Update Calico Felix to v3

Moving to v3 requires etcd3, which uses a new L4 gateway setup and
deprecates v2 proxy. The role configuration is updated to use the
etcd3 L4 gateway.

This also includes several dependent fixes and moves the Calico
test to use the integrated repo's Calico scenario.

Combined backport of:
https://review.opendev.org/#/c/641483/
https://review.opendev.org/#/c/645971/
https://review.opendev.org/#/c/659710/
https://review.opendev.org/#/c/659711/

Depends-On: I746b9dbb090dd484a36e826f06beda1eba3f55f4
Depends-On: Iaf392898c072ac4b39d878bb27654406c5ab0d8b
Change-Id: I91d3fef8d1b89f595b529c7c96b3d7249e5b7291

defaults/main.yml

@@ -435,9 +435,9 @@ neutron_vpnaas_service_provider: VPN:strongswan:neutron_vpnaas.services.vpn.serv
 neutron_management_ip: 127.0.0.1
 
 # Calico Felix agent upstream settings
-calico_felix_url: "https://github.com/projectcalico/felix/releases/download/{{ calico_felix_version }}/calico-felix"
-calico_felix_version: 2.3.0
-calico_felix_sha256: 6cc538d6d93d2b5e732841769f427ce61a4e7d9a6eedf4ca8d33c4df42cf6419
+calico_felix_url: "https://github.com/projectcalico/felix/releases/download/{{ calico_felix_version }}/calico-felix-amd64"
+calico_felix_version: v3.7.0
+calico_felix_sha256: ae0bed304702097cee0ad5d9b4abb07b263deeb46ac21f2bcb0118d5bf439f46
 calico_felix_validate_certs: yes
 
 # Database specific configuration

tasks/dependent_neutron_roles.yml

@@ -25,7 +25,7 @@
   include_role:
     name: etcd
   vars:
-    etcd_install_type: proxy
+    etcd_install_type: gateway
   when:
     - "neutron_plugin_type in ['ml2.calico', 'ml2.dragonflow']"
     - "group_names | intersect([
@@ -34,6 +34,7 @@
          neutron_services['dragonflow-controller-agent']['group'],
          neutron_services['neutron-server']['group']
        ]) | length > 0"
+    - "'etcd' not in group_names"
 
 - name: Include ODL role
   include_role:

templates/felix.cfg.j2

@@ -2,3 +2,5 @@
 
 [global]
 MetadataAddr = {{ internal_lb_vip_address }}
+EtcdEndpoints = http://127.0.0.1:2379
+DatastoreType = etcdv3

vars/main.yml

@@ -469,8 +469,8 @@ neutron_services:
     start_order: 1
   calico-felix:
     group: neutron_calico_dhcp_agent
-    system_user: root
-    system_group: root
+    systemd_user_name: root
+    systemd_group_name: root
     service_name: calico-felix
     service_en: "{{ neutron_plugin_type == 'ml2.calico' }}"
     service_conf_path: /etc/calico
@@ -482,8 +482,8 @@ neutron_services:
     start_order: 3
   calico-dhcp-agent:
     group: neutron_calico_dhcp_agent
-    system_user: root
-    system_group: root
+    systemd_user_name: root
+    systemd_group_name: root
     service_name: calico-dhcp-agent
     service_en: "{{ neutron_plugin_type == 'ml2.calico' }}"
     service_rootwrap: rootwrap.d/dhcp.filters

zuul.d/jobs.yaml

@@ -20,10 +20,10 @@
       tox_env: ovs
 
 - job:
-    name: openstack-ansible-calico-ubuntu-xenial
-    parent: openstack-ansible-functional-ubuntu-xenial
+    name: openstack-ansible-deploy-aio_metal_calico-ubuntu-xenial
+    parent: openstack-ansible-deploy-aio_metal-ubuntu-xenial
     vars:
-      tox_env: calico
+      scenario: aio_metal_calico
 
 - job:
     name: openstack-ansible-dragonflow-ubuntu-xenial

zuul.d/project.yaml

@@ -21,8 +21,7 @@
     check:
       jobs:
         - openstack-ansible-ovs-ubuntu-xenial
-        - openstack-ansible-calico-ubuntu-xenial:
-            voting: false
+        - openstack-ansible-deploy-aio_metal_calico-ubuntu-xenial
         - openstack-ansible-dragonflow-ubuntu-xenial:
             voting: false
         - openstack-ansible-opendaylight-ubuntu-xenial
@@ -38,6 +37,7 @@
         - openstack-ansible-functional-distro_install-opensuse-423
     gate:
       jobs:
+        - openstack-ansible-deploy-aio_metal_calico-ubuntu-xenial
         - openstack-ansible-ovs-ubuntu-xenial
         - openstack-ansible-ovn-ubuntu-xenial
         - openstack-ansible-ovn-centos-7