Ceph octopus incompatible with containerised chrony

[Mark Goddard]

CentOS 8 appears to have chrony enabled and started by default. The chronyd service is disabled and packages uninstalled during kolla-ansible bootstrap-servers, if enable_chrony is true.

The problem with Kolla-containerised chrony is that Ceph Octopus node health checks don’t see it and this puts the node into a warning state. Also, Ceph Orchestrator does a check for time sync during pre-flight checks, and Ceph deployment normally runs before the containerised service is deployed by kolla-ansible.

Related kayobe bug: https://storyboard.openstack.org/#!/story/2007872

[Radosław Piliszek (yoctozepto)]

I'm +1 on stopping containerizing chrony - NTP service is a critical part of the base host for its many functions, usually related to synchronization and security.

[Pierre Riteau (priteau)]

Indeed, it feels odd to deploy a containerised chronyd when it comes enabled by default on CentOS 8. And it would be one fewer image for the Kolla project to build and maintain.

[Radosław Piliszek (yoctozepto)]

Honestly, I think it was usually on by default on 7 as well, not to mention Ubuntu Bionic.

[Mark Goddard (mgoddard)]

Agreed in kolla IRC meeting 2020/7/1:

* support configuration of an NTP client/server on the host
* add (timedatectl check?) to prechecks
* switch default of enable_chrony to false, enable host daemon by default

[Mark Goddard (mgoddard)]

> * support configuration of an NTP client/server on the host

Seems this was not unanimous.

[Radosław Piliszek (yoctozepto)]

enable_host_ntp looks brokenish too, at least stop advertising this part.

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/738877

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/740585

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/740586

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/740585
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=3018199f0b57cbab35b06ab84292519ab374fb87
Submitter: Zuul
Branch: master

commit 3018199f0b57cbab35b06ab84292519ab374fb87
Author: Radosław Piliszek <email address hidden>
Date: Sun Jul 12 10:33:24 2020 +0200

    Add timesync prechecks

    If not running containerised chrony, we need to check that host
    has its own means of system clock synchronization.

    Change-Id: I31b3e9ed625d63a4bf82c674593522268c20ec4c
    Partial-Bug: #1885689

[OpenStack Infra (hudson-openstack)]

Change abandoned by Radosław Piliszek (<email address hidden>) on branch: master
Review: https://review.opendev.org/738877
Reason: not needed

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible 12.0.0.0rc1 release candidate.

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Doug Szumski <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/764355