Update Calico Felix to v3

Moving to v3 requires etcd3, which uses a new L4 gateway setup and
deprecates v2 proxy. The role configuration is updated to use the
etcd3 L4 gateway.

This also includes several dependent fixes and moves the Calico
test to use the integrated repo's Calico scenario.

Combined backport of:
https://review.opendev.org/#/c/641483/
https://review.opendev.org/#/c/645971/
https://review.opendev.org/#/c/659710/
https://review.opendev.org/#/c/659711/

Also pulls in the updated tests-repo-clone from
I67ebe9e813c95a3a8bcf204678ddccbcea7a45cd so that the depends-on
function in this patch works.

openSUSE 42.3 testing is removed since this version is EOL soon and
our ability to build LXC containers on 42.3 is broken/unmaintained.

Depends-On: I9fb16b7f046530efc124e760bc7870c13b4e8d32
Depends-On: I746b9dbb090dd484a36e826f06beda1eba3f55f4
Depends-On: Iaf392898c072ac4b39d878bb27654406c5ab0d8b
Change-Id: I91d3fef8d1b89f595b529c7c96b3d7249e5b7291
(cherry picked from commit a4181a77c10c62dd7205b5452fbb4a63391c1e13)

defaults/main.yml

@@ -397,9 +397,9 @@ neutron_vpnaas_service_provider: VPN:strongswan:neutron_vpnaas.services.vpn.serv
 neutron_management_ip: 127.0.0.1
 
 # Calico Felix agent upstream settings
-calico_felix_url: "https://github.com/projectcalico/felix/releases/download/{{ calico_felix_version }}/calico-felix"
-calico_felix_version: 2.3.0
-calico_felix_sha256: 6cc538d6d93d2b5e732841769f427ce61a4e7d9a6eedf4ca8d33c4df42cf6419
+calico_felix_url: "https://github.com/projectcalico/felix/releases/download/{{ calico_felix_version }}/calico-felix-amd64"
+calico_felix_version: v3.7.0
+calico_felix_sha256: ae0bed304702097cee0ad5d9b4abb07b263deeb46ac21f2bcb0118d5bf439f46
 calico_felix_validate_certs: yes
 
 # Database specific configuration

meta/main.yml

@@ -44,8 +44,9 @@ dependencies:
       - ansible_pkg_mgr == 'apt'
   - openstack_openrc
   - role: etcd
-    etcd_install_type: proxy
+    etcd_install_type: gateway
     when:
+      - "'etcd' not in group_names"
       - "neutron_plugin_type in ['ml2.calico', 'ml2.dragonflow']"
       - "group_names | intersect([
            neutron_services['calico-dhcp-agent']['group'],

templates/felix.cfg.j2

@@ -2,3 +2,5 @@
 
 [global]
 MetadataAddr = {{ internal_lb_vip_address }}
+EtcdEndpoints = http://127.0.0.1:2379
+DatastoreType = etcdv3

tests/tests-repo-clone.sh

@@ -33,7 +33,7 @@ set -e
 export TESTING_HOME=${TESTING_HOME:-$HOME}
 export WORKING_DIR=${WORKING_DIR:-$(pwd)}
 export CLONE_UPGRADE_TESTS=${CLONE_UPGRADE_TESTS:-no}
-export ZUUL_TESTS_CLONE_LOCATION="/home/zuul/src/git.openstack.org/openstack/openstack-ansible-tests"
+export ZUUL_TESTS_CLONE_LOCATION="/home/zuul/src/opendev.org/openstack/openstack-ansible-tests"
 
 ## Functions -----------------------------------------------------------------
 
@@ -66,7 +66,7 @@ if [[ -x /usr/zuul-env/bin/zuul-cloner ]] && [[ "${ZUUL_REF:-none}" != "none" ]]
     /usr/zuul-env/bin/zuul-cloner \
         --cache-dir /opt/git \
         --map ${TESTING_HOME}/tests-clonemap.yaml \
-        https://git.openstack.org \
+        https://opendev.org \
         openstack/openstack-ansible-tests
 
     # Clean up the clonemap.
@@ -97,7 +97,7 @@ elif [[ ! -d tests/common ]]; then
     # repo in some way, so just clone it from upstream.
     else
         git clone -b stable/queens \
-            https://git.openstack.org/openstack/openstack-ansible-tests \
+            https://opendev.org/openstack/openstack-ansible-tests \
             ${WORKING_DIR}/tests/common
     fi
 fi
@@ -111,7 +111,7 @@ fi
 if [[ "${CLONE_UPGRADE_TESTS}" == "yes" ]]; then
     if [[ ! -d "${WORKING_DIR}/tests/common/previous" ]]; then
         git clone -b stable/pike \
-            https://git.openstack.org/openstack/openstack-ansible-tests \
+            https://opendev.org/openstack/openstack-ansible-tests \
             ${WORKING_DIR}/tests/common/previous
   fi
 fi

zuul.d/jobs.yaml

@@ -20,10 +20,10 @@
       tox_env: ovs
 
 - job:
-    name: openstack-ansible-calico-ubuntu-xenial
-    parent: openstack-ansible-functional-ubuntu-xenial
+    name: openstack-ansible-deploy-aio_metal_calico-ubuntu-xenial
+    parent: openstack-ansible-deploy-aio_metal-ubuntu-xenial
     vars:
-      tox_env: calico
+      scenario: aio_metal_calico
 
 - job:
     name: openstack-ansible-dragonflow-ubuntu-xenial

zuul.d/project.yaml

@@ -21,11 +21,9 @@
       jobs:
         - openstack-ansible-linters
         - openstack-ansible-functional-centos-7
-        - openstack-ansible-functional-opensuse-423
         - openstack-ansible-functional-ubuntu-xenial
         - openstack-ansible-ovs-ubuntu-xenial
-        - openstack-ansible-calico-ubuntu-xenial:
-            voting: false
+        - openstack-ansible-deploy-aio_metal_calico-ubuntu-xenial
         - openstack-ansible-dragonflow-ubuntu-xenial:
             voting: false
         - openstack-ansible-opendaylight-ubuntu-xenial
@@ -39,10 +37,10 @@
     gate:
       jobs:
         - openstack-ansible-linters
+        - openstack-ansible-deploy-aio_metal_calico-ubuntu-xenial
         - openstack-ansible-ovs-ubuntu-xenial
         - openstack-ansible-opendaylight-ubuntu-xenial
         - openstack-ansible-ovs-nsh-ubuntu-xenial
         - openstack-ansible-odl-sfc-ubuntu-xenial
         - openstack-ansible-functional-centos-7
-        - openstack-ansible-functional-opensuse-423
         - openstack-ansible-functional-ubuntu-xenial