openstack/kolla-ansible.git/ansible/roles/nova-cell/tasks/version-check.yml, branch stable/2026.1

Start virtlogd in nova-libvirt and route console logs to it.

2026-06-25T19:28:28+00:00

Due to implementation choices in qemu and libvirt, standard log rotate does not work on these console files, and instead the usual approach is to have libvirt's virtlogd rotate the contents of the console log file when it gets a bit big. OpenStack Compute knows how to read data from more than one rotated console log file if required to service a REST API request. OpenStack Kolla and Kolla-Ansible deploy OpenStack components in docker or podman containers. An error in the startup configuration for the nova_libvirt container results in the libvirt virtlogd daemon not being run, which results in this console log rotation not occurring. This opens up the risk of a disk usage denial of service attack on a hypervisor. The console log is stored on the same filesystem as ephemeral disks, and OpenStack Nova will take a hypervisor out of service if disk space becomes constrained. There is some protection from the instance console not being able to write data particularly quickly, but it is definitely still possible to fill the hypervisor file system -- especially if multiple instances are used. This misconfiguration appears to exist in all versions of Kolla / Kolla-Ansible as best as I can tell. Flip qemu.conf's stdio_handler from "file" to "logd" so libvirt routes instance console chardevs through virtlogd, which rotates them per /etc/libvirt/virtlogd.conf. Without this, virtlogd runs but is never consulted and console.log grows unbounded. The nova_libvirt command now points at the /usr/local/bin/kolla_nova_libvirt_start helper shipped in the image. Deploying this Kolla-Ansible change against an older image that predates that helper would leave the container unable to start. Add a deploy-time check that inspects the nova_libvirt image for the helper and fails with an explanatory message when it is absent, so an incomplete upgrade (new code, stale image) is caught before the container is reconfigured. Partial-Bug: 2155214 Depends-On: https://review.opendev.org/c/openstack/kolla/+/993065 Change-Id: Ia543939b17cd06714695dff8ef8bd29bc3f8175e (cherry picked from commit 4244e6a91767a4706e59145f6841adbeeac048bb) Signed-off-by: Michael Still

ansible-lint: Fix fqcn[actions-core] for nova

2026-03-23T12:55:11+00:00

Change-Id: I3f8fc252c0254a95b30259f13a7c96b7b4ad34bf Signed-off-by: Michal Nasiadka

nova-cell: parallelize libvirt version check

2026-03-17T20:20:02+00:00

The previous code used `run_once`, `delegate_to`, and `loop`, so one host ran `kolla_container_facts` and `libvirtd --version` for every compute host in sequence. This is slow on large deployments. Run these checks on the compute hosts directly so Ansible can use normal per-host concurrency. Set `any_errors_fatal: true` on the libvirt version-check tasks so a failure on one host fails the play. Closes-bug: #2144664 Change-Id: Ic9564c84c0a6c1cef1f77ed115d860f819eec67b Signed-off-by: Bartosz Bezak

ansible-lint: fix unnamed-task in nova-cell

2025-12-10T21:19:49+00:00

Change-Id: I308edb8e04b1d752ebaecfcfda2a8e135228e0af Signed-off-by: Bertrand Lanson

ansible-lint: Remove key-order[task] exclude

2025-11-17T10:53:10+00:00

Change-Id: I77cce57f3f2b05455e8bd4e7093081ef4ed25d59 Signed-off-by: Michal Nasiadka

Prevent accidental Libvirt downgrades

2025-08-25T12:54:45+00:00

Add a version check for nova_libvirt during deploy and upgrade. Resolve the target image digest once on the first compute host. Compare it with each running container digest before version check. This runs the assertion only on hypervisors that would change image and leaves other hosts untouched. Adds a tiny macro role ``service-image-info`` to resolve container image info (Docker/Podman) once per service. The nova-libvirt version check now uses it to compare running vs target image. Closes-bug: #2120290 Co-Authored-By: Bartosz Bezak Signed-off-by: Bartosz Bezak Change-Id: I904a7b959f8fd151ab40bf6ac830dcf13d899239