openstack/kolla-ansible.git/ansible/roles/nova-cell/defaults/main.yml, branch stable/2026.1

Tune libvirtd connection limits for OpenStack

2026-06-29T00:11:47+00:00

The libvirt daemon ships with max_workers=20 and max_client_requests=5. Those defaults suit a multi-tenant host serving many mutually distrustful clients, where the per-client request cap protects the daemon from any single client monopolising it. Under Kolla-Ansible, nova-compute is effectively the sole privileged client of libvirtd, so the cap of 5 concurrent requests per client becomes the binding constraint rather than a safety net. When several instances build at once -- as they do during the tempest run of the upgrade jobs -- nova-compute's concurrent libvirt RPCs (instance defineXML calls plus the resource-tracker periodic) exceed five. Further requests queue, the connection's keepalive responses are starved, and after keepalive_interval (5s) x keepalive_count (5) = 25s libvirtd closes the connection. nova then sees "Cannot recv data: Input/output error" mid-defineXML, the build is rescheduled, and once all hosts are exhausted the instance is left in ERROR. This presents as flaky upgrade-job failures. Example failure, on the voting kolla-ansible-debian-bookworm-upgrade job (stable/2025.2): https://zuul.opendev.org/t/openstack/build/73ff5a97567d4e05b1774170e0f4aada with primary/logs/kolla/libvirt/libvirtd.txt showing libvirt's own recommendation to tune this parameter: warning : Client hit max requests limit 5. This may result in keep-alive timeouts. Consider tuning the max_client_requests server parameter ... error : connection closed due to keepalive timeout Raise the per-client cap to 20 -- comfortably above the handful of concurrent builds plus periodics seen in practice -- and the worker pool to 50 so that lifting the per-client limit does not starve other connections such as live migration, health checks and periodic tasks. Both values are exposed as variables (libvirt_max_client_requests and libvirt_max_workers) so operators can tune them further. This is not a Kolla-specific workaround -- the stock libvirtd.conf comment warns that setting max_client_requests too low "may cause keepalive timeouts", and since 2022 libvirtd emits the runtime warning quoted above. As Daniel Berrange explained when he added that warning, the keepalive packets "are subject to the 'max_client_requests' limit just like any API calls", so a client that saturates the limit can have its connection dropped: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/5NIJPA7SJVY55VSK7RTEDEHKWOZYJKT6/ Red Hat documents the same tuning for libvirt hosts under load in its knowledge base, notably "Too many active clients are dropping the connection" at https://access.redhat.com/solutions/28146. Assisted-By: Claude Opus 4.8 (1M context, medium effort) Partial-Bug: 2158515 Change-Id: I131c3d4d57dc73ca4dd421cc8f28465248c9830e (cherry picked from commit 5acd2f91d22213ef04bd6988a2a0261982b0cf05) Signed-off-by: Michael Still

Support multiple Nova Compute Ironic instances

2026-04-24T13:47:26+00:00

Adds support for deploying multiple instances of the Nova Compute Ironic service on the same host. This is useful in large baremetal deployments, where the sharding and/or conductor group feature is used to scale out the service. A further patch to support deploying multiple Ironic conductor instances will follow. Co-Authored-By: Bartosz Bezak Co-Authored-By: Bertrand Lanson Change-Id: Ibbddfd87e831a3775c3ed66c80b18e5070cedc90 Signed-off-by: Doug Szumski

Add additional SPICE configuration options

2026-04-02T20:05:13+00:00

Recent changes to OpenStack Compute have added a number of new configuration options for SPICE VDI consoles. Additionally, it is not always desirable to enable the HTML5 transcoding proxy for SPICE consoles in Horizon. This patch adds configuration to globals.yml for most of these new options. Specifically: * nova_spice_html5: whether to enable the HTML5 transcoding proxy or not. Defaults to the previous behaviour of enabling the proxy. Notably, nova_spice_require_secure is not exposed here as it implies that qemu is configured to support TLS, and that TLS certificates have been configured in the nova_libvirt container. These changes are large, and are included in a separate patch for clarity. Additionally, OpenStack Compute added these configuration options in 2023.1, and they are exposed as well: * nova_spice_image_compression: "auto_glz" * nova_spice_jpeg_compression: "auto" * nova_spice_zlib_compression: "auto" * nova_spice_playback_compression: true * nova_spice_streaming_mode: "filter" All configuration options and their various values are documented by OpenStack Compute in their documentation. Partial-Bug: #2131793 (spice-direct consoles) Change-Id: I07f6890f1c7c4e543667d3cbd7b3e82bd9ec83e3 Signed-off-by: Michael Still

ansible-lint: fix yaml[line-length] in nova-cell

2026-03-11T10:53:09+00:00

Change-Id: I2c9440a46dda9d5d188ae1efc6e363970220c37c Signed-off-by: Bertrand Lanson

Revert "ansible-lint: fix yaml[line-length] in roles"

2026-01-29T11:06:35+00:00

This reverts commit ae92e165ef5b02eb3870cdf92da58e76f049c7dd. Reason for revert: This broke cephadm jobs Change-Id: Ie1b2ceb9946dba2f50eda7bb5405a53f5ae044b8 Signed-off-by: Michal Nasiadka

ProxySQL: Add missing schemaname for default Nova cell

2026-01-18T12:18:57+00:00

When cells are unnamed (default single-cell setup), ProxySQL rules for Nova do not include a `schemaname: nova` entry. Routing still works because the user-based rule (`username: nova`) covers both the default cell and nova_cell0 on the same shard, but the configuration is incomplete and inconsistent with named cells. Closes-Bug: #2130985 Change-Id: I66861b7b78ae1f9810bd0b33bd13d5c00e6f2711 Signed-off-by: Michal Arbet

ansible-lint: fix yaml[line-length] in roles

2026-01-15T16:57:19+00:00

role: nova-cell Change-Id: Id3be578484f4f606658dd27e423ae06f971a97f1 Signed-off-by: Bertrand Lanson

Merge "Add support for libvirt swtpm (vTPM) configuration."

2025-12-23T09:08:55+00:00

Add support for Debian Trixie (13)

2025-12-19T14:55:59+00:00

Remove /etc/timezone bind mount since Debian does not provide that file anymore. Depends-On: https://review.opendev.org/c/openstack/kolla/+/964793 Change-Id: If1a289068093843184f0d7b495815db006f2d563 Signed-off-by: Michal Nasiadka

Add support for libvirt swtpm (vTPM) configuration.

2025-12-15T09:27:24+00:00

Since both nova-compute and nova-libvirt Kolla images have swtpm packages installed [1], it is possible to configure vTPM for libvirt instances. This patch adds support for such configuration in kolla-ansible. [1] https://bugs.launchpad.net/kolla/+bug/2062572 Closes-Bug: #2106219 Change-Id: Ic7969b05bde258c38ee31fe2821aeb4e9c77a567 Signed-off-by: fprzewozn