openstack/kolla-ansible.git/ansible/roles/keystone/tasks, branch stable/2026.1

fix: Delegate fernet key distribution to correct host

2026-08-12T19:53:46+00:00

The key used to group hosts was previously changed[0] but the group not updated in the task used to distribute fernet keys. When migrating hosts this could lead to the task being delegated to a host without keys, resulting in all hosts losing their keys. 0: Change I1db88e28a828ebf073f018b2bae1d9556ec22807 Closes-Bug: #2163158 Change-Id: Ia76f3e6cb41a30b88ac885832755ebe5264ad9fc Signed-off-by: Owen Jones (cherry picked from commit 541a26c7d4dd1988eda64327c6b08aa831ee3162)

Drop support for running WSGI under Apache

2026-04-24T11:07:46+00:00

The migration to uWSGI has been successfully completed. All API services now run exclusively under uWSGI. The *_wsgi_provider variables have been removed from all affected roles along with leftover Apache wsgi config templates and fluentd Apache log handling. Rework Apache fluentd input configuration so it doesn't glob out whole /var/log/kolla/*/* and just include required services when enabled. Change-Id: I1475e629d033163a50a5c681c8fe2557a7b10bae Signed-off-by: Michal Nasiadka Signed-off-by: Bartosz Bezak

Fix keystone with IDP configured.

2026-04-15T12:23:10+00:00

1. Add CI coverage for keystone_identity_providers under federation scenario. 2. Add fix for federation config in keystone role if keystone_identity_providers is defined. 3. Update Horizon tests with federation example. 4. Use openstack.cloud ansible modules instead of python-openstackclient in register_identity_providers.yml Closes-Bug: #2134455 Change-Id: Id03bc5770c3856c7c09a34e327b33786d7b7d859 Signed-off-by: Taavi Ansper

kolla-toolbox: Template clouds.yaml and use it

2026-04-15T12:17:01+00:00

Basically Ansible heuristic obfuscation methods mark auth: that we pass to openstack.* modules as no_log_values and then obfuscates it's values in other runs (which then end up as **** e.g. auth_url, domain_id, domain name, etc) Example return: "domains": [ { "description": "The ******** domain", "id": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER", "is_enabled": true, "links": { "self": "********/v3/domains/********" }, "name": "Default", "options": {}, "tags": [] } This patch adds clouds.yaml to files templated for kolla-toolbox (but without the password) and only uses password from Kolla-Ansible secrets instead of storing that on disk on all of the nodes. Change-Id: I479445563d5b5dc2e45601e936d89def647da841 Signed-off-by: Michal Nasiadka

ansible-lint: Fix fqcn[actions-core] for keystone

2026-03-20T15:42:58+00:00

Change-Id: I137a6b4de493c0284116eda2c148bc97b13df5ee Signed-off-by: Michal Nasiadka

Merge "keystone: Manage OIDC metadata files as templates"

2026-02-02T20:48:35+00:00

keystone: Manage OIDC metadata files as templates

2026-01-28T08:28:44+00:00

Switch from copy to template module for Keystone OIDC metadata configuration files. Such change was once implemented [1] in #937094, but reverted due to lack of file handling logic [2]. [1] https://review.opendev.org/c/openstack/kolla-ansible/+/937094 [2] https://review.opendev.org/c/openstack/kolla-ansible/+/940465 Change-Id: I270d741942a1502f2ef2ca39d119234713b7d939 Signed-off-by: fprzewozn

keystone: apply keystone_api_workers to uWSGI

2026-01-27T13:56:31+00:00

Partial-Bug: #2139153 Change-Id: If315f86cef80781cdea37d0fec391f638adb727d Signed-off-by: Bartosz Bezak

ansible-lint: fix yaml[line-length] in keystone

2026-01-15T16:57:13+00:00

Change-Id: Idf78a6e2a49a606d6d2060f21dbe69a06dc882d1 Signed-off-by: Bertrand Lanson

ansible-lint: fix unnamed-task in keystone

2025-12-10T21:19:48+00:00

Change-Id: I3be19b30e1431cddfc1da1ba5efd57f006ec9a1e Signed-off-by: Bertrand Lanson