openstack/kolla-ansible.git/ansible/roles/heat, branch stable/2026.1

Fix j2lint jinja-statements-indentation error

2026-07-09T08:40:12+00:00

Change-Id: I109f80d8903cb6f9c608ab39d181a001d426fd87 Signed-off-by: Pierre Riteau (cherry picked from commit b2e63e2791e49cdca206241e07f27a53f4ac7556)

Fix for overly restrictive permissions on ca-certificates directory

2026-05-12T05:56:37+00:00

Closes-Bug: #2112280 Change-Id: I52499bdf2b7fc70f91a4c2920749bfef83a79850 Signed-off-by: Rafal Lewandowski Signed-off-by: Michal Nasiadka (cherry picked from commit e302bab31f30296f7d6f41c3d46e19cf5668b97a)

Drop support for running WSGI under Apache

2026-04-24T11:07:46+00:00

The migration to uWSGI has been successfully completed. All API services now run exclusively under uWSGI. The *_wsgi_provider variables have been removed from all affected roles along with leftover Apache wsgi config templates and fluentd Apache log handling. Rework Apache fluentd input configuration so it doesn't glob out whole /var/log/kolla/*/* and just include required services when enabled. Change-Id: I1475e629d033163a50a5c681c8fe2557a7b10bae Signed-off-by: Michal Nasiadka Signed-off-by: Bartosz Bezak

kolla-toolbox: Template clouds.yaml and use it

2026-04-15T12:17:01+00:00

Basically Ansible heuristic obfuscation methods mark auth: that we pass to openstack.* modules as no_log_values and then obfuscates it's values in other runs (which then end up as **** e.g. auth_url, domain_id, domain name, etc) Example return: "domains": [ { "description": "The ******** domain", "id": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER", "is_enabled": true, "links": { "self": "********/v3/domains/********" }, "name": "Default", "options": {}, "tags": [] } This patch adds clouds.yaml to files templated for kolla-toolbox (but without the password) and only uses password from Kolla-Ansible secrets instead of storing that on disk on all of the nodes. Change-Id: I479445563d5b5dc2e45601e936d89def647da841 Signed-off-by: Michal Nasiadka

Standardize API health check endpoints

2026-04-12T13:02:28+00:00

Configure dedicated health check endpoints for Load Balancers Standardize health check paths in OpenStack and Grafana Ansible defaults to improve Load Balancer (HAProxy) reliability. The 'httpchk' configuration for the modified roles now uses dedicated health check endpoints (e.g., /healthcheck or /api/health) and enforces an HTTP 200 OK expectation. This ensures faster and more robust failure detection. Additionally, by moving health checks away from generic endpoints (such as OPTIONS /), application logs are now much cleaner. The log files will no longer be flooded every second with HAProxy probe entries like: "OPTIONS / HTTP/1.0" 200 94 0.000954 NOTE: The following services are exceptions to this standardization and still use the root endpoint (`/`) for health checks due to the lack of a dedicated health check middleware in their default API paste configuration: **cyborg_api**, **masakari**, **mistral_api**, **nova_api**, **octavia_api**, **placement**, **tacker**, **venus**, and **watcher**. Updated roles: * aodh * barbican * cinder * cloudkitty * cyborg * designate * etcd * glance * gnocchi * grafana * heat * horizon * influxdb * ironic * keystone * loadbalancer * magnum * manila * masakari * mistral * neutron * nova * nova-cell * octavia * opensearch * placement * rabbitmq * skyline * tacker * trove * venus * watcher * zun Change-Id: Ibbb9fda45a98565ab12e784bbef80be787bd6638 Signed-off-by: Piotr Milewski

ansible-lint: Fix fqcn[actions-core] for heat

2026-03-20T06:43:29+00:00

Change-Id: I01df5f8dbf25f8af42fececd8c32db7c0dc4aefe Signed-off-by: Michal Nasiadka

heat: apply heat_api_workers and heat_api_cfn_workers to uWSGI

2026-01-27T14:01:18+00:00

Partial-Bug: #2139153 Change-Id: Ica9069cd336055f842af8ade17687dbadc1e6edc Signed-off-by: Bartosz Bezak

ansible-lint: fix yaml[line-length] in heat

2026-01-15T16:57:10+00:00

Change-Id: I26bca4f5b3aa11af8d912568da44e90e013cbd83 Signed-off-by: Bertrand Lanson

Switch to pypi version of j2lint and fix linting errors

2025-12-30T16:31:17+00:00

Since ipwrap filter is getting moved another time inside ansible code - let's switch to j2lint that is actively maintained and it's rules will help in readability of jinja2 templates Change-Id: I6762b691b927de31fa1abd83c4c14e87226fe5e2 Signed-off-by: Michal Nasiadka

Add support for Debian Trixie (13)

2025-12-19T14:55:59+00:00

Remove /etc/timezone bind mount since Debian does not provide that file anymore. Depends-On: https://review.opendev.org/c/openstack/kolla/+/964793 Change-Id: If1a289068093843184f0d7b495815db006f2d563 Signed-off-by: Michal Nasiadka