openstack/kolla-ansible.git/ansible/post-deploy.yml, branch stable/2026.1

Break out clouds.yaml/openrc creation from common role

2026-04-14T09:27:31+00:00

It currently only holds kolla-toolbox and due to introducing clouds.yaml for kolla-toolbox usage we should separate these two for readability. Change-Id: I0b4d3b8ab199260cd5087c10cf916f9d43f346cc Signed-off-by: Michal Nasiadka

ansible-lint: Fix fqcn[actions-core] in playbooks

2026-03-19T12:17:03+00:00

Also add all failed roles into ignore and these will be removed in subsequent patches Change-Id: Ifa6f2725cfa93cb14d72daf27448bd58f186acfd Signed-off-by: Michal Nasiadka

ansible-lint: fix unnamed-task in post-deploy.yml

2025-12-09T22:06:22+00:00

Change-Id: Ia5ae6ffc11b99a2c93c9aba567ad28913b042fbb Signed-off-by: Bertrand Lanson

ansible-lint: Remove yaml[truthy] from excludes

2025-11-28T09:06:26+00:00

Normalize quotes and some other easy fixes done by ansible-lint --fix Also drop etc from excludes and ignore comment check in etc/kolla/globals.yml Pinning to ansible-lint<25.11.0 because 25.11.1 is breaking without any messages Change-Id: I7dee3866191cef84cd12b1816cdab0a02380ec7f Signed-off-by: Michal Nasiadka

ansible-lint: Fix yaml[octal-values]

2025-11-06T10:56:10+00:00

Change-Id: I0c55f924489657ddcdb2957070cd69563c6d9886 Signed-off-by: Michal Nasiadka

Fix unconditional use of become in post-deploy

2025-05-14T14:09:33+00:00

This must have snuck in after we landed the linked related change. Related-ID: Ied5ef4e1e3c9346342962d44de26702522b06b86 Related-Bug: #2098887 Change-Id: I9b0d67ba443a680f0eaa4f2ad5bb7137faf396de

Merge "Allow to run post-deploy without privilege escalation"

2025-05-09T14:32:55+00:00

Allow to run post-deploy without privilege escalation

2025-02-19T18:56:05+00:00

In deployments where `kolla-ansible` is run by a regular user, `post-deploy` could fail when attempting to create the `/etc/openstack` directory if privilege escalation is not enabled/possible non-interactively. With this change, we can run `post-deploy` with `become: false` if root is not the owner of the `node_config` directory. This change also removes the task creating `/etc/openstack` as this directory is unused since the change moving the cloud config file to `node_config`. Related-Id: Idd458ad6ef29e4eee2f9e537b4eae39d26eb9f64 Closes-Bug: #2098887 Change-Id: Ied5ef4e1e3c9346342962d44de26702522b06b86

Generate system scoped public-openrc

2024-12-12T21:24:37+00:00

It can be useful to run Ironic commands on the public API if access to the internal API is not possible. Related-Bug: #2051837 Change-Id: Ice0eb62f2bb26ca6e3ac8d02c6ea787b60408a86

Template system scoped admin-openrc and clouds.yml files

2024-02-15T15:01:59+00:00

Ironic enabled secure RBAC with system scoped enforcement [1]. Some API calls, for instance 'baremetal:driver:get' needs system scope role by design [2], even with elevated access project scope service role [3]. [1] https://review.opendev.org/c/openstack/ironic/+/902009 [2] https://opendev.org/openstack/ironic/src/commit/8ec56066223301230ac0ed0f0c471a10d366b474/ironic/common/policy.py#L1349-L1357 [3] https://review.opendev.org/c/openstack/kolla-ansible/+/908007 Related-Bug: #2051837 Change-Id: Id6313d7dd343b82d4c9ccf7bf429d340ea0e93d1