC_RPM}

# for whatever reason (I think because it is in a macro
# check in the .spec) the above builddep misses this
# dependency
sudo dnf install -y elfutils-devel

popd

mv *.tar.gz {{ zuul.project.short_name }}-{{ zuul.branch | replace('/', '-') }}.tar.gz

src/opendev.org/openstack/releases/tools/announce.sh
  src/{{ zuul.project.canonical_name }} {{ zuul.tag }}

{{ ansible_user_dir }}/.venv/bin/python {{ ansible_user_dir }}/xstatic_check_version.py

grep '^\[testenv:{{ tox_pdf_envlist }}\]' {{ zuul_work_dir }}/tox.ini

mount {{ opt_partition }} /mnt
find /opt/ -mindepth 1 -maxdepth 1 -exec mv {} /mnt/ \;
umount /mnt

{{ configure_swap_size - ansible_memory_mb['swap']['total'] | int }}

dd if=/dev/zero of=/root/swapfile bs=1M count={{ swap_required }}

source {{ zuul_work_virtualenv }}/bin/activate
tools/tox_install.sh {{ constraints_file }}

mv {{ doc_build_dir }}/tmp {{ doc_build_dir }}/html/{{ zuul.branch }}

Project: {{ zuul.project.name }} Branch: {{ zuul.branch }} Build: {{ zuul.build }} Revision: {{ zuul.ref }}

zuul.branch != 'master' and 'stable' not in zuul.branch and zuul.tag is not defined

set -xe
DOCBUILD="{{ sphinx_build_dir }}"
if [[ {{ zuul.ref }} =~ ^refs/tags/ ]]; then
    # This job should not be configured to run for
    # pre-releases, so if we have a tag we want to use it as
    # the publishing location.
    tag=$(echo {{ zuul.ref }} | cut -d/ -f3-)
    branch_name=""
else
    # If the ref was not a tag, assume it is a branch.
    branch_name={{ zuul.branch }}
    tag=""
fi
# Rearrange the build output to reflect the end publishing
# location, so we can use doc/publish as the source for the
# publisher step.
mkdir -p doc/publish
if [[ ! -z "$tag" ]]; then
    # We will have already moved the content inside
    # a directory named for the tag, so we move that
    # directory to the publish location.
    mv $DOCBUILD/html/$tag doc/publish/
elif [[ $branch_name = master ]]; then
    # The above tasks does not rename the output directory, but
    # we want it to be called "latest".
    mv $DOCBUILD/html doc/publish/latest
elif [[ $branch_name =~ stable/ ]]; then
    # a directory named for the branch, so move that to the
    # publish location.
    mv $DOCBUILD/html/$(basename $branch_name) doc/publish/
elif [[ $branch_name =~ feature/ ]]; then
    echo "Docs should not be published for feature branches"
    exit 1
elif [[ $branch_name =~ driverfixes/ ]]; then
    exit 1
else
    # What is this even?
    echo "Could not determine publishing location for branch_name $branch_name"
    exit 1
fi
# Move back into doc/build/html for artifact publisher.
rm -rf $DOCBUILD/html
mv doc/publish $DOCBUILD/html

mv {{ doc_build_dir }}/tmp
  {{ doc_build_dir }}/html/{{ zuul.branch | replace('stable/', '') }}

mv {{ doc_build_dir }}/tmp {{ doc_build_dir }}/html/{{ zuul.tag }}

Project: {{ zuul.project.name }} Tag: {{ zuul.tag }} Build: {{ zuul.build }} Revision: {{ zuul.ref }}

zuul.branch is defined and 'stable' in zuul.branch and zuul.tag is not defined

zuul.branch is defined and zuul.branch != 'master' and 'stable' not in zuul.branch and zuul.tag is not defined

/opt/cache/files/zanata-cli-{{ zanata_client_version }}-dist.tar.gz

/opt/zanata/zanata-cli-{{ zanata_client_version }}/bin/zanata-cli

https://search.maven.org/remotecontent?filepath=org/zanata/zanata-cli/{{ zanata_client_version }}/zanata-cli-{{ zanata_client_version }}-dist.tar.gz

Project: {{ zuul.project.name }} Branch: {{ zuul.branch | default('') }} Build: {{ zuul.build }} Revision: {{ zuul.ref }}

/opt/zanata/zanata-cli-{{ zanata_client_version }}/bin/zanata-cli --version

ansible_selinux.status == "enabled" and ansible_selinux.mode in ["enforcing", "permissive"]

{% if 'source' in item and item.source == 'localhost' %}{{ localhost_ip }}{% else %}{{ item.source|default(omit) }}{% endif %}

{% if ('source' in item and item.source|ipv6) or force_ipv6  %}ipv6{% else %}ipv4{% endif %}

rule {% if 'source' in item %}
  family="{% if item.source|ipv6 or force_ipv6 %}ipv6{% else %}ipv4{% endif %}"
  source address="{% if item.source == 'localhost' %}{{ localhost_ip }}{% else %}{{ item.source }}{% endif %}"
{% elif force_ipv6 %}
  family="ipv6"
{% endif %}
  port protocol="{{ item.protocol }}" port="{{ item.port }}" accept

su apache -s /bin/bash -c "/usr/bin/graphite-manage syncdb --noinput"

htpasswd -b {{ kibana_proxy_htpasswd }} \ {{ item['username'] }} {{ item['password'] }}

(database_host == 'localhost') or (database_host == '127.0.0.1')

ansible_distribution == 'CentOS' and manage_repos|default(false)

manage_repos|default(false) and ansible_distribution != 'CentOS'

manage_repos|default(false) and ansible_distribution == 'CentOS'

repoquery --installed --whatprovides '{{ sensu_package_name }} <= {{ sensu_minimum_version }}'

cat $HOME/overcloudrc | grep {{ item.rc_param }} | sed -e 's/export.*=\(.*\)/\1/' | sed -e 's/\s*//'g

source ~/stackrc && openstack stack output show -f shell overcloud HostsEntry | grep overcloud.ctlplane.localdomain | awk '{print $1}' | head -n 1

ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null heat-admin@{{ controllerip.stdout }} "sudo awk 'BEGIN {PRINT=0;}{if( \$2 == \"haproxy.stats\") {PRINT=1;} else if ( PRINT==1 ) {if (\$1 == \"bind\") URI=\$2; if (\$1 == \"mode\") MODE=\$2;if (\$1 == \"stats\" && \$2 == \"auth\") USER=\$3; if (\$1 == \"listen\" ) { exit }} }END{ print MODE\"://\"URI\"\n\"USER}' /etc/haproxy/haproxy.cfg"

htpasswd -b {{ uchiwa_proxy_htpasswd }} \ {{ item['username'] }} {{ item['password'] }}

http://127.0.0.1:{{ couchdb_port }}/_config/admins/{{ couchdb_admin_user }}

{{ couchdb_backup_install_location }}/backup-{{ couchdb_backup_database }}.sh

{{ couchdb_lucene_local_checkout_path }}/target/couchdb-lucene-{{ couchdb_lucene_version_number }}-dist.tar.gz

{{ couchdb_lucene_local_package_directory }}/{{ couchdb_lucene_version_name }}.tar.gz

path={{ couchdb_lucene_local_package_directory }}/{{ couchdb_lucene_version_name }}.tar.gz

{{ couchdb_lucene_install_path }}/couchdb-lucene-{{ couchdb_lucene_version_number }}/conf/couchdb-lucene.ini

{{ couchdb_lucene_install_path }}/couchdb-lucene-{{ couchdb_lucene_version_number }}/bin/run

http://s3-eu-west-1.amazonaws.com/releases.dhis2.org/{{ dhis_version }}/dhis.war

{{ dhis_user_home }}/{{ dhis_tomcat_instance }}/webapps/ROOT.war

openssl dhparam -out {{ ssl_file_dir }}/dhparam.pem 2048 creates={{ ssl_file_dir }}/dhparam.pem

Open the OpenMRS initial setup page on https://{{ openmrs_site_name }}/{{ openmrs_install_name }}/initialsetup and follow these steps:

----------------------------------------------------------------------------------
On the first page:

Which language do you prefer? English

On the second page:

Which type of installation do you want? Advanced

On page labeled 'Step 1 of 5'

Please specify how to connect to your currently installed database server:
  Database connection: jdbc:mysql://{{ openmrs_mysql_host }}:{{ openmrs_mysql_port }}/@DBNAME@?autoReconnect=true&sessionVariables=default_storage_engine=InnoDB&useUnicode=true&characterEncoding=UTF-8&zeroDateTimeBehavior=convertToNull # noqa 204

Do you currently have an OpenMRS database installed that you would like to connect to? Yes
  If yes, what is the name of this database? {{ openmrs_mysql_database }}

On page labeled 'Step 2 of 5'

Do you need OpenMRS to automatically create the tables for your current database openmrs? Yes

Do you currently have a database user other than root that has read/write access to the openmrs database? Yes
  If yes, specify the log in user name and password for that database user:
    Username: {{ openmrs_mysql_user }}
    Password: {{ openmrs_mysql_password }}

On page labeled 'Step 3 of 5'

Do you want to be able to upload modules from the web interface? No

Do you want updates to the database to be automatically applied on startup when a new web application is deployed? Yes

On page labeled 'Step 4 of 5'

Currently the default administrator user/pass is admin:test. Please specify a new password for that user
  Password: {{ openmrs_admin_password }}
  Retype password: {{ openmrs_admin_password }}

Press ENTER when setup on the browser is done and you are redirected to the login page

{{ openmrs_home_directory }}/openmrs-runtime.propeties file doesn't exist on the server

SSH as {{ ansible_ssh_user }}@{{ ansible_ssh_host }}

Get the values of encryption.vector and encryption.key from {{ openmrs_home_directory }}/openmrs-runtime.properties
and copy them to these variables in your inventory:
 - encryption.vector to openmrs_encryption_vector variable
 - encryption.key to openmrs_encryption_key variable

Press ENTER when done adding the variables to the inventories

{{ openmrs_mysql_database }}.*:{{ openmrs_mysql_user_privilages }}

{{ openmrs_tomcat_user_home }}/{{ openmrs_tomcat_instance }}/webapps/{{ openmrs_install_name }}.war

{{ openmrs_tomcat_user_home }}/{{ openmrs_tomcat_instance }}/webapps/{{ openmrs_install_name }}

Please make sure openmrs_encryption_vector and openmrs_encryption_key are set.
Check the {{ openmrs_home_directory }}/openmrs-runtime.properties file currently
in the server if these variables are not yet set in the inventories.

openmrs_require_encryption and (openmrs_encryption_vector|length == 0 or openmrs_encryption_key|length == 0)

{{ openmrs_tomcat_user_home }}/{{ openmrs_tomcat_instance }}/conf/logging.properties

{{ opensrp_local_checkout_path }}/configs/assets/config/{{ item }}.properties

{{ opensrp_local_checkout_path }}/src/main/resources//{{ item }}.properties

{{ opensrp_local_checkout_path }}/src/main/resources/spring/{{ item }}.xml

{{ opensrp_local_checkout_path }}/src/main/webapp/META-INF/{{ item }}.xml

cd {{ opensrp_local_checkout_path }} && mvn package -Dmaven.test.skip=true -P {{ opensrp_maven_package_profiles | join(',') }}

path={{ opensrp_local_package_directory }}/{{ opensrp_version }}.war

{{ opensrp_user_home }}/{{ opensrp_tomcat_instance }}/webapps/{{ opensrp_install_name }}.war

{{ opensrp_user_home }}/{{ opensrp_tomcat_instance }}/webapps/{{ opensrp_install_name }}

{{ opensrp_user_home }}/{{ opensrp_tomcat_instance }}/webapps/opensrp/WEB-INF

{{ opensrp_mysql_privilages_joiner.join(opensrp_mysql_databases) }}.*:{{ opensrp_mysql_user_privilages }}

{{ opensrp_local_checkout_path }}/configs/assets/migrations/environments/{{ opensrp_mybatis_env }}.properties

{{ opensrp_mybatis_install_dir }}/mybatis-migrations-{{ opensrp_mybatis_version }}/bin/migrate up --path={{ opensrp_local_checkout_path }}/configs/assets/migrations --env={{ opensrp_mybatis_env }} {{ opensrp_mybatis_migration_extra_args }}

software-properties-common={{ oracle_java8_software_properties_common_version }}

tomcat7-instance-create -p {{ tomcat_http_port }} -c {{ tomcat_shutdown_port }} {{ tomcat_instance }}

test -e /usr/bin/python3 || (sudo apt -y update && sudo apt install -y python3-minimal)

set -euox
{{ ansible_python.executable }} -m pip install --user 'tox>=3.8.0'
{{ ansible_python.executable }} -m tox --version

set -euox pipefail
dnf -y install epel-release yum-utils
yum-config-manager --enable epel

# This builder, when run from a child job of validate-buildsys-tags
# configures the temporary repositories created by it
# This allows to install the packages in that repository and test
# them.
set +e -x
# This job requires variable 'release' to be defined.

if [ -z "{{ release|default("") }}" ]; then
    echo "ERROR in job definition"
    exit 1
fi

logs={{ buildset_artifacts_url|default("") }}

# If we could not find a working repository, give up
curl -o /dev/null -sIf "${logs}" || exit 1

# Use the latest repository hash
# If DLRN built multiple packages, there will be multiple repositories.
# We want the latest repository which contains all of the packages that were just built.
repository="${logs}/centos/current"

# The rdoinfo-DLRN-check job may create different repos (centos-rpm-master, centos-pike-rdo)
# when it builds packages for more than one release. In that case, let us try to find the
# right one
curl -o /dev/null -sIf "${repository}"
if [ $? -ne 0 ]; then
  releases="rpm-master train-rdo stein-rdo rocky-rdo queens-rdo"
  for release in $releases; do
      repository="${logs}/centos-${release}/current"
      curl -o /dev/null -sIf "${repository}" || continue
      break
  done
fi

curl -o /dev/null -sIf "${repository}" || exit 1
echo ${repository}

# them.
set +e -x
# This job requires variables 'rdoinfo_release' and 'rdoinfo_phase' to be defined.

REQUIRED=0
CREPOS_FILE=changed_repos.txt

if [ -z "{{ rdoinfo_phase|default("") }}" -o -z "{{ rdoinfo_release|default("") }}" ]; then
    exit 1
fi

# Set log path
if [ -z "{{ buildset_artifacts_url|default("") }}" ]; then
    echo "buildset_artifacts_url is not defined, job needs to be run with parent job:- validate-buildsys-tags"
    exit 1
fi
logs={{ buildset_artifacts_url }}

curl -o $CREPOS_FILE -sf "$logs/repos/changed_repos.txt" || exit 1

if ! grep -q -E "{{ rdoinfo_release }}-{{ rdoinfo_phase }}" $CREPOS_FILE; then
    echo "INFO: this test is not required"| tee not_required
    exit 0
fi

Rename CloudSIG repos name to include delorean in name as build-containers role rely on it

set -ex
# due to https://review.opendev.org/#/c/692513/
sed -i 's/gpgcheck.*/gpgcheck=0/' /etc/yum.repos.d/CentOS-OpenStack-{{ rdoinfo_release }}.repo
mv /etc/yum.repos.d/CentOS-OpenStack-{{ rdoinfo_release }}.repo /etc/yum.repos.d/delorean-CentOS-OpenStack-{{ rdoinfo_release }}.repo
mv /etc/yum.repos.d/CentOS-Ceph-Nautilus.repo /etc/yum.repos.d/delorean-CentOS-Ceph-Nautilus.repo
# Need to include delorean-current repo while building container
curl -o /etc/yum.repos.d/delorean-current.repo https://trunk.rdoproject.org/centos7-{{ rdoinfo_release }}/current/delorean.repo
echo "includepkgs=ansible-role-container-registry,ansible-role-tripleo*,ansible-tripleo-ipsec,instack,instack-undercloud,openstack-tripleo-*,os-apply-config,os-collect-config,os-net-config,os-refresh-config,puppet-*,python*-tripleo*,python*-paunch*,paunch-services,tripleo-ansible,ansible-config_template " >> /etc/yum.repos.d/delorean-current.repo # noqa 204

{{ ansible_user_dir }}/{{ zuul.projects['opendev.org/openstack/python-tripleoclient'].src_dir }}

cloud{{ ansible_distribution_major_version }}-openstack-{{ rdoinfo_release }}-{{ rdoinfo_phase }}

cloud{{ ansible_distribution_major_version }}-openstack-ussuri-{{ rdoinfo_phase }}

{{ buildset_artifacts_url | default('') }}/repos/{{ buildsys_tag }}/temp-{{ buildsys_tag }}.repo

# them.
set +e -x

    exit 1
fi

if [ "{{ rdoinfo_release }}" = "master" ]; then
    RELEASE="{{ master_release }}"
else
    RELEASE="{{ rdoinfo_release }}"
fi

# Re-construct the expected repository URL
ZUUL_REF=$(echo $ZUUL_REF |cut -f4 -d /)
job="validate-buildsys-tags"
LOG_PATH="$BASE_LOG_PATH/$ZUUL_PIPELINE/$job/$ZUUL_REF"
logs="https://logserver.rdoproject.org/$LOG_PATH/"

# NOTE(pabelanger): Override logs for zuulv3 jobs.
if [[ -d /home/zuul ]]; then
    logs={{ buildset_artifacts_url }}
fi

if ! grep -q -E "$RELEASE-{{ rdoinfo_phase }}" $CREPOS_FILE; then
    exit 0
fi

cloud{{ ansible_distribution_major_version }}-openstack-{{ master_release if rdoinfo_release == 'master' else rdoinfo_release }}-{{ rdoinfo_phase }}

{{ ansible_user_dir }}/{{ zuul.projects['opendev.org/openstack/tripleo-repos'].src_dir }}

http://{{ ipv4_addr }}/delorean.repo,http://{{ ipv4_addr }}/delorean-{{ rdoinfo_release }}-testing.repo

{{ false if rdoinfo_build_containers|default(false)|bool else true }}

{{ push_registry|default('127.0.0.1:8787') if rdoinfo_build_containers|default(false)|bool else omit }}

{{ ansible_user_dir }}/{{ zuul.projects['softwarefactory-project.io/DLRN'].src_dir }}/logs/

set +e
# Setup virtualenv with tox and use it
tox -epy36 --notest
. .tox/py36/bin/activate
# Use latest pymod2pkg from Git, to avoid waiting for new releases
pip install --upgrade git+https://opendev.org/openstack/pymod2pkg
# Prepare config
if [[ "{{ zuul.branch }}" =~ stable/ ]]; then    # stable branch
    repo_branch=$(sed "s#stable/##" <<< "{{ zuul.branch }}")
    baseurl="https://centos8-rpm-packaging-ci.rdoproject.org/$repo_branch/repos/"
    use_version_from_spec="1"
else
    # master
    baseurl="https://centos8-rpm-packaging-ci.rdoproject.org/repos/"
fi

repo="http://opendev.org/openstack/rpm-packaging"
directory="/openstack"
skip="openstack-macros"
pkginfo_driver="dlrn.drivers.gitrepo.GitRepoDriver"
branch="{{ zuul.branch }}"
target=centos8

# Update the configuration
sed -i "s%#repo=.*%repo=$repo%" projects.ini
sed -i "s%#directory=.*%directory=$directory%" projects.ini
sed -i "s%#skip=.*%skip=$skip%" projects.ini
sed -i "s%#use_version_from_spec=.*%use_version_from_spec=$use_version_from_spec%" projects.ini
sed -i "s%#keep_tarball=.*%keep_tarball=1%" projects.ini
sed -i "s%pkginfo_driver=.*%pkginfo_driver=$pkginfo_driver%" projects.ini
sed -i "s%baseurl=.*%baseurl=$baseurl%" projects.ini
sed -i "s%source=.*%source=$branch%" projects.ini
sed -i "s%distro=.*%distro=$branch%" projects.ini
sed -i "s%target=.*%target=$target%" projects.ini

# Prepare directories
mkdir -p data/repos

if [ -d "{{ ansible_user_dir }}/{{ zuul.projects['opendev.org/openstack/rpm-packaging'].src_dir }}" ]; then
  ln -s "{{ ansible_user_dir }}/{{ zuul.projects['opendev.org/openstack/rpm-packaging'].src_dir }}" data/package_info
else
  # We are outside the gate, just do a regular git clone
  pushd data/
  # rm -rf first for idempotency
  rm -rf package_info
  git clone "https://opendev.org/openstack/rpm-packaging" package_info
  cd package_info
  git checkout $branch
  popd
fi

# Find out which packages are being tested
pushd data/package_info
CHANGED_FILES=$(git diff --name-only --diff-filter=ACMTR HEAD~1)
PACKAGES_TO_BUILD=""
for spec in $CHANGED_FILES; do
  filename=$(echo $spec | awk -F/ '{print $NF}')
  extension=$(echo $filename | awk -F. '{print $NF}')
  if [ "$extension" = "j2" ]; then
      # Remove the .spec.j2 extension
      PACKAGES_TO_BUILD="$PACKAGES_TO_BUILD --package-name $(echo $filename | awk 'BEGIN{FS=OFS="."}{NF--; NF--; print}')"
  fi
done
popd
if [ ! -n "$PACKAGES_TO_BUILD" ]; then
  exit 0
fi

TIMEOUT="{{ zuul.timeout | default('10800') }}"
timeout --signal=SIGKILL $TIMEOUT dlrn --config-file projects.ini --head-only $PACKAGES_TO_BUILD --dev --local --verbose-build --sequential
ret=$?

mkdir -p logs
rsync -avzr data/repos logs/centos8
# Clean up mock cache, just in case there is a change for the next run
mock -r data/dlrn-1.cfg --scrub=all
exit $ret

{{ ansible_user_dir }}/{{ zuul.projects['softwarefactory-project.io/DLRN'].src_dir }}

set +e
# FIXME(jpena) some packages are moving to use singlespec, which
# requires an up to date openstack-macros package in the builder,
# and not just in the mock buildroot.
sudo yum -y install https://rpm-packaging-ci.rdoproject.org/repos/deps/openstack-macros-2019.1.1-0.20190225070246.ce6a105.el7.noarch.rpm
tox -epy27 --notest
. .tox/py27/bin/activate
    # We only support Ocata and later as stable repos
    if [ "$repo_branch" = "newton" ]; then
      exit 0
    fi
    baseurl="https://rpm-packaging-ci.rdoproject.org//$repo_branch/repos/"
else
    # master
    baseurl="https://rpm-packaging-ci.rdoproject.org//repos/"
fi

target=centos

else
  popd
fi

  fi
done
popd
  exit 0
fi

TIMEOUT="{{ zuul.timeout | default('5400') }}"
ret=$?

rsync -avzr data/repos logs/centos
exit $ret

BASE="http://{{ mirror_fqdn | default('mirror.centos.org') }}/centos"
sed -e "s|^#baseurl=http://mirror.centos.org/centos|baseurl=$BASE|;/^mirrorlist=/d" -i scripts/centos*.cfg # noqa 303
sed -e "s|^#baseurl=http://mirror.centos.org/\$contentdir|baseurl=$BASE|" -i scripts/centos*.cfg # noqa 303

export TAG="{{  tag | default('') }}"
export CENTOS_VERS="{{  centos_version | default('centos7') }}"
export REPO_SERVER="https://trunk.rdoproject.org"
export TARGET="centos"
if [ ${CENTOS_VERS} = "centos8" ]; then
   export PYTHON_VERSION="py36"
   export TARGET="centos8"
fi
#
if [ -z "$TAG" ];then
ARGS="$TARGET ${REPO_SERVER}/${CENTOS_VERS}/"
else
ARGS="$TARGET ${REPO_SERVER}/${CENTOS_VERS}/ $TAG"
fi
if [[ "{{ zuul.pipeline }}" =~ "openstack-" ]]; then
    ARGS=""
fi
./scripts/run_tests.sh {{ ansible_user_dir }}/{{ zuul.projects['review.rdoproject.org/rdoinfo'].src_dir }} $ARGS

{% set comma = joiner('^') %} {% for chg in zuul['items'] %}{{ comma() }}{{ chg.project.name }}:{{ chg.branch }}:{{ chg.change_url }}{% endfor %}

ansible_distribution == "CentOS" and ansible_distribution_major_version|int >= 8

set +e
# This builder, when run from a child job of a DLRN based job,
# will rebuild and test installation of a src.rpm, when built
# using the repository configuration used by Tripleo CI jobs.
# This ensures that we are not breaking the TripleO gates with a
# packaging change.
#

CENTOS_VERS="{{ centos_version | default('centos7') }}"

if [ "$CENTOS_VERS" = "centos7" ]; then
  repository="${logs}/centos/current"
  mock_cfg=centos.cfg
else
  repository="${logs}/centos8/current"
  mock_cfg=centos8.cfg
fi

# Fetch all src.rpm files, we will rebuild them here
wget -e robots=off -nd -r --accept .src.rpm $repository

# Create mock config file
if [[ "{{ zuul.branch }}" =~ -rdo ]]; then
    branch=$(sed "s/-rdo//" <<< "{{ zuul.branch }}")
else
    branch="master"
fi
baseurl="https://trunk.rdoproject.org/${CENTOS_VERS}-${branch}/"

# Fetch base mock configuration, we will update it to match TripleO requirements
cp "{{ ansible_user_dir }}/{{ zuul.projects['softwarefactory-project.io/DLRN'].src_dir }}/scripts/${mock_cfg}" .
# Remove the last line, then add all required repos
sed -i '$ d' ${mock_cfg}
# current
if [ "$CENTOS_VERS" = "centos7" ]||[ "$CENTOS_VERS" = "centos8" -a "{{ zuul.branch }}" = "train-rdo" ]; then
  curl -o /tmp/delorean-current.repo  ${baseurl}/current/delorean.repo
  sed -i 's/priority=.*/priority=10/' /tmp/delorean-current.repo
  sed -i 's/\[delorean\]/\[delorean-current\]/' /tmp/delorean-current.repo
  echo >> /tmp/delorean-current.repo
  echo "includepkgs=ansible-role-container-registry,ansible-role-tripleo*,ansible-tripleo-ipsec,diskimage-builder,\
instack,instack-undercloud,os-apply-config,os-collect-config,os-net-config,os-refresh-config,openstack-tripleo-*,\
python*-tripleo*,puppet-*,python*-paunch*,paunch-services,tripleo-ansible,\
ansible-config_template" >> /tmp/delorean-current.repo
else
  curl -o /tmp/delorean-current.repo  ${baseurl}/component/tripleo/current/delorean.repo
  sed -i 's/\[delorean-component-tripleo\]/\[delorean-current\]/' /tmp/delorean-current.repo
fi
cat /tmp/delorean-current.repo >> ${mock_cfg}
echo >> ${mock_cfg}
# current-tripleo
curl -o /tmp/delorean-current-tripleo.repo  ${baseurl}/current-tripleo/delorean.repo
sed -i 's/priority=.*/priority=20/' /tmp/delorean-current-tripleo.repo
sed -i 's/\[delorean\]/\[delorean-current-tripleo\]/' /tmp/delorean-current-tripleo.repo
cat /tmp/delorean-current-tripleo.repo >> ${mock_cfg}
# deps
curl ${baseurl}/delorean-deps.repo >> ${mock_cfg}
echo '"""' >> ${mock_cfg}
# Build package
OUTPUT_DIRECTORY="$PWD/build"
mkdir $OUTPUT_DIRECTORY
MOCKOPTS="-v -r ${mock_cfg} --resultdir $OUTPUT_DIRECTORY"
ret=0
/usr/bin/mock ${MOCKOPTS} --rebuild *.src.rpm 2>&1
RC_BUILD=$?
if [ $RC_BUILD -ne 0 ]; then
  ret=$RC_BUILD
else
  sed -i "s/.*chroot_setup_cmd.*/config_opts['chroot_setup_cmd'] = 'install basesystem rpm-build'/" ${mock_cfg}
  sed -i '/^python3/ d' ${mock_cfg}
  /usr/bin/mock ${MOCKOPTS} --disablerepo='*-build-deps' clean 2>&1
  /usr/bin/mock ${MOCKOPTS} --disablerepo='*-build-deps' init 2>&1
  /usr/bin/mock ${MOCKOPTS} --disablerepo='*-build-deps' --install $OUTPUT_DIRECTORY/*[!src].rpm 2>&1
   RC_INSTALL=$?
   if [ $RC_INSTALL -ne 0 ]; then
       ret=$RC_INSTALL
   fi
fi
# Retrieve logs/repositories/packages
mkdir buildset
cp -a ${OUTPUT_DIRECTORY}/* buildset/
exit $ret

(ansible_distribution == "CentOS" and ansible_distribution_major_version|int >= 8) or (ansible_distribution == "RedHat" and ansible_lsb.major_release|int >= 8)

"invalid username/password" in registry_login_podman.results.0.stdout

Role failed authentication for {{ registry_login_podman.results.0 }}.

echo "[DEBUG]: JJB template name: {template-name}"

# If this is called in a periodic job, these will not be set
echo "Use default for ZUUL_BRANCH and ZUUL_REF if needed"
export ZUUL_BRANCH=${ZUUL_BRANCH:-master}
export ZUUL_REF=${ZUUL_REF:-None}

# In the post pipeline ZUUL_REF is master but does not behave as we want
# So fall back on None
[ "$ZUUL_REF" = "master" ] && ZUUL_REF=None
echo "Clean workspace"
rm -Rf ./*

echo "Clone $ZUUL_PROJECT"
# zuul-cloner is installed as /usr/zuul-env/bin/zuul-cloner
# in upstream images
export PATH=$PATH:/usr/zuul-env/bin

# Note (dmsimard): If we are running for a periodic job, there is no
# incentive in using Zuul cloner because the jobs are not going to
# potentially depend on things from the zuul context (ex: depends-on)
# The zuul git namespace (where the job was triggered from) is also
# wonky for periodic jobs. A periodic pipeline targetted at an
# upstream project would still end up trying to clone from review.rdo.
# This should be revisited in Zuul v3 which is supposedly not a
# problem

# We can receive reviews from review.openstack.org.
# Builds that are run as third party for review.o.o are in the Zuul
# pipelines prefixed by "openstack-".
GIT_SOURCE="https://review.rdoproject.org/r"
if [[ "${ZUUL_PIPELINE}" =~ "openstack-" ]]; then
    GIT_SOURCE="https://opendev.org"
fi

git config --global http.postBuffer 524288000
git config --global https.postBuffer 524288000

if [[ "${ZUUL_PIPELINE}" =~ "periodic" ]]; then
# Note (trown): we need to make sure we clone this to the same
# location as zuul-cloner will so that manual and periodic jobs
# can share builders
    git clone --depth=1 $GIT_SOURCE/$ZUUL_PROJECT $ZUUL_PROJECT
else
    /usr/zuul-env/bin/zuul-cloner -v $GIT_SOURCE $ZUUL_PROJECT
fi

set +e
mkdir $WORKSPACE/logs

sudo yum -y install rubygems
gem install asciidoctor

pushd $ZUUL_PROJECT
~/bin/asciidoctor -v -b html5 *.txt -D $WORKSPACE/logs
popd

set -e
sudo yum -y install rpm-build rpmdevtools centos-release-opstools centos-release-openstack-queens
sudo yum -y groupinstall "Development Tools"
cat << EOF | sudo tee /etc/yum.repos.d/opstools-build.repo
[centos-opstools-perfmon-testing]
name=CentOS-7 - OpsTools Performance monitoring - testing repo
baseurl=http://cbs.centos.org/repos/opstools7-perfmon-common-testing/\$basearch/os
gpgcheck=0
enabled=1

[centos-opstools-sensu-testing]
name=CentOS-7 - OpsTools availability monitoring - testing repo
baseurl=http://cbs.centos.org/repos/opstools7-sensu-common-testing/\$basearch/os
enabled=1

[centos-opstools-sensu-027-testing]
name=CentOS-7 - OpsTools availability monitoring - sensu 0.27 testing repo
baseurl=http://cbs.centos.org/repos/opstools7-sensu-027-testing/\$basearch/os
enabled=1

[centos-opstools-sensu-110-testing]
name=CentOS-7 - OpsTools availability monitoring - sensu 1.1.x testing repo
baseurl=http://cbs.centos.org/repos/opstools7-sensu-110-testing/\$basearch/os
enabled=1

[centos-opstools-common-testing]
name=CentOS-7 - OpsTools common testing
baseurl=http://cbs.centos.org/repos/opstools7-common-testing/\$basearch/os
enabled=1

[centos-opstools-fluent-testing]
name=CentOS-7 - OpsTools fluentd testing
baseurl=http://cbs.centos.org/repos/opstools7-fluentd-012-testing/\$basearch/os
enabled=1
EOF

sudo yum -y update
base=`basename $ZUUL_PROJECT`
if [ -f "$base.spec" ]; then
   specfile="$base.spec"
else
   num_spec=`ls -l *.spec | wc -l`
   if [ ${num_spec} -eq 1 ]; then
     specfile=`ls *.spec`
   else
     echo "** ERROR: There are more than one spec file"
     exit 1
   fi
fi
spectool -g  "$specfile"
sudo yum-builddep -y "$specfile"
rpmbuild -D '_sourcedir '$PWD -D '_specdir '$PWD -D '_topdir '$PWD -ba "$specfile"
# move built rpms to logs for later use
mv SRPMS/* $WORKSPACE/logs
mv RPMS/* $WORKSPACE/logs
popd

set -e
sudo yum -y install rpmlint
else
   else
     exit 1
   fi
fi
rpmlint "$specfile"
popd

set -e
if [ $(grep -c ^CentOS /etc/system-release) -eq 0 ]; then
    PYTHON_VERSION='python3'
    sudo dnf remove -y yum-utils
    sudo dnf install -y createrepo_c dnf-utils fedora-packager
else
    # For CentOS we need to use yum4 repo to use dnf libraries.
    PYTHON_VERSION='python2'
    sudo yum -y install /usr/bin/yum4
    sudo yum4 -y install dnf-plugins-core
    sudo yum -y install createrepo_c centos-packager
fi
virtualenv -p $PYTHON_VERSION --system-site-packages .venv
source .venv/bin/activate
pip install .
# enable debug
set -x
if [ -d functional_tests ]; then
    pushd functional_tests
    for i in $(ls -d scenario*); do
        pushd $i
        OUTPUT_DIR=$(grep output_dir fedora_config | cut -d= -f2 | tr -d '[:space:]')
        rm -rf $OUTPUT_DIR
        mkdir -p $OUTPUT_DIR
        if [ -f comps*xml ];then
            cp comps*xml $OUTPUT_DIR
        fi
        echo "INFO: Running synchronization using sinkhole"
        sinkhole --config fedora_config config_file
        echo "INFO: List of synchronized packages"
        sudo repoquery --repofrompath=temp,file://${OUTPUT_DIR} --disablerepo='*' --enablerepo=temp -q -a
        if [ -f expected_packages ];then
            cat expected_packages|while read pkg
            do
                echo "INFO: checking if $pkg is in the repo"
                sudo repoquery --repofrompath=temp,file://${OUTPUT_DIR} --disablerepo='*' --enablerepo=temp -q $pkg | grep -q -w $pkg
            done
        fi
        popd
    done
    popd
fi
popd

set -e
rm -Rf config build
# in nodepool images
zuul-cloner http://gerrit/r config
# Prepare a default configuration for zuul and nodepool
mkdir -p build/nodepool build/zuul build/repoxplorer
cp ~jenkins/defconf/zuul.conf build/zuul/zuul.conf
cp ~jenkins/defconf/nodepool.yaml build/nodepool/_nodepool.yaml
cp ~jenkins/defconf/repoxplorer.py build/repoxplorer/config.py
# Prepare a fake jenkins-job config file to force offline jobs check
echo -e "[jenkins]\nurl=http://localhost:99" > build/jenkins.ini

cd config
echo "[+] Checking jobs"
jenkins-jobs --conf ../build/jenkins.ini test jobs/ > /dev/null

echo "[+] Checking jobs-zuul"
jenkins-jobs --conf ../build/jenkins.ini test jobs-zuul/ > /dev/null

echo "[+] Checking zuul"
/usr/share/sf-config/scripts/yaml-merger.py zuul | tee ../build/zuul/layout.yaml
cp zuul/*.py ../build/zuul/ || true
zuul-server -c ../build/zuul/zuul.conf -l ../build/zuul/layout.yaml -t

echo "[+] Checking nodepool [v2]"
/usr/share/sf-config/scripts/sf-nodepool-conf-merger.py nodepool/nodepool.yaml ../build/nodepool/nodepool.yaml v2
nodepool -c ../build/nodepool/nodepool.yaml config-validate

if [ -f /usr/bin/nodepool3 ]; then
    echo "[+] Checking nodepool [v3]"
    echo -e "---\n{}" > ../build/nodepool/_nodepool.yaml
    /usr/share/sf-config/scripts/sf-nodepool-conf-merger.py nodepoolV3/nodepool.yaml ../build/nodepool/nodepool.yaml v3
    nodepool3 -c ../build/nodepool/nodepool.yaml config-validate
fi

echo "[+] Checking gerrit replication"
git config -f gerrit/replication.config -l > /dev/null

echo "[+] Checking gerrit commentlinks"
python -c "import yaml; 'commentlinks' in yaml.safe_load(open('gerrit/commentlinks.yaml'))"

echo "[+] Check dashboards"
sf-update-dashboard --check --input dashboards/

echo "[+] Checking syntax errors in policy file"
python -c "import yaml; yaml.safe_load(open('policies/policy.yaml'))"

if [ -f /usr/bin/repoxplorer-config-validate ]; then
    echo "[+] Checking syntax errors in repoxplorer definition files"
    repoxplorer-config-validate --config ../build/repoxplorer/config.py
fi

echo "[+] Checking resources changes"
# Managesf validate can now use directly the local clone
unset ZUUL_REF
unset ZUUL_URL
/usr/local/bin/resources.sh validate

set +e
cd $ZUUL_PROJECT
sudo pip install -r test-requirements.txt
python sanity-check.py

set -e
echo "[+] Updating configuration using $ZUUL_COMMIT"
ssh root@install-server sf_configrepo_update $ZUUL_COMMIT

mkdir -p $WORKSPACE/logs
cp -a /tmp/kolla $WORKSPACE/logs/

# Ensure permissions allow artifact uploading
sudo chown -R "$(id -u).$(id -g)" $WORKSPACE/logs

set -e
set -x
cat > clonemap.yaml << EOF
clonemap:
  - name: openstack-infra/devstack-gate
    dest: devstack-gate
EOF
/usr/zuul-env/bin/zuul-cloner -m clonemap.yaml --cache-dir /opt/git \
    https://opendev.org \
    openstack-infra/devstack-gate

git clone https://review.rdoproject.org/r/p/rdo-infra/ci-config.git $WORKSPACE/rdo-infra/ci-config

cat <<EOF | sudo tee /etc/nodepool/provider
NODEPOOL_PROVIDER="{{ nodepool.provider }}"
NODEPOOL_CLOUD="{{ nodepool.cloud }}"
NODEPOOL_REGION="{{ nodepool.region }}"
NODEPOOL_AZ="{{ nodepool.az }}"
EOF

export RELEASE=master
export PROMOTE_NAME=tripleo-ci-testing
bash -xe $WORKSPACE/rdo-infra/ci-config/ci-scripts/tripleo-upstream/get-hash.sh

bash -xe $WORKSPACE/rdo-infra/ci-config/ci-scripts/tripleo-upstream/build-containers-images.sh

boostrap-subnodes - warning {{ ceph_loop_device }} already exists

dd if=/dev/zero of={{ ceph_loop_device_file }} bs=1 count=0 seek=7G
losetup {{ ceph_loop_device }} {{ ceph_loop_device_file }}
lsblk

set -e -x
if [ "{{ zuul.branch }}" == master ]; then
  export RELEASE=master
else
  export RELEASE=$(echo "{{ zuul.branch }}" | cut -d/ -f 2)
fi
sudo yum -y install libguestfs-tools policycoreutils-python wget
sudo wget -O /etc/yum.repos.d/delorean.repo https://trunk.rdoproject.org/centos7-${RELEASE}/current/delorean.repo
sudo wget -O /etc/yum.repos.d/delorean-deps.repo https://trunk.rdoproject.org/centos7-${RELEASE}/delorean-deps.repo
# NOTE(jpena): python36-distro, a mock requirement, conflicts with python2-distro
sudo yum -y remove python36-distro
sudo yum -y install openstack-octavia-diskimage-create
# NOTE(cgoncalves): Starting from Train release, CentOS amphora
# images are built using the centos-minimal DIB element. This element
# builds the base system in a chroot, whereas the centos DIB element
# used in previous releases uses a pre-existing qcow image.
if [[ "$RELEASE" =~ (queens|rocky|stein) ]]; then
  export IMAGE_NAME=CentOS-7-x86_64-GenericCloud.qcow2
  wget https://cloud.centos.org/centos/7/images/$IMAGE_NAME
  sudo systemctl start libvirtd
  sudo LIBGUESTFS_BACKEND_SETTINGS=force_tcg LIBGUESTFS_BACKEND=direct \
      virt-customize -a $IMAGE_NAME --selinux-relabel --run-command \
      "yum-config-manager --add-repo https://trunk.rdoproject.org/centos7-${RELEASE}/delorean-deps.repo"
      "yum-config-manager --add-repo https://trunk.rdoproject.org/centos7-${RELEASE}/current-passed-ci/delorean.repo"
  export DIB_LOCAL_IMAGE=$PWD/$IMAGE_NAME
else
  mkdir $PWD/rdo-repos
  cp /etc/yum.repos.d/delorean.repo /etc/yum.repos.d/delorean-deps.repo $PWD/rdo-repos/
  export DIB_YUM_MINIMAL_EXTRA_REPOS=$PWD/rdo-repos
fi
sudo --preserve-env=DIB_LOCAL_IMAGE,DIB_YUM_MINIMAL_EXTRA_REPOS \
    /usr/bin/octavia-diskimage-create.sh -s 3 -p -i centos -o amphora-x64-haproxy-centos.qcow2
# Create output directory
mkdir -p images/$RELEASE
if [ -f amphora-x64-haproxy-centos.qcow2 ]; then
    curdate=$(date +%Y%m%d-%H%M%S)
    mv amphora-x64-haproxy-centos.qcow2 images/${RELEASE}/amphora-x64-haproxy-centos-$curdate.qcow2
    pushd images/${RELEASE}
    ln -s amphora-x64-haproxy-centos-$curdate.qcow2 amphora-x64-haproxy-centos.qcow2
    popd
fi

{{ ansible_user_dir }}/{{ zuul.projects['github.com/containers/libpod'].src_dir }}/build/buildset/

set -x
dnf config-manager --enable rhui-*
dnf makecache
dnf repolist
rpm -qa | grep rhui

{{ ansible_user_dir }}/{{ zuul.projects['github.com/containers/libpod'].src_dir }}/build/buildset

set -euo pipefail
make package-install
podman version
podman info  --log-level debug

{{ ansible_user_dir }}/{{ zuul.projects['github.com/containers/libpod'].src_dir }}

"fatal: The remote end hung up unexpectedly" not in result.stdout

set -exuo pipefail
mkdir -p build/buildset
pushd build/buildset
cp -l ~/rpmbuild/RPMS/*/*.rpm .
createrepo .
popd

if [ -f Modulefile -o -f metadata.json ]; then
  if [ -f Modulefile ]; then
    MODULE=$(awk '/^name/ {print $NF}' Modulefile |tr -d \"\')
  elif [ -f metadata.json ]; then
    MODULE=$(python -c 'import json;print json.load(open("metadata.json"))["name"]')
  fi
  if [ -z "$MODULE" ]; then
    echo "Module name not defined in Modulefile or metadata.json"
  else
    mkdir -p "$MODULE"
    rsync -a --exclude="$MODULE" --exclude ".*" . "$MODULE"
    cd "$MODULE"
  fi
fi
if [ -f Gemfile ]; then
  mkdir .bundled_gems
  export GEM_HOME=`pwd`/.bundled_gems
  gem install bundler --version 1.17.3 --no-rdoc --no-ri --verbose
  gem install rake --version '< 13.0.0'
  $GEM_HOME/bin/bundle install --without system_tests
  $GEM_HOME/bin/bundle exec rake lint 2>&1
else
  rake lint 2>&1
fi

export LANG=en_US.UTF-8
export PUPPET_GEM_VERSION='~> 3.8.0'
mkdir .bundled_gems
export GEM_HOME=`pwd`/.bundled_gems
gem install bundler --version 1.17.3 --no-rdoc --no-ri --verbose
gem install rake --version '< 13.0.0'
$GEM_HOME/bin/bundle exec rake spec SPEC_OPTS='--format documentation'

find . -iname *.pp | xargs puppet parser validate --modulepath=`pwd`/modules
for f in `find . -iname *.erb` ; do
  erb -x -T '-' $f | ruby -c
done

{{ ansible_user_dir }}/{{ zuul.projects['review.rdoproject.org/rdoinfo'].src_dir }}

set +e -x
virtualenv --system-site-packages .venv
. .venv/bin/activate
pip install rdopkg

CURRENT_MASTER_TAG="ussuri-uc"

PACKAGES_UPDATED_MASTER=""
PACKAGES_UPDATED_QUEENS=""
PACKAGES_UPDATED_ROCKY=""
PACKAGES_UPDATED_STEIN=""
PACKAGES_UPDATED_TRAIN=""

TAGS_DIFF=$(rdopkg info-tags-diff .)

while read line; do
    PKGNAME=$(awk '{print $1}' <<< $line)
    if [[ -n $(echo "$line" | grep -w $CURRENT_MASTER_TAG) ]]; then
        PACKAGES_UPDATED_MASTER="$PACKAGES_UPDATED_MASTER $PKGNAME"
    fi
    if [[ -n $(echo "$line" | grep -w train) ]]; then
        PACKAGES_UPDATED_TRAIN="$PACKAGES_UPDATED_TRAIN $PKGNAME"
    fi
    if [ "${CENTOS_VERS}" = "centos7" ]; then
        if [[ -n $(echo "$line" | grep -w stein) ]]; then
            PACKAGES_UPDATED_STEIN="$PACKAGES_UPDATED_STEIN $PKGNAME"
        fi
        if [[ -n $(echo "$line" | grep -w rocky) ]]; then
            PACKAGES_UPDATED_ROCKY="$PACKAGES_UPDATED_ROCKY $PKGNAME"
        fi
        if [[ -n $(echo "$line" | grep -w queens) ]]; then
            PACKAGES_UPDATED_QUEENS="$PACKAGES_UPDATED_QUEENS $PKGNAME"
        fi
    fi
done <<< "${TAGS_DIFF}"

pushd "{{ ansible_user_dir }}/{{ zuul.projects['softwarefactory-project.io/DLRN'].src_dir }}"
# Create log directory always
ret=0
if [ -n "${PACKAGES_UPDATED_MASTER}" ]; then
    timeout --signal=SIGKILL $TIMEOUT  {{ ansible_user_dir }}/rdoinfo-DLRN.sh $CURRENT_MASTER_TAG "${PACKAGES_UPDATED_MASTER}" "${CENTOS_VERS}"
    ret1=$?
    if [ $ret1 -ne 0 ]; then
        ret=$ret1
    fi
    # The data/ contents have been archived already, remove to avoid issues with the next branch
    rm -rf data
    sudo rm -rf /var/cache/mock/*
fi
if [ -n "${PACKAGES_UPDATED_TRAIN}" ]; then
    timeout --signal=SIGKILL $TIMEOUT {{ ansible_user_dir }}/rdoinfo-DLRN.sh train "${PACKAGES_UPDATED_TRAIN}" "${CENTOS_VERS}"
    ret1=$?
        ret=$ret1
    fi
    rm -rf data
fi
if [ -n "${PACKAGES_UPDATED_STEIN}" ]; then
    timeout --signal=SIGKILL $TIMEOUT {{ ansible_user_dir }}/rdoinfo-DLRN.sh stein "${PACKAGES_UPDATED_STEIN}" "${CENTOS_VERS}"
    ret1=$?
        ret=$ret1
    fi
    rm -rf data
fi
if [ -n "${PACKAGES_UPDATED_ROCKY}" ]; then
    timeout --signal=SIGKILL $TIMEOUT {{ ansible_user_dir }}/rdoinfo-DLRN.sh rocky "${PACKAGES_UPDATED_ROCKY}" "${CENTOS_VERS}"
    ret1=$?
        ret=$ret1
    fi
    rm -rf data
fi
if [ -n "${PACKAGES_UPDATED_QUEENS}" ]; then
    timeout --signal=SIGKILL $TIMEOUT {{ ansible_user_dir }}/rdoinfo-DLRN.sh queens "${PACKAGES_UPDATED_QUEENS}" "${CENTOS_VERS}"
    ret1=$?
        ret=$ret1
    fi
    rm -rf data
fi
popd

exit $ret

set -e
# Need to inherit system-site-packages for python-yum
virtualenv --system-site-packages {{ ansible_user_dir }}/.venv
source {{ ansible_user_dir }}/.venv/bin/activate
pushd {{ ansible_user_dir }}/{{ zuul.projects['softwarefactory-project.io/rdopkg'].src_dir }}/
popd

set -e
rdopkg findpkg {{ zuul.project.name }} | sed -n "/^upstream/ s/upstream. \(.*\)/\1/p"

set -e
pushd {{ ansible_user_dir }}/{{ zuul.project.src_dir }}
git remote add upstream {{ upstream.stdout }}
git fetch upstream
rdopkg reqcheck --strict
popd

# configures the DLRN repository that was uploaded as an artifact
# of the parent DLRN-rpmbuild job.
# them.
set +ex

if [ $(echo {{ buildset_artifacts_url }}| grep -c centos8) -ne 0 ]; then
    repository="${logs}/centos8/current"
else
    repository="${logs}/centos/current"
fi

# right one
  releases="rpm-master train-rdo stein-rdo rocky-rdo queens-rdo pike-rdo ocata-rdo"
      break
  done
fi

# Configure the repository
name="delorean-zuul"
sudo bash -c "cat << EOF > /etc/yum.repos.d/${name}.repo
[${name}]
name=${name}
baseurl=${repository}
enabled=1
priority=1
EOF"

# This builder, when run from a child job of a DLRN based
# job, download the packages built from DLRN and compare
# rpmlint reports from the previously built packages.

# must be in sync with the previous builder (dlrn-gate-repository)
eval $(grep baseurl= < /etc/yum.repos.d/delorean-zuul.repo)

# download binary packages
wget -e robots=off -nd -r --accept .rpm --reject .src.rpm ${baseurl}
unset baseurl

# get the repo data from the previous repository
URL=https://trunk.rdoproject.org/centos7/current
eval $(curl $URL/delorean.repo|grep baseurl=)
wget $baseurl/repodata/repomd.xml

# extract the name of primary db from repomd.xml
db=$(python3 -c "import xml.etree.ElementTree as et; ns = {'ns0': 'http://linux.duke.edu/metadata/repo'}; \
  print(et.parse('repomd.xml').getroot().find('ns0:data[@type=\"primary_db\"]/ns0:location', ns).attrib['href'])")

# download this db to get the name of the rpm files
wget $baseurl/$db

db=$(basename $db .bz2)
bunzip2 $db.bz2

# our rpmlint config
cat > $HOME/.rpmlintrc <<EOF
from Config import *

addFilter("no-changelogname-tag")
addFilter("no-manual-page-for-binary")
addFilter("no-documentation")
addFilter("non-readable")

# vitrage-ui exceptions
addFilter("openstack-vitrage-ui.noarch: W: non-conffile-in-etc /etc/openstack-dashboard/enabled/_4140_admin_template_vitrage_panel.py.*")

# ironic exceptions
addFilter("openstack-ironic-common.noarch: E: non-standard-dir-perm /var/log/ironic 0?750L?")

# Exceptions for nova
addFilter("openstack-nova-common.noarch: W: obsolete-not-provided openstack-nova-cert")
addFilter("python-novajoin.noarch: W: non-standard-gid")
addFilter("python-novajoin.noarch: W: non-standard-uid")
addFilter("openstack-nova-compute.noarch: E: explicit-lib-dependency libvirt-client")

# Exception for tackerclient
addFilter("python-tackerclient-doc.noarch: W: file-not-utf8 /usr/share/doc/python-tackerclient-doc-.*/html/objects.inv")

# Exception for congress
addFilter("openstack-congress-common.noarch: E: non-standard-dir-perm /etc/congress/keys 0?750L?")

# Exception for mistral
addFilter("python-mistral.noarch: W: self-obsoletion python-openstack-mistral < 5.0.0-1 obsoletes python-openstack-mistral.*")
addFilter("openstack-mistral-common.noarch: E: non-standard-dir-perm /var/lib/mistral 0?750L?")

# Exception for cloudkitty
addFilter("openstack-cloudkitty-common.noarch: E: non-standard-dir-perm /var/log/cloudkitty 0750L?")

# Exception for puppet-tripleo
addFilter("puppet-tripleo.noarch: E: explicit-lib-dependency puppet-openstacklib")
addFilter("puppet-tripleo.noarch: E: explicit-lib-dependency puppet-stdlib")
addFilter("puppet-tripleo.noarch: E: non-executable-script \
/usr/share/openstack-puppet/modules/tripleo/templates/redis/redis-notifications.sh.erb 0644L /bin/bash")

# Exceptions for glance
addFilter("openstack-glance.noarch: E: non-standard-dir-perm /var/log/glance 0?750L?")
# The dangling-symlink exclusions are related to files from
# python-glance-store and python-os-brick.
addFilter("openstack-glance.noarch: \
W: dangling-symlink /etc/glance/rootwrap.d/glance_cinder_store.filters /usr/share/glance_store/glance_cinder_store.filters")
addFilter("openstack-glance.noarch: W: dangling-symlink /etc/glance/rootwrap.d/os-brick.filters /usr/share/os-brick/rootwrap/os-brick.filters")

# Exceptions for puppet-ceph
addFilter("puppet-ceph.noarch: E: explicit-lib-dependency puppet-openstacklib")
addFilter("puppet-ceph.noarch: E: explicit-lib-dependency puppet-stdlib")
addFilter("puppet-ceph.noarch: E: non-executable-script /usr/share/openstack-puppet/modules/ceph/setup.py 0644L /usr/bin/env")

# Exceptions for horizon
addFilter("python-django-horizon.noarch: E: non-executable-script \
/usr/lib/python2.7/site-packages/openstack_auth/tests/run_tests.py 0644L /usr/bin/env")
addFilter("python-django-horizon.noarch: E: zero-length /usr/lib/python2.7/site-packages/openstack_auth/tests/models.py")

# Exceptions for ceilometer
addFilter("openstack-ceilometer-common.noarch: W: obsolete-not-provided openstack-ceilometer-api")

# Exceptions for kuryr
# Following error only-non-binary-in-usr-lib has been fixed in recent rpmlint versions not in CentOS yet.
addFilter("openstack-kuryr-kubernetes-cni.noarch: W: only-non-binary-in-usr-lib")

# Exceptions for heat
addFilter("openstack-heat-common.noarch: W: obsolete-not-provided openstack-heat-api-cloudwatch")
addFilter("openstack-heat-common.noarch: E: explicit-lib-dependency python2-neutron-lib")

# Exceptions for neutron-tempest-plugin
addFilter("python2-neutron-tests-tempest.noarch: \
W: self-obsoletion python2-networking-bgpvpn-tests-tempest obsoletes python2-networking-bgpvpn-tests-tempest*")

# Exceptions for telemetry-tempest-plugin
addFilter("python2-telemetry-tests-tempest.noarch: E: zero-length /usr/lib/python2.7/site-packages/telemetry_tempest_plugin/gnocchi/__init_.py")
addFilter("\w+.*-tests-tempest.noarch: W: obsolete-not-provided \w+.*-tests")

# Exceptions for os-xenapi
addFilter("python2-os-xenapi.noarch: E: non-executable-script /usr/lib/python2.7/site-packages/os_xenapi/utils/himn.py 0644L /usr/bin/env")
addFilter("python2-os-xenapi.noarch: E: non-executable-script /usr/lib/python2.7/site-packages/os_xenapi/utils/iptables.py 0644L /usr/bin/env")
addFilter("python2-os-xenapi.noarch: E: non-executable-script \
/usr/lib/python2.7/site-packages/os_xenapi/utils/shell_tools/install_conntrack.sh 0644L /bin/bash")
addFilter("python2-os-xenapi.noarch: E: non-executable-script /usr/lib/python2.7/site-packages/os_xenapi/utils/xapi_plugin.py 0644L /usr/bin/env")
addFilter("python2-os-xenapi.noarch: E: non-executable-script /usr/lib/python2.7/site-packages/os_xenapi/utils/xenapi_facts.py 0644L /usr/bin/env")
addFilter("python2-os-xenapi.noarch: E: non-executable-script /usr/lib/python2.7/site-packages/os_xenapi/utils/consoles.py 0644L /usr/bin/env")

# Exceptions for openstack-tripleo-heat-templates-compat
addFilter("openstack-tripleo-heat-templates-compat.noarch: E: description-line-too-long \
C building Heat Templates to do deployments of OpenStack.  \
These templates provide support for the clouds running the previous upstream version of OpenStack.")
addFilter("openstack-tripleo-heat-templates-compat.noarch: E: non-executable-script \
/usr/share/openstack-tripleo-heat-templates/compat/ci/scripts/freeipa_setup.sh 0644L /bin/bash")
/usr/share/openstack-tripleo-heat-templates/compat/common/container-puppet.sh 0644L /bin/bash")
/usr/share/openstack-tripleo-heat-templates/compat/deployed-server/deployed-server-bootstrap-centos.sh 0644L /bin/bash")
/usr/share/openstack-tripleo-heat-templates/compat/deployed-server/deployed-server-bootstrap-rhel.sh 0644L /bin/bash")
addFilter("openstack-tripleo-heat-templates-compat.noarch: E: script-without-shebang \
/usr/share/openstack-tripleo-heat-templates/compat/deployed-server/deployed-server-bootstrap-centos.sh")
/usr/share/openstack-tripleo-heat-templates/compat/deployed-server/deployed-server-bootstrap-rhel.sh")
/usr/share/openstack-tripleo-heat-templates/compat/container_config_scripts/nova_statedir_ownership.py 0644L /usr/bin/env")
/usr/share/openstack-tripleo-heat-templates/compat/container_config_scripts/nova_wait_for_api_service.py 0644L /usr/bin/env")
/usr/share/openstack-tripleo-heat-templates/compat/container_config_scripts/nova_wait_for_compute_service.py 0644L /usr/bin/env")
/usr/share/openstack-tripleo-heat-templates/compat/container_config_scripts/pacemaker_restart_bundle.sh 0644L /bin/bash")
/usr/share/openstack-tripleo-heat-templates/compat/container_config_scripts/placement_wait_for_service.sh 0644L /usr/bin/env")
/usr/share/openstack-tripleo-heat-templates/compat/container_config_scripts/pyshim.sh 0644L /bin/bash")
/usr/share/openstack-tripleo-heat-templates/compat/extraconfig/post_deploy/clouds_yaml.py 0644L /usr/bin/env")
/usr/share/openstack-tripleo-heat-templates/compat/extraconfig/post_deploy/undercloud_ctlplane_network.py 0644L /usr/bin/env")
/usr/share/openstack-tripleo-heat-templates/compat/extraconfig/post_deploy/undercloud_post.py 0644L /usr/bin/env")
/usr/share/openstack-tripleo-heat-templates/compat/extraconfig/pre_deploy/rhel-registration/scripts/rhel-registration 0644L /bin/bash")
/usr/share/openstack-tripleo-heat-templates/compat/extraconfig/pre_deploy/rhel-registration/scripts/rhel-unregistration 0644L /bin/bash")
/usr/share/openstack-tripleo-heat-templates/compat/extraconfig/pre_deploy/undercloud_pre.sh 0644L /bin/bash")
/usr/share/openstack-tripleo-heat-templates/compat/puppet/deploy-artifacts.sh 0644L /bin/bash")
/usr/share/openstack-tripleo-heat-templates/compat/validation-scripts/all-nodes.sh 0644L /bin/bash")
/usr/share/openstack-tripleo-heat-templates/compat/environments/neutron-plumgrid.yaml")
/usr/share/openstack-tripleo-heat-templates/compat/environments/neutron-sriov.yaml")
C building Heat Templates to do deployments of OpenStack.  These templates provide support for the clouds \
running the previous upstream version of OpenStack.")
/usr/share/openstack-tripleo-heat-templates/compat/extraconfig/tasks/tripleo_upgrade_node.sh 0644L /bin/bash")

EOF

# now download all these packages from the previous repository
mkdir -p old
for fname in $(ls *.rpm); do
    name=$(rpm -qp --qf '%{NAME}\n' $fname)

    eval $(sqlite3 -line $db "select rpm_sourcerpm as srpm from packages where name = '$name' and arch != 'src';"|sed 's/ //g')
    sqlite3 -line $db "select location_href as pkgfile from packages where rpm_sourcerpm = '$srpm' and arch != 'src';"|sed 's/ //g' >> old_pkgs_list
done

cat old_pkgs_list |sort -u|grep -v ^$ > old_packages

# if there is no previous package, it means that is new
# packages so just run rpmlint on the packages and exit
if [ $(wc -l old_packages) -eq 0 ];then
    rpmlint *.rpm | tee rpmlint.new.txt
    exit 0
fi

cat old_packages|while read line
do
    eval $line
    curl -o old/$pkgfile $baseurl/$pkgfile
done

# run rpmlint on old and new packages
rpmlint *.rpm | sort | tee rpmlint.new.txt
rpmlint old/*.rpm | sort | tee rpmlint.old.txt

# check that we have the same number of packages else we
# cannot really compare and we just exit gracefully
if [ $(ls *.rpm|wc -l) != $(ls old/*.rpm|wc -l) ]; then
    exit 0
fi

# compare if we have more reports with the new packages
if [ $(wc -l < rpmlint.new.txt) -gt $(wc -l < rpmlint.old.txt) ]; then
    diff -u rpmlint.old.txt rpmlint.new.txt
    exit 1
fi

{{ ansible_user_dir }}/{{ zuul.projects['github.com/ceph/ceph-ansible'].src_dir }}/logs/

echo "config_opts['use_bootstrap_container'] = True" >> /etc/mock/site-defaults.cfg
echo "config_opts['dnf_warning'] = False" >> /etc/mock/site-defaults.cfg

export DIST="{{ dist | default('el7') }}"
export MOCK_CONFIG="{{ mock_config | default('epel-7-x86_64') }}"
make rpm

{{ ansible_user_dir }}/{{ zuul.projects['github.com/ceph/ceph-ansible'].src_dir }}

mkdir logs
cp *.log logs
cp *.rpm logs
pushd logs
popd

{{ (lookup('file', zuul.executor.result_data_file) | from_json).get('zuul').get('log_url') }}

name={{ sensu_enterprise_dashboard_service_name }} state=restarted

/usr/sbin/svccfg import /opt/local/lib/svc/manifest/sensu-server.xml

/usr/sbin/svccfg import /opt/local/lib/svc/manifest/sensu-api.xml

/usr/sbin/svccfg import /opt/local/lib/svc/manifest/sensu-client.xml

{{ uchiwa_service_name if not se_enterprise else sensu_enterprise_dashboard_service_name }}

file state=directory dest="{{ static_data_store }}/sensu/{{ item }}"

sensu_available_checks is defined and item in sensu_available_checks.stdout_lines

{{ sensu_config_path }}/conf.d/{{ item | basename | regex_replace('.j2', '')}}

sensu_available_client_definitions is defined and item in sensu_available_client_definitions.stdout_lines

src="{{ item.src }}" dest="{{ rabbitmq_config_path }}/ssl/{{ item.dest }}" remote_src="{{ sensu_ssl_deploy_remote_src }}"

name={{ sensu_server_service_name if not se_enterprise else sensu_enterprise_service_name }} state=started enabled=yes

http://sensuapp.org/docs/{{ sensu_ssl_tool_version }}/files/sensu_ssl_tool.tar

{{ __bash_path }} {{ sensu_config_path }}/ssl_generation/sensu_ssl_tool/ssl_certs.sh generate

{{ sensu_config_path }}/ssl_generation/sensu_ssl_tool/{{ item }}

{{ ( (ansible_distribution == 'CentOS' or ansible_distribution == 'Red Hat Enterprise Linux') and ansible_distribution_major_version == '5' ) | ternary('no', 'yes') }}

Sensu enterprise credential must not be empty. Did you forget to set se_user and se_pass?

[sensu-enterprise]
name=sensu-enterprise
baseurl=http://{{ se_user }}:{{ se_pass }}@enterprise.sensuapp.com/yum/noarch/
enabled=1

[sensu-enterprise-dashboard]
name=sensu-enterprise-dashboard
baseurl=http://{{ se_user }}:{{ se_pass }}@enterprise.sensuapp.com/yum/\$basearch/
enabled=1

deb https://dl.bintray.com/rabbitmq/debian {{ ansible_distribution_release }} main

deb https://packages.erlang-solutions.com/debian {{ ansible_distribution_release }} contrib

sensu{% if sensu_pkg_version %}-{{ sensu_pkg_version }}{% endif %}

{{ sensu_gem_repository | default('https://api.rubygems.org/')}}

name=sensu-plugin state={{ sensu_plugin_gem_state }} user_install=no

deb https://packages.erlang-solutions.com/ubuntu {{ ansible_distribution_release }} contrib

cp -r {{ solr_install_path }}/example/files/conf/ {{ solr_home }}/data/{{ item }}/

cp -r {{ solr_workspace }}/{{ solr_filename }} {{ solr_install_path }}

not solr_example.stat.exists and solr_version.split('.')[0] == '4'

(ansible_distribution == 'Ubuntu' and ansible_distribution_version == '16.04') or (ansible_distribution == 'Debian' and ansible_distribution_version|int >= 8) or (ansible_distribution == 'CentOS' and ansible_distribution_major_version|int >= 7) or (ansible_distribution == 'Fedora')

{{ solr_workspace }}/{{ solr_filename }}/bin/install_solr_service.sh {{ solr_workspace }}/{{ solr_filename }}.tgz -i {{ solr_install_dir }} -d {{ solr_home }} -u {{ solr_user }} -s {{ solr_service_name }} -p {{ solr_port }} creates={{ solr_install_path }}/bin/solr

(ansible_os_family == 'RedHat') and (ansible_distribution_version.split(".")[0] == '7') and (solr_install_script_result.changed)

{{ solr_mirror }}/lucene/solr/{{ solr_version }}/{{ solr_filename }}.tgz

ansible_distribution == "Debian" or (ansible_distribution == "Ubuntu" and ansible_distribution_version == "14.04")

{% if downloaded_plays.dest is defined %}{{ downloaded_plays.dest }}{% endif %}

{{ splunk.exec }} apply cluster-bundle -auth {{ splunk.admin_user }}:{{ splunk.password }} --skip-validation --answer-yes

((splunk_cluster_bundle_result.stdout is not search("[Aa]pply"))
  or ("bundle" not in splunk_cluster_bundle_result.stdout)
  or (splunk_cluster_bundle_result.stdout is search("[Ee]rror")))
and ("already" not in splunk_cluster_bundle_result.stderr)

((splunk_cluster_bundle_result.stdout is search("[Aa]pply"))
  and ("bundle" in splunk_cluster_bundle_result.stdout)
  and (splunk_cluster_bundle_result.stdout is not search("[Ee]rror")))

{{ splunk.exec }} show cluster-bundle-status -auth {{ splunk.admin_user }}:{{ splunk.password }}

{{ index.hotlist_bloom_filter_recency_hours | default('', true) }}

cp /opt/ansible/library/es_ta_for_indexers.py /tmp/es_ta_for_indexers.py

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/services/apps/local/SplunkEnterpriseSecuritySuite?output_mode=json

{{ splunk.exec }} cmd {% if ess_info.json.entry[0].content.version is version('6.1', '>=') %}python3{% else %}python{% endif %} /tmp/es_ta_for_indexers.py --password {{ splunk.password }} --username {{ splunk.admin_user }}

tar -zxvf {{ ta_location.stdout_lines[0] | replace(backslash, '/') | replace('C:', '') }} -C {{ splunk.app_paths.idxc }} --force-local

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/servicesNS/nobody/system/configs/conf-server

{{ splunk.exec }} edit cluster-config -mode master -replication_factor {{ splunk.idxc.replication_factor }} -search_factor {{ splunk.idxc.search_factor }} -secret '{{ splunk.idxc.pass4SymmKey }}' -cluster_label '{{ splunk.idxc.label }}' -auth '{{ splunk.admin_user }}:{{ splunk.password }}'

cp -R {{ splunk.app_paths.default }}/{{ item }} {{ splunk.app_paths.idxc }}

{{ cert_prefix }}://{{ splunk.multisite_master }}:{{ splunk.svc_port }}

{{ splunk.exec }} edit cluster-config -mode master -multisite true -available_sites {{ splunk.all_sites }} -site {{ splunk.site }} -site_replication_factor origin:{{ splunk.multisite_replication_factor_origin }},total:{{ splunk.multisite_replication_factor_total }} -site_search_factor origin:{{ splunk.multisite_search_factor_origin }},total:{{ splunk.multisite_search_factor_total }} -auth {{ splunk.admin_user }}:{{ splunk.password }} -secret {{ splunk.idxc.pass4SymmKey }}

{{ splunk.exec }} add forward-server {{ item }}:{{ splunk.s2s.port if splunk.s2s.port is defined else splunk.s2s_port }} -auth {{ splunk.admin_user }}:{{ splunk.password }}

("s2s" not in splunk and "s2s_port" in splunk) or ("s2s" in splunk and ("ssl" not in splunk.s2s or ("ssl" in splunk.s2s and not splunk.s2s.ssl))) | bool

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/servicesNS/nobody/system/configs/conf-outputs

{% for fwd in forward_servers %}{{ fwd }}:{{ splunk.s2s.port }}{{ ',' if not loop.last else '' }}{% endfor %}

{{ splunk.s2s.cert if splunk.s2s is defined and splunk.s2s.cert is defined else '' }}

{{ splunk.s2s.password if splunk.s2s is defined and splunk.s2s.password is defined else '' }}

{{ 'true' if splunk.s2s is defined and splunk.s2s.ssl is defined and splunk.s2s.ssl else '' }}

"s2s" in splunk and "ssl" in splunk.s2s and splunk.s2s.ssl | bool

not ('license_master_url' in splunk and splunk.license_master_url) or splunk.role == 'splunk_license_master'

{{ splunk.exec }} add {{ item }} -auth {{ splunk.admin_user }}:{{ splunk.password }}

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/services/messages/restart_required?output_mode=json

{{ splunk.exec }} disable app {{ item }} -auth {{ splunk.admin_user }}:{{ splunk.password }}

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/servicesNS/nobody/system/configs/conf-server/dfs

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/servicesNS/nobody/system/configs/conf-limits/dfs

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/servicesNS/nobody/system/configs/conf-limits/search

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/servicesNS/nobody/system/configs/conf-limits/search_optimization%3a%3adfs_job_extractor

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/servicesNS/nobody/system/configs/conf-limits

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/servicesNS/nobody/splunk_monitoring_console/saved/searches/DMC+Forwarder+-+Build+Asset+Table

{{ dmc_forwarder_build_assets.json['entry'][0]['content']['search'] }}

{{ cert_prefix }}://{{ splunk.cluster_master_url }}:{{ splunk.svc_port }}

{{ splunk.s2s.cert if splunk.s2s is defined and splunk.s2s.cert is defined }}

{{ splunk.s2s.password if splunk.s2s is defined and splunk.s2s.password is defined }}

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/servicesNS/nobody/system/configs/conf-outputs/tcpout

{{ splunk.exec }} version --accept-license --answer-yes --no-prompt

{{ installed_splunk_version.stdout | regex_search(regexp, '\1') }}

{{ splunk.exec }} enable boot-start -systemd-managed 1 -user {{ splunk.user }} --accept-license --answer-yes --no-prompt

ExecStartPost=/bin/bash -c "chown -R {{ splunk.user }}:{{ splunk.group }} /sys/fs/cgroup/cpu/system.slice/%n"

ExecStartPost=/bin/bash -c "chown -R {{ splunk.user }}:{{ splunk.group }} /sys/fs/cgroup/memory/system.slice/%n"

{{ splunk.exec }} enable boot-start -user {{ splunk.user }} --accept-license --answer-yes --no-prompt

{{ (installed_apps | default([]) + [ item.path | basename ] | difference(default_apps)) | unique }}

{% if ansible_system is match('CYGWIN*|Win32NT') %}Administrator{% else %}root{% endif %}

{{ not pre_existing_splunk_secret.stat.exists | default(True) }}

splunk_target_version is not defined or splunk_target_version == none

{{ manifests.files[0].path | regex_search(regexp, '\1') if (manifests.matched == 1) else '0' }}

{{ 'build_location' in splunk and splunk.build_location and not splunk_install and splunk_target_version and splunk_target_version != splunk_current_version | default(False) }}

{{ True if 'cluster_master_url' in splunk and splunk.cluster_master_url else False }}

{{ True if 'search_head_captain_url' in splunk and splunk.search_head_captain_url else False }}

{{ groups['splunk_standalone'] | difference([ansible_hostname]) }}

'target_version' in splunk and splunk.target_version is not none

{{ splunk.build_location | regex_search(regexp, '\1') | default('0') }}

splunk_build_type is defined and splunk_build_type is match('(tgz|msi|rpm|deb)')

item.version is version_compare( splunk_target_version|default('0.0.0'), '>')

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/services/apps/local

set -o pipefail && tar --exclude='*/*/*' --exclude='*.*' -tf /tmp/app.spl | awk -F'/' '{ print$1 }' | uniq

{% if 'http' in app_url %}/tmp/app.spl{% else %}{{ app_url }}{% endif %}

msiexec /I {{ splunk.build_location }} AGREETOLICENSE=yes LAUNCHSPLUNK=0 INSTALLDIR=C:\\opt\\{{ splunk.tar_dir }} /passive /qn

{{ splunk.build_location|regex_replace('^file://(.*)$', '\1') }}

splunk_install | bool or (first_run | bool and splunk.build_location and splunk.build_location is match("^(https?|file)://.*"))

{{ splunk.exec }} edit cluster-config -mode searchhead -master_uri {{ cert_prefix }}://{{ splunk.cluster_master_url }}:{{ splunk.svc_port }} -replication_port {{ splunk.idxc.replication_port }} -secret '{{ splunk.idxc.pass4SymmKey }}' -auth '{{ splunk.admin_user }}:{{ splunk.password }}'

{{ splunk.exec }} add search-server {{ cert_prefix }}://{{ item }}:{{ splunk.svc_port }} -auth {{ splunk.admin_user }}:{{ splunk.password }} -remoteUsername {{ splunk.admin_user }} -remotePassword {{ splunk.password }}

set_indexer_as_peer.rc != 0 and 'already exists' not in set_indexer_as_peer.stderr

{{ splunk.exec }} {{ item }} -auth {{ splunk.admin_user }}:{{ splunk.password }} --accept-license --answer-yes --no-prompt

{{ splunk.exec }} set deploy-poll {{ splunk.deployment_server }}:{{ splunk.svc_port }} -auth '{{ splunk.admin_user }}:{{ splunk.password }}'

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/services/data/inputs/http/http

{% if ('hec' in splunk and 'enable' in splunk.hec and splunk.hec.enable | bool) or ('hec_disabled' in splunk and not splunk.hec_disabled | bool) %}0{% else %}1{% endif %}

{% if ('hec' in splunk and 'ssl' in splunk.hec and splunk.hec.ssl | bool) or ('hec_enableSSL' in splunk and splunk.hec_enableSSL | bool) %}1{% else %}0{% endif %}

{% if 'hec' in splunk and 'port' in splunk.hec and splunk.hec.port %}{{ splunk.hec.port }}{% elif 'hec_port' in splunk and splunk.hec_port %}{{ splunk.hec_port }}{% else %}8088{% endif %}

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/services/data/inputs/http/splunk_hec_token?output_mode=json

('hec' in splunk and 'token' in splunk.hec) or ('hec_token' in splunk)

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/services/data/inputs/http/splunk_hec_token

('hec' in splunk and 'token' in splunk.hec and hec_token.json['entry'][0]['content']['token'] != splunk.hec.token) or ('hec_token' in splunk and hec_token.json['entry'][0]['content']['token'] != splunk.hec_token)

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/services/data/inputs/http

{% if 'hec' in splunk and 'token' in splunk.hec and splunk.hec.token %}{{ splunk.hec.token }}{% else %}{{ splunk.hec_token }}{% endif %}

('hec' in splunk and 'token' in splunk.hec and splunk.hec.token) or ('hec_token' in splunk and splunk.hec_token)

{{ splunk.exec }} edit licenser-localslave -master_uri {{ cert_prefix }}://{{ splunk.license_master_url }}:{{ splunk.svc_port }} -auth '{{ splunk.admin_user }}:{{ splunk.password }}'

{% if ssl_enabled.status == 200 %}https{% else %}http{% endif %}

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/servicesNS/nobody/system/configs/conf-web/settings

{{ splunk.exec }} status --accept-license --answer-yes --no-prompt

{{ splunk.exec }} start --accept-license --answer-yes --no-prompt

start_splunk.rc == 0 and 'already running' not in start_splunk.stdout

{{ splunk.exec }} stop --accept-license --answer-yes --no-prompt

{{ cert_prefix }}://{{ splunk_instance_address }}:{{ splunk.svc_port }}

ansible_distribution == 'Debian' or ansible_distribution == 'RedHat'

cp {{ splunk.home }}/etc/splunk-launch.conf.default {{ splunk.home }}/etc/splunk-launch.conf

ansible_distribution == 'Debian' or ansible_distribution == 'RedHat' or ansible_distribution == 'CentOS'

/opt/container_artifact/jdk-8u{{ java_update_version }}-linux-x64.tar.gz

update-alternatives --install /usr/bin/java java /opt/container_artifact/jdk1.8.0_{{ java_update_version }}/bin/java 100

update-alternatives --install /usr/bin/javac javac /opt/container_artifact/jdk1.8.0_{{ java_update_version }}/bin/javac 100

update-alternatives --set java /opt/container_artifact/jdk1.8.0_{{ java_update_version }}/bin/java

update-alternatives --set javac /opt/container_artifact/jdk1.8.0_{{ java_update_version }}/bin/javac

{{ splunk.exec }} add licenses {{ splunk.license_download_dest }} -auth {{ splunk.admin_user }}:{{ splunk.password }}

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/services/licenser/groups/Free?output_mode=json

{{ splunk.exec }} search '| essinstall' -auth {{ splunk.admin_user }}:{{ splunk.password }}

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/servicesNS/nobody/itsi/authorization/roles

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/servicesNS/nobody/itsi/authentication/users/admin

splunktcp://{{ splunk.s2s_port if splunk.s2s_port is defined else splunk.s2s.port }}

{{ 0 if 's2s' in splunk and 'enable' in splunk.s2s and splunk.s2s.enable else 1 }}

splunktcp-ssl:{{ splunk.s2s_port if splunk.s2s_port is defined else splunk.s2s.port }}

splunk_status.rc == 0 and (splunktcp_enabled is changed or splunktcp_ssl_disabled is changed or splunktcp_ssl_reset is changed or splunktcp_ssl_ca_reset is changed)

{{ splunk.s2s.ca if splunk.s2s.ca else '$SPLUNK_HOME/etc/auth/ca.pem' }}

splunk_status.rc == 0 and (splunktcp_disabled is changed or splunktcp_ssl_cert_configured is changed or splunktcp_ssl_pass_configured is changed or splunktcp_ssl_ca_configured is changed)

captain_url="{{ splunk.search_head_captain_url }}" shc_peers="{{ groups['splunk_search_head'] }}" spl_user="{{ splunk.admin_user }}" spl_pass="{{ splunk.password }}"

cp -R {{ splunk.app_paths.default }}/{{ item }} {{ splunk.app_paths.shc }}

{{ splunk.exec }} apply shcluster-bundle -target {{ cert_prefix }}://{{ splunk.search_head_captain_url }}:{{ splunk.svc_port }} -auth {{ splunk.admin_user }}:{{ splunk.password }} --answer-yes

shcluster_bundle.rc == 0 or "Found zero deployable apps" in shcluster_bundle.stderr

shcluster_bundle.rc != 0 and "Found zero deployable apps" not in shcluster_bundle.stderr

cp -R {{ splunk.app_paths.default }}/{{ item }} {{ splunk.app_paths.deployment }}

{{ splunk.exec }} reload deploy-server -auth {{ splunk.admin_user }}:{{ splunk.password }}

{{ splunk.exec }} {{ item }} -auth {{ splunk.admin_user }}:{{ splunk.password }}

{{ splunk.exec }} edit cluster-config -mode slave -master_uri '{{ cert_prefix }}://{{ splunk.cluster_master_url }}:{{ splunk.svc_port }}' -replication_port {{ splunk.idxc.replication_port }} -secret '{{ splunk.idxc.pass4SymmKey }}' -auth '{{ splunk.admin_user }}:{{ splunk.password }}'

{{ splunk.exec }} edit cluster-config -mode slave -site {{ splunk.site }} -master_uri {{ multisite_master_uri }} -replication_port {{ splunk.idxc.replication_port }} -auth {{ splunk.admin_user }}:{{ splunk.password }} -secret {{ splunk.idxc.pass4SymmKey }}

ansible_hostname == splunk.search_head_captain_url or ansible_fqdn == splunk.search_head_captain_url or splunk.hostname == splunk.search_head_captain_url or splunk.role == "splunk_search_head_captain"

{{ splunk.exec }} init shcluster-config -auth '{{ splunk.admin_user }}:{{ splunk.password }}' -mgmt_uri '{{ cert_prefix }}://{{ splunk.hostname }}:{{ splunk.svc_port }}' -replication_port {{ splunk.shc.replication_port }} -replication_factor {{ splunk.shc.replication_factor }} -conf_deploy_fetch_url '{{ cert_prefix }}://{{ splunk.deployer_url }}:{{ splunk.svc_port }}' -secret '{{ splunk.shc.pass4SymmKey }}' -shcluster_label '{{ splunk.shc.label }}'

{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/servicesNS/nobody/system/configs/conf-server/shclustering

splunk_search_head_captain is defined and splunk.preferred_captaincy | bool

{{ splunk.exec }} bootstrap shcluster-captain -servers_list '{% for host in groups['splunk_search_head'] %}{{ cert_prefix }}://{{ host }}:{{ splunk.svc_port }}{% if not loop.last %},{% endif %}{% endfor %}' -auth '{{ splunk.admin_user }}:{{ splunk.password }}'

task_result.rc == 0 or "node seems to have already joined another cluster" in task_result.stderr

task_result.rc !=0 and "node seems to have already joined another cluster" not in task_result.stderr

{{ splunk.exec }} add shcluster-member -current_member_uri {{ cert_prefix }}://{{ splunk.search_head_captain_url }}:{{ splunk.svc_port }} -auth {{ splunk.admin_user }}:{{ splunk.password }}

task_result.rc !=0 and "is already part of cluster" not in task_result.stderr

task_result.rc == 0 or "is already part of cluster" in task_result.stderr

{{ splunk.exec }} resync shcluster-replicated-config -auth {{ splunk.admin_user }}:{{ splunk.password }}

task_result.rc !=0 and "this instance is the captain" not in task_result.stderr

task_result.rc == 0 or "this instance is the captain" in task_result.stderr

{{ splunk.exec }} edit cluster-config -mode searchhead -master_uri {{ multisite_master_uri }} -auth {{ splunk.admin_user }}:{{ splunk.password }} -secret {{ splunk.idxc.pass4SymmKey }}

{{ splunk.exec }} edit cluster-master -old_master_uri {{ multisite_master_uri }} -site {{ splunk.site }} -auth {{ splunk.admin_user }}:{{ splunk.password }} -secret {{ splunk.idxc.pass4SymmKey }} -multisite True

set_associated_site.rc == 0 or (set_associated_site.rc == 22 and 'No change in master or secret or site' in set_associated_site.stderr)

set_associated_site.rc != 0 and 'No change in master or secret or site' not in set_associated_site.stderr

set_new_master.rc == 0 or (set_new_master.rc == 22 and  "Use 'splunk edit cluster-master' to edit information for this" in set_new_master.stderr)

set_new_master.rc != 0 and "Use 'splunk edit cluster-master' to edit information for this" not in set_new_master.stderr

virt-customize --smp 2 -m {{ convert_image_host_memory }} -a {{ convert_image_working_dir }}/overcloud-full.qcow2 --root-password password:{{ overcloud_full_root_pwd }}

cp {{ convert_image_working_dir }}/overcloud-full.qcow2
   {{ convert_image_working_dir }}/undercloud.qcow2

overcloud_full_qcow2.stat.exists and overcloud_as_undercloud|bool

qemu-img resize {{ convert_image_working_dir }}/undercloud.qcow2
                {{ flavors[undercloud_node.name].disk }}G

virt-customize -v --smp 2 -m {{ convert_image_host_memory }} -a {{ convert_image_working_dir }}/undercloud.qcow2 --run convert_image.sh

virt-cat -a undercloud.qcow2 /tmp/builder.log > builder-undercloud.log 2>&1;

item.virtualport_type is defined and item.virtualport_type == "openvswitch"

msg="Some libvirt networks were not set to autostart. Please see https://bugs.launchpad.net/tripleo-quickstart/+bug/1581676"

content={{ item.get_xml }} dest=/tmp/network-{{ item.item.name }}.xml

{{ ansible_distribution | lower }}-{{ ansible_distribution_version.split('.')[0:2] | join('-') | lower }}.yml

{{ ansible_distribution | lower }}-{{ ansible_distribution_version.split('.')[0:3] | join('-') | lower }}.yml

{{ force_cached_images|default(false)|bool or image.force_cached|default(false)|bool }}

curl -skfL -C- -o _{{ image.name }}.{{ image.type }} {{ image.url }}

cp {{ image_cache_path }} {{ image_fetch_dir }}/{{ image.name }}.{{ image.type }}

cp {{ image_cache_path }} {{ image_fetch_dir }}/undercloud.{{ image.type }}

set -o pipefail; find {{ image_cache_dir }} -type f {% if not image_cache_dir_cleanup|bool %} -mtime +{{ image_cache_expire_days|int - 1 }} {% endif %} | xargs --no-run-if-empty -t rm -rf

dlrn_hash_tag_newest is defined and dlrn_task_run_newest is not defined

set -o pipefail; virsh pool-dumpxml {{ libvirt_volume_pool }} | virsh pool-define /dev/stdin

ssh-add -L | head -1 > {{ pub_key }}.agent
test -s {{ pub_key }}.agent

qemu-img create -f qcow2 -o preallocation=off '{{ working_dir }}/undercloud-resized.qcow2' '80G'

libguestfs-test-tool > {{ working_dir }}/libguestfs-test.log 2>&1;

set -eo pipefail; source {{ working_dir }}/libguestf-env.sh; virt-resize -x --verbose --expand /dev/sda1 '{{ working_dir }}/undercloud.qcow2' '{{ working_dir }}/undercloud-resized.qcow2' 2>&1 | tee -a {{ working_dir }}/virt-resize.log

mv -f '{{ working_dir }}/undercloud-resized.qcow2'
      '{{ working_dir }}/undercloud.qcow2'

import crypt; print(crypt.crypt("{{ vm_pass }}", "$1$SecretSalt$"))

source {{ working_dir }}/libguestf-env.sh && virt-customize -v -a {{ working_dir }}/undercloud.qcow2 --root-password file:"{{ working_dir }}/pwtemp" >> {{ working_dir }}/virt-customize.log 2>&1

source {{ working_dir }}/libguestf-env.sh && virt-customize -v -a {{ working_dir }}/undercloud.qcow2 --run-command 'FS_TYPE=`findmnt -o FSTYPE -fn /`; if [ "$FS_TYPE" = "xfs" ]; then xfs_growfs /; elif [ "$FS_TYPE" = "ext4" ]; then resize2fs /dev/sda1; else echo "ERROR: Unknown filesystem $FSTYPE, cannot resize."; exit 1; fi' >> {{ working_dir }}/virt-customize.log 2>&1

source {{ working_dir }}/libguestf-env.sh && virt-customize -v -a {{ working_dir }}/undercloud.qcow2 --run-command "grubby --update-kernel=ALL --args=\"cloud-init=disabled\"" >> {{ working_dir }}/virt-customize.log 2>&1

source {{ working_dir }}/libguestf-env.sh && virt-customize -v -a {{ working_dir }}/undercloud.qcow2 --mkdir /root/.ssh/ --upload {{ pub_key }}:/root/.ssh/authorized_keys --run-command 'chown -R root:root /root/.ssh' --run-command 'chmod 0700 /root/.ssh' --run-command 'chmod 0600 /root/.ssh/authorized_keys' --selinux-relabel >> {{ working_dir }}/virt-customize.log 2>&1

source {{ working_dir }}/libguestf-env.sh && virt-customize -v -a {{ working_dir }}/undercloud.qcow2 --run-command 'id -u zuul &>/dev/null || useradd zuul' --mkdir /home/zuul/.ssh --run-command 'cp /root/.ssh/authorized_keys /home/zuul/.ssh/' --run-command 'chown -R zuul:zuul /home/zuul/.ssh' --run-command 'chmod 0700 /home/zuul/.ssh' --run-command 'chmod 0600 /home/zuul/.ssh/authorized_keys' --run-command 'echo "zuul ALL=(root) NOPASSWD:ALL" > /etc/sudoers.d/zuul' --run-command 'chmod 0440 /etc/sudoers.d/zuul' --selinux-relabel >> {{ working_dir }}/virt-customize.log 2>&1

source {{ working_dir }}/libguestf-env.sh && virt-customize -a {{ working_dir }}/undercloud.qcow2 --run-command 'yum install -y qemu-guest-agent' --run-command 'systemctl enable qemu-guest-agent' >> {{ working_dir }}/virt-customize.log 2>&1

virsh vol-create-as {{ libvirt_volume_pool }} {{ item.name }}.qcow2 {{ flavors[item.flavor].disk }}G --format qcow2

virsh -k 0 vol-upload --pool '{{ libvirt_volume_pool }}' '{{ item.name }}.qcow2' '{{ local_working_dir }}/undercloud.qcow2'

virsh vol-info --pool '{{ libvirt_volume_pool }}' '{{ item.name }}.qcow2'

virsh vol-create-as '{{ libvirt_volume_pool }}' '{{ item.item.name }}'.qcow2 '{{ flavors[item.item.flavor].disk }}'G --format qcow2

dd if=/dev/zero of={{ libvirt_volume_path }}/{{ item[0].name }}_{{ item[1] }}.img bs=1 count=0 seek={{ extradisks_size }}

virsh domblkinfo {{ item[0].name }} {{ libvirt_volume_path }}/{{ item[0].name }}_{{ item[1] }}.img

virsh attach-disk --config {{ item.item[0].name }} {{ libvirt_volume_path }}/{{ item.item[0].name }}_{{ item.item[1] }}.img {{ item.item[1] }}

{{ lookup('pipe', 'ssh-keyscan -t ecdsa-sha2-nistp256 ' + ip_result.stdout_lines[0]) }}

echo "127.0.0.1  {{ item.name }} localhost" > /etc/hosts; echo "HOSTNAME={{ item.name }}" >> /etc/sysconfig/network; echo "{{ item.name }}" > /etc/hostname; hostnamectl set-hostname {{ item.name }}; {% if custom_nameserver is defined and custom_nameserver %} echo "nameserver {{ custom_nameserver }} " >> /etc/resolv.conf; echo "append domain-name-servers {{ custom_nameserver }};" >> /etc/dhcp/dhclient.conf {% endif %}

ssh-keygen -f '{{ supplemental_node_key }}' -N '' -C ansible_generated_supplemental -t rsa -b 4096

virsh vol-info --pool '{{ libvirt_volume_pool }}' '{{ supplemental_node.name }}.qcow2'

bash ~/tls_everywhere_provisioner.sh &> ~/tls_everywhere_provisioner.log

virt-copy-out -a {{ working_dir }}/undercloud.qcow2 /home/{{ undercloud_user }}/overcloud-full.qcow2 {{ working_dir }}

virt-customize -a {{ working_dir }}/overcloud-full.qcow2 --run '{{ working_dir }}/overcloud-customize.sh'

virt-copy-in -a {{ working_dir }}/undercloud.qcow2 {{ working_dir }}/overcloud-full.qcow2 /home/{{ undercloud_user }}/

virt-customize -a {{ working_dir }}/overcloud-full.qcow2 --upload {{ compressed_gating_repo }}:/tmp/gating_repo.tar.gz --run '{{ working_dir }}/inject_gating_repo.sh'

overcloud_image_extracted is defined and overcloud_image_extracted|changed

virt-customize -a {{ working_dir }}/undercloud.qcow2 --upload {{ compressed_gating_repo }}:/tmp/gating_repo.tar.gz --run '{{ working_dir }}/inject_gating_repo.sh'

virsh vol-info --pool '{{ libvirt_volume_pool }}' '{{ undercloud_node.name }}.qcow2'

virt-customize -a {{ working_dir }}/undercloud.qcow2 --upload {{ working_dir }}/{{ item }}:/home/{{ undercloud_user }}/{{ item }} --run-command 'chown {{ undercloud_user }}:{{ undercloud_user }} /home/{{ undercloud_user }}/{{ item }}'

virt-customize -a {{ working_dir }}/undercloud.qcow2 --upload {{ working_dir }}/instackenv.json:/home/{{ undercloud_user }}/instackenv.json --run-command 'chown {{ undercloud_user }}:{{ undercloud_user }} /home/{{ undercloud_user }}/instackenv.json'

virt-customize -a {{ working_dir }}/undercloud.qcow2 --mkdir {{ item.homedir }}/.ssh/ --upload '{{ working_dir }}/id_rsa_undercloud.pub:{{ item.homedir }}/.ssh/authorized_keys' --run-command 'chown -R {{ item.owner }}:{{ item.group }} {{ item.homedir }}/.ssh' --run-command 'chmod 0700 {{ item.homedir }}/.ssh' --run-command 'chmod 0600 {{ item.homedir }}/.ssh/authorized_keys'

virt-customize -a {{ working_dir }}/undercloud.qcow2 --upload '{{ working_dir }}/id_rsa_virt_power:/root/.ssh/id_rsa_virt_power' --run-command 'chown root:root /root/.ssh/id_rsa_virt_power' --run-command 'chmod 0600 /root/.ssh/id_rsa_virt_power'

virt-customize -a {{ working_dir }}/undercloud.qcow2 --run '{{ working_dir }}/undercloud-customize.sh'

virt-customize -a {{ working_dir }}/undercloud.qcow2 --selinux-relabel

qemu-img create -f qcow2 -o preallocation=off '{{ working_dir }}/undercloud-resized.qcow2' '{{ flavors[undercloud_node.flavor].disk }}G'

virt-resize --expand /dev/sda1 '{{ working_dir }}/undercloud.qcow2' '{{ working_dir }}/undercloud-resized.qcow2'

virt-customize -a '{{ working_dir }}/undercloud.qcow2' --run-command 'FS_TYPE=`findmnt -o FSTYPE -fn /`; if [ "$FS_TYPE" = "xfs" ]; then xfs_growfs /; elif [ "$FS_TYPE" = "ext4" ]; then resize2fs /dev/sda1; else echo "ERROR: Unknown filesystem $FSTYPE, cannot resize."; exit 1; fi'

qemu-img resize '{{ working_dir }}/undercloud.qcow2' '{{ flavors[undercloud_node.flavor].disk }}G'

virt-customize -a '{{ working_dir }}/undercloud.qcow2' --run-command 'FS_TYPE=`findmnt -o FSTYPE -fn /`; if [ "$FS_TYPE" = "xfs" ]; then xfs_growfs /; elif [ "$FS_TYPE" = "ext4" ]; then resize2fs /dev/sda; else echo "ERROR: Unknown filesystem $FSTYPE, cannot resize."; exit 1; fi'

virt-copy-out -a '{{ working_dir }}/undercloud.qcow2' '/home/{{ undercloud_user }}/overcloud-full.vmlinuz' '/home/{{ undercloud_user }}/overcloud-full.initrd' '{{ working_dir }}'

virt-get-kernel -a '{{ working_dir }}/undercloud.qcow2' --unversioned-names --output '{{ working_dir }}'

mv '{{ working_dir }}/vmlinuz' '{{ working_dir }}/overcloud-full.vmlinuz'

mv '{{ working_dir }}/initramfs' '{{ working_dir }}/overcloud-full.initrd'

virsh vol-create-as {{ libvirt_volume_pool }} {{ undercloud_node.name }}.qcow2 {{ flavors[undercloud_node.flavor].disk }}G --format qcow2

virsh -k 0 vol-upload --pool '{{ libvirt_volume_pool }}' '{{ undercloud_node.name }}.qcow2' '{{ working_dir }}/undercloud.qcow2'

virt-customize -v --smp 2 -m 4096 -a {{ item.path }} --run update_image-{{ item.inode }}.sh

ssh-keygen -f '{{ item.path }}' -N '' -C '{{ item.comment }}' -t rsa -b 4096

{{ role_path }}/../../setup/overcloud/vars/libvirt_nodepool_vars.yml

virsh vol-dumpxml --pool '{{ libvirt_volume_pool }}' \
  '{{ undercloud_node.name }}'.qcow2 2>&1 > /dev/null
virsh vol-delete --pool '{{ libvirt_volume_pool }}' \
  '{{ undercloud_node.name }}'.qcow2

virsh pool-dumpxml "{{ libvirt_volume_pool }}" |
virsh pool-define /dev/stdin

/run/user/{{ pool_uid.stdout }}/libvirt/storage/run/{{ libvirt_volume_pool }}.xml

{{ 'intel' if 'Intel' in ansible_processor|join('') else 'amd' if 'AMD' in ansible_processor|join('') else 'unknown' }}

{{ true if cpu_vendor == 'intel' and 'vmx' in cpu_flags_cmd.stdout.split() else true if cpu_vendor == 'amd' and 'svm' in cpu_flags_cmd.stdout.split() else false }}

find /etc/modprobe.d/ -type f -print0 | xargs -r -0 sed -i '/^options kvm_intel/d;/^options kvm_amd/d'

options kvm_{{ cpu_vendor }} nested={{ nested|bool|ternary('1', '0') }}

{{ true if 'Y' in kvm_nested_info.stdout else true if '1' in kvm_nested_info.stdout else false }}

Cannot change the state of nested virtualization. Please shut down any running VMs.

if rpm -q ipxe-roms-qemu-20130517; then
   rpm -e --nodeps ipxe-roms-qemu-20130517 && echo "rpm removed";
fi;

getent passwd {{ non_root_user }} | cut -d: -f6

ssh-keygen -f {{ virt_host_key }} -N '' -C 'ansible_generated_virt_host' -t rsa -b 4096

/etc/polkit-1/localauthority/50-local.d/50-{{ non_root_user }}-libvirt.pkla

# Setting up XDG_RUNTIME_DIR for creating non-essential runtime files and other file objects in accordance with
# https://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html
if [[ -z "${XDG_RUNTIME_DIR}" && -d "/run/user/${UID}" ]] ; then
    export XDG_RUNTIME_DIR="/run/user/${UID}"
fi

msg="Unfortunately your linux distribution is not supported at the moment. We welcome community support, please see https://github.com/openstack/tripleo-quickstart .
To run quickstart with out this check set 'quickstart.sh -e supported_distro_check=false'"

not (ansible_distribution == 'CentOS' or ansible_distribution == 'RedHat')

The newest DLRN hash or tag is not recognized. The hash or tag should not contain path slashes.

(not dlrn_hash_tag is match("[a-zA-Z0-9]{40}_[a-zA-Z0-9]{8}")) or (not dlrn_hash_tag is match("[a-zA-Z0-9]{32}"))

dlrn_hash_tag_newest is match("[a-zA-Z0-9]{40}_[a-zA-Z0-9]{8}") or dlrn_hash_tag is match("[a-zA-Z0-9]{32}")

dlrn_base={{ dlrn_baseurl }}
if [ -e /etc/ci/mirror_info.sh ]; then
  source /etc/ci/mirror_info.sh
  NODEPOOL_RDO_PROXY=${NODEPOOL_RDO_PROXY:-https://trunk.rdoproject.org}
  dlrn_base=${dlrn_base/https:\/\/trunk.rdoproject.org/$NODEPOOL_RDO_PROXY}
fi
curl -s --fail --show-error ${dlrn_base}/{{ dlrn_hash_tag_newest }}/delorean.repo \
| grep baseurl | grep -Eo '[a-zA-Z0-9]{40}_[a-zA-Z0-9]{8}'

fi
curl -s --fail --show-error ${dlrn_base}/{{ dlrn_hash_tag_newest }}/delorean.repo.md5

{{ dlrn_hash_newest[:2] }}/{{ dlrn_hash_newest[2:4] }}/{{ dlrn_hash_newest }}

The DLRN hash or tag is not recognized. The hash or tag should not contain path slashes.

dlrn_hash_tag is match("[a-zA-Z0-9]{40}_[a-zA-Z0-9]{8}") or dlrn_hash_tag is match("[a-zA-Z0-9]{32}")

fi
curl -s --fail --show-error ${dlrn_base}/{{ dlrn_hash_tag }}/delorean.repo \

fi
curl -s --fail --show-error ${dlrn_base}/{{ dlrn_hash_tag }}/delorean.repo.md5

dlrn_base=https://trunk.rdoproject.org/centos7-{{ overcloud_release }}
fi

{{ overcloud_dlrn_hash[:2] }}/{{ overcloud_dlrn_hash[2:4] }}/{{ overcloud_dlrn_hash }}

set -o pipefail && {{ repo_setup_dir }}/{{ repo_setup_script }} 2>&1 {{ timestamper_cmd }} | tee -a {{ repo_setup_dir }}/{{ repo_setup_log }}

WARNING: This role is deprecated for removal since Ocata.
Reason: The tripleo/undercloud role is now deprecated, has moved
into the tripleo-quickstart-extras repository, and been renamed
to undercloud-deploy. The tripleo/undercloud role will be removed in
the Queens release. Please revise your playbooks to use the new role
location and name.

source {{ working_dir }}/stackrc; $(command -v python3 || command -v python2) {{ working_dir }}/get-overcloud-nodes.py

overcloud,{{ item.key | regex_replace('overcloud-(?:nova)?([a-zA-Z0-9_]+)-[0-9]+$', '\1') }}

hostvars['undercloud'] is defined and hostvars['undercloud'].undercloud_ip is defined

{{ 'virthost' in groups and groups['virthost']|length>0 and hostvars[groups['virthost'][0]].ansible_private_key_file is defined }}

ssh -q -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=60 -i {{ hostvars[groups['virthost'][0]].ansible_private_key_file }} {{ ssh_user }}@{{ hostvars[groups['virthost'][0]].ansible_host }} -W {{ undercloud_ip }}:22

ssh -q -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=60 -i {{ local_working_dir }}/id_rsa_virt_power {{ ssh_user }}@{{ hostvars['localhost'].ansible_default_ipv4.address }} -W {{ undercloud_ip }}:22

ssh -q -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=60 -i {{ local_working_dir }}/id_rsa_virt_power {{ ssh_user }}@{{ hostvars[groups['virthost'][0]].ansible_host }} -W {{ supplemental_node_ip }}:22

undercloud_ip is not defined and result_stat_id_rsa_virt_power.stat.exists

{{ (registered_nodes_output.stdout | from_json) | json_query(jq_overcloud) }}

{{ (registered_nodes_output.stdout | from_json) | json_query(jq_undercloud) }}

{{ (registered_nodes_output.stdout | from_json) | json_query(jq_cluster) }}

[?metadata.clusterid] | [?metadata.clusterid=='{{ clusterid }}']

{{ registered_overcloud_nodes|union(registered_undercloud_nodes) }}

{{ item.metadata.group|default('overcloud') }}, {{ item.name|regex_replace('overcloud-(?:nova)?([a-zA-Z0-9_]+)-[0-9]+$', '\\1') }}

{% set node = registered_nodes | json_query("[?name=='" + item.name + "']") -%} {{ node[0].addresses[openstack_private_network_name|quote][0].addr }}

ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=60 -i {{ hostvars['undercloud'].ansible_private_key_file }} {{ ssh_user }}@{{ hostvars['undercloud'].ansible_host }}

[default]
config_dir=/root/.vbmc
[log]
logfile=/var/log/virtualbmc/virtualbmc.log
debug=True
[ipmi]
session_timout=20

{{ networks|selectattr('address', 'defined')|map(attribute='address')|list|first }}

networks|selectattr('address', 'defined')|map(attribute='name')|list|length > 0

qemu+ssh://{{ non_root_user }}@{{ vbmc_address }}/session?socket=/run/user/{{ non_root_user_uid }}/libvirt/libvirt-sock&keyfile=/root/.ssh/id_rsa_virt_power&no_verify=1&no_tty=1

vbmc add {{ item.name }} --port {{ item.virtualbmc_port }} --libvirt-uri {{ vbmc_libvirt_uri }}

[Unit]
Description=VirtualBMC %i service
After=network.target

[Service]
Type=forking
PIDFile=/root/.vbmc/%i/pid
ExecStart=/bin/vbmc start %i
ExecStop=/bin/vbmc stop %i
Restart=always

[Install]
WantedBy=multi-user.target

ip a add dev eth2 {{ supplemental_node_ip }}/24;
ip l set eth2 up;
ip link set dev eth2 mtu 1450;
ping 10.0.0.1 -c 4 -q;

run_tripleo_validations|bool or run_tripleo_validations_negative_tests|bool

set -o pipefail && {{ baremetal_provisioning_script }} 2>&1 | tee "{{ local_working_dir }}/baremetal_provision.log"

hostvars['undercloud']['compressed_gating_repo'] is defined and mixed_upgrade|default(false)|bool

{{ hostvars['undercloud']['update_containers_append_tag'] | default('') }}

{{ ansible_pkg_mgr }} --enablerepo='gating-repo' update -y  # noqa 305

::1        localhost localhost.localdomain localhost6 localhost6.localdomain6

hostvars['undercloud']['compressed_gating_repo'] is defined and not mixed_upgrade|default(false)|bool

set -eo pipefail; echo "127.0.0.1 $(hostname) $(hostname).openstacklocal" | sudo tee -a /etc/hosts; echo "127.0.0.2 undercloud undercloud.openstacklocal" | sudo tee -a /etc/hosts; if [ ! -e ${HOME}/.ssh/id_rsa.pub ] ; then
    if [[ -e ${HOME}/.ssh/id_rsa ]]; then
        ssh-keygen -y -f ${HOME}/.ssh/id_rsa > ${HOME}/.ssh/id_rsa.pub;
    else
        ssh-keygen -N "" -f ${HOME}/.ssh/id_rsa;
    fi
fi; sudo mkdir -p /root/.ssh; cat ~/.ssh/id_rsa.pub | sudo tee -a /root/.ssh/authorized_keys | tee -a ~/.ssh/authorized_keys; sudo rm -rf /etc/puppet /etc/hiera.yaml; sudo cp {{ tripleo_root }}/tripleo-ci/test-environments/overcloud-cacert.pem /etc/pki/ca-trust/source/anchors/; sudo update-ca-trust extract; cp -f {{ lookup('env', 'TE_DATAFILE') }} ~/instackenv.json;

network_config:
  - type: interface
    name: eth2
    use_dhcp: false
    mtu: 1450
    addresses:
      - ip_netmask: 10.0.0.1/24
      - ip_netmask: 2001:db8:fd00:1000::1/64

The variable tempest_install_method and tempest_cloud_name is required and
has not been set.

{{ tempest_cidr|nthhost(100) ~ "-" ~ tempest_cidr|nthhost(120) }}

{{ playbook_dir | dirname }}/vars/tempest_skip_{{ release | default('master') }}.yml

release in ['newton','ocata','pike','queens'] or not containerized_undercloud|bool

set -euxo pipefail
ntpdate $(grep ^server /etc/ntp.conf | tail -1 | awk '{print $2}')

set -o pipefail && {{ baremetal_provisioning_script }} 2>&1 {{ timestamper_cmd }} | tee {{ baremetal_provisioning_log }}

You need to set virthost/undercloud before running these playbooks.

Host {{ virthost }}
    Hostname {{ virthost }}
    IdentityFile {{ virthost_key }}
    User root
    StrictHostKeyChecking no
    UserKnownHostsFile=/dev/null

ssh-keygen -f {{ undercloud_key }} -N '' -C 'ansible_generated_virt_host' -t rsa -b 4096

set -o pipefail && {{ images_working_dir }}/overcloud_image_build_script.sh 2>&1 {{ timestamper_cmd }} > {{ working_dir }}/{{ overcloud_image_build_log }}

virt-cat -a {{ build_isolation_image.name }}.qcow2 \
    /tmp/builder.log > builder.log 2>&1 || true
    /ironic-python-agent.log > ironic-python-agent.log 2>&1 || true
    /overcloud-full.log > overcloud-full.log 2>&1 || true

virt-customize -a {{ images_working_dir }}/undercloud.qcow2 --upload {{ images_working_dir }}/{{ item }}:/home/{{ undercloud_user }}/{{ item }} --run-command 'chown {{ undercloud_user }}:{{ undercloud_user }} /home/{{ undercloud_user }}/{{ item }}'

qemu-img convert -c -O qcow2 undercloud.qcow2 undercloud-compressed.qcow2
mv undercloud-compressed.qcow2 undercloud.qcow2

tar -cf ironic-python-agent.tar \
        ironic-python-agent.initramfs \
        ironic-python-agent.kernel
tar -cf overcloud-full.tar \
        overcloud-full.qcow2 \
        overcloud-full.initrd \
        overcloud-full.vmlinuz

md5sum ironic-python-agent.tar > ironic-python-agent.tar.md5
md5sum overcloud-full.tar > overcloud-full.tar.md5

rm -rf {{ images_working_dir }}/overcloud-full.d {{ images_working_dir }}/ironic-python-agent.d/ sudo chown $USER: {{ images_working_dir }}/overcloud-full.* {{ images_working_dir }}/ironic-python-agent.*

source '{{ build_repo_dir }}/dlrn-venv/bin/activate'
set -xeo pipefail
rdopkg findpkg -s '{{ artg_change.project | basename }}' -l rdoinfo | \
  awk '/^name/{print $2}; {print "findpkg: " $0 > "/dev/stderr"}'

cp -raf {{ artg_repos_dir | dirname  }}/{{ artg_change.project }} {{ build_repo_dir }}/DLRN/data/{{ project_name_mapped.stdout }}

{{ artg_change.distgit.host }}/{{ artg_change.distgit.project }}

{{ build_repo_dir }}/DLRN/data/{{ project_name_mapped.stdout }}_distro

set +e; source {{ build_repo_dir }}/dlrn-venv/bin/activate; while true; do
    dlrn --config-file projects.ini --head-only --package-name {{ project_name_mapped.stdout }} --local --info-repo rdoinfo --dev;
    if [ $? -eq 0 ]; then
        # SUCCESS
        break;
    elif [ $? -eq 1 ]; then
        # FAILED
        exit 1;
    elif [ $? -eq 2 ]; then
        # RETRY
        continue;
    fi;
    # Unexpected DLRN return code
    exit $?;
done;

ansible_user_dir is not defined or ansible_python is not defined or ansible_processor_vcpus is not defined or ansible_pkg_mgr is not defined or ansible_distribution is not defined

{% if ansible_python.version.major == 3 %} python3-libselinux {% else %} libselinux-python {% endif %}

(release in ['queens']) or (lookup('env', 'ZUUL_BRANCH') | replace('stable/', '') in ['queens'])

{% if ansible_python.version.major == 3 %} python3-virtualenv {% else %} python-virtualenv {% endif %}

source {{ build_repo_dir }}/dlrn-venv/bin/activate; pip install -r requirements.txt; python setup.py install;

set -o pipefail ; gawk '{ print $0 }; /^# repos$/ { exit }' {{ build_repo_dir }}/DLRN/scripts/{{ initial_dlrn_config }}.cfg > {{ build_repo_dir }}/DLRN/scripts/{{ initial_dlrn_config }}-local.cfg; cat /etc/yum.repos.d/quickstart-{{ ansible_distribution | lower }}-*.repo >> {{ build_repo_dir }}/DLRN/scripts/{{ initial_dlrn_config }}-local.cfg; find /etc/yum.repos.d -name "delorean*repo" ! -name "delorean*build-deps.repo" -exec cat {} \; -exec echo ""  \; >> {{ build_repo_dir }}/DLRN/scripts/{{ initial_dlrn_config }}-local.cfg; find /etc/yum.repos.d -name "delorean*build-deps.repo" -exec sed 's/enabled=.*/enabled=1/g' {} \; >> {{ build_repo_dir }}/DLRN/scripts/{{ initial_dlrn_config }}-local.cfg; {% if ansible_distribution|lower == "redhat" and ansible_distribution_major_version == "8" %} find /etc/yum.repos.d -name "rh-cloud.repo" -exec sed 's/enabled=.*/enabled=1/g' {} \; >> {{ build_repo_dir }}/DLRN/scripts/{{ initial_dlrn_config }}-local.cfg; {% endif %} echo '"""' >> {{ build_repo_dir }}/DLRN/scripts/{{ initial_dlrn_config }}-local.cfg; mkdir -p /tmp/fake-dlrn-repos/current; touch /tmp/fake-dlrn-repos/delorean-deps.repo; touch /tmp/fake-dlrn-repos/current/delorean.repo;

sed -i -e 's%--postinstall%%' {{ build_repo_dir }}/DLRN/scripts/build_rpm.sh

{{ lookup('env', 'ZUUL_URL')|default('https://review.opendev.org', true) }}

{{ zuul.override_checkout | default(lookup('env', 'ZUUL_BRANCH')) }}

release in item.branch or (zuul.project.name | default("") == "rdoinfo")

    dlrn --config-file projects.ini --head-only --package-name {{ artg_rdo_packages|join(' --package-name ') }} --local --info-repo rdoinfo --dev --order;
        # SUCCESS
        break;
        # FAILED
        exit 1;
        # RETRY
        continue;
    fi;
    exit $?;
done;

set -o pipefail && rm -rf {{ build_repo_dir }}/gating_repo/*; find {{ build_repo_dir }}/DLRN/data/repos -type f -name '*.rpm' -print0 | xargs -0 cp -t {{ build_repo_dir }}/gating_repo;

{{ lookup('env', 'ZUUL_CHANGES')|regex_replace('openstack/', '') }}

{{ zuul_changes|regex_replace(':[a-z/]*:refs/changes/\d{2}/\d+/\d+','') }}

{{ zuul_changes | intersect(projects_need_build_list|default(default_projects_need_build_list)) }}

update_containers is defined and update_containers|bool and update_containers_append_tag is undefined

\1 {{ docker_registry_host }}/{{ docker_registry_namespace_used }}

/home/{{ undercloud_user }}/src/opendev.org/openstack/tripleo-ci/{{ item }}

{{ artcl_collect_dir }}/{{ old_reproducer_dir }}/featureset-override.yaml

{{ artcl_collect_dir }}/{{ old_reproducer_dir }}/reproducer-quickstart.sh

{{ artcl_collect_dir }}/{{ zuul_reproducer_dir }}/featureset-override.yaml

{{ lookup('file', '/home/{{ undercloud_user }}/workspace/logs/releases.sh') | replace('export' , '            export') }}

{{ lookup('file', '/home/{{ undercloud_user }}/src/opendev.org/openstack/tripleo-ci/featureset-override.yaml') }}

{{ artcl_collect_dir }}/{{ zuul_reproducer_dir }}/launcher-env-setup-playbook.yaml

{{ artcl_collect_dir }}/{{ zuul_reproducer_dir }}/launcher-playbook.yaml

{{ artcl_collect_dir }}/{{ zuul_reproducer_dir }}/reproducer-zuul-based-quickstart.sh

{{ artcl_collect_dir }}/{{ zuul_reproducer_dir }}/reproducer-fresh-box-setup.sh

/home/{{ undercloud_user }}/src/opendev.org/openstack/tripleo-quickstart/{{ item }}

{{ artcl_collect_dir }}/{{ zuul_reproducer_dir }}/install-deps.sh

{{ artcl_collect_dir }}/{{ zuul_reproducer_dir }}/reproducer-zuul-based-quickstart.tar

~{{ supplemental_user }}/deploy_freeipa.sh &> ~{{ supplemental_user }}/deploy_freeipa.log

{{ lookup("env", "WORKSPACE") }}/tripleo-quickstart/quickstart-extras-requirements.txt

file://{{ lookup("env", "WORKSPACE") }}/{{ gated_project_name }}/#egg={{ gated_project_name }}

set -o pipefail && {{ ib_repo_workdir }}/install-built-repo.sh 2>&1 {{ timestamper_cmd }} > {{ ib_repo_install_log }}

src={{ ib_repo_file_path }} dest={{ local_working_dir }}/gating_repo.tar.gz flat=yes

src={{ local_working_dir }}/gating_repo.tar.gz dest=/tmp/gating_repo.tar.gz

_vc_args="{{ _vc_args }} --upload {{ item.src }}:{{ item.dest }}"

_vc_args="{{ _vc_args }} --install {{ modify_image_install_packages|join(",") }}"

_vc_args="{{ _vc_args }} --root-password password:{{ modify_image_vc_root_password }}"

virt-customize {{ _vc_args }} -a {{ image_to_modify }} > {{ working_dir }}/{{ modify_script|default('modify_image')|replace('/','_') }}.log 2>&1

{{ lookup( 'env', 'LIBGUESTFS_BACKEND_SETTINGS')|default('force_tcg', true) }}

virt-copy-out -a {{ image_to_modify }} {{ item }} {{ modify_image_working_dir }}

In order to use this role image_to_modify and modify_script must be
provided.

image_to_modify is not defined or (modify_script is not defined and modify_image_upload_files == [])

qemu-img convert -f qcow2 -O raw {{ image_to_modify_qcow }} {{ image_to_modify_raw }}; rm -rf "{{ image_to_modify_qcow }}";

kpartx -avs {{ image_to_modify_raw }}; mount /dev/mapper/loop0p1 {{ mount_tempdir }} || mount /dev/loop0 {{ mount_tempdir }};

set -o pipefail && gunzip -c {{ image_to_modify_abs_path.stdout }} | cpio -i

chmod 775 {{ mount_tempdir }}; mount -o bind /dev {{ mount_tempdir }}/dev/; mv {{ mount_tempdir }}/etc/resolv.conf{,_}; echo -e "nameserver 8.8.8.8\nnameserver 8.8.4.4" > {{ mount_tempdir }}/etc/resolv.conf; cp {{ modify_script }} {{ mount_tempdir }}/tmp/{{ modify_script|basename }}; {% if initramfs_image|bool %}sed -i "s/sudo //g" {{ mount_tempdir }}/tmp/{{ modify_script|basename }};{% endif %} set -o pipefail && chroot {{ mount_tempdir }} /bin/bash /tmp/{{ modify_script|basename }} 2>&1 {{ timestamper_cmd }} > {{ working_dir }}/{{ modify_script|basename }}.$(date +%s).log; mv -f {{ mount_tempdir }}/etc/resolv.conf{_,};

cp {{ mount_tempdir }}/{{ item }} {{ modify_image_working_dir }}/;

set -o pipefail && umount {{ mount_tempdir }}/dev/; pushd {{ mount_tempdir }}; find . -print | cpio -o -H newc | gzip > {{ image_to_modify_abs_path.stdout }}; popd; rm -rf "{{ mount_tempdir }}";

chroot {{ mount_tempdir }} setfiles /etc/selinux/targeted/contexts/files/file_contexts / ; umount {{ mount_tempdir }}/dev/; umount {{ mount_tempdir }}; kpartx -dv {{ image_to_modify_raw }}; qemu-img convert -c -f raw -O qcow2 {{ image_to_modify_raw }} {{ image_to_modify_qcow }}; rm -rf "{{ image_to_modify_raw }}"; losetup -d /dev/loop0; rm -rf "{{ mount_tempdir }}"; chown -R {{ undercloud_user }}: /home/{{ undercloud_user }}/;

echo "Executing 'openstack stack delete {{ stack_name }} --yes'" >>  {{ stack_log }}; openstack stack delete {{ stack_name }} --yes &>> {{ stack_log }} && { export COUNTER=0;
  while openstack stack show {{ stack_name }} &>> {{ stack_log }} ; do
    if [ $COUNTER -lt 10 ]; then
      sleep 30;
      if openstack stack show {{ stack_name }} | grep FAILED ; then
        echo "Failed deleting OVB stack" | tee -a {{ stack_log }};
        openstack stack show {{ stack_name }} &>> {{ stack_log }};
        openstack stack failures list --long {{ stack_name }} &>> {{ stack_log }} || echo 'Failed to list stack failures' >> {{ stack_log }};
        # NOTE(emilien) "openstack overcloud failures" was introduced in Rocky
        openstack overcloud failures &>> {{ stack_log }} || echo 'Failed to list deployment failures' >> {{ stack_log }};
        exit 0;
      fi;
      COUNTER=$((COUNTER+1));
    fi;
  done; } || echo "No stack {{ stack_name }} present" >> {{ stack_log }}

Please install openstack client as it is required for running this role

openstack image list --long -f value -c ID --public --property latest=centos-7-latest | tail -1

set -o pipefail && openstack keypair show {{ key_name }} && echo "{{ key_name }} already exists" || openstack keypair create --public-key {{ key_location }} {{ key_name }} 2>&1 | tee -a {{ stack_log }}

echo "Executing 'openstack stack create {{ stack_name }} --template {{ local_working_dir }}/multinode_stack.yaml -e {{ local_working_dir }}/params_multinode.yaml &>> {{ stack_log }}'" | tee -a {{ stack_log }}; openstack stack create {{ stack_name }} --template {{ local_working_dir }}/multinode_stack.yaml -e {{ local_working_dir }}/params_multinode.yaml &>> {{ stack_log }} || exit 1; export COUNTER=0;
  while ! openstack stack show {{ stack_name }} | grep CREATE_COMPLETE; do
    if [ $COUNTER -lt 30 ]; then
      sleep 10;
        echo "Failed to create multinode stack {{ stack_name }}" | tee -a {{ stack_log }};
        openstack stack show {{ stack_name }} >> {{ stack_log }} 2>&1;
        openstack stack failures list --long {{ stack_name }} >> {{ stack_log }} 2>&1 || echo 'Failed to list stack failures' >> {{ stack_log }};
        exit 0;
      fi;
    fi;
  done;
  openstack stack show "{{ stack_name }}" >>  {{ stack_log }};

Failed to create multinode stack {{ stack_name }}, check log: {{ stack_log }}

openstack stack output show {{ stack_name }} subnode_ip_pairs -c output_value -f value

ssh -o BatchMode=yes -o "StrictHostKeyChecking=no" {{ default_image_user }}@{{ hostvars[item].ansible_host }} -i "{{ private_key_location }}"

git config --global user.email "user@example.com"; git config --global user.name "CI user"

NODEPOOL_PROVIDER={% if rdo_cloud_provider|bool %}
rdo-cloud-tripleo
{% else %}
fake-cloud
{% endif %}
NODEPOOL_CLOUD=fake-cloud
NODEPOOL_REGION=FAKE
NODEPOOL_AZ=

ssh-keygen -N "" -f /etc/nodepool/id_rsa; chmod 600  /etc/nodepool/id_rsa;

dd if=/dev/zero of=/root/swapfile bs=1024 count={{ subnode_swap_size }}; chmod 600 /root/swapfile; mkswap /root/swapfile; swapon /root/swapfile; echo "/root/swapfile swap swap defaults 0 0" >> /etc/fstab;

for key in {{ hostvars[item].subnode_public_ip }} {{ hostvars[item].subnode_private_ip }}; do
  if ! grep -q $key /etc/ssh/ssh_known_hosts ; then
    ssh-keyscan $key >> /etc/ssh/ssh_known_hosts
  fi
done

export dir={{ item.split(':')[0].split('/')[1] }}
export refs={{ item.split(':')[2] }}
if [[ ! -e $dir ]]; then
  git clone {{ repo_item }}
  cd $dir
  git fetch {{ repo_item }} $refs && git checkout FETCH_HEAD
else
  cd $dir
  git fetch {{ repo_item }} $refs && git cherry-pick --allow-empty FETCH_HEAD
fi
git rebase {{ stable_release|default('master', true) }}

set -o pipefail && {{ local_working_dir }}/cleanup-stacks-keypairs.sh 2>&1 {{ timestamper_cmd }} > {{ cleanup_stacks_keypairs_log }}

Network isolation type 'multi-nic' is deprecated in R release, please use 'multiple-nics'.

export OS_USERNAME="{{ os_username }}"; export OS_PASSWORD="{{ os_password }}"; export OS_TENANT_NAME="{{ os_tenant_name }}"; export OS_AUTH_URL="{{ os_auth_url }}"; nova keypair-add --pub-key {{ existing_key_location }}.pub key-{{ idnum }}

export OS_CLIENT_CONFIG_FILE="{{ local_working_dir }}/clouds.yaml"; export OS_CLOUD="{{ cloud_name }}"; {{ ovb_dir }}/bin/deploy.py --env {{ local_working_dir }}/env-{{ idnum }}.yaml --name {{ stack_name }} --quintupleo

export OS_USERNAME="{{ os_username }}"; export OS_PASSWORD="{{ os_password }}"; export OS_TENANT_NAME="{{ os_tenant_name }}"; export OS_AUTH_URL="{{ os_auth_url }}"; export STACK_LOG="{{ local_working_dir }}/ovb_create_stack.log"; export COUNTER=0; while ! openstack stack show {{ stack_name }} | grep CREATE_COMPLETE; do
  if [ $COUNTER -lt 10 ]; then
    sleep 30;
    if openstack stack show {{ stack_name }} | grep FAILED ; then
      echo "Failed OVB stack" > $STACK_LOG;
      openstack stack show {{ stack_name }} >> $STACK_LOG 2>&1;
      openstack stack failures list --long {{ stack_name }} >> $STACK_LOG 2>&1 || echo 'Failed to list stack failures' >> $STACK_LOG;
      exit 0;
    fi;
    COUNTER=$((COUNTER+1));
  fi;
done; openstack stack show "{{ stack_name }}" | grep "status"

Stack {{ stack_name }} did not deploy successfully. See the stack status message above.

export OS_USERNAME="{{ os_username }}"; export OS_PASSWORD="{{ os_password }}"; export OS_TENANT_NAME="{{ os_tenant_name }}"; export OS_AUTH_URL="{{ os_auth_url }}"; openstack stack show {{ stack_name }} -f json -c outputs

ssh -o BatchMode=yes -o "StrictHostKeyChecking=no" root@{{ undercloud_ip }} -i "{{ undercloud_key }}"

chdir={{ local_working_dir }} export OS_CLIENT_CONFIG_FILE="{{ local_working_dir }}/clouds.yaml"; export OS_CLOUD="{{ cloud_name }}"; {{ ovb_dir }}/bin/build-nodes-json --env {{ local_working_dir }}/env-{{ idnum }}.yaml --driver {{ baremetal_driver }}

export OS_USERNAME="{{ os_username }}"; export OS_PASSWORD="{{ os_password }}"; export OS_TENANT_NAME="{{ os_tenant_name }}"; export OS_AUTH_URL="{{ os_auth_url }}"; nova keypair-delete key-{{ idnum }}

set -o pipefail && {{ working_dir }}/overcloud-delete.sh 2>&1 {{ timestamper_cmd }} > {{ delete_log }}

source {{ working_dir }}/stackrc
openstack stack show $(cat {{ working_dir }}/overcloud_id) -f yaml

{{ extra_tht_config_args|default('') }} {% if extra_tht_configs|default([])|length > 0 %} -e {{ extra_tht_configs | default([]) | map('basename') | map('regex_replace', '(.*)', "{{ working_dir }}/\1") | join (' -e ') }} {% endif %}

(deploy_steps_ansible_workflow|bool) and (deploy_multinode|bool)

composable_roles|bool and generate_overcloud_roles is not defined

set -o pipefail && {{ working_dir }}/overcloud-deploy-cell.sh 2>&1 {{ timestamper_cmd }} > {{ deploy_cell_log }}

set -o pipefail && {{ working_dir }}/overcloud-deploy.sh 2>&1 {{ timestamper_cmd }} > {{ deploy_log }}

set -o pipefail && {{ working_dir }}/deployed_server_prepare.sh 2>&1 {{ timestamper_cmd }} > {{ deployed_server_prepare_log }}

echo '{ "overcloud_deploy_result": "failed" }' > "{{ local_working_dir }}/overcloud_deployment_result.json"

echo '{ "overcloud_deploy_result": "passed" }' > "{{ local_working_dir }}/overcloud_deployment_result.json"

set -o pipefail && {{ working_dir }}/overcloud-deploy-post.sh 2>&1 {{ timestamper_cmd }} > {{ post_deploy_log }}

{% if cell_topology_map.CellController is defined -%}
{{ cell_topology_map.CellController.scale }}
1
{%- endif %}

{% if cell_topology_map.CellController is defined and cell_topology_map.CellController.flavor is defined -%}
{{ cell_topology_map.CellController.flavor }}
baremetal

{% if cell_topology_map.Compute is defined -%}
{{ cell_topology_map.Compute.scale }}
0

-r {{ working_dir }}/{{ cell_name }}/cell_roles_data.yaml -e {{ working_dir }}/{{ cell_name }}/cell-input.yaml -e {{ working_dir }}/{{ cell_name }}/cell.yaml --stack {{ cell_name }}

Network isolation types 'multi-nic', 'bond_with_vlans', 'single_nic_vlans' are deprecated in R release, please use 'multiple-nics', 'bond-with-vlans', 'single-nic-vlans'.

network_isolation_type in ["single_nic_vlans", "bond_with_vlans", "multi-nic"]

-e {{ overcloud_templates_path }}/environments/network-isolation.yaml -e {{ overcloud_templates_path }}/environments/net-single-nic-with-vlans.yaml -e {{ working_dir }}/network-environment.yaml

network_isolation_type in ["single_nic_vlans", "single-nic-vlans"]

-e {{ overcloud_templates_path }}/environments/network-isolation.yaml -e {{ overcloud_templates_path }}/environments/net-bond-with-vlans.yaml -e {{ working_dir }}/network-environment.yaml

network_isolation_type in ["bond_with_vlans", "bond-with-vlans"]

-e {{ overcloud_templates_path }}/environments/network-isolation.yaml -e {{ overcloud_templates_path }}/environments/net-multiple-nics.yaml -e {{ working_dir }}/network-environment.yaml

-e {{ overcloud_templates_path }}/environments/network-isolation-v6.yaml -e {{ overcloud_templates_path }}/environments/net-multiple-nics-v6.yaml -e {{ working_dir }}/network-environment.yaml

-e {{ overcloud_templates_path }}/environments/network-isolation.yaml -e {{ working_dir }}/network-environment.yaml

-e {{ overcloud_templates_path }}/environments/puppet-pacemaker.yaml

{{ deploy_args| regex_replace('^.*--control-scale +([0-9]+).*$', '\1') | regex_replace('^[^ 0-9]+$', '1') }}

{% if topology_map.Controller is defined -%}
{{ topology_map.Controller.scale }}
1

-e {{ overcloud_templates_path }}/environments/cinder-backup.yaml

-e {{ working_dir }}/enable-tls.yaml -e {{ overcloud_templates_path }}/environments/ssl/tls-endpoints-public-ip.yaml

ssl_overcloud|bool or undercloud_generate_service_certificate|bool

-e {{ overcloud_templates_path }}/environments/services/haproxy-public-tls-certmonger.yaml -e {{ overcloud_templates_path }}/environments/ssl/enable-internal-tls.yaml -e {{ overcloud_templates_path }}/environments/ssl/tls-everywhere-endpoints-dns.yaml

-e {{ overcloud_templates_path }}/environments/low-memory-usage.yaml

{% if release in ['pike', 'queens', 'rocky'] %} -e {{ overcloud_templates_path }}/environments/docker.yaml {% endif %} {% if enable_pacemaker|bool or osp_release is defined%} -e {{ overcloud_templates_path }}/environments/docker-ha.yaml {% endif %} {% if release in ['ocata', 'pike', 'queens', 'rocky'] %} -e {{ working_dir }}/containers-default-parameters.yaml {% else %} -e {{ working_dir }}/containers-prepare-parameter.yaml {% endif %} {% if release not in ['pike', 'queens', 'rocky'] %} -e {{ overcloud_templates_path }}/environments/{{ overcloud_container_cli }}.yaml {% endif %}

openstack overcloud roles generate --roles-path {{ overcloud_templates_path }}/roles -o {{ working_dir }}/overcloud_roles.yaml {{ generate_overcloud_roles }}

{{ composable_args }} -e {{ working_dir }}/overcloud_services.yaml

-e {{ overcloud_templates_path }}/environments/deployed-server-environment.yaml {% if release in ['queens', 'rocky', 'stein'] and overcloud_release|default('') in ['queens', 'rocky', 'stein'] %} -e {{ overcloud_templates_path }}/environments/deployed-server-bootstrap-environment-centos.yaml {% endif %} --overcloud-ssh-user {{ undercloud_user }} {% if not undercloud_enable_nova|bool %} --deployed-server {% endif %}

-e {{ overcloud_templates_path }}/environments/deployed-server-environment.yaml {% if release in ['queens', 'rocky', 'stein'] and overcloud_release|default('') in ['queens', 'rocky', 'stein'] %} -e {{ overcloud_templates_path }}/environments/deployed-server-bootstrap-environment-centos.yaml {% endif %} -e {{ working_dir }}/overcloud-baremetal-deployed.yaml --deployed-server

-e {{ overcloud_templates_path }}/environments/services/neutron-ovn-ha.yaml

-e {{ overcloud_templates_path }}/ci/environments/{{ composable_scenario }}

-e {{ overcloud_templates_path }}/environments/enable-swap-partition.yaml

{{ network_args }} -e {{ working_dir }}/overcloud_network_params.yaml

{{ storage_args }} -e {{ working_dir }}/overcloud_storage_params.yaml

{{ ((ci_job_end_time|int - lookup('pipe','date +%s')|int)/60)|int -15 }}

{{ ((ci_job_end_time|int - lookup('pipe','date +%s')|int)/60)|int -5 }}

Network isolation type 'bond_with_vlans' is deprecated in R release, please use 'bond-with-vlans'.

network_isolation_type is defined and network_isolation_type == "bond_with_vlans"

{{ network_environment_args | combine(public_virtual_fixed_ips) }}

network_isolation|bool and undercloud_type != "baremetal" or deployed_server|bool

set -o pipefail && {{ working_dir }}/bond-with-vlans-copy-nic-configs.sh 2>&1 {{ timestamper_cmd }} > {{ bond_with_vlans_nic_configs_log }}

overcloud_templates_refspec is defined or overcloud_templates_branch is defined

-e {{ overcloud_templates_path }}/environments/docker.yaml -e {{ overcloud_templates_path }}/ci/environments/{{ composable_scenario }}

ansible_user_dir is not defined or ansible_python is not defined

set -o pipefail && {{ working_dir }}/{{ overcloud_prep_containers_script }} 2>&1 {{ timestamper_cmd }} > {{ overcloud_prep_containers_log }}

set -o pipefail && {{ working_dir }}/overcloud-prep-flavors.sh 2>&1 {{ timestamper_cmd }} > {{ overcloud_prep_flavors_log }}

set -o pipefail && {{ working_dir }}/overcloud-prep-images.sh 2>&1 {{ timestamper_cmd }} > {{ overcloud_prep_images_log }}

set -o pipefail && {{ working_dir }}/overcloud-prep-network.sh 2>&1 {{ timestamper_cmd }} > {{ overcloud_prep_network_log }}

set -eo pipefail
nova list | grep -m 1 {{ node_to_scale }} | sed -e 's/|//g' | awk '{print $1}'

nova list | grep -m 1 {{ node_to_scale }} | sed -e 's/|//g' | awk '{print $2}'

cat {{ working_dir }}/delete-node.sh; set -o pipefail && {{ working_dir }}/delete-node.sh 2>&1 {{ timestamper_cmd }} > delete_node_scale_console.log;

nova list | grep {{ node_to_scale }} | cut -f2- -d':' | wc -l

sed -i '/{{ node_name_to_delete.stdout }}/d' {{ local_working_dir }}/hosts

Overcloud nova list does not show expected number of {{ node_to_scale }} services

{{ scale_args| regex_replace('^.*--control-scale +([0-9]+).*$', '\1') | regex_replace('^[^ 0-9]+$', '1') }}

source {{ working_dir }}/stackrc; set -o pipefail && {{ working_dir }}/scale-deployment.sh 2>&1 {{ timestamper_cmd }} > overcloud_deployment_scale_console.log;

set -o pipefail && {{ working_dir }}/overcloud-create-ssl-cert.sh 2>&1 {{ timestamper_cmd }} > {{ overcloud_ssl_cert_log }}

{%- set names=[] -%} {%- for n in overcloud_nodes -%}
  {%- if names.append(hostvars[n['name']]['inventory_hostname']) -%}{%- endif -%}
{%- endfor -%} {{ names | join('|') }}

while true
do virsh list | grep -E '{{ libvirt_oc_names }}' > /dev/null || break
done

qemu-img commit {{ libvirt_volume_path }}/{{ item.name }}.qcow2

mv {{ libvirt_volume_path }}/{{ item.name }}.qcow2 {{ libvirt_volume_path }}/{{ item.name }}.qcow2.bak
qemu-img create -f qcow2 -b {{ libvirt_volume_path }}/{{ item.name }}.qcow2.bak {{ libvirt_volume_path }}/{{ item.name }}.qcow2

rm {{ libvirt_volume_path }}/{{ item.name }}.qcow2

set -o pipefail && {{ working_dir }}/standalone-container-prep.sh 2>&1 {{ timestamper_cmd }} > {{ working_dir }}/{{ standalone_container_prep_log }}

 namespace: {{ docker_registry_host }}/{{ docker_registry_namespace }}

{% if job.add_repos[item|int].update_container|default(false) -%} {{ job.add_repos[item|int].reponame }} {% endif -%}

{{ add_repo_update_list_result.results | map(attribute='ansible_facts.add_repo_update_list') | list }}

#
    push_destination: "{{ local_docker_registry_host }}:8787"
    modify_role: tripleo-modify-image
    modify_append_tag: "{{ update_containers_append_tag }}"
    {% if osp_release is defined -%}
    # no kolla labels are defined
    {% else -%}
    modify_only_with_labels:
    - kolla_version
    {% endif -%}
    modify_vars:
      tasks_from: yum_update.yml
      yum_repos_dir_path: /etc/yum.repos.d
      update_repo: "{{ standalone_container_prep_update_repo }}{{ add_repos_update|default('') }}"

set -o pipefail && {{ working_dir }}/standalone.sh 2>&1 {{ timestamper_cmd }} > {{ working_dir }}/{{ standalone_deploy_log }}

find $(ls -rtd {{ working_dir }}/undercloud-ansible-* | tail -1)/ -name '*playbook*.yaml'

source {{ quickstart_venv }}/bin/activate; exec 1>>{{ working_dir }}/{{ standalone_ansible_lint_log }}; exec 2>&1; echo LINTING {{ item }}; ansible-lint -v {{ item }}; rc=$?; echo DONE rc=$rc; exit $rc

/usr/share/ansible-modules/:{{ lookup('env', 'ANSIBLE_LIBRARY') }}

set -o pipefail && {{ working_dir }}/standalone-container-prep-upgrade.sh 2>&1 {{ timestamper_cmd }} > {{ working_dir }}/{{ standalone_container_prep_log }}

set -o pipefail && {{ working_dir }}/standalone-upgrade.sh 2>&1 {{ timestamper_cmd }} > {{ working_dir }}/{{ standalone_upgrade_log }}

set -o pipefail && {{ working_dir }}/{{ script_name }} 2>&1 {{ timestamper_cmd }} > {{ custom_tht_log }}

{{ val_working_dir }}/run-preintro-validations-negative-tests.sh

{{ val_working_dir }}/run-tripleo-validations.sh {{ item }} > {{ val_working_dir }}/validations_{{ item }}.log 2>&1

set -o pipefail && {{ val_working_dir }}/run-preintro-validations-negative-tests.sh 2>&1 {{ timestamper_cmd }} > {{ run_preintro_val_log }}

awk 'match($0, /nameserver\s+(([0-9]{1,3}.?){4})/,address){ print address[1] }' /etc/resolv.conf

WARNING: The variable undercloud_hieradata_override_file
is deprecated for removal since Pike.
Reason: Both the undercloud and overcloud can use
hieradata overrides and we must distinguish between the two.
The variable will be removed in the "R" release.
Please revise your code to use the new variable,
and file name.

undercloud_install_cli_options == '--use-heat' or containerized_undercloud|bool

undercloud_templates_branch is defined or undercloud_templates_refspec is defined

set -o pipefail && {{ working_dir }}/undercloud-install.sh 2>&1 {{ timestamper_cmd }} > {{ undercloud_install_log }}

{%- if podman_ver is success -%} {{ podman_ver.stdout | replace("podman version ", "") }} {%- else -%}0.0 {%- endif -%}

deploy_supplemental_node|bool and not hostvars['supplemental'].freeipa_admin_password|default('')

freeipa_server_hostname is not defined or ( freeipa_server_hostname is defined and freeipa_server_hostname == "" )

overcloud_cloud_domain is not defined or ( overcloud_cloud_domain is defined and overcloud_cloud_domain == "" )

undercloud_undercloud_hostname is not defined or ( undercloud_undercloud_hostname is defined and undercloud_undercloud_hostname == "" )

set -o pipefail && {{ working_dir }}/install_novajoin.sh 2>&1 {{ timestamper_cmd }} > {{ working_dir }}/install_novajoin.sh.log

set -o pipefail && {{ working_dir }}/novajoin_prep.sh 2>&1 {{ timestamper_cmd }} > {{ working_dir }}/novajoin_prep.sh.log

awk -F= '$1 == "undercloud_admin_password" {print $2}' {{ working_dir }}/undercloud-passwords.conf

openstack catalog show heat --format value | grep public | awk -F '/' '{print $5}'

openstack catalog show swift --format value | grep public | awk -F '/' '{print $5}'

  'keystone': 'https://{{ hostvars[groups['virthost'][0]].ansible_default_ipv4.address }}/keystone/v3/',

  'keystone': 'https://{{ hostvars[groups['virthost'][0]].ansible_default_ipv4.address }}/keystone/v2/',

  'heat': 'https://{{ hostvars[groups['virthost'][0]].ansible_default_ipv4.address }}/heat/v1/{{ heat_public_url.stdout }}',

  'ironic': 'https://{{ hostvars[groups['virthost'][0]].ansible_default_ipv4.address }}/ironic',

  'ironic-inspector': 'https://{{ hostvars[groups['virthost'][0]].ansible_default_ipv4.address }}/ironic-inspector',

  'mistral': 'https://{{ hostvars[groups['virthost'][0]].ansible_default_ipv4.address }}/mistral/v2',

  'swift': 'https://{{ hostvars[groups['virthost'][0]].ansible_default_ipv4.address }}/swift/v1/{{ swift_public_url.stdout }}',

  'zaqar-websocket': 'wss://{{ hostvars[groups['virthost'][0]].ansible_default_ipv4.address }}/zaqar',

{{ hostvars[groups['virthost'][0]].ansible_default_ipv4.address }}

set -o pipefail && {{ working_dir }}/minion-install.sh 2>&1 {{ timestamper_cmd }} > {{ minion_install_log }}

callback_plugins={% if ansible_python.version.major == 3 %}/usr/local/lib/python3.6/site-packages{% else %}/usr/lib/python2.7/site-packages{% endif %}/ara/plugins/callbacks

action_plugins={% if ansible_python.version.major == 3 %}/usr/local/lib/python3.6/site-packages{% else %}/usr/lib/python2.7/site-packages{% endif %}/ara/plugins/actions

fi
atop_location=$(repoquery --repoid=osepel --repofrompath=osepel,$NODEPOOL_EPEL_MIRROR/7/x86_64/ --location atop)
{{ ansible_pkg_mgr }} install -y $atop_location

set -o pipefail && {{ working_dir }}/hostname.sh 2>&1 {{ timestamper_cmd }} > {{ working_dir }}/hostname.sh.log

{{ ansible_all_ipv4_addresses | first }} {{ ansible_hostname }}-unique

set fact for undercloud_fqdn override when undercloud_cloud_domain was provided

set fact for undercloud_fqdn override when we don't have a domain

set -o pipefail && {{ working_dir }}/ovb-undercloud-connectivity.sh 2>&1 {{ timestamper_cmd }} > {{ ovb_undercloud_connectivity_log }}

set -o pipefail && {{ working_dir }}/install_packages.sh 2>&1 {{ timestamper_cmd }} > {{ working_dir }}/install_packages.sh.log

set -o pipefail && timeout --preserve-status 60s {{ working_dir }}/toci_vxlan_networking_multinode.sh 2>&1 {{ timestamper_cmd }} > {{ working_dir }}/toci_vxlan_networking_multinode.sh.log

set -o pipefail && {{ working_dir }}/toci_vxlan_networking.sh 2>&1 {{ timestamper_cmd }} > {{ working_dir }}/toci_vxlan_networking.sh.log

set -o pipefail && {{ working_dir }}/vxlan_networking.sh 2>&1 {{ timestamper_cmd }} > {{ working_dir }}/vxlan_networking.sh.log

set -o pipefail && sudo ip link set dev {{ undercloud_local_interface }} up 2>&1 {{ timestamper_cmd }} >> {{ working_dir }}/vxlan_networking.sh.log

set -o pipefail && sudo ip link set dev {{ undercloud_local_interface }} mtu {{ vxlan_mtu }} 2>&1 {{ timestamper_cmd }} >> {{ working_dir }}/vxlan_networking.sh.log; echo "MTU={{ vxlan_mtu }}" | sudo tee -a /etc/sysconfig/network-scripts/ifcfg-{{ undercloud_local_interface }}

ping -c 6 -W 3 {{ vxlan_networking_addr_prefix }}.2 || (sudo systemctl restart openvswitch && ping -c 6 -W 3 {{ vxlan_networking_addr_prefix }}.2)

set -o pipefail && {{ working_dir }}/validate-overcloud-ipmi-connection.sh 2>&1 {{ timestamper_cmd }} | tee {{ working_dir }}/validate-overcloud-ipmi-connection.log

set -o pipefail && {{ local_working_dir }}/validate_minion_simple.sh | tee {{ validate_minion_simple_log }}

dstat -{{ dstat_options }} --nocolor --output /var/log/extra/{{ dstat_log_name }} {{ dstat_delay }} > /dev/null &

echo "/sys/kernel/debug/x86/{{ item }}: $(cat /sys/kernel/debug/x86/{{ item }})"

set -o pipefail && {{ working_dir }}/validate-sanity-check.sh 2>&1 {{ timestamper_cmd }} > {{ sanity_checks_log }}

{% raw %} podman ps -a --filter 'status=exited' --format '{{ .Names }} {{ .Status }}' {% endraw %}

Failed container detected. Please check the following locations
/var/log/extras/failed_containers.log
/var/log/extras/podman

{% raw %} docker ps -a --filter 'status=exited' --format '{{ .Names }} {{ .Status }}' {% endraw %}

/var/log/extras/docker

systemctl list-units --failed --plain --no-legend --no-pager "tripleo_*"

set -o pipefail && {{ working_dir }}/overcloud-validate.sh 2>&1 {{ timestamper_cmd }} > {{ validate_log }}

ansible_python is not defined or ansible_processor_vcpus is not defined

{{ working_dir }}/{% if tempest_undercloud %}stackrc{% else %}overcloudrc{% endif %}

{{ tempest_data }}/{% if tempest_undercloud %}stackrc{% else %}overcloudrc{% endif %}

WARNING: The variable test_regex is deprecated and will be removed by end of ROCKY release in the favor of test_white_regex.

tempest_format in ['container', 'packages'] and release not in ['newton', 'ocata']

source "{{ working_dir }}"/bugcheck/.venv/bin/activate; python bugcheck.py --skip-file "{{ working_dir }}/bugcheck/tempest_skip_{{ release }}.yml" --to-file "{{ working_dir }}/{{ skip_file }}" --format txt

set -o pipefail && {{ working_dir }}/tempest-setup.sh 2>&1 {{ timestamper_cmd }} > {{ tempest_log_file }}

cp -r "{{ working_dir }}/tempest/.stackviz/share/stackviz-html" "{{ working_dir }}/stackviz"

source "{{ working_dir }}/tempest/.stackviz/bin/activate"
stackviz-export {{ tempest_dstat_opt | default('') }} --env -f {{ working_dir }}/tempest/testrepository.subunit {{ working_dir }}/stackviz/data

cp -Rf --reflink=auto /var/lib/tempestdata/tempest {{ working_dir }}

{{ testr_dir.stat.exists | ternary(python_cmd + ' -m stestr.cli', 'testr') }}

set -o pipefail && {% if tempest_format == 'venv' %}source {{ working_dir }}/tempest_git/.venv/bin/activate; {% endif %} {{ testr_command }} last --subunit | subunit-1to2 > {{ working_dir }}/tempest/testrepository.subunit

set -o pipefail &&
{% if tempest_format == 'venv' %}source {{ working_dir }}/tempest_git/.venv/bin/activate; {% endif %}
subunit2html {{ working_dir }}/tempest/testrepository.subunit {{ working_dir }}/tempest/tempest.html

{%- if tempest_format == 'venv' -%}
source {{ working_dir }}/tempest_git/.venv/bin/activate;
{%- endif -%}
subunit2junitxml {{ working_dir }}/tempest/testrepository.subunit --output-to {{ working_dir }}/tempest/tempest.xml 2>&1 >> {{ tempest_log_file }}

{% if lookup('env', 'LOG_PATH') %}LOG_PATH='{{ lookup('env', 'LOG_PATH') }}' {% endif %} ./tempestmail.py -c {{ tempestmail_config }} --job "{{ lookup('env', 'JOB_NAME')|default('Periodic job', true) }}" --file "{{ working_dir }}/{{ tempest_log_file }}" --log-url "{{ tempestmail_log_server }}" --skip-file "{{ working_dir }}/tempestmail/tempest_skip_{{ release }}.yml" || { ERR=$?; echo -e "\0127ARNING: Send tempest results by mail failed with code $ERR"; exit $ERR; }

{{ item | regex_replace( '^python[0-9]*-(.*)$', python_package_prefix + '-\1' ) }}

{% if release == 'newton' %}/usr/share/openstack-tempest-*/tools/configure-tempest-directory{% else %}tempest init {{ tempest_dir }}{% endif %}

{% if release == 'newton' %}{{ tempest_dir }}/tools/config_tempest.py{% else %}/usr/bin/discover-tempest-config{% endif %}

{{ working_dir }}/tempest_git/tools/{% if release == 'newton' %}configure-tempest-directory{% else %}with_venv.sh tempest init{% endif %}

{% if release == 'newton' %}{{ working_dir }}/tools/config_tempest.py{% else %}{{ working_dir }}/tempest_git/tools/with_venv.sh discover-tempest-config{% endif %}

number_of_files=$(ls {{ tobiko_log_dir }} | grep -E "{{ tobiko_log_file_base }}-[0-9]+.log$" -c)
echo $(( $number_of_files + 1 ));

{{ tobiko_log_file_base }}-{{ current_tobiko_log_file_number.stdout }}.log

set -o pipefail && tools/ci/tox -e {{ tobiko_envlist }} {{ tobiko_extra_args }} 2>&1 {{ timestamper_cmd }} > {{ tobiko_log_dir }}/{{ tobiko_log_file }};

set -o pipefail && {{ testr_command }} last --subunit > {{ tobiko_log_dir }}/testrepository.subunit

subunit2html {{ tobiko_log_dir }}/testrepository.subunit {{ tobiko_log_dir }}/{{ tobiko_log_file }}.html

set -o pipefail && {{ local_working_dir }}/ui_validate_simple.sh | tee {{ ui_validate_simple_log }}

set -o pipefail && {{ working_dir }}/undercloud-install.sh 2>&1 {{ timestamper_cmd }} > {{ undercloud_reinstall_log }}

set -o pipefail && {{ working_dir }}/undercloud-sanity-check.sh 2>&1 {{ timestamper_cmd }} > {{ undercloud_sanity_check_log }}

find /var/cache/tripleo-quickstart/images/*  -mtime +3 -exec rm -rf {} \;

rm -rf /var/log/artib; rm -rf /home/oooq-images; rm -rf /var/lib/oooq-images; rm -rf /root/.cache/image-create;

set -euo pipefail; cat /etc/passwd | grep stack | awk -F ':' '{ print $3 }'

yum-complete-transaction; yum clean all; rm -Rfv /var/cache/yum;

yumdb search from_repo rhelosp-*-director* | egrep -v from_repo | grep -v '^$' | tail -n +2 

yumdb search from_repo rhelosp-*-p* | egrep -v from_repo | grep -v '^$' | tail -n +2 

yumdb search from_repo delorean* | egrep -v from_repo | grep -v '^$' | tail -n +2 

The required variable `role_name` is undefined. Check your settings.

ansible-galaxy init --role-skeleton=_skeleton_role_ --init-path=roles/ {{ _role_name }}

---
{% set items = molecule_yaml['content'] | b64decode | from_yaml %}
{% set job_index = [] %}
{% set new_job_name = "tripleo-validations-centos-7-molecule-" ~ _role_name %}
{% for item in items %}
{%   if 'project-template' in item %}
{%     if item['project-template']['name'] == "tripleo-validations-molecule-jobs" %}
{%       if not (new_job_name in item['project-template']['check']['jobs']) %}
{%         set _ = item['project-template']['check']['jobs'].append(new_job_name) %}
{%         set check_jobs = (item['project-template']['check']['jobs'] | sort) %}
{%         set _ = item['project-template']['check'].update({'jobs': check_jobs}) %}
{%       endif %}
{%       if not (new_job_name in item['project-template']['gate']['jobs']) %}
{%         set _ = item['project-template']['gate']['jobs'].append(new_job_name) %}
{%         set gate_jobs = (item['project-template']['gate']['jobs'] | sort) %}
{%         set _ = item['project-template']['gate'].update({'jobs': gate_jobs}) %}
{%       endif %}
{%     endif %}
{%   else %}
{%     if item['job']['name'] == new_job_name %}
{%       set _ = job_index.append(new_job_name) %}
{%     endif %}
{%   endif %}
{% if (job_index | length) < 1 %}
{%   set new_job = {
        "name": new_job_name,
        "parent": "tripleo-validations-centos-7-base",
        "files": [
          "^roles/" ~ _role_name ~ "/.*"
        ],
        "vars": {
          "tripleo_validations_role_name": _role_name
        }
      }
%}
{%   set _ = items.append({"job": new_job}) %}
{% endif %}
{{ items | to_nice_yaml(indent=2, width=1337) }}

---
- hosts: undercloud
  vars:
    metadata:
      name: The Validation name goes here
      description: >-
        Write a description of your validations
      groups:
        - no-op
        - prep
        - pre-introspection
        - post-introspection
        - openshift-on-openstack
        - pre-upgrade
        - post-upgrade
        - pre-ceph
        - post-ceph
    {{ role_name | replace('-', '_') }}_debug: false
  roles:
    - {{ role_name }}

{% set opening = 'Role - ' ~ _role_name %}
{{ '=' * (opening | length) }}
{{ opening }}

.. ansibleautoplugin::
  :role: roles/{{ _role_name }}

Panko has been deprecated since the Train Release. The 'ceilometerdb-size' validation is now considered as deprecated too.

'{{ panko_config_file }}[database]/{{ event_ttl_check }}' is set to -1 or not set

If planning to use Ceph, it is necessary to install the ceph-ansible package on the undercloud

Make sure ceph-ansible package is installed from {{ ceph_ansible_repo }}

(repo.stdout | length == 0 or repo.stdout != "{{ ceph_ansible_repo }}")

If planning to use Ceph, it is necessary to check {{ item[0] }} is installed!

If planning to use Ceph, it is necessary to install {{ item[0] }} package

{{ lookup('config', 'DEFAULT_HASH_BEHAVIOUR', on_missing='skip')|default('replace') }}

In order to simulate Tripleo Heat Template behavior this role requires
that it be run with Ansible's hash_behaviour set to merge. Please
re-run with 'export ANSIBLE_HASH_BEHAVIOUR=merge'"

{{ parameter_defaults['CinderBackupRbdPoolName']|default('backups') }}

{{ parameter_defaults['CinderRbdPoolName']|default('volumes') }}

{{ parameter_defaults['GnocchiRbdPoolName']|default('metrics') }}

{{ ceph_pools | default([]) + [dict(name=item, application='rbd') ] }}

One or more of following parameters is in use but is
deprecated in Stein and newer; ManilaCephFSDataPoolPGNum,
ManilaCephFSMetadataPoolPGNum, and ManilaCephFSShareBackendName

(parameter_defaults['ManilaCephFSDataPoolPGNum'] is defined or parameter_defaults['ManilaCephFSMetadataPoolPGNum'] is defined or parameter_defaults['ManilaCephFSShareBackendName'] is defined)

{{ parameter_defaults['ManilaCephFSDataPoolName']|default('manila_data') }}

{{ parameter_defaults['ManilaCephFSDataPoolPGNum']|default(128) }}

{{ parameter_defaults['ManilaCephFSMetadataPoolPGNum']|default(128) }}

resource_registry['OS::TripleO::Services::ManilaBackendCephFs'] is defined

{{ ceph_pools | default([]) + [dict(name=item, application='rgw') ] }}

resource_registry['OS::TripleO::Services::CephRgw'] != 'OS::Heat::None'

The pool {{ item.name }} should have an application set, e.g. {'name': {{ item.name }}, 'application': rbd}

The check_latest_packages_version role should have detected
that packages have available updates.

A newer version of the {{ item.name }} package is available: {{ item.new_version }}-{{ item.new_release }} (currently {{ item.current_version }}-{{ item.current_release }})

[DEFAULT]
local_subnet = 192.168.254.0/24
[192.168.254.0/24]
gateway = 8.8.8.8

The check_network_gateway validation didn't properly detect faulty
gateway!

:backends:
  - yaml
:yaml:
  :datadir: "/etc/puppet/"
:hierarchy:
  - "common"

{% if local_subnet.value %}{{ local_subnet.value }}{% else %}ctlplane-subnet{% endif %}

"local_ip.value | default('0.0.0.0', true) | ipaddr('address')" != "gateway.value | default('0.0.0.0', true) | ipaddr('address')"

{{ running_containers | difference(docker.containers_filtered | map(attribute='name') | list) }}

{{ hostvars[inventory_hostname].container_cli | default('podman', true) }}

{% if oc_container_cli is defined %}{{ oc_container_cli }}{% else %}{{ uc_container_cli }}{% endif %} {% raw %} ps -a --filter 'status=exited' --format '{{ .Names }} {{ .Status }}' {% endraw %}

nofiles is set to {{ nofilesval.stdout }}.  It should be at least {{ nofiles_min }} or higher, depending on available resources.

nproc is set to {{ nprocval.stdout }}.  It should be at least {{ nproc_min }} or higher, depending on available resources.

  - yaml
  - json
:yaml:
  - "common"

[ctlplane-subnet]
dhcp_start = 192.168.12.10
dhcp_end = 192.168.12.100

dhcp_end = 192.168.12.20

The ctlplane-ip-range validation didn't properly detect too short
range!

{{ lookup('ironic_nodes', 'provision_state', ['available'], wantlist=True) }}

{{ ((associated_nodes|length) + (available_nodes|length))|int }}

Not enough baremetal nodes - available: {{ available_count }}, requested: {{ requested_count }}

Only {{ statistics.count }} nodes are exposed to Nova of {{ available_count }} requests. Check that enough nodes are in 'available' state with maintenance mode off.

files/rogue_dhcp.py {{ interface.value or interface_deprecated.value or 'br-ctlplane' }}

files/rogue_dhcp.py {{ local_interface.value|default('eth1', true) }}

# This file managed by Puppet
global
  daemon
  group  haproxy
  log  /dev/log local0
  maxconn  100
  pidfile  /var/run/haproxy.pid
  ssl-default-bind-ciphers  !SSLv2:kEECDH:kRSA:kEDH:kPSK:+3DES:!aNULL:!eNULL:!MD5:!EXP:!RC4:!SEED:!IDEA:!DES
  ssl-default-bind-options  no-sslv3 no-tlsv10
  stats  socket /var/lib/haproxy/stats mode 600 level user
  stats  timeout 1s
  user  haproxy

defaults
  log  global
  mode  tcp
  retries  1
  timeout  http-request 1s
  timeout  queue 1s
  timeout  connect 1s
  timeout  client 1s
  timeout  server 1s
  timeout  check 1s

The haproxy role should have detected issues within haproxy
configuration file!

The 'global maxconn' value '{{ haproxy_conf.global.maxconn }}' must be greater than {{ global_maxconn_min }}

The 'defaults maxconn' value '{{ haproxy_conf.defaults.maxconn }}' must be greater than {{ defaults_maxconn_min }}

The 'timeout queue' option in 'defaults' is '{{ haproxy_conf.defaults['timeout queue'] }}', but must be set to {{ defaults_timeout_queue }}

haproxy_conf.defaults['timeout queue'] != defaults_timeout_queue

The 'timeout client' option in 'defaults' is '{{ haproxy_conf.defaults['timeout client'] }}', but must be set to {{ defaults_timeout_client }}

haproxy_conf.defaults['timeout client'] != defaults_timeout_client

The 'timeout server' option in 'defaults' is '{{ haproxy_conf.defaults['timeout server'] }}', but must be set to {{ defaults_timeout_server }}

haproxy_conf.defaults['timeout server'] != defaults_timeout_server

The 'timeout check' option in 'defaults' is '{{ haproxy_conf.defaults['timeout check'] }}', but must be set to {{ defaults_timeout_check }}

haproxy_conf.defaults['timeout check'] != defaults_timeout_check

systemctl list-unit-files | grep "^tripleo.*healthcheck.*enabled" | awk -F'.' '{print $1}'

{%- if inflight_healthcheck_services | length > 0 -%}
  {{ inflight_healthcheck_services }}
  {{ healthcheck_services_list.stdout_lines }}

systemd_healthcheck_state.status.ActiveState in ['inactive', 'failed']

The image_serve role should have detected httpd wasn't running or
index.json is absent.

http://{{ container_registry_host }}:{{ container_registry_port }}/v2/index.json

"{{ container_cli|default('podman', true) }}" exec -u root $("{{ container_cli|default('podman', true) }}" ps -q --filter "name=mysql|galera-bundle" | head -1) /bin/bash -c 'ulimit -n'

The open_files_limit option for mysql must be higher than {{ min_open_files_limit }}. Right now it's {{ mysqld_open_files_limit.stdout }}.

{% if oc_container_cli is defined %}{{ oc_container_cli }}{% else %}{{ uc_container_cli }}{% endif %} exec -u root {{ container_name }} /bin/bash -c 'neutron-sanity-check --config-file {{ item }}'

{{ nsc_return.results | sum(attribute='stderr_lines', start=[]) | select('search', '(ERROR)') | list | length | int > 0 }}

{{ nsc_return.results | sum(attribute='stderr_lines', start=[]) | select('search', '(WARNING)') | list | length | int > 0 }}

{{ nsc_return.results | sum(attribute='stderr_lines', start=[]) | select('search', '(ERROR|WARNING)') | list }}

{{ lookup('introspection_data', auth_url=ironic_auth_url.value, password=ironic_password.value) }}

{{ oc_ips.results | map(attribute='ansible_facts.ansible_host') | list }}

{{ ping_results.results | selectattr('failed', 'equalto', True) | map(attribute='item') | list }}

{{ lookup('nova_servers', 'ip', 'ctlplane', failed_ips, wantlist=True) }}

{{ lookup('ironic_nodes', 'instance_uuid', server_ids, wantlist=True) }}

{{ lookup('template', './templates/unreachable_nodes.j2',
template_vars=dict(nodes=nodes)) }}

(item.item == vif_plugging_fatal_check and (not item.value|bool or None)) or (item.item == vif_plugging_timeout_check and (item.value|int <= vif_plugging_timeout_value_min|int or None))

hiera -c /etc/puppet/hiera.yaml neutron::server::notifications::auth_url

[nova]/auth_url from {{ neutron_config_file }} is set to {{ neutron_auth_url_result.value or 'None' }} but it should be set to {{ auth_url.stdout }}.

[nova]/tenant_name from {{ neutron_config_file }} is set to {{ neutron_tenant_name_result.value or 'None' }} but it should be set to 'service'.

The nova_status validation didn't properly detect bad upgrade
status check!

action="$1"
shift
container="$3"
shift
command="$@"

case $container in
  'heat_api_cron')
    echo '# This is a comment that should be ignored'
    echo '0 12 14 2 * heat-manage purge_deleted'
    ;;
  'keystone_cron')
    echo '0 12 14 2 * keystone-manage token_flush'
    ;;
  'nova_api')
    exit 0
    ;;
  *)
    echo "Unknown container ${container}"
    ;;
esac

shift
shift

    echo '0 12 14 2 * some-other command'
    ;;
    ;;
    exit 2
    ;;
  *)
    ;;
esac

{{ container_cli }} exec -u root nova_api nova-status upgrade check

At least one check encountered an issue and requires further investigation.
This is considered a warning but the upgrade may be OK.

There was an upgrade status check failure that needs to be investigated.
This should be considered something that stops an upgrade.

This is a no-op action for testing that the validations framework runs

{{ overcloud_keystone_url | urlsplit('scheme') }}://{{ overcloud_keystone_url | urlsplit('netloc') }}/v3/auth/tokens

nova_url="{{ keystone_result.json.token | json_query("catalog[?name=='nova'].endpoints") | first | selectattr('interface', 'equalto', 'public') | map(attribute='url') | first }}"

glance_url="{{ keystone_result.json.token | json_query("catalog[?name=='glance'].endpoints") | first | selectattr('interface', 'equalto', 'public') | map(attribute='url') | first }}"

{{ nova_url }}/flavors/detail?minRam={{ min_node_ram_testing }}&minDisk={{ min_node_disk_testing }}

{{ nova_url }}/flavors/detail?minRam={{ min_node_ram_prod }}&minDisk={{ min_node_disk_prod }}

{{ flavors_result_prod.json.flavors | selectattr('vcpus', 'ge', 4) | list | length > 0 }}

hv_stats.disk_available_least >= min_total_disk_testing and hv_stats.free_ram_mb >= min_total_ram_testing and hv_stats.vcpus - hv_stats.vcpus_used >= min_total_vcpus_testing

hv_stats.disk_available_least >= min_total_disk_prod and hv_stats.free_ram_mb >= min_total_ram_prod and hv_stats.vcpus - hv_stats.vcpus_used >= min_total_vcpus_prod

{{ images.json.images | map(attribute='name') | map('lower') | select('search', '(centos|rhel)') | list | length | int > 0 }}

{{ lookup('template', './templates/openshift-hw-requirements-warnings.j2') }}

not matching_flavors_testing or not matching_image or not resource_reqs_testing

not matching_flavors_prod or not matching_image or not resource_reqs_prod

This validation should be executed on the Undercloud with a working Overcloud.

neutron_url="{{ keystone_result.json.token | json_query("catalog[?name=='neutron'].endpoints") | first | selectattr('interface', 'equalto', 'public') | map(attribute='url') | first }}"

No external network found. It is strongly recommended that you
configure an external Neutron network with a floating IP address
pool.

"The `HorizonPublic` endpoint is not defined in the `EndpointMap` of the deployed stack. This means Horizon may not have been deployed correctly."

"The `KeystoneURL` output is not available in the deployed stack."

ovs-vsctl --no-wait get Open_vSwitch . other_config:pmd-cpu-mask

The rabbitmq_limits validation didn't properly detect bad rabbitmq
setting!

shift
container="$1"
shift

case $action in
  'exec')
    case $container in
      'heat_api_cron')
        echo '# This is a comment that should be ignored'
        echo '0 12 14 2 * heat-manage purge_deleted'
        ;;
      'keystone_cron')
        echo '0 12 14 2 * keystone-manage token_flush'
        ;;
      'rabbitmq')
        echo 16484
        ;;
      *)
        echo "Unknown container ${container}"
        ;;
    esac
    ;;
  'ps')
    (echo "$@" | grep -q 'name=rabbitmq') && echo 'rabbitmq'
    ;;
  *)
    echo "Unknown action ${action}"
    ;;
esac

shift
shift

  'exec')
        echo '0 12 14 2 * some-other command'
        ;;
        ;;
        echo 1
        ;;
      *)
        ;;
    esac
    ;;
  'ps')
    (echo "$@" | grep -q 'name=rabbitmq') && echo rabbitmq
    ;;
esac

{{ hostvars[inventory_hostname].container_cli |default('podman', true) }}

"{{ container_cli }}" exec $("{{ container_cli }}" ps -q --filter "name=rabbitmq" | head -1) rabbitmqctl eval 'proplists:get_value(max_fds, erlang:system_info(check_io)).'

{{ actual_fd_limit.stdout }} must be greater than or equal to {{ min_fd_limit }}

The repos validation failed detecting broken/non-working repository

One or more repositories are either broken or unreachable. Please correct.

repositories.stdout is regex('(cannot|could not|failure)', ignorecase=True)

echo "{{ repositories.stdout }}" | grep Repo-id | sed "s/Repo-id.*://" | tr -d " "

#!/bin/sh
echo 'thirsty_goldwasser Exited (0) 12 seconds ago'
echo 'fedora28 Exited (255) 7 hours ago'
echo 'centos7 Exited (255) 7 hours ago'

[Unit]
Wants=
Requires=

[Service]
Type=simple
ExecStart=/usr/bin/fake
Restart=

[Unit]

[Service]
ExecStart=/usr/bin/false

podman {{ service_status_podman_opt }} ps -a --filter 'status=exited' --format {{ "'{{ .Names }} {{ .Status }}'" }}

Failed container detected.
On CI, please check the following locations

"Health check failed for resource {{ item.resource_name }} with status: {{ item.resource_status }}"

The stonith_exists validation didn't properly detect failed
stonith config

pcs_cluster_status.rc == 0 and 'NO stonith devices configured' in stonith_devices.stdout

{{ lookup('introspection_data', auth_url=auth_url.value, password=password.value) }}

For the undercloud, you need to set the 'undercloud_nameservers' configuration parameter

Make sure that the relevant 'search' entry is in /etc/resolv.conf

Check all relevant ports for IdM/FreeIPA are accessible from {{ ansible_hostname }}

The host {{ ansible_hostname }} can access FreeIPA through all relevant ports

The host {{ ansible_hostname }} could NOT access IdM/FreeIPA on some ports

Please make sure that the following ports are open on the IdM/FreeIPA node: {{ firewall_query }}

{{ port_status.results | json_query('[?failed].item') | join(', ') }}

skipped {{ ansible_hostname }} firewall checks because DNS wasn't set correctly.

The host {{ ansible_host }} is missing the file /etc/ipa/default.conf

If there were enrollment issues, you'll see them in /var/log/ipaclient-install.log

The host {{ ansible_host }} is missing the file /etc/krb5.keytab

alternatively, you can request the keytab for this host with the ipa-getkeytab command

You might have overwritten the keytab. Re-enroll or request the keytab using ipa-getkeytab

skipped checking for the principal in the host's {{ ansible_host }} because there is no keytab file

skipped checking if the principal is usable for host {{ ansible_host }} because there is no keytab file

The principal {{ host_principal }} is usable to obtain a kerberos ticket

The principal {{ host_principal }} is unable to obtain a kerberos ticket

Please add the 'OS::TripleO::Services::CertmongerUser' service to all of your TripleO roles.

getcert list | grep 'Request ID' | sed "s/Request ID '\(.*\)':/\1/"

getcert list -i {{ certname }} | grep "status:" | sed "s/^\s*//"

The following certificates are not in a healthy status: {{ failed_certs | join(", ") }}

Log into this host and do 'getcert list -i <cert name>' to verify the failure reason

Verify that the service principal of the certificate is present in IdM/FreeIPA for this host

{{ command_prefix }} exec novajoin_server test -e /etc/novajoin/join.conf

{{ command_prefix }} exec novajoin_server test -e /etc/novajoin/krb5.keytab

{{ command_prefix }} exec novajoin_server kinit -kt {{ novajoin_keytab_path.value }} -c /tmp/my_novajoin_krb5_ccache {{ novajoin_principal }}

skipped checking if the novajoin principal is usable for host {{ ansible_host }} because there is no keytab file

The principal {{ novajoin_principal }} is able to obtain a kerberos ticket

{{ novajoin_temp_krb_caches + [ '/tmp/my_novajoin_krb5_ccache' ] }}

{{ command_prefix }} exec novajoin_server kdestroy -c {{ item }}

Tho principal {{ novajoin_principal }} is unable to obtain a kerberos ticket

Start the novajoin_server service with {{ command_prefix }} ... TBD

The novajoin_server container is reachable on {{ novajoin_server_port.value }}

The novajoin_server container is started, but not reachable locally on {{ novajoin_server_port.value }}

Start the novajoin-notify service with {{ command_prefix }} ... TBD

kinit -kt "{{ novajoin_keytab_path.value }}" -c /tmp/my_novajoin_krb5_ccache "{{ novajoin_principal }}"

Start the novajoin-server service with systemctl start novajoin-server

The novajoin-server service is reachable on {{ novajoin_server_port.value }}

The novajoin-server service is started, but not reachable locally on {{ novajoin_server_port.value }}

Start the novajoin-notify service with systemctl start novajoin-notify

undercloud_nameservers.value | length > 0 and undercloud_nameservers.value != []

Please set the 'undercloud_nameservers' parameter to point to IdM/FreeIPA in undercloud.conf

Please set the 'overcloud_domain_name' parameter to point to the IdM/FreeIPA's domain in undercloud.conf

undercloud_overcloud_domain.value | length == 0 or undercloud_overcloud_domain.value == [] or undercloud_overcloud_domain.value not in host_from_ip_reg.stdout

The undercloud_cpu role should have detected that there is not
enough CPU

There are {{ ansible_processor_vcpus }} cores in the system, but there should be at least {{ min_undercloud_cpu_count }}

The undercloud_debug should have detected a configuration issue

Minimum free space required for {{ item.item.mount }}: {{ item.item.min_size }}G - current free space: {{ (item.stdout|int / const_bytes_in_gb|int) |round(1) }}G

item.stdout|int / const_bytes_in_gb|int < item.item.min_size|int

The undercloud_heat_purge_deleted validation failed to detect
missing cron job.

shift
shift

    ;;
  *)
    ;;
esac

shift
shift

    ;;
  *)
    ;;
esac

{{ container_cli.value|default('podman', true) }} exec heat_api_cron crontab -l -u heat |grep -v '^#'

heat-manage purge_deleted does not appear to be enabled via cron. You should add '<desired interval> heat-manage purge_deleted' to the heat users crontab.

{{ container_cli.value|default('podman', true) }} exec {{ item.container }} pgrep -f -c {{ item.proc }}

echo "There are {{ item.stdout }} {{ item.item }} processes running. Having more than {{ max_process_count }} risks running out of memory."

{{ process_warnings.results|selectattr('changed')|map(attribute='stdout')|join('
') }}

The undercloud_ram role should have detected that there is not
enough RAM

The RAM on the undercloud node is {{ ansible_memtotal_mb }} MB, the minimal recommended value is {{ min_undercloud_ram_gb|int * 1024 }} MB.

SELinux is running in {{ sestatus.stdout }} mode on the Undercloud. Ensure that SELinux is enabled and running in Enforcing mode.

One of the undercloud services was not active. Please check {{ item.item }} first and then confirm the status of undercloud services in general before attempting to update or upgrade the environment.

The undercloud_tokenflush validation failed to detect

  - yaml
:yaml:
  - "common"
  - "service_configs"

shift
shift

    ;;
    ;;
  *)
    ;;
esac

shift
shift

    ;;
    ;;
  *)
    ;;
esac

  - yaml
:yaml:

{{ container_cli.value|default('podman', true) }} exec keystone_cron crontab -l -u keystone |grep -v '^#'

keystone token_flush does not appear to be enabled via cron. You should add '<desired interval> keystone-manage token_flush' to the keystone users crontab."

Skipping token flush validation since you are using a non-persistent token format ({{ ansible_facts['keystone::token_provider'] }}). You do not need a separate keystone_cron container to periodically prune tokens from keystone's database.

ansible_facts['keystone::token_provider'] == 'fernet' or ansible_facts['keystone::token_provider'] == 'jws'

type=SERVICE_START msg=audit(1575877870.934:286): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sssd-kcm comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
type=SERVICE_STOP msg=audit(1575878320.981:287): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sssd-kcm comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
type=USER_ACCT msg=audit(1575878471.739:288): pid=4430 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
type=USER_CMD msg=audit(1575878471.740:289): pid=4430 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 msg='cwd="/root" cmd=626F7267202D2D696E666F20637265617465202D2D636F6D7072657373696F6E206C7A34202D2D6578636C7564652D636163686573202D2D6578636C756465202A2F2A2E6C6F636B202D2D6578636C756465202A2F2E746F78202D2D6578636C756465202A2F2E737465737472202D2D6578636C756465202A2F727562792D76656E646F72202D2D6578636C756465202A2F7A75756C2F202D2D6578636C756465202A2F73736866732F202D2D6578636C756465202A2F2E6C6F63616C2F7368617265202F6D656469612F6261636B7570732F7268656C3A3A31306130393963382D316135612D313165612D613663622D386331363435366466626265202F686F6D652F636A65616E6E6572 exe="/usr/bin/sudo" terminal=? res=success'UID="root" AUID="unset"
type=USER_ACCT msg=audit(1575878554.296:294): pid=4445 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
type=USER_CMD msg=audit(1575878554.296:295): pid=4445 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 msg='cwd="/root" cmd=626F7267206C697374202F6D656469612F6261636B7570732F7268656C exe="/usr/bin/sudo" terminal=? res=success'UID="root" AUID="unset"
type=USER_ACCT msg=audit(1575878555.032:300): pid=4449 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
type=USER_CMD msg=audit(1575878555.032:301): pid=4449 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 msg='cwd="/root" cmd=626F7267207072756E65202D70202D2D6B6565702D77697468696E203277202D2D7374617473202F6D656469612F6261636B7570732F7268656C exe="/usr/bin/sudo" terminal=? res=success'UID="root" AUID="unset"
type=SERVICE_START msg=audit(1575878869.915:306): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=fprintd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
type=SERVICE_STOP msg=audit(1575878900.615:312): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=fprintd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"

type=AVC msg=audit(1575534183.234:4933): avc:  denied  { write } for  pid=11266 comm="iptables" path="pipe:[231496]" dev="pipefs" ino=231496 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:system_r:certmonger_t:s0 tclass=fifo_file permissive=1
type=AVC msg=audit(1575534183.342:4934): avc:  denied  { write } for  pid=11284 comm="iptables" path="pipe:[231496]" dev="pipefs" ino=231496 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:system_r:certmonger_t:s0 tclass=fifo_file permissive=1
type=USER_AVC msg=audit(1575535009.861:5275): pid=1397 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.DBus member=Hello dest=org.freedesktop.DBus spid=38869 scontext=system_u:system_r:container_t:s0:c313,c573 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=dbus permissive=1  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'UID="dbus" AUID="unset" SAUID="dbus"
type=USER_AVC msg=audit(1575535009.861:5276): pid=1397 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.systemd1.Manager member=GetDynamicUsers dest=org.freedesktop.systemd1 spid=38869 tpid=1 scontext=system_u:system_r:container_t:s0:c313,c573 tcontext=system_u:system_r:init_t:s0 tclass=dbus permissive=1  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'UID="dbus" AUID="unset" SAUID="dbus"
type=USER_AVC msg=audit(1575535009.862:5277): pid=1397 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.1198 spid=1 tpid=38869 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:container_t:s0:c313,c573 tclass=dbus permissive=1  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'UID="dbus" AUID="unset" SAUID="dbus"
type=USER_AVC msg=audit(1575535013.340:5290): pid=1397 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.DBus member=Hello dest=org.freedesktop.DBus spid=39132 scontext=system_u:system_r:container_t:s0:c192,c917 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=dbus permissive=1  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'UID="dbus" AUID="unset" SAUID="dbus"
type=USER_AVC msg=audit(1575535013.341:5291): pid=1397 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.systemd1.Manager member=GetDynamicUsers dest=org.freedesktop.systemd1 spid=39132 tpid=1 scontext=system_u:system_r:container_t:s0:c192,c917 tcontext=system_u:system_r:init_t:s0 tclass=dbus permissive=1  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'UID="dbus" AUID="unset" SAUID="dbus"
type=USER_AVC msg=audit(1575535013.342:5292): pid=1397 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.1209 spid=1 tpid=39132 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:container_t:s0:c192,c917 tclass=dbus permissive=1  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'UID="dbus" AUID="unset" SAUID="dbus"
type=USER_AVC msg=audit(1575535028.912:5307): pid=1397 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.DBus member=Hello dest=org.freedesktop.DBus spid=39430 scontext=system_u:system_r:container_t:s0:c776,c848 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=dbus permissive=1  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'UID="dbus" AUID="unset" SAUID="dbus"
type=USER_AVC msg=audit(1575535028.913:5308): pid=1397 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.systemd1.Manager member=GetDynamicUsers dest=org.freedesktop.systemd1 spid=39430 tpid=1 scontext=system_u:system_r:container_t:s0:c776,c848 tcontext=system_u:system_r:init_t:s0 tclass=dbus permissive=1  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'UID="dbus" AUID="unset" SAUID="dbus"

selinux_skip_{{ release }}_on_{{ ansible_distribution_major_version }}.yml

grep denied {{ validate_selinux_audit_source }} > /tmp/denials.log

grep -v -f {{ validate_selinux_skip_list_dest }} /tmp/denials.log > {{ validate_selinux_filtered_denials_dest }}

Untracked SELinux AVCs found, please refer to {{ validate_selinux_filtered_denials_dest }}

for dev in $(df -h | grep '/dev/' | grep -v 'tmp' | cut -d' ' -f1)
do
  parseftype=$(xfs_info $dev | grep ftype=0);
  if [[ ! -z "$parseftype" ]]; then
    ftype="ftype=0";
    break;
  fi
done
echo $ftype;

XFS volumes formatted using ftype=0 are incompatible with the docker overlayfs driver. Run xfs_info on {{ ansible_fqdn }} and fix those volumes before proceeding with the upgrade.

The variable `ansible_user` set this option and try again. On the CLI this can be defined with "-e ansible_user=${USER}"

The variable `ansible_user_dir` set this option and try again. On the CLI this can be defined with "-e ansible_user_dir=${HOME}"

. {{ ansible_user_dir }}/test-python/bin/activate
{{ ansible_user_dir }}/{{ zuul.project.src_dir }}/scripts/bindep-install

{{ ansible_user_dir }}/{{ zuul.project.src_dir }}/molecule-requirements.txt

. {{ ansible_user_dir }}/{{ zuul.project.src_dir }}/ansible-test-env.rc
pytest --color=no \
       --html={{ ansible_user_dir }}/zuul-output/logs/reports.html \
       --self-contained-html \
       --ansible-args='{{ tripleo_job_ansible_args | default("") }}' \
       {{ ansible_user_dir }}/{{ zuul.project.src_dir }}/tests/test_molecule.py

{{ ansible_user_dir }}/{{ zuul.project.src_dir }}/roles/{{ tripleo_validations_role_name }}

host={{ elasticsearch_reachable_host }} port={{ elasticsearch_http_port }} delay=3 timeout=400

https://{{ node_certs_generator_ip }}:{{ elasticsearch_http_port }}/_cluster/health/

(  _result.json is defined) and (_result.json.status == "green")

https://{{ node_certs_generator_ip }}:{{ elasticsearch_http_port }}/_security/user/{{ item.key }}

{ "password" : "{{ item.value["password"] }}", "roles" : {{ item.value["roles"] }} }

/usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in {{ node_certs_source }}/instances.yml --out {{ node_certs_source }}/certs.zip

/usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca-key {{ node_certs_source }}/{{ ca_key_name }} --ca-cert {{ node_certs_source }}/{{ ca_cert_name }} --pem --in {{ node_certs_source }}/instances.yml --out {{ node_certs_source }}/certs.zip

/usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca-key {{ node_certs_source }}/{{ ca_key_name }} --ca-cert {{ node_certs_source }}/{{ ca_cert_name }} --pem --in {{ node_certs_source }}/instances.yml --out {{ node_certs_source }}/certs.zip --ca-pass {{ ca_password }}

{{ master_certs_path }}/{{ elasticsearch_node_name }}/{{ elasticsearch_node_name }}.key

{{ master_certs_path }}/{{ elasticsearch_node_name }}/{{ elasticsearch_node_name }}.crt

echo {{ elasticsearch_xpack_security_password }} | {{ node_certs_source }}/bin/elasticsearch-keystore add -xf bootstrap.password

https://{{ nodejs['repo_dict'][ansible_os_family|lower] }}.{{ nodejs['repo_url_ext'] }}

git clone https://github.com/wazuh/wazuh-kibana-app -b {{ wazuh_plugin_branch }} --single-branch --depth=1 app

/usr/share/kibana/bin/kibana-plugin install file:///tmp/app/build/{{ wazuhapp_package_name.stdout }}

It's not possible to compile the Wazuh Kibana plugin on Debian 10 due to: https://github.com/wazuh/wazuh-kibana-app/issues/1924

not (ansible_distribution == "Amazon" and ansible_distribution_version == "(Karoo)")

not (ansible_distribution == "Ubuntu" and ansible_distribution_version is version('15.04', '<'))

not (ansible_distribution == "Debian" and ansible_distribution_version is version('8', '<'))

not (ansible_os_family == "RedHat" and ansible_distribution_version is version('7', '<'))

{{ master_certs_path }}/{{ kibana_node_name }}/{{ kibana_node_name }}.key

{{ master_certs_path }}/{{ kibana_node_name }}/{{ kibana_node_name }}.crt

grep -c -E 'version.*{{ elastic_stack_version }}' /usr/share/kibana/plugins/wazuh/package.json

/usr/share/kibana/bin/kibana-plugin install {{ wazuh_app_url }}-{{ wazuh_version }}_{{ elastic_stack_version }}.zip

host={{ elasticsearch_network_host }} port={{ elasticsearch_http_port }}

{{ elastic_api_protocol }}://{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}/.wazuh

{{ master_certs_path }}/{{ filebeat_node_name }}/{{ filebeat_node_name }}.key

{{ master_certs_path }}/{{ filebeat_node_name }}/{{ filebeat_node_name }}.crt

{{ filebeat_module_package_url }}/{{ filebeat_module_package_name }}

{{ filebeat_module_package_path }}/{{ filebeat_module_package_name }}

dest={{ filebeat_module_folder }} mode=u=rwX,g=rwX,o=rwX recurse=yes

not (ansible_distribution == "Amazon" and ansible_distribution_major_version == "NA")

curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -

not (ansible_distribution == "Ubuntu" and ansible_distribution_major_version | int == 14)

(ansible_distribution == "Ubuntu" and ansible_distribution_major_version | int == 14)

dpkg --compare-versions '{{ openscap_version.stdout }}' '>=' '1.2'; echo $?

not (ansible_distribution|lower == "centos" and ansible_distribution_major_version >= "8")

not (ansible_distribution|lower == "redhat" and ansible_distribution_major_version >= "8")

(ansible_distribution|lower == "centos" and ansible_distribution_major_version >= "8") or (ansible_distribution|lower == "redhat" and ansible_distribution_major_version >= "8")

tar -xzvf /tmp/{{ wazuh_agent_sources_installation.branch }}.tar.gz --strip 1 --directory /tmp/wazuh-{{ wazuh_agent_sources_installation.branch }}

/tmp/wazuh-{{ wazuh_agent_sources_installation.branch }}/etc/preloaded-vars.conf

/var/ossec/bin/agent-auth {% if wazuh_agent_authd.agent_name is defined and wazuh_agent_authd.agent_name != None %} -A {{ wazuh_agent_authd.agent_name }} {% endif %} -m {{ wazuh_managers.0.address }} -p {{ wazuh_agent_authd.port }} {% if wazuh_agent_nat %} -I "any" {% endif %} {% if authd_pass is defined %} -P {{ authd_pass }} {% endif %} {% if wazuh_agent_authd.ssl_agent_ca is defined and wazuh_agent_authd.ssl_agent_ca != None %} -v "/var/ossec/etc/{{ wazuh_agent_authd.ssl_agent_ca | basename }}" {% endif %} {% if wazuh_agent_authd.ssl_agent_cert is defined and wazuh_agent_authd.ssl_agent_cert != None %} -x "/var/ossec/etc/{{ wazuh_agent_authd.ssl_agent_cert | basename }}" {% endif %} {% if wazuh_agent_authd.ssl_agent_key is defined and wazuh_agent_authd.ssl_agent_key != None  %} -k "/var/ossec/etc/{{ wazuh_agent_authd.ssl_agent_key | basename }}" {% endif %} {% if wazuh_agent_authd.ssl_auto_negotiate == 'yes' %} -a {% endif %}

{% if single_agent_name is defined %}{{ single_agent_name }}{% else %}{{ ansible_hostname }}{% endif %}

{{ wazuh_managers.0.api_proto }}://{{ wazuh_managers.0.address }}:{{ wazuh_managers.0.api_port }}/agents/

{% if single_agent_name is defined %}{{ single_agent_name }}{% else %}{{ inventory_hostname }}{% endif %}

{{ wazuh_managers.0.api_proto }}://{{ wazuh_managers.0.address }}:{{ wazuh_managers.0.api_port }}/agents/{{ newagent_api.json.data.id }}

{% if wazuh_agent_nat %}any{% else %}{{ newagentdata_api.json.data.ip }}{% endif %}

/var/ossec/wodles/vuls/deploy_vuls.sh {{ ansible_distribution|lower }} {{ ansible_distribution_major_version|int }}

ansible_distribution in ['Redhat', 'CentOS', 'Ubuntu', 'Debian', 'Oracle']

src=var-ossec-etc-ossec-agent.conf.j2 dest=/var/ossec/etc/ossec.conf owner=root group=ossec mode=0644

src=var-ossec-etc-local-internal-options.conf.j2 dest=/var/ossec/etc/local_internal_options.conf owner=root group=ossec mode=0640

(ansible_facts['os_family']|lower == 'redhat') and (ansible_distribution|lower != 'amazon')

ansible_os_family == "RedHat" and ansible_distribution_major_version == "5"

ansible_os_family == "RedHat" and ansible_distribution_major_version == "6"

deb https://packages.wazuh.com/apt {{ ansible_distribution_release }} main

{{ wazuh_winagent_config.download_dir }}{{ wazuh_winagent_package_name }}

{{ wazuh_agent_win_auth_path }} -m {{ wazuh_managers.0.address }} -p {{ wazuh_agent_authd.port }} {% if wazuh_agent_authd.agent_name is defined %}-A {{ wazuh_agent_authd.agent_name }} {% endif %} {% if authd_pass is defined %} -P {{ authd_pass }}{% endif %}

not check_windows_key.stat.exists or check_windows_key.stat.size == 0

not wazuh_manager_sources_installation.enabled or not wazuh_api_sources_installation.enabled

not wazuh_custom_packages_installation_manager_enabled or not wazuh_custom_packages_installation_api_enabled

tar -xzvf /tmp/{{ wazuh_manager_sources_installation.branch }}.tar.gz --strip 1 --directory /tmp/wazuh-{{ wazuh_manager_sources_installation.branch }}

Executing "install.sh" script to build and install the Wazuh Manager

not (ansible_os_family|lower == "redhat" and ansible_distribution_major_version|int < 6)

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:1825 -keyout sslmanager.key -out sslmanager.cert -subj /CN={{ wazuh_manager_fqdn }}/

src=var-ossec-rules-local_rules.xml.j2 dest=/var/ossec/etc/rules/local_rules.xml owner=root group=ossec mode=0640

src="{{ wazuh_manager_config.ruleset.rules_path }}" dest=/var/ossec/etc/rules/ owner=root group=ossec mode=0640

src=var-ossec-rules-local_decoder.xml.j2 dest=/var/ossec/etc/decoders/local_decoder.xml owner=root group=ossec mode=0640

src="{{ wazuh_manager_config.ruleset.decoders_path }}" dest=/var/ossec/etc/decoders/ owner=root group=ossec mode=0640

src=var-ossec-api-configuration-config.js.j2 dest=/var/ossec/api/configuration/config.js owner=root group=ossec mode=0740

"grep -c 'ossec-csyslogd' /var/ossec/bin/.process_list | xargs echo"

csyslog_enabled.stdout == '0' or "skipped" in csyslog_enabled.stdout

"grep -c 'ossec-agentlessd' /var/ossec/bin/.process_list | xargs echo"

agentlessd_enabled.stdout == '0' or "skipped" in agentlessd_enabled.stdout

ansible_distribution in ['Redhat', 'CentOS', 'Ubuntu', 'Debian', 'Oracle', 'Amazon']

src=var-ossec-etc-ossec-server.conf.j2 dest=/var/ossec/etc/ossec.conf owner=root group=ossec mode=0644

/usr/bin/base64 /var/ossec/agentless/.passlist_tmp > /var/ossec/agentless/.passlist && rm /var/ossec/agentless/.passlist_tmp

(ansible_os_family|lower == 'redhat') and (ansible_distribution|lower != 'amazon')

ansible_distribution == 'CentOS' and ansible_distribution_major_version == '6'

ansible_distribution == 'RedHat' and  ansible_distribution_major_version == '6'

( ansible_distribution == 'CentOS' or ansible_distribution == 'RedHat' ) and ansible_distribution_major_version == '6'

not (( ansible_distribution == 'CentOS' or ansible_distribution == 'RedHat') and ansible_distribution_major_version == '6' )

ansible_os_family == "RedHat" and ansible_distribution_major_version == '5'

ansible_os_family == "RedHat" and ansible_distribution_major_version == '6'

ansible_os_family == "RedHat" and ansible_distribution_major_version == '7'

ansible_distribution == "Amazon" and ansible_distribution_major_version == "NA"

echo -n "Starting Wazuh-manager (EL6): "; source /opt/rh/python27/enable; export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/var/ossec/framework/lib

ansible_distribution in ['CentOS', 'RedHat', 'Amazon'] and ansible_distribution_major_version|int == 6

deb https://deb.nodesource.com/node_6.x {{ ansible_distribution_release }} main