group_vars: Reorganize huge all.yml into smaller files

This will help us to trigger scenario jobs on changes in given
group_vars files.

Changes to Zuul config to trigger given scenarios will be posted
as a follow-up.

Change-Id: I3f17adf655d2d0c1fc2969153dddb0c72b11397a
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>

67 files changed, 1506 insertions, 1430 deletions

diff --git a/ansible/group_vars/all.yml b/ansible/group_vars/all.yml
deleted file mode 100644
index 435937c58..000000000
--- a/ansible/group_vars/all.yml
+++ /dev/null
@@ -1,1413 +0,0 @@
----
-# The options in this file can be overridden in 'globals.yml'
-
-# The "temp" files that are created before merge need to stay persistent due
-# to the fact that ansible will register a "change" if it has to create them
-# again. Persistent files allow for idempotency
-container_config_directory: "/var/lib/kolla/config_files"
-
-# The directory on the deploy host containing globals.yml.
-node_config: "{{ CONFIG_DIR | default('/etc/kolla') }}"
-
-# The directory to merge custom config files the kolla's config files
-node_custom_config: "{{ node_config }}/config"
-
-# The directory to store the config files on the destination node
-node_config_directory: "/etc/kolla"
-
-# The group which own node_config_directory, you can use a non-root
-# user to deploy kolla
-config_owner_user: "root"
-config_owner_group: "root"
-
-###################
-# Ansible options
-###################
-
-# This variable is used as the "filter" argument for the setup module.  For
-# instance, if one wants to remove/ignore all Neutron interface facts:
-# kolla_ansible_setup_filter: "ansible_[!qt]*"
-# By default, we do not provide a filter.
-kolla_ansible_setup_filter: "{{ omit }}"
-
-# This variable is used as the "gather_subset" argument for the setup module.
-# For instance, if one wants to avoid collecting facts via facter:
-# kolla_ansible_setup_gather_subset: "all,!facter"
-# By default, we do not provide a gather subset.
-kolla_ansible_setup_gather_subset: "{{ omit }}"
-
-# This variable determines which hosts require facts when using --limit. Facts
-# will be gathered using delegation for hosts in this list that are not
-# included in the limit.
-# By default, this list includes all hosts.
-kolla_ansible_delegate_facts_hosts: "{{ groups['all'] }}"
-
-###################
-# Kolla options
-###################
-# Valid options are [ COPY_ONCE, COPY_ALWAYS ]
-config_strategy: "COPY_ALWAYS"
-
-# Valid options are ['centos', 'debian', 'rocky', 'ubuntu']
-kolla_base_distro: "rocky"
-
-kolla_internal_vip_address: "{{ kolla_internal_address | default('') }}"
-kolla_internal_fqdn: "{{ kolla_internal_vip_address }}"
-kolla_external_vip_address: "{{ kolla_internal_vip_address }}"
-kolla_same_external_internal_vip: "{{ kolla_external_vip_address | ansible.utils.ipaddr('address') == kolla_internal_vip_address | ansible.utils.ipaddr('address') }}"
-kolla_external_fqdn: "{{ kolla_internal_fqdn if kolla_same_external_internal_vip | bool else kolla_external_vip_address }}"
-
-kolla_dev_repos_directory: "/opt/stack/"
-kolla_dev_repos_git: "https://opendev.org/openstack"
-kolla_dev_repos_pull: "no"
-kolla_dev_mode: "no"
-kolla_source_version: "{% if openstack_release == 'master' %}master{% else %}stable/{{ openstack_release }}{% endif %}"
-
-# Proxy settings for containers such as magnum that need internet access
-container_http_proxy: ""
-container_https_proxy: ""
-container_no_proxy: "localhost,127.0.0.1"
-
-container_proxy_no_proxy_entries:
-  - "{{ container_no_proxy }}"
-  - "{{ api_interface_address }}"
-  - "{{ kolla_internal_vip_address | default('') }}"
-
-container_proxy:
-  http_proxy: "{{ container_http_proxy }}"
-  https_proxy: "{{ container_https_proxy }}"
-  no_proxy: "{{ container_proxy_no_proxy_entries | select | join(',') }}"
-
-# By default, Kolla API services bind to the network address assigned
-# to the api_interface.  Allow the bind address to be an override.
-api_interface_address: "{{ 'api' | kolla_address }}"
-
-
-####################
-# Database options
-####################
-database_address: "{{ kolla_internal_fqdn }}"
-database_user: "root"
-database_port: "3306"
-database_connection_recycle_time: 10
-database_max_pool_size: 1
-database_enable_tls_backend: "{{ 'yes' if ((kolla_enable_tls_backend | bool ) and ( enable_proxysql | bool)) else 'no' }}"
-database_enable_tls_internal: "{{ 'yes' if ((kolla_enable_tls_internal | bool ) and ( enable_proxysql | bool)) else 'no' }}"
-
-####################
-# Container engine options
-####################
-kolla_container_engine: "docker"
-
-####################
-# Docker options
-####################
-docker_registry_email:
-docker_registry: "quay.io"
-docker_namespace: "openstack.kolla"
-docker_image_name_prefix: ""
-docker_image_url: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ docker_namespace }}/{{ docker_image_name_prefix }}"
-docker_registry_username:
-# Please read the docs carefully before applying docker_registry_insecure.
-docker_registry_insecure: "no"
-docker_runtime_directory: ""
-# Docker client timeout in seconds.
-docker_client_timeout: 120
-
-# Docker networking options
-docker_disable_default_iptables_rules: "yes"
-docker_disable_default_network: "{{ docker_disable_default_iptables_rules }}"
-docker_disable_ip_forward: "{{ docker_disable_default_iptables_rules }}"
-
-# Retention settings for Docker logs
-docker_log_max_file: "5"
-docker_log_max_size: "50m"
-
-# Valid options are [ no, on-failure, always, unless-stopped ]
-docker_restart_policy: "unless-stopped"
-
-# '0' means unlimited retries (applies only to 'on-failure' policy)
-docker_restart_policy_retry: "10"
-
-# Extra docker options for Zun
-docker_configure_for_zun: "no"
-docker_zun_options: -H tcp://{{ api_interface_address | put_address_in_context('url') }}:2375
-docker_zun_config: {}
-
-# Extra containerd options for Zun
-containerd_configure_for_zun: "no"
-
-# Enable Ceph backed Cinder Volumes for zun
-zun_configure_for_cinder_ceph: "no"
-
-# 42463 is the static group id of the zun user in the Zun image.
-# If users customize this value on building the Zun images,
-# they need to change this config accordingly.
-containerd_grpc_gid: 42463
-
-# Timeout after Docker sends SIGTERM before sending SIGKILL.
-docker_graceful_timeout: 60
-
-# Common options used throughout Docker
-docker_common_options:
-  auth_email: "{{ docker_registry_email }}"
-  auth_password: "{{ docker_registry_password }}"
-  auth_registry: "{{ docker_registry }}"
-  auth_username: "{{ docker_registry_username }}"
-  environment:
-    KOLLA_CONFIG_STRATEGY: "{{ config_strategy }}"
-  restart_policy: "{{ docker_restart_policy }}"
-  restart_retries: "{{ docker_restart_policy_retry }}"
-  graceful_timeout: "{{ docker_graceful_timeout }}"
-  client_timeout: "{{ docker_client_timeout }}"
-  container_engine: "{{ kolla_container_engine }}"
-
-# Container engine specific volume paths
-docker_volumes_path: "{{ docker_runtime_directory or '/var/lib/docker' }}/volumes"
-podman_volumes_path: "{{ docker_runtime_directory or '/var/lib/containers' }}/storage/volumes"
-container_engine_volumes_path: "{{ docker_volumes_path if kolla_container_engine == 'docker' else podman_volumes_path }}"
-
-#####################
-# Volumes under /run
-#####################
-# Podman has problem with mounting whole /run directory
-# described here: https://github.com/containers/podman/issues/16305
-run_default_volumes_podman:
-  - '/run/netns:/run/netns:shared'
-  - '/run/lock/nova:/run/lock/nova:shared'
-  - "/run/libvirt:/run/libvirt:shared"
-  - "/run/nova:/run/nova:shared"
-  - "/run/openvswitch:/run/openvswitch:shared"
-
-run_default_volumes_docker: []
-
-run_default_subdirectories:
-  - '/run/netns'
-  - '/run/lock/nova'
-  - "/run/libvirt"
-  - "/run/nova"
-  - "/run/openvswitch"
-
-####################
-# Dimensions options
-####################
-# Dimension options for Docker Containers
-# NOTE(mnasiadka): Lower 1073741816 nofile limit on EL9 (RHEL9/CentOS Stream 9/Rocky Linux 9)
-#                  fixes at least rabbitmq and mariadb
-default_container_dimensions: "{{ default_container_dimensions_el9 if ansible_facts.os_family == 'RedHat' else '{}' }}"
-default_container_dimensions_el9: "{{ default_docker_dimensions_el9 if kolla_container_engine == 'docker' else default_podman_dimensions_el9 }}"
-default_docker_dimensions_el9:
-  ulimits:
-    nofile:
-      soft: 1048576
-      hard: 1048576
-default_podman_dimensions_el9:
-  ulimits:
-    RLIMIT_NOFILE:
-      soft: 1048576
-      hard: 1048576
-    RLIMIT_NPROC:
-      soft: 1048576
-      hard: 1048576
-
-#####################
-# Healthcheck options
-#####################
-enable_container_healthchecks: "yes"
-# Healthcheck options for Docker containers
-# interval/timeout/start_period are in seconds
-default_container_healthcheck_interval: 30
-default_container_healthcheck_timeout: 30
-default_container_healthcheck_retries: 3
-default_container_healthcheck_start_period: 5
-
-#######################
-# Extra volumes options
-#######################
-# Extra volumes for Docker Containers
-default_extra_volumes: []
-
-####################
-# keepalived options
-####################
-# Arbitrary unique number from 0..255
-keepalived_virtual_router_id: "51"
-
-
-#######################
-## Opensearch Options
-########################
-opensearch_datadir_volume: "opensearch"
-
-opensearch_internal_endpoint: "{{ opensearch_address | kolla_url(internal_protocol, opensearch_port) }}"
-opensearch_dashboards_internal_fqdn: "{{ kolla_internal_fqdn }}"
-opensearch_dashboards_external_fqdn: "{{ kolla_external_fqdn }}"
-opensearch_dashboards_internal_endpoint: "{{ opensearch_dashboards_internal_fqdn | kolla_url(internal_protocol, opensearch_dashboards_port) }}"
-opensearch_dashboards_external_endpoint: "{{ opensearch_dashboards_external_fqdn | kolla_url(public_protocol, opensearch_dashboards_port_external) }}"
-opensearch_dashboards_user: "opensearch"
-opensearch_log_index_prefix: "{{ kibana_log_prefix if kibana_log_prefix is defined else 'flog' }}"
-
-###################
-# Messaging options
-###################
-# oslo.messaging rpc transport valid options are [ rabbit, amqp ]
-om_rpc_transport: "rabbit"
-om_rpc_user: "{{ rabbitmq_user }}"
-om_rpc_password: "{{ rabbitmq_password }}"
-om_rpc_port: "{{ rabbitmq_port }}"
-om_rpc_group: "rabbitmq"
-om_rpc_vhost: "/"
-
-rpc_transport_url: "{{ om_rpc_transport }}://{% for host in groups[om_rpc_group] %}{{ om_rpc_user }}:{{ om_rpc_password }}@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ om_rpc_port }}{% if not loop.last %},{% endif %}{% endfor %}/{{ om_rpc_vhost }}"
-
-# oslo.messaging notify transport valid options are [ rabbit ]
-om_notify_transport: "rabbit"
-om_notify_user: "{{ rabbitmq_user }}"
-om_notify_password: "{{ rabbitmq_password }}"
-om_notify_port: "{{ rabbitmq_port }}"
-om_notify_group: "rabbitmq"
-om_notify_vhost: "/"
-
-notify_transport_url: "{{ om_notify_transport }}://{% for host in groups[om_notify_group] %}{{ om_notify_user }}:{{ om_notify_password }}@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ om_notify_port }}{% if not loop.last %},{% endif %}{% endfor %}/{{ om_notify_vhost }}"
-
-# Whether to enable TLS for oslo.messaging communication with RabbitMQ.
-om_enable_rabbitmq_tls: "{{ rabbitmq_enable_tls | bool }}"
-# CA certificate bundle in containers using oslo.messaging with RabbitMQ TLS.
-om_rabbitmq_cacert: "{{ rabbitmq_cacert }}"
-om_rabbitmq_qos_prefetch_count: "1"
-
-om_enable_rabbitmq_stream_fanout: true
-
-####################
-# Networking options
-####################
-network_interface: "eth0"
-neutron_external_interface: "eth1"
-kolla_external_vip_interface: "{{ network_interface }}"
-api_interface: "{{ network_interface }}"
-migration_interface: "{{ api_interface }}"
-tunnel_interface: "{{ network_interface }}"
-octavia_network_interface: "{{ 'o-hm0' if octavia_network_type == 'tenant' else api_interface }}"
-bifrost_network_interface: "{{ network_interface }}"
-dns_interface: "{{ network_interface }}"
-dpdk_tunnel_interface: "{{ neutron_external_interface }}"
-ironic_http_interface: "{{ api_interface }}"
-ironic_tftp_interface: "{{ api_interface }}"
-
-# Configure the address family (AF) per network.
-# Valid options are [ ipv4, ipv6 ]
-network_address_family: "ipv4"
-api_address_family: "{{ network_address_family }}"
-storage_address_family: "{{ network_address_family }}"
-migration_address_family: "{{ api_address_family }}"
-tunnel_address_family: "{{ network_address_family }}"
-octavia_network_address_family: "{{ api_address_family }}"
-bifrost_network_address_family: "{{ network_address_family }}"
-dns_address_family: "{{ network_address_family }}"
-dpdk_tunnel_address_family: "{{ network_address_family }}"
-ironic_http_address_family: "{{ api_address_family }}"
-ironic_tftp_address_family: "{{ api_address_family }}"
-
-migration_interface_address: "{{ 'migration' | kolla_address }}"
-tunnel_interface_address: "{{ 'tunnel' | kolla_address }}"
-octavia_network_interface_address: "{{ 'octavia_network' | kolla_address }}"
-dpdk_tunnel_interface_address: "{{ 'dpdk_tunnel' | kolla_address }}"
-ironic_http_interface_address: "{{ 'ironic_http' | kolla_address }}"
-ironic_tftp_interface_address: "{{ 'ironic_tftp' | kolla_address }}"
-
-# Valid options are [ openvswitch, ovn, linuxbridge ]
-# Do note linuxbridge is *EXPERIMENTAL* in Neutron since Zed and it requires extra tweaks to config to be usable.
-# For details, see: https://docs.openstack.org/neutron/latest/admin/config-experimental-framework.html
-neutron_plugin_agent: "openvswitch"
-
-# Valid options are [ internal, infoblox ]
-neutron_ipam_driver: "internal"
-
-# The default ports used by each service.
-# The list should be in alphabetical order
-aodh_internal_fqdn: "{{ kolla_internal_fqdn }}"
-aodh_external_fqdn: "{{ kolla_external_fqdn }}"
-aodh_internal_endpoint: "{{ aodh_internal_fqdn | kolla_url(internal_protocol, aodh_api_port) }}"
-aodh_public_endpoint: "{{ aodh_external_fqdn | kolla_url(public_protocol, aodh_api_public_port) }}"
-aodh_api_port: "8042"
-aodh_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else aodh_api_port }}"
-aodh_api_listen_port: "{{ aodh_api_port }}"
-
-barbican_internal_fqdn: "{{ kolla_internal_fqdn }}"
-barbican_external_fqdn: "{{ kolla_external_fqdn }}"
-barbican_internal_endpoint: "{{ barbican_internal_fqdn | kolla_url(internal_protocol, barbican_api_port) }}"
-barbican_public_endpoint: "{{ barbican_external_fqdn | kolla_url(public_protocol, barbican_api_public_port) }}"
-barbican_api_port: "9311"
-barbican_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else barbican_api_port }}"
-barbican_api_listen_port: "{{ barbican_api_port }}"
-
-blazar_internal_fqdn: "{{ kolla_internal_fqdn }}"
-blazar_external_fqdn: "{{ kolla_external_fqdn }}"
-blazar_internal_base_endpoint: "{{ blazar_internal_fqdn | kolla_url(internal_protocol, blazar_api_port) }}"
-blazar_public_base_endpoint: "{{ blazar_external_fqdn | kolla_url(public_protocol, blazar_api_public_port) }}"
-blazar_api_port: "1234"
-blazar_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else blazar_api_port }}"
-blazar_api_listen_port: "{{ blazar_api_port }}"
-
-ceph_rgw_internal_fqdn: "{{ kolla_internal_fqdn }}"
-ceph_rgw_external_fqdn: "{{ kolla_external_fqdn }}"
-ceph_rgw_internal_base_endpoint: "{{ ceph_rgw_internal_fqdn | kolla_url(internal_protocol, ceph_rgw_port) }}"
-ceph_rgw_public_base_endpoint: "{{ ceph_rgw_external_fqdn | kolla_url(public_protocol, ceph_rgw_public_port) }}"
-ceph_rgw_port: "6780"
-ceph_rgw_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else ceph_rgw_port }}"
-
-cinder_internal_fqdn: "{{ kolla_internal_fqdn }}"
-cinder_external_fqdn: "{{ kolla_external_fqdn }}"
-cinder_internal_base_endpoint: "{{ cinder_internal_fqdn | kolla_url(internal_protocol, cinder_api_port) }}"
-cinder_public_base_endpoint: "{{ cinder_external_fqdn | kolla_url(public_protocol, cinder_api_public_port) }}"
-cinder_api_port: "8776"
-cinder_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else cinder_api_port }}"
-cinder_api_listen_port: "{{ cinder_api_port }}"
-
-cloudkitty_internal_fqdn: "{{ kolla_internal_fqdn }}"
-cloudkitty_external_fqdn: "{{ kolla_external_fqdn }}"
-cloudkitty_internal_endpoint: "{{ cloudkitty_internal_fqdn | kolla_url(internal_protocol, cloudkitty_api_port) }}"
-cloudkitty_public_endpoint: "{{ cloudkitty_external_fqdn | kolla_url(public_protocol, cloudkitty_api_public_port) }}"
-cloudkitty_api_port: "8889"
-cloudkitty_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else cloudkitty_api_port }}"
-cloudkitty_api_listen_port: "{{ cloudkitty_api_port }}"
-
-collectd_udp_port: "25826"
-
-cyborg_internal_fqdn: "{{ kolla_internal_fqdn }}"
-cyborg_external_fqdn: "{{ kolla_external_fqdn }}"
-cyborg_api_port: "6666"
-cyborg_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else cyborg_api_port }}"
-cyborg_api_listen_port: "{{ cyborg_api_port }}"
-
-designate_internal_fqdn: "{{ kolla_internal_fqdn }}"
-designate_external_fqdn: "{{ kolla_external_fqdn }}"
-designate_internal_endpoint: "{{ designate_internal_fqdn | kolla_url(internal_protocol, designate_api_port) }}"
-designate_public_endpoint: "{{ designate_external_fqdn | kolla_url(public_protocol, designate_api_public_port) }}"
-designate_api_port: "9001"
-designate_api_listen_port: "{{ designate_api_port }}"
-designate_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else designate_api_port }}"
-designate_bind_port: "53"
-designate_mdns_port: "{{ '53' if designate_backend == 'infoblox' else '5354' }}"
-designate_rndc_port: "953"
-
-etcd_client_port: "2379"
-etcd_peer_port: "2380"
-etcd_enable_tls: "{{ kolla_enable_tls_backend }}"
-etcd_protocol: "{{ 'https' if etcd_enable_tls | bool else 'http' }}"
-
-fluentd_syslog_port: "5140"
-
-glance_internal_fqdn: "{{ kolla_internal_fqdn }}"
-glance_external_fqdn: "{{ kolla_external_fqdn }}"
-glance_internal_endpoint: "{{ glance_internal_fqdn | kolla_url(internal_protocol, glance_api_port) }}"
-glance_public_endpoint: "{{ glance_external_fqdn | kolla_url(public_protocol, glance_api_public_port) }}"
-glance_api_port: "9292"
-glance_api_listen_port: "{{ glance_api_port }}"
-glance_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else glance_api_port }}"
-glance_tls_proxy_stats_port: "9293"
-
-gnocchi_internal_fqdn: "{{ kolla_internal_fqdn }}"
-gnocchi_external_fqdn: "{{ kolla_external_fqdn }}"
-gnocchi_internal_endpoint: "{{ gnocchi_internal_fqdn | kolla_url(internal_protocol, gnocchi_api_port) }}"
-gnocchi_public_endpoint: "{{ gnocchi_external_fqdn | kolla_url(public_protocol, gnocchi_api_public_port) }}"
-gnocchi_api_port: "8041"
-gnocchi_api_listen_port: "{{ gnocchi_api_port }}"
-gnocchi_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else gnocchi_api_port }}"
-
-grafana_internal_fqdn: "{{ kolla_internal_fqdn }}"
-grafana_external_fqdn: "{{ kolla_external_fqdn }}"
-grafana_internal_endpoint: "{{ grafana_internal_fqdn | kolla_url(internal_protocol, grafana_server_port) }}"
-grafana_public_endpoint: "{{ grafana_external_fqdn | kolla_url(public_protocol, grafana_server_public_port) }}"
-grafana_server_port: "3000"
-grafana_server_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else grafana_server_port }}"
-grafana_server_listen_port: "{{ grafana_server_port }}"
-
-haproxy_stats_port: "1984"
-haproxy_monitor_port: "61313"
-haproxy_ssh_port: "2985"
-# configure SSL/TLS settings for haproxy config, one of [modern, intermediate, legacy]:
-kolla_haproxy_ssl_settings: "modern"
-
-haproxy_ssl_settings: "{{ ssl_legacy_settings if kolla_haproxy_ssl_settings == 'legacy' else ssl_intermediate_settings if kolla_haproxy_ssl_settings == 'intermediate' else ssl_modern_settings | default(ssl_modern_settings) }}"
-
-ssl_legacy_settings: |
-    ssl-default-bind-ciphers DEFAULT:!MEDIUM:!3DES
-    ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11
-
-ssl_intermediate_settings: |
-    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
-    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
-    ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
-    ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
-    ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
-    ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
-
-ssl_modern_settings: |
-    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
-    ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets
-    ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
-    ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets
-
-heat_internal_fqdn: "{{ kolla_internal_fqdn }}"
-heat_external_fqdn: "{{ kolla_external_fqdn }}"
-heat_internal_base_endpoint: "{{ heat_internal_fqdn | kolla_url(internal_protocol, heat_api_port) }}"
-heat_public_base_endpoint: "{{ heat_external_fqdn | kolla_url(public_protocol, heat_api_public_port) }}"
-heat_api_port: "8004"
-heat_api_listen_port: "{{ heat_api_port }}"
-heat_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else heat_api_port }}"
-heat_cfn_internal_fqdn: "{{ kolla_internal_fqdn }}"
-heat_cfn_external_fqdn: "{{ kolla_external_fqdn }}"
-heat_cfn_internal_base_endpoint: "{{ heat_cfn_internal_fqdn | kolla_url(internal_protocol, heat_api_cfn_port) }}"
-heat_cfn_public_base_endpoint: "{{ heat_cfn_external_fqdn | kolla_url(public_protocol, heat_api_cfn_public_port) }}"
-heat_api_cfn_port: "8000"
-heat_api_cfn_listen_port: "{{ heat_api_cfn_port }}"
-heat_api_cfn_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else heat_api_cfn_port }}"
-
-horizon_internal_fqdn: "{{ kolla_internal_fqdn }}"
-horizon_external_fqdn: "{{ kolla_external_fqdn }}"
-horizon_internal_endpoint: "{{ kolla_internal_fqdn | kolla_url(internal_protocol, horizon_tls_port if kolla_enable_tls_internal | bool else horizon_port) }}"
-horizon_public_endpoint: "{{ kolla_external_fqdn | kolla_url(public_protocol, horizon_tls_port if kolla_enable_tls_external | bool else horizon_port) }}"
-horizon_port: "80"
-horizon_tls_port: "443"
-horizon_listen_port: "{{ horizon_tls_port if horizon_enable_tls_backend | bool else horizon_port }}"
-
-influxdb_http_port: "8086"
-
-ironic_internal_fqdn: "{{ kolla_internal_fqdn }}"
-ironic_external_fqdn: "{{ kolla_external_fqdn }}"
-ironic_internal_endpoint: "{{ ironic_internal_fqdn | kolla_url(internal_protocol, ironic_api_port) }}"
-ironic_public_endpoint: "{{ ironic_external_fqdn | kolla_url(public_protocol, ironic_api_public_port) }}"
-ironic_api_port: "6385"
-ironic_api_listen_port: "{{ ironic_api_port }}"
-ironic_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else ironic_api_port }}"
-ironic_http_port: "8089"
-ironic_prometheus_exporter_port: "9608"
-
-iscsi_port: "3260"
-
-keystone_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else keystone_public_listen_port }}"
-keystone_public_listen_port: "5000"
-keystone_internal_port: "5000"
-keystone_internal_listen_port: "{{ keystone_internal_port }}"
-keystone_listen_port: "{{ keystone_internal_listen_port }}"
-
-keystone_ssh_port: "8023"
-
-kuryr_port: "23750"
-
-letsencrypt_webserver_port: "8081"
-letsencrypt_managed_certs: "{{ '' if not enable_letsencrypt | bool else ('internal' if letsencrypt_internal_cert_server != '' and kolla_same_external_internal_vip | bool else ('internal,external' if letsencrypt_internal_cert_server != '' and letsencrypt_external_cert_server != '' else ('internal' if letsencrypt_internal_cert_server != '' else ('external' if letsencrypt_external_cert_server != '' and not kolla_same_external_internal_vip | bool else '')))) }}"
-letsencrypt_external_cert_server: "https://acme-v02.api.letsencrypt.org/directory"
-letsencrypt_internal_cert_server: ""
-
-magnum_internal_fqdn: "{{ kolla_internal_fqdn }}"
-magnum_external_fqdn: "{{ kolla_external_fqdn }}"
-magnum_internal_base_endpoint: "{{ magnum_internal_fqdn | kolla_url(internal_protocol, magnum_api_port) }}"
-magnum_public_base_endpoint: "{{ magnum_external_fqdn | kolla_url(public_protocol, magnum_api_public_port) }}"
-magnum_api_port: "9511"
-magnum_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else magnum_api_port }}"
-magnum_api_listen_port: "{{ magnum_api_port }}"
-
-manila_internal_fqdn: "{{ kolla_internal_fqdn }}"
-manila_external_fqdn: "{{ kolla_external_fqdn }}"
-manila_internal_base_endpoint: "{{ manila_internal_fqdn | kolla_url(internal_protocol, manila_api_port) }}"
-manila_public_base_endpoint: "{{ manila_external_fqdn | kolla_url(public_protocol, manila_api_public_port) }}"
-manila_api_port: "8786"
-manila_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else manila_api_port }}"
-manila_api_listen_port: "{{ manila_api_port }}"
-
-mariadb_port: "{{ database_port }}"
-mariadb_wsrep_port: "4567"
-mariadb_ist_port: "4568"
-mariadb_sst_port: "4444"
-mariadb_clustercheck_port: "4569"
-mariadb_enable_tls_backend: "{{ database_enable_tls_backend }}"
-
-mariadb_monitor_user: "{{ 'monitor' if enable_proxysql | bool else 'haproxy' }}"
-
-mariadb_datadir_volume: "mariadb"
-
-mariadb_default_database_shard_id: 0
-mariadb_default_database_shard_hosts: "{% set default_shard = [] %}{% for host in groups['mariadb'] %}{% if hostvars[host]['mariadb_shard_id'] is not defined or hostvars[host]['mariadb_shard_id'] == mariadb_default_database_shard_id %}{{ default_shard.append(host) }}{% endif %}{% endfor %}{{ default_shard }}"
-mariadb_shard_id: "{{ mariadb_default_database_shard_id }}"
-mariadb_shard_name: "shard_{{ mariadb_shard_id }}"
-mariadb_shard_group: "mariadb_{{ mariadb_shard_name }}"
-mariadb_loadbalancer: "{{ 'proxysql' if enable_proxysql | bool else 'haproxy' }}"
-mariadb_backup_target: "{{ 'active' if mariadb_loadbalancer == 'haproxy' else 'replica' }}"
-mariadb_shard_root_user_prefix: "root_shard_"
-mariadb_shard_backup_user_prefix: "backup_shard_"
-mariadb_shards_info: "{{ groups['mariadb'] | database_shards_info() }}"
-
-masakari_internal_fqdn: "{{ kolla_internal_fqdn }}"
-masakari_external_fqdn: "{{ kolla_external_fqdn }}"
-masakari_internal_endpoint: "{{ masakari_internal_fqdn | kolla_url(internal_protocol, masakari_api_port) }}"
-masakari_public_endpoint: "{{ masakari_external_fqdn | kolla_url(public_protocol, masakari_api_public_port) }}"
-masakari_api_port: "15868"
-masakari_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else masakari_api_port }}"
-masakari_api_listen_port: "{{ masakari_api_port }}"
-masakari_coordination_backend: "{{ 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}"
-
-memcached_port: "11211"
-memcache_security_strategy: "ENCRYPT"
-
-mistral_internal_fqdn: "{{ kolla_internal_fqdn }}"
-mistral_external_fqdn: "{{ kolla_external_fqdn }}"
-mistral_internal_base_endpoint: "{{ mistral_internal_fqdn | kolla_url(internal_protocol, mistral_api_port) }}"
-mistral_public_base_endpoint: "{{ mistral_external_fqdn | kolla_url(public_protocol, mistral_api_public_port) }}"
-mistral_api_port: "8989"
-mistral_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else mistral_api_port }}"
-mistral_api_listen_port: "{{ mistral_api_port }}"
-
-neutron_internal_fqdn: "{{ kolla_internal_fqdn }}"
-neutron_external_fqdn: "{{ kolla_external_fqdn }}"
-neutron_internal_endpoint: "{{ neutron_internal_fqdn | kolla_url(internal_protocol, neutron_server_port) }}"
-neutron_public_endpoint: "{{ neutron_external_fqdn | kolla_url(public_protocol, neutron_server_public_port) }}"
-neutron_server_port: "9696"
-neutron_server_listen_port: "{{ neutron_server_port }}"
-neutron_server_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else neutron_server_port }}"
-
-nova_internal_fqdn: "{{ kolla_internal_fqdn }}"
-nova_external_fqdn: "{{ kolla_external_fqdn }}"
-nova_internal_base_endpoint: "{{ nova_internal_fqdn | kolla_url(internal_protocol, nova_api_port) }}"
-nova_public_base_endpoint: "{{ nova_external_fqdn | kolla_url(public_protocol, nova_api_public_port) }}"
-nova_api_port: "8774"
-nova_api_listen_port: "{{ nova_api_port }}"
-nova_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else nova_api_port }}"
-nova_metadata_internal_fqdn: "{{ kolla_internal_fqdn }}"
-nova_metadata_external_fqdn: "{{ kolla_external_fqdn }}"
-nova_metadata_port: "8775"
-nova_metadata_listen_port: "{{ nova_metadata_port }}"
-nova_novncproxy_fqdn: "{{ kolla_external_fqdn }}"
-nova_novncproxy_port: "6080"
-nova_novncproxy_listen_port: "{{ nova_novncproxy_port }}"
-nova_novncproxy_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else nova_novncproxy_port }}"
-nova_spicehtml5proxy_fqdn: "{{ kolla_external_fqdn }}"
-nova_spicehtml5proxy_port: "6082"
-nova_spicehtml5proxy_listen_port: "{{ nova_spicehtml5proxy_port }}"
-nova_spicehtml5proxy_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else nova_spicehtml5proxy_port }}"
-nova_serialproxy_fqdn: "{{ kolla_external_fqdn }}"
-nova_serialproxy_port: "6083"
-nova_serialproxy_listen_port: "{{ nova_serialproxy_port }}"
-nova_serialproxy_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else nova_serialproxy_port }}"
-nova_serialproxy_protocol: "{{ 'wss' if kolla_enable_tls_external | bool else 'ws' }}"
-
-octavia_internal_fqdn: "{{ kolla_internal_fqdn }}"
-octavia_external_fqdn: "{{ kolla_external_fqdn }}"
-octavia_internal_endpoint: "{{ octavia_internal_fqdn | kolla_url(internal_protocol, octavia_api_port) }}"
-octavia_public_endpoint: "{{ octavia_external_fqdn | kolla_url(public_protocol, octavia_api_public_port) }}"
-octavia_api_port: "9876"
-octavia_api_listen_port: "{{ octavia_api_port }}"
-octavia_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else octavia_api_port }}"
-octavia_health_manager_port: "5555"
-
-# NOTE: If an external ElasticSearch cluster port is specified,
-# we default to using that port in services with ElasticSearch
-# endpoints. This is for backwards compatibility.
-opensearch_port: "{{ elasticsearch_port | default('9200') }}"
-opensearch_dashboards_port: "5601"
-opensearch_dashboards_port_external: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else opensearch_dashboards_port }}"
-opensearch_dashboards_listen_port: "{{ opensearch_dashboards_port }}"
-
-ovn_nb_db_port: "6641"
-ovn_sb_db_port: "6642"
-# OVN SB Relay related variables
-ovn_sb_db_relay_count: "{{ ((groups['ovn-controller'] | length) / ovn_sb_db_relay_compute_per_relay | int) | round(0, 'ceil') | int }}"
-ovn_sb_db_relay_compute_per_relay: "50"
-ovn_sb_db_relay_port_prefix: "1664"
-ovn_sb_db_relay_port: "{{ ovn_sb_db_relay_port_prefix ~ ovn_sb_db_relay_client_group_id }}"
-ovn_sb_db_relay_client_group_id: "{{ range(1, ovn_sb_db_relay_count | int + 1) | random(seed=inventory_hostname) }}"
-ovn_nb_connection: "{% for host in groups['ovn-nb-db'] %}tcp:{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ ovn_nb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}"
-ovn_sb_connection: "{{ ovn_sb_connection_relay if enable_ovn_sb_db_relay | bool else ovn_sb_connection_no_relay }}"
-ovn_sb_connection_no_relay: "{% for host in groups['ovn-sb-db'] %}tcp:{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ ovn_sb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}"
-ovn_sb_connection_relay: "{% for host in groups['ovn-sb-db-relay'] %}tcp:{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ ovn_sb_db_relay_port }}{% if not loop.last %},{% endif %}{% endfor %}"
-
-ovsdb_port: "6640"
-
-placement_internal_fqdn: "{{ kolla_internal_fqdn }}"
-placement_external_fqdn: "{{ kolla_external_fqdn }}"
-placement_internal_endpoint: "{{ placement_internal_fqdn | kolla_url(internal_protocol, placement_api_port) }}"
-placement_public_endpoint: "{{ placement_external_fqdn | kolla_url(public_protocol, placement_api_public_port) }}"
-# Default Placement API port of 8778 already in use
-placement_api_port: "8780"
-placement_api_listen_port: "{{ placement_api_port }}"
-placement_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else placement_api_port }}"
-
-prometheus_internal_fqdn: "{{ kolla_internal_fqdn }}"
-prometheus_external_fqdn: "{{ kolla_external_fqdn }}"
-prometheus_internal_endpoint: "{{ prometheus_internal_fqdn | kolla_url(internal_protocol, prometheus_port) }}"
-prometheus_public_endpoint: "{{ prometheus_external_fqdn | kolla_url(public_protocol, prometheus_public_port) }}"
-prometheus_port: "9091"
-prometheus_listen_port: "{{ prometheus_port }}"
-prometheus_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else prometheus_port }}"
-prometheus_node_exporter_port: "9100"
-prometheus_mysqld_exporter_port: "9104"
-prometheus_haproxy_exporter_port: "9101"
-prometheus_memcached_exporter_port: "9150"
-prometheus_rabbitmq_exporter_port: "{{ rabbitmq_prometheus_port }}"
-# Default cadvisor port of 8080 already in use
-prometheus_cadvisor_port: "18080"
-prometheus_fluentd_integration_port: "24231"
-prometheus_libvirt_exporter_port: "9177"
-prometheus_etcd_integration_port: "{{ etcd_client_port }}"
-proxysql_prometheus_exporter_port: "6070"
-
-# Prometheus alertmanager ports
-prometheus_alertmanager_internal_fqdn: "{{ kolla_internal_fqdn }}"
-prometheus_alertmanager_external_fqdn: "{{ kolla_external_fqdn }}"
-prometheus_alertmanager_internal_endpoint: "{{ prometheus_alertmanager_internal_fqdn | kolla_url(internal_protocol, prometheus_alertmanager_port) }}"
-prometheus_alertmanager_public_endpoint: "{{ prometheus_alertmanager_external_fqdn | kolla_url(public_protocol, prometheus_alertmanager_public_port) }}"
-prometheus_alertmanager_port: "9093"
-prometheus_alertmanager_cluster_port: "9094"
-prometheus_alertmanager_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else prometheus_alertmanager_port }}"
-prometheus_alertmanager_listen_port: "{{ prometheus_alertmanager_port }}"
-
-# Prometheus openstack-exporter ports
-prometheus_openstack_exporter_port: "9198"
-prometheus_elasticsearch_exporter_port: "9108"
-
-# Prometheus blackbox-exporter ports
-prometheus_blackbox_exporter_port: "9115"
-
-# Prometheus instance label to use for metrics
-prometheus_instance_label:
-
-proxysql_admin_port: "6032"
-
-rabbitmq_port: "{{ '5671' if rabbitmq_enable_tls | bool else '5672' }}"
-rabbitmq_management_port: "15672"
-rabbitmq_cluster_port: "25672"
-rabbitmq_epmd_port: "4369"
-rabbitmq_prometheus_port: "15692"
-
-redis_port: "6379"
-redis_sentinel_port: "26379"
-
-skyline_apiserver_internal_fqdn: "{{ kolla_internal_fqdn }}"
-skyline_apiserver_external_fqdn: "{{ kolla_external_fqdn }}"
-skyline_apiserver_internal_endpoint: "{{ skyline_apiserver_internal_fqdn | kolla_url(internal_protocol, skyline_apiserver_port) }}"
-skyline_apiserver_public_endpoint: "{{ skyline_apiserver_external_fqdn | kolla_url(public_protocol, skyline_apiserver_public_port) }}"
-skyline_console_internal_fqdn: "{{ kolla_internal_fqdn }}"
-skyline_console_external_fqdn: "{{ kolla_external_fqdn }}"
-skyline_console_internal_endpoint: "{{ skyline_console_internal_fqdn | kolla_url(internal_protocol, skyline_console_port) }}"
-skyline_console_public_endpoint: "{{ skyline_console_external_fqdn | kolla_url(public_protocol, skyline_console_public_port) }}"
-skyline_apiserver_port: "9998"
-skyline_apiserver_listen_port: "{{ skyline_apiserver_port }}"
-skyline_apiserver_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else skyline_apiserver_port }}"
-skyline_console_port: "9999"
-skyline_console_listen_port: "{{ skyline_console_port }}"
-skyline_console_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else skyline_console_port }}"
-skyline_enable_sso: "{{ enable_keystone_federation | bool and keystone_identity_providers | selectattr('protocol', 'equalto', 'openid') | list | count > 0 }}"
-
-syslog_udp_port: "{{ fluentd_syslog_port }}"
-
-tacker_internal_fqdn: "{{ kolla_internal_fqdn }}"
-tacker_external_fqdn: "{{ kolla_external_fqdn }}"
-tacker_internal_endpoint: "{{ tacker_internal_fqdn | kolla_url(internal_protocol, tacker_server_port) }}"
-tacker_public_endpoint: "{{ tacker_external_fqdn | kolla_url(public_protocol, tacker_server_public_port) }}"
-tacker_server_port: "9890"
-tacker_server_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else tacker_server_port }}"
-tacker_server_listen_port: "{{ tacker_server_port }}"
-
-trove_internal_fqdn: "{{ kolla_internal_fqdn }}"
-trove_external_fqdn: "{{ kolla_external_fqdn }}"
-trove_internal_base_endpoint: "{{ trove_internal_fqdn | kolla_url(internal_protocol, trove_api_port) }}"
-trove_public_base_endpoint: "{{ trove_external_fqdn | kolla_url(public_protocol, trove_api_public_port) }}"
-trove_api_port: "8779"
-trove_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else trove_api_port }}"
-trove_api_listen_port: "{{ trove_api_port }}"
-
-venus_internal_fqdn: "{{ kolla_internal_fqdn }}"
-venus_external_fqdn: "{{ kolla_external_fqdn }}"
-venus_internal_endpoint: "{{ venus_internal_fqdn | kolla_url(internal_protocol, venus_api_port) }}"
-venus_public_endpoint: "{{ venus_external_fqdn | kolla_url(public_protocol, venus_api_public_port) }}"
-venus_api_port: "10010"
-venus_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else venus_api_port }}"
-venus_api_listen_port: "{{ venus_api_port }}"
-
-watcher_internal_fqdn: "{{ kolla_internal_fqdn }}"
-watcher_external_fqdn: "{{ kolla_external_fqdn }}"
-watcher_internal_endpoint: "{{ watcher_internal_fqdn | kolla_url(internal_protocol, watcher_api_port) }}"
-watcher_public_endpoint: "{{ watcher_external_fqdn | kolla_url(public_protocol, watcher_api_public_port) }}"
-watcher_api_port: "9322"
-watcher_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else watcher_api_port }}"
-watcher_api_listen_port: "{{ watcher_api_port }}"
-
-zun_api_port: "9517"
-zun_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else zun_api_port }}"
-zun_api_listen_port: "{{ zun_api_port }}"
-zun_wsproxy_internal_fqdn: "{{ kolla_internal_fqdn }}"
-zun_wsproxy_external_fqdn: "{{ kolla_external_fqdn }}"
-zun_wsproxy_port: "6784"
-zun_wsproxy_protocol: "{{ 'wss' if kolla_enable_tls_external | bool else 'ws' }}"
-zun_cni_daemon_port: "9036"
-zun_internal_fqdn: "{{ kolla_internal_fqdn }}"
-zun_external_fqdn: "{{ kolla_external_fqdn }}"
-zun_internal_base_endpoint: "{{ zun_internal_fqdn | kolla_url(internal_protocol, zun_api_port) }}"
-zun_public_base_endpoint: "{{ zun_external_fqdn | kolla_url(public_protocol, zun_api_public_port) }}"
-
-public_protocol: "{{ 'https' if kolla_enable_tls_external | bool else 'http' }}"
-internal_protocol: "{{ 'https' if kolla_enable_tls_internal | bool else 'http' }}"
-
-##################
-# Firewall options
-##################
-enable_external_api_firewalld: "false"
-external_api_firewalld_zone: "public"
-
-####################
-# OpenStack options
-####################
-openstack_release: "master"
-# Docker image tag used by default.
-openstack_tag: "{{ openstack_release }}-{{ kolla_base_distro }}-{{ kolla_base_distro_version }}{{ openstack_tag_suffix }}"
-openstack_tag_suffix: ""
-openstack_logging_debug: "False"
-
-openstack_region_name: "RegionOne"
-
-# A list of policy file formats that are supported by Oslo.policy
-supported_policy_format_list:
-  - policy.yaml
-  - policy.json
-
-# In the context of multi-regions, list here the name of all your regions.
-multiple_regions_names:
-  - "{{ openstack_region_name }}"
-
-openstack_service_workers: "{{ [ansible_facts.processor_vcpus, 5] | min }}"
-openstack_service_rpc_workers: "{{ [ansible_facts.processor_vcpus, 3] | min }}"
-
-# Optionally allow Kolla to set sysctl values
-set_sysctl: "yes"
-
-# Optionally change the path to sysctl.conf modified by Kolla Ansible plays.
-kolla_sysctl_conf_path: /etc/sysctl.conf
-
-# Endpoint type used to connect with OpenStack services with ansible modules.
-# Valid options are [ public, internal ]
-openstack_interface: "internal"
-
-# Openstack CA certificate bundle file
-# CA bundle file must be added to both the Horizon and Kolla Toolbox containers
-openstack_cacert: ""
-
-# Enable core OpenStack services. This includes:
-# glance, keystone, neutron, nova, heat, and horizon.
-enable_openstack_core: "yes"
-
-# These roles are required for Kolla to be operation, however a savvy deployer
-# could disable some of these required roles and run their own services.
-enable_glance: "{{ enable_openstack_core | bool }}"
-enable_haproxy: "yes"
-enable_keepalived: "{{ enable_haproxy | bool }}"
-enable_loadbalancer: "{{ enable_haproxy | bool or enable_keepalived | bool or enable_proxysql | bool }}"
-enable_keystone: "{{ enable_openstack_core | bool }}"
-enable_keystone_federation: "{{ (keystone_identity_providers | length > 0) and (keystone_identity_mappings | length > 0) }}"
-enable_mariadb: "yes"
-enable_memcached: "yes"
-enable_neutron: "{{ enable_openstack_core | bool }}"
-enable_nova: "{{ enable_openstack_core | bool }}"
-enable_rabbitmq: "{{ 'yes' if om_rpc_transport == 'rabbit' or om_notify_transport == 'rabbit' else 'no' }}"
-
-# NOTE: Most memcached clients handle load-balancing via client side
-# hashing (consistent or not) logic, so going under the covers and messing
-# with things that the clients are not aware of is generally wrong
-enable_haproxy_memcached: "no"
-
-# Additional optional OpenStack features and services are specified here
-enable_aodh: "no"
-enable_barbican: "no"
-enable_blazar: "no"
-enable_ceilometer: "no"
-enable_ceilometer_ipmi: "no"
-enable_ceilometer_prometheus_pushgateway: "no"
-enable_cells: "no"
-enable_central_logging: "no"
-enable_ceph_rgw: "no"
-enable_ceph_rgw_loadbalancer: "{{ enable_ceph_rgw | bool }}"
-enable_cinder: "no"
-enable_cinder_backup: "yes"
-enable_cinder_backend_iscsi: "{{ enable_cinder_backend_lvm | bool }}"
-enable_cinder_backend_lvm: "no"
-enable_cinder_backend_nfs: "no"
-enable_cinder_backend_quobyte: "no"
-enable_cinder_backend_pure_iscsi: "no"
-enable_cinder_backend_pure_fc: "no"
-enable_cinder_backend_pure_roce: "no"
-enable_cinder_backend_pure_nvme_tcp: "no"
-enable_cinder_backend_lightbits: "no"
-enable_cloudkitty: "no"
-enable_collectd: "no"
-enable_cyborg: "no"
-enable_designate: "no"
-enable_etcd: "no"
-enable_fluentd: "yes"
-enable_fluentd_systemd: "{{ (enable_fluentd | bool) and (enable_central_logging | bool) }}"
-enable_gnocchi: "no"
-enable_gnocchi_statsd: "no"
-enable_grafana: "no"
-enable_grafana_external: "{{ enable_grafana | bool }}"
-enable_hacluster: "{{ enable_masakari_hostmonitor | bool }}"
-enable_heat: "{{ enable_openstack_core | bool }}"
-enable_horizon: "{{ enable_openstack_core | bool }}"
-enable_horizon_blazar: "{{ enable_blazar | bool }}"
-enable_horizon_cloudkitty: "{{ enable_cloudkitty | bool }}"
-enable_horizon_designate: "{{ enable_designate | bool }}"
-enable_horizon_fwaas: "{{ enable_neutron_fwaas | bool }}"
-enable_horizon_heat: "{{ enable_heat | bool }}"
-enable_horizon_ironic: "{{ enable_ironic | bool }}"
-enable_horizon_magnum: "{{ enable_magnum | bool }}"
-enable_horizon_manila: "{{ enable_manila | bool }}"
-enable_horizon_masakari: "{{ enable_masakari | bool }}"
-enable_horizon_mistral: "{{ enable_mistral | bool }}"
-enable_horizon_neutron_vpnaas: "{{ enable_neutron_vpnaas | bool }}"
-enable_horizon_octavia: "{{ enable_octavia | bool }}"
-enable_horizon_tacker: "{{ enable_tacker | bool }}"
-enable_horizon_trove: "{{ enable_trove | bool }}"
-enable_horizon_venus: "{{ enable_venus | bool }}"
-enable_horizon_watcher: "{{ enable_watcher | bool }}"
-enable_horizon_zun: "{{ enable_zun | bool }}"
-enable_influxdb: "{{ enable_cloudkitty | bool and cloudkitty_storage_backend == 'influxdb' }}"
-enable_ironic: "no"
-enable_ironic_dnsmasq: "{{ enable_ironic | bool }}"
-enable_ironic_neutron_agent: "no"
-enable_ironic_prometheus_exporter: "{{ enable_ironic | bool and enable_prometheus | bool }}"
-enable_iscsid: "{{ enable_cinder | bool and enable_cinder_backend_iscsi | bool }}"
-enable_kuryr: "no"
-enable_letsencrypt: "no"
-enable_magnum: "no"
-enable_manila: "no"
-enable_manila_backend_generic: "no"
-enable_manila_backend_hnas: "no"
-enable_manila_backend_cephfs_native: "no"
-enable_manila_backend_cephfs_nfs: "no"
-enable_manila_backend_glusterfs_nfs: "no"
-enable_manila_backend_flashblade: "no"
-enable_mariabackup: "no"
-enable_masakari: "no"
-enable_masakari_instancemonitor: "{{ enable_masakari | bool }}"
-enable_masakari_hostmonitor: "{{ enable_masakari | bool }}"
-enable_mistral: "no"
-enable_multipathd: "no"
-enable_neutron_vpnaas: "no"
-enable_neutron_sriov: "no"
-enable_neutron_mlnx: "no"
-enable_neutron_dvr: "no"
-enable_neutron_fwaas: "no"
-enable_neutron_qos: "no"
-enable_neutron_agent_ha: "no"
-enable_neutron_bgp_dragent: "no"
-enable_neutron_provider_networks: "no"
-enable_neutron_segments: "no"
-enable_neutron_packet_logging: "no"
-enable_neutron_sfc: "no"
-enable_neutron_taas: "no"
-enable_neutron_trunk: "no"
-enable_neutron_metering: "no"
-enable_neutron_infoblox_ipam_agent: "no"
-enable_neutron_port_forwarding: "no"
-enable_nova_libvirt_container: "{{ nova_compute_virt_type in ['kvm', 'qemu'] }}"
-enable_nova_serialconsole_proxy: "no"
-enable_nova_ssh: "yes"
-enable_octavia: "no"
-enable_octavia_driver_agent: "{{ enable_octavia | bool and neutron_plugin_agent == 'ovn' }}"
-enable_octavia_jobboard: "{{ enable_octavia | bool and 'amphora' in octavia_provider_drivers }}"
-enable_openvswitch: "{{ enable_neutron | bool and neutron_plugin_agent != 'linuxbridge' }}"
-enable_ovn: "{{ enable_neutron | bool and neutron_plugin_agent == 'ovn' }}"
-enable_ovn_sb_db_relay: "{{ enable_ovn | bool }}"
-enable_ovs_dpdk: "no"
-enable_osprofiler: "no"
-enable_placement: "{{ enable_nova | bool or enable_zun | bool }}"
-enable_prometheus: "no"
-enable_proxysql: "yes"
-enable_redis: "no"
-enable_skyline: "no"
-enable_tacker: "no"
-enable_telegraf: "no"
-enable_trove: "no"
-enable_trove_singletenant: "no"
-enable_venus: "no"
-enable_watcher: "no"
-enable_zun: "no"
-
-ovs_datapath: "{{ 'netdev' if enable_ovs_dpdk | bool else 'system' }}"
-designate_keystone_user: "designate"
-ironic_keystone_user: "ironic"
-neutron_keystone_user: "neutron"
-nova_keystone_user: "nova"
-placement_keystone_user: "placement"
-cinder_keystone_user: "cinder"
-glance_keystone_user: "glance"
-
-# Nova fake driver and the number of fake driver per compute node
-enable_nova_fake: "no"
-num_nova_fake_per_node: 5
-
-# Clean images options are specified here
-enable_destroy_images: "no"
-
-####################
-# Global Options
-####################
-# List of containers to skip during stop command in YAML list format
-# skip_stop_containers:
-#   - container1
-#   - container2
-skip_stop_containers: []
-
-####################
-# Logging options
-####################
-
-# NOTE: If an external ElasticSearch cluster address is configured, all
-# services with ElasticSearch endpoints should be configured to log
-# to the external cluster by default. This is for backwards compatibility.
-opensearch_address: "{{ elasticsearch_address if elasticsearch_address is defined else kolla_internal_fqdn }}"
-enable_opensearch: "{{ enable_central_logging | bool or enable_osprofiler | bool or (enable_cloudkitty | bool and cloudkitty_storage_backend == 'opensearch') }}"
-enable_opensearch_dashboards: "{{ enable_opensearch | bool }}"
-enable_opensearch_dashboards_external: "{{ enable_opensearch_dashboards | bool }}"
-
-####################
-# Redis options
-####################
-redis_connection_string: "redis://{% for host in groups['redis'] %}{% if host == groups['redis'][0] %}default:{{ redis_master_password }}@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ redis_sentinel_port }}?sentinel=kolla{% else %}&sentinel_fallback={{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ redis_sentinel_port }}{% endif %}{% endfor %}{{ redis_connection_string_extras }}"
-redis_connection_string_extras: "&db=0&socket_timeout=60&retry_on_timeout=yes"
-
-####################
-# Osprofiler options
-####################
-# valid values: ["elasticsearch", "redis"]
-osprofiler_backend: "elasticsearch"
-opensearch_connection_string: "elasticsearch://{{ opensearch_address | put_address_in_context('url') }}:{{ opensearch_port }}"
-osprofiler_backend_connection_string: "{{ redis_connection_string if osprofiler_backend == 'redis' else opensearch_connection_string }}"
-
-####################
-# RabbitMQ options
-####################
-rabbitmq_user: "openstack"
-rabbitmq_monitoring_user: ""
-# Whether to enable TLS encryption for RabbitMQ client-server communication.
-rabbitmq_enable_tls: "no"
-# CA certificate bundle in RabbitMQ container.
-rabbitmq_cacert: "/etc/ssl/certs/{{ 'ca-certificates.crt' if kolla_base_distro in ['debian', 'ubuntu'] else 'ca-bundle.crt' }}"
-rabbitmq_datadir_volume: "rabbitmq"
-
-####################
-# HAProxy options
-####################
-haproxy_user: "openstack"
-haproxy_enable_external_vip: "{{ 'no' if kolla_same_external_internal_vip | bool else 'yes' }}"
-haproxy_enable_http2: "yes"
-haproxy_http2_protocol: "alpn h2,http/1.1"
-kolla_enable_tls_internal: "no"
-kolla_enable_tls_external: "{{ kolla_enable_tls_internal if kolla_same_external_internal_vip | bool else 'no' }}"
-kolla_certificates_dir: "{{ node_config }}/certificates"
-kolla_external_fqdn_cert: "{{ kolla_certificates_dir }}/haproxy.pem"
-kolla_internal_fqdn_cert: "{{ kolla_certificates_dir }}/haproxy-internal.pem"
-kolla_admin_openrc_cacert: ""
-kolla_copy_ca_into_containers: "no"
-haproxy_backend_cacert: "{{ 'ca-certificates.crt' if kolla_base_distro in ['debian', 'ubuntu'] else 'ca-bundle.crt' }}"
-haproxy_backend_cacert_dir: "/etc/ssl/certs"
-haproxy_single_external_frontend: false
-haproxy_single_external_frontend_public_port: "{{ '443' if kolla_enable_tls_external | bool else '80' }}"
-
-##################
-# Backend options
-##################
-kolla_httpd_keep_alive: "60"
-kolla_httpd_timeout: "60"
-
-######################
-# Backend TLS options
-######################
-kolla_enable_tls_backend: "no"
-kolla_verify_tls_backend: "yes"
-kolla_tls_backend_cert: "{{ kolla_certificates_dir }}/backend-cert.pem"
-kolla_tls_backend_key: "{{ kolla_certificates_dir }}/backend-key.pem"
-
-#####################
-# ACME client options
-#####################
-acme_client_lego: "server lego {{ api_interface_address }}:{{ letsencrypt_webserver_port }}"
-acme_client_servers: "{% set arr = [] %}{% if enable_letsencrypt | bool %}{{ arr.append(acme_client_lego) }}{% endif %}{{ arr }}"
-
-####################
-# Keystone options
-####################
-keystone_internal_fqdn: "{{ kolla_internal_fqdn }}"
-keystone_external_fqdn: "{{ kolla_external_fqdn }}"
-
-keystone_internal_url: "{{ keystone_internal_fqdn | kolla_url(internal_protocol, keystone_internal_port) }}"
-keystone_public_url: "{{ keystone_external_fqdn | kolla_url(public_protocol, keystone_public_port) }}"
-
-keystone_admin_user: "admin"
-keystone_admin_project: "admin"
-
-# Whether or not to apply changes to service user passwords when services are
-# reconfigured
-update_keystone_service_user_passwords: true
-
-default_project_domain_name: "Default"
-default_project_domain_id: "default"
-
-default_user_domain_name: "Default"
-default_user_domain_id: "default"
-
-# Keystone fernet token expiry in seconds. Default is 1 day.
-fernet_token_expiry: 86400
-# Keystone window to allow expired fernet tokens. Default is 2 days.
-fernet_token_allow_expired_window: 172800
-# Keystone fernet key rotation interval in seconds. Default is sum of token
-# expiry and allow expired window, 3 days. This ensures the minimum number
-# of keys are active. If this interval is lower than the sum of the token
-# expiry and allow expired window, multiple active keys will be necessary.
-fernet_key_rotation_interval: "{{ fernet_token_expiry + fernet_token_allow_expired_window }}"
-
-keystone_default_user_role: "member"
-
-# OpenStack authentication string. You should only need to override these if you
-# are changing the admin tenant/project or user.
-openstack_auth:
-  auth_url: "{{ keystone_internal_url }}"
-  username: "{{ keystone_admin_user }}"
-  password: "{{ keystone_admin_password }}"
-  project_name: "{{ keystone_admin_project }}"
-  domain_name: "default"
-  user_domain_name: "default"
-
-#######################
-# Glance options
-#######################
-glance_backend_file: "{{ not (glance_backend_ceph | bool or glance_backend_s3 | bool) }}"
-glance_backend_ceph: "no"
-glance_backend_s3: "no"
-enable_glance_image_cache: "no"
-glance_file_datadir_volume: "glance"
-glance_enable_rolling_upgrade: "no"
-glance_enable_property_protection: "no"
-glance_enable_interoperable_image_import: "no"
-glance_api_hosts: "{{ [groups['glance-api'] | first] if glance_backend_file | bool and glance_file_datadir_volume == 'glance' else groups['glance-api'] }}"
-# NOTE(mnasiadka): For use in common role
-glance_enable_tls_backend: "{{ kolla_enable_tls_backend }}"
-
-#######################
-# Barbican options
-#######################
-# Valid options are [ simple_crypto, p11_crypto ]
-barbican_crypto_plugin: "simple_crypto"
-barbican_library_path: "/usr/lib/libCryptoki2_64.so"
-
-#################
-# Gnocchi options
-#################
-# Valid options are [ file, ceph ]
-gnocchi_backend_storage: "file"
-
-# Valid options are [redis, '']
-gnocchi_incoming_storage: "{{ 'redis' if enable_redis | bool else '' }}"
-gnocchi_metric_datadir_volume: "gnocchi"
-
-#################################
-# Cinder options
-#################################
-cinder_backend_ceph: "no"
-cinder_backend_huawei: "no"
-cinder_backend_huawei_xml_files: []
-cinder_volume_group: "cinder-volumes"
-cinder_target_helper: "{{ 'lioadm' if ansible_facts.os_family == 'RedHat' else 'tgtadm' }}"
-# Valid options are [ '', redis, etcd ]
-cinder_coordination_backend: "{{ 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}"
-
-# Valid options are [ nfs, ceph, s3 ]
-cinder_backup_driver: "ceph"
-cinder_backup_share: ""
-cinder_backup_mount_options_nfs: ""
-
-#######################
-# Cloudkitty options
-#######################
-# Valid options are 'sqlalchemy' or 'influxdb'. The default value is
-# 'influxdb', which matches the default in Cloudkitty since the Stein release.
-# When the backend is "influxdb", we also enable Influxdb.
-# Also, when using 'influxdb' as the backend, we trigger the configuration/use
-# of Cloudkitty storage backend version 2.
-cloudkitty_storage_backend: "influxdb"
-
-#######################
-# Designate options
-#######################
-# Valid options are [ bind9, infoblox ]
-designate_backend: "bind9"
-designate_ns_record:
-  - "ns1.example.org"
-designate_backend_external: "no"
-designate_backend_external_bind9_nameservers: ""
-# Valid options are [ '', redis ]
-designate_coordination_backend: "{{ 'redis' if enable_redis | bool else '' }}"
-
-designate_enable_notifications_sink: "no"
-designate_notifications_topic_name: "notifications_designate"
-
-#######################
-# Neutron options
-#######################
-neutron_bgp_router_id: "1.1.1.1"
-neutron_bridge_name: "{{ 'br_dpdk' if enable_ovs_dpdk | bool else 'br-ex' }}"
-neutron_physical_networks: "{% for bridge in neutron_bridge_name.split(',') %}physnet{{ loop.index }}{% if not loop.last %},{% endif %}{% endfor %}"
-# Comma-separated type of enabled ml2 type drivers
-neutron_type_drivers: "flat,vlan,vxlan{% if neutron_plugin_agent == 'ovn' %},geneve{% endif %}"
-# Comma-separated types of tenant networks (should be listed in 'neutron_type_drivers')
-# NOTE: for ironic this list should also contain 'flat'
-neutron_tenant_network_types: "{% if neutron_plugin_agent == 'ovn' %}geneve{% else %}vxlan{% endif %}"
-
-# valid values: ["dvr", "dvr_no_external"]
-neutron_compute_dvr_mode: "dvr"
-computes_need_external_bridge: "{{ (enable_neutron_dvr | bool and neutron_compute_dvr_mode == 'dvr') or enable_neutron_provider_networks | bool or neutron_ovn_distributed_fip | bool }}"
-
-# Default DNS resolvers for virtual networks
-neutron_dnsmasq_dns_servers: "1.1.1.1,8.8.8.8,8.8.4.4"
-
-# Set legacy iptables to allow kernels not supporting iptables-nft
-neutron_legacy_iptables: "no"
-
-# Enable distributed floating ip for OVN deployments
-neutron_ovn_distributed_fip: "no"
-
-# SRIOV physnet:interface mappings when SRIOV is enabled
-# "sriovnet1" and tunnel_interface used here as placeholders
-neutron_sriov_physnet_mappings:
-  sriovnet1: "{{ tunnel_interface }}"
-neutron_enable_tls_backend: "{{ kolla_enable_tls_backend }}"
-
-# Set OVN network availability zones
-neutron_ovn_availability_zones: []
-
-# Enable OVN agent
-neutron_enable_ovn_agent: "no"
-
-#######################
-# Nova options
-#######################
-nova_backend_ceph: "no"
-nova_backend: "{{ 'rbd' if nova_backend_ceph | bool else 'default' }}"
-# Valid options are [ kvm, qemu ]
-nova_compute_virt_type: "kvm"
-nova_instance_datadir_volume: "{{ 'nova_compute' if enable_nova_libvirt_container | bool else '/var/lib/nova' }}"
-nova_safety_upgrade: "no"
-# Valid options are [ none, novnc, spice ]
-nova_console: "novnc"
-
-#######################
-# Nova Database
-#######################
-nova_database_shard_id: "{{ mariadb_default_database_shard_id | int }}"
-nova_cell0_database_shard_id: "{{ nova_database_shard_id | int }}"
-
-# These are kept for backwards compatibility, as cell0 references them.
-nova_database_name: "nova"
-nova_database_user: "{% if use_preconfigured_databases | bool and use_common_mariadb_user | bool %}{{ database_user }}{% else %}nova{% endif %}"
-nova_database_address: "{{ database_address | put_address_in_context('url') }}:{{ database_port }}"
-
-nova_cell0_database_name: "{{ nova_database_name }}_cell0"
-nova_cell0_database_user: "{{ nova_database_user }}"
-nova_cell0_database_address: "{{ nova_database_address }}"
-nova_cell0_database_password: "{{ nova_database_password }}"
-
-#######################
-# Horizon options
-#######################
-horizon_backend_database: false
-horizon_keystone_multidomain: False
-
-# Enable deploying custom horizon policy files for services that don't have a
-# horizon plugin but have a policy file. Override these when you have services
-# not deployed by kolla-ansible but want custom policy files deployed for them
-# in horizon.
-enable_ceilometer_horizon_policy_file: "{{ enable_ceilometer }}"
-enable_cinder_horizon_policy_file: "{{ enable_cinder }}"
-enable_glance_horizon_policy_file: "{{ enable_glance }}"
-enable_heat_horizon_policy_file: "{{ enable_heat }}"
-enable_keystone_horizon_policy_file: "{{ enable_keystone }}"
-enable_neutron_horizon_policy_file: "{{ enable_neutron }}"
-enable_nova_horizon_policy_file: "{{ enable_nova }}"
-
-horizon_enable_tls_backend: "{{ kolla_enable_tls_backend }}"
-
-###################
-# External Ceph options
-###################
-# External Ceph - cephx auth enabled (this is the standard nowadays, defaults to yes)
-external_ceph_cephx_enabled: "yes"
-
-ceph_cluster: "ceph"
-
-# External Ceph pool names
-ceph_cinder_pool_name: "volumes"
-ceph_cinder_backup_pool_name: "backups"
-ceph_glance_pool_name: "images"
-ceph_gnocchi_pool_name: "gnocchi"
-ceph_nova_pool_name: "vms"
-
-ceph_cinder_backup_user: "cinder-backup"
-ceph_cinder_user: "cinder"
-ceph_glance_user: "glance"
-ceph_gnocchi_user: "gnocchi"
-ceph_manila_user: "manila"
-ceph_nova_user: "{{ ceph_cinder_user }}"
-
-#############################################
-# MariaDB component-specific database details
-#############################################
-# Whether to configure haproxy to load balance
-# the external MariaDB server(s)
-enable_external_mariadb_load_balancer: "no"
-# Whether to use pre-configured databases / users
-use_preconfigured_databases: "no"
-# whether to use a common, preconfigured user
-# for all component databases
-use_common_mariadb_user: "no"
-
-############
-# Prometheus
-############
-enable_prometheus_server: "{{ enable_prometheus | bool }}"
-enable_prometheus_haproxy_exporter: "{{ enable_haproxy | bool }}"
-enable_prometheus_mysqld_exporter: "{{ enable_mariadb | bool }}"
-enable_prometheus_node_exporter: "{{ enable_prometheus | bool }}"
-enable_prometheus_memcached_exporter: "{{ enable_memcached | bool }}"
-enable_prometheus_cadvisor: "{{ enable_prometheus | bool }}"
-enable_prometheus_fluentd_integration: "{{ enable_prometheus | bool and enable_fluentd | bool }}"
-enable_prometheus_alertmanager: "{{ enable_prometheus | bool }}"
-enable_prometheus_alertmanager_external: "{{ enable_prometheus_alertmanager | bool }}"
-enable_prometheus_ceph_mgr_exporter: "no"
-enable_prometheus_openstack_exporter: "{{ enable_prometheus | bool }}"
-enable_prometheus_openstack_exporter_external: "no"
-enable_prometheus_elasticsearch_exporter: "{{ enable_prometheus | bool and enable_opensearch | bool }}"
-enable_prometheus_blackbox_exporter: "{{ enable_prometheus | bool }}"
-enable_prometheus_rabbitmq_exporter: "{{ enable_prometheus | bool and enable_rabbitmq | bool }}"
-enable_prometheus_libvirt_exporter: "{{ enable_prometheus | bool and enable_nova | bool and nova_compute_virt_type in ['kvm', 'qemu'] }}"
-enable_prometheus_etcd_integration: "{{ enable_prometheus | bool and enable_etcd | bool }}"
-enable_prometheus_proxysql_exporter: "{{ enable_prometheus | bool and enable_proxysql | bool }}"
-
-prometheus_alertmanager_user: "admin"
-prometheus_ceph_exporter_interval: "{{ prometheus_scrape_interval }}"
-prometheus_grafana_user: "grafana"
-prometheus_haproxy_user: "haproxy"
-prometheus_skyline_user: "skyline"
-prometheus_scrape_interval: "60s"
-prometheus_openstack_exporter_interval: "{{ prometheus_scrape_interval }}"
-prometheus_openstack_exporter_timeout: "45s"
-prometheus_elasticsearch_exporter_interval: "{{ prometheus_scrape_interval }}"
-prometheus_cmdline_extras:
-prometheus_ceph_mgr_exporter_endpoints: []
-prometheus_openstack_exporter_endpoint_type: "internal"
-prometheus_openstack_exporter_compute_api_version: "latest"
-prometheus_libvirt_exporter_interval: "60s"
-
-
-####################
-# InfluxDB options
-####################
-influxdb_address: "{{ kolla_internal_fqdn }}"
-influxdb_datadir_volume: "influxdb"
-
-influxdb_internal_endpoint: "{{ kolla_internal_fqdn | kolla_url(internal_protocol, influxdb_http_port) }}"
-
-#########################
-# Internal Image options
-#########################
-kolla_base_distro_version_default_map: {
-  "centos": "stream9",
-  "debian": "bookworm",
-  "rocky": "9",
-  "ubuntu": "noble",
-}
-
-distro_python_version: "3"
-
-kolla_base_distro_version: "{{ kolla_base_distro_version_default_map[kolla_base_distro] }}"
-
-#############
-# S3 options
-#############
-# Common options for S3 Cinder Backup and Glance S3 backend.
-s3_url:
-s3_bucket:
-s3_access_key:
-s3_secret_key:
-
-##########
-# Telegraf
-##########
-# Configure telegraf to use the docker daemon itself as an input for
-# telemetry data.
-telegraf_enable_docker_input: "no"
-
-# Valid options are [ '', redis, etcd ]
-ironic_coordination_backend: "{{ 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}"
-
-##########
-# Octavia
-##########
-# Whether to run Kolla-Ansible's automatic configuration for Octavia.
-# NOTE: if you upgrade from Ussuri, you must set `octavia_auto_configure` to `no`
-# and keep your other Octavia config like before.
-octavia_auto_configure: "{{ 'amphora' in octavia_provider_drivers }}"
-
-# Octavia network type options are [ tenant, provider ]
-# * tenant indicates that we will create a tenant network and a network
-#   interface on the Octavia worker nodes for communication with amphorae.
-# * provider indicates that we will create a flat or vlan provider network.
-#   In this case octavia_network_interface should be set to a network interface
-#   on the Octavia worker nodes on the same provider network.
-octavia_network_type: "provider"
-
-###################################
-# Identity federation configuration
-###################################
-# Here we configure all of the IdPs meta information that will be required to implement identity federation with OpenStack Keystone.
-# We require the administrator to enter the following metadata:
-# * name (internal name of the IdP in Keystone);
-# * openstack_domain (the domain in Keystone that the IdP belongs to)
-# * protocol (the federated protocol used by the IdP; e.g. openid or saml);
-# * identifier (the IdP identifier; e.g. https://accounts.google.com);
-# * public_name (the public name that will be shown for users in Horizon);
-# * attribute_mapping (the attribute mapping to be used for this IdP. This mapping is configured in the "keystone_identity_mappings" configuration);
-# * metadata_folder (folder containing all the identity provider metadata as jsons named as the identifier without the protocol
-#   and with '/' escaped as %2F followed with '.provider' or '.client' or '.conf'; e.g. accounts.google.com.provider; PS, all .conf,
-#   .provider and .client jsons must be in the folder, even if you dont override any conf in the .conf json, you must leave it as an empty json '{}');
-# * certificate_file (the path to the Identity Provider certificate file, the file must be named as 'certificate-key-id.pem';
-#   e.g. LRVweuT51StjMdsna59jKfB3xw0r8Iz1d1J1HeAbmlw.pem; You can find the key-id in the Identity provider '.well-known/openid-configuration' jwks_uri as kid);
-#
-# The IdPs meta information are to be presented to Kolla-Ansible as the following example:
-# keystone_identity_providers:
-#   - name: "myidp1"
-#     openstack_domain: "my-domain"
-#     protocol: "openid"
-#     identifier: "https://accounts.google.com"
-#     public_name: "Authenticate via myidp1"
-#     attribute_mapping: "mappingId1"
-#     metadata_folder: "path/to/metadata/folder"
-#     certificate_file: "path/to/certificate/file.pem"
-#
-# We also need to configure the attribute mapping that is used by IdPs.
-# The configuration of attribute mappings is a list of objects, where each
-# object must have a 'name' (that mapps to the 'attribute_mapping' to the IdP
-# object in the IdPs set), and the 'file' with a full qualified path to a mapping file.
-# keystone_identity_mappings:
-#   - name: "mappingId1"
-#     file: "/full/qualified/path/to/mapping/json/file/to/mappingId1"
-#   - name: "mappingId2"
-#     file: "/full/qualified/path/to/mapping/json/file/to/mappingId2"
-#   - name: "mappingId3"
-#     file: "/full/qualified/path/to/mapping/json/file/to/mappingId3"
-keystone_identity_providers: []
-keystone_identity_mappings: []
-
-####################
-# Corosync options
-####################
-
-# this is UDP port
-hacluster_corosync_port: 5405
diff --git a/ansible/group_vars/all/aodh.yml b/ansible/group_vars/all/aodh.yml
new file mode 100644
index 000000000..2e431e11e
--- /dev/null
+++ b/ansible/group_vars/all/aodh.yml
@@ -0,0 +1,11 @@
+---
+enable_aodh: "no"
+
+# Ports
+aodh_internal_fqdn: "{{ kolla_internal_fqdn }}"
+aodh_external_fqdn: "{{ kolla_external_fqdn }}"
+aodh_internal_endpoint: "{{ aodh_internal_fqdn | kolla_url(internal_protocol, aodh_api_port) }}"
+aodh_public_endpoint: "{{ aodh_external_fqdn | kolla_url(public_protocol, aodh_api_public_port) }}"
+aodh_api_port: "8042"
+aodh_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else aodh_api_port }}"
+aodh_api_listen_port: "{{ aodh_api_port }}"
diff --git a/ansible/group_vars/all/barbican.yml b/ansible/group_vars/all/barbican.yml
new file mode 100644
index 000000000..36e256a01
--- /dev/null
+++ b/ansible/group_vars/all/barbican.yml
@@ -0,0 +1,17 @@
+---
+enable_barbican: "no"
+
+#######################
+# Barbican options
+#######################
+# Valid options are [ simple_crypto, p11_crypto ]
+barbican_crypto_plugin: "simple_crypto"
+barbican_library_path: "/usr/lib/libCryptoki2_64.so"
+
+barbican_internal_fqdn: "{{ kolla_internal_fqdn }}"
+barbican_external_fqdn: "{{ kolla_external_fqdn }}"
+barbican_internal_endpoint: "{{ barbican_internal_fqdn | kolla_url(internal_protocol, barbican_api_port) }}"
+barbican_public_endpoint: "{{ barbican_external_fqdn | kolla_url(public_protocol, barbican_api_public_port) }}"
+barbican_api_port: "9311"
+barbican_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else barbican_api_port }}"
+barbican_api_listen_port: "{{ barbican_api_port }}"
diff --git a/ansible/group_vars/all/bifrost.yml b/ansible/group_vars/all/bifrost.yml
new file mode 100644
index 000000000..a42e6c9ea
--- /dev/null
+++ b/ansible/group_vars/all/bifrost.yml
@@ -0,0 +1,3 @@
+---
+bifrost_network_interface: "{{ network_interface }}"
+bifrost_network_address_family: "{{ network_address_family }}"
diff --git a/ansible/group_vars/all/blazar.yml b/ansible/group_vars/all/blazar.yml
new file mode 100644
index 000000000..10122ffdc
--- /dev/null
+++ b/ansible/group_vars/all/blazar.yml
@@ -0,0 +1,11 @@
+---
+enable_blazar: "no"
+
+# Ports
+blazar_internal_fqdn: "{{ kolla_internal_fqdn }}"
+blazar_external_fqdn: "{{ kolla_external_fqdn }}"
+blazar_internal_base_endpoint: "{{ blazar_internal_fqdn | kolla_url(internal_protocol, blazar_api_port) }}"
+blazar_public_base_endpoint: "{{ blazar_external_fqdn | kolla_url(public_protocol, blazar_api_public_port) }}"
+blazar_api_port: "1234"
+blazar_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else blazar_api_port }}"
+blazar_api_listen_port: "{{ blazar_api_port }}"
diff --git a/ansible/group_vars/all/ceilometer.yml b/ansible/group_vars/all/ceilometer.yml
new file mode 100644
index 000000000..19e99eee0
--- /dev/null
+++ b/ansible/group_vars/all/ceilometer.yml
@@ -0,0 +1,4 @@
+---
+enable_ceilometer: "no"
+enable_ceilometer_ipmi: "no"
+enable_ceilometer_prometheus_pushgateway: "no"
diff --git a/ansible/group_vars/all/ceph-rgw.yml b/ansible/group_vars/all/ceph-rgw.yml
new file mode 100644
index 000000000..3d3d4802b
--- /dev/null
+++ b/ansible/group_vars/all/ceph-rgw.yml
@@ -0,0 +1,10 @@
+---
+enable_ceph_rgw: "no"
+enable_ceph_rgw_loadbalancer: "{{ enable_ceph_rgw | bool }}"
+
+ceph_rgw_internal_fqdn: "{{ kolla_internal_fqdn }}"
+ceph_rgw_external_fqdn: "{{ kolla_external_fqdn }}"
+ceph_rgw_internal_base_endpoint: "{{ ceph_rgw_internal_fqdn | kolla_url(internal_protocol, ceph_rgw_port) }}"
+ceph_rgw_public_base_endpoint: "{{ ceph_rgw_external_fqdn | kolla_url(public_protocol, ceph_rgw_public_port) }}"
+ceph_rgw_port: "6780"
+ceph_rgw_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else ceph_rgw_port }}"
diff --git a/ansible/group_vars/all/ceph.yml b/ansible/group_vars/all/ceph.yml
new file mode 100644
index 000000000..987717a65
--- /dev/null
+++ b/ansible/group_vars/all/ceph.yml
@@ -0,0 +1,21 @@
+---
+###################
+# External Ceph options
+###################
+# External Ceph - cephx auth enabled (this is the standard nowadays, defaults to yes)
+external_ceph_cephx_enabled: "yes"
+
+ceph_cluster: "ceph"
+
+# External Ceph pool names
+ceph_cinder_pool_name: "volumes"
+ceph_cinder_backup_pool_name: "backups"
+ceph_glance_pool_name: "images"
+ceph_gnocchi_pool_name: "gnocchi"
+ceph_nova_pool_name: "vms"
+
+ceph_cinder_backup_user: "cinder-backup"
+ceph_cinder_user: "cinder"
+ceph_glance_user: "glance"
+ceph_gnocchi_user: "gnocchi"
+ceph_nova_user: "{{ ceph_cinder_user }}"
diff --git a/ansible/group_vars/all/cinder.yml b/ansible/group_vars/all/cinder.yml
new file mode 100644
index 000000000..e4659674e
--- /dev/null
+++ b/ansible/group_vars/all/cinder.yml
@@ -0,0 +1,40 @@
+---
+enable_cinder: "no"
+enable_cinder_backup: "yes"
+enable_cinder_backend_iscsi: "{{ enable_cinder_backend_lvm | bool }}"
+enable_cinder_backend_lvm: "no"
+enable_cinder_backend_nfs: "no"
+enable_cinder_backend_quobyte: "no"
+enable_cinder_backend_pure_iscsi: "no"
+enable_cinder_backend_pure_fc: "no"
+enable_cinder_backend_pure_roce: "no"
+enable_cinder_backend_pure_nvme_tcp: "no"
+enable_cinder_backend_lightbits: "no"
+
+#################################
+# Cinder options
+#################################
+cinder_backend_ceph: "no"
+cinder_backend_huawei: "no"
+cinder_backend_huawei_xml_files: []
+cinder_volume_group: "cinder-volumes"
+cinder_target_helper: "{{ 'lioadm' if ansible_facts.os_family == 'RedHat' else 'tgtadm' }}"
+# Valid options are [ '', redis, etcd ]
+cinder_coordination_backend: "{{ 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}"
+
+# Valid options are [ nfs, ceph, s3 ]
+cinder_backup_driver: "ceph"
+cinder_backup_share: ""
+cinder_backup_mount_options_nfs: ""
+
+storage_address_family: "{{ network_address_family }}"
+
+cinder_keystone_user: "cinder"
+
+cinder_internal_fqdn: "{{ kolla_internal_fqdn }}"
+cinder_external_fqdn: "{{ kolla_external_fqdn }}"
+cinder_internal_base_endpoint: "{{ cinder_internal_fqdn | kolla_url(internal_protocol, cinder_api_port) }}"
+cinder_public_base_endpoint: "{{ cinder_external_fqdn | kolla_url(public_protocol, cinder_api_public_port) }}"
+cinder_api_port: "8776"
+cinder_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else cinder_api_port }}"
+cinder_api_listen_port: "{{ cinder_api_port }}"
diff --git a/ansible/group_vars/all/cloudkitty.yml b/ansible/group_vars/all/cloudkitty.yml
new file mode 100644
index 000000000..a657c3bd0
--- /dev/null
+++ b/ansible/group_vars/all/cloudkitty.yml
@@ -0,0 +1,20 @@
+---
+enable_cloudkitty: "no"
+
+#######################
+# Cloudkitty options
+#######################
+# Valid options are 'sqlalchemy' or 'influxdb'. The default value is
+# 'influxdb', which matches the default in Cloudkitty since the Stein release.
+# When the backend is "influxdb", we also enable Influxdb.
+# Also, when using 'influxdb' as the backend, we trigger the configuration/use
+# of Cloudkitty storage backend version 2.
+cloudkitty_storage_backend: "influxdb"
+
+cloudkitty_internal_fqdn: "{{ kolla_internal_fqdn }}"
+cloudkitty_external_fqdn: "{{ kolla_external_fqdn }}"
+cloudkitty_internal_endpoint: "{{ cloudkitty_internal_fqdn | kolla_url(internal_protocol, cloudkitty_api_port) }}"
+cloudkitty_public_endpoint: "{{ cloudkitty_external_fqdn | kolla_url(public_protocol, cloudkitty_api_public_port) }}"
+cloudkitty_api_port: "8889"
+cloudkitty_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else cloudkitty_api_port }}"
+cloudkitty_api_listen_port: "{{ cloudkitty_api_port }}"
diff --git a/ansible/group_vars/all/collectd.yml b/ansible/group_vars/all/collectd.yml
new file mode 100644
index 000000000..8e6232716
--- /dev/null
+++ b/ansible/group_vars/all/collectd.yml
@@ -0,0 +1,4 @@
+---
+enable_collectd: "no"
+
+collectd_udp_port: "25826"
diff --git a/ansible/group_vars/all/common.yml b/ansible/group_vars/all/common.yml
new file mode 100644
index 000000000..a08a3ce3c
--- /dev/null
+++ b/ansible/group_vars/all/common.yml
@@ -0,0 +1,366 @@
+---
+###################
+# Ansible options
+###################
+
+# This variable is used as the "filter" argument for the setup module.  For
+# instance, if one wants to remove/ignore all Neutron interface facts:
+# kolla_ansible_setup_filter: "ansible_[!qt]*"
+# By default, we do not provide a filter.
+kolla_ansible_setup_filter: "{{ omit }}"
+
+# This variable is used as the "gather_subset" argument for the setup module.
+# For instance, if one wants to avoid collecting facts via facter:
+# kolla_ansible_setup_gather_subset: "all,!facter"
+# By default, we do not provide a gather subset.
+kolla_ansible_setup_gather_subset: "{{ omit }}"
+
+# This variable determines which hosts require facts when using --limit. Facts
+# will be gathered using delegation for hosts in this list that are not
+# included in the limit.
+# By default, this list includes all hosts.
+kolla_ansible_delegate_facts_hosts: "{{ groups['all'] }}"
+
+####################
+# Docker options
+####################
+docker_registry_email:
+docker_registry: "quay.io"
+docker_namespace: "openstack.kolla"
+docker_image_name_prefix: ""
+docker_image_url: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ docker_namespace }}/{{ docker_image_name_prefix }}"
+docker_registry_username:
+# Please read the docs carefully before applying docker_registry_insecure.
+docker_registry_insecure: "no"
+docker_runtime_directory: ""
+# Docker client timeout in seconds.
+docker_client_timeout: 120
+
+# Docker networking options
+docker_disable_default_iptables_rules: "yes"
+docker_disable_default_network: "{{ docker_disable_default_iptables_rules }}"
+docker_disable_ip_forward: "{{ docker_disable_default_iptables_rules }}"
+
+# Retention settings for Docker logs
+docker_log_max_file: "5"
+docker_log_max_size: "50m"
+
+# Valid options are [ no, on-failure, always, unless-stopped ]
+docker_restart_policy: "unless-stopped"
+
+# '0' means unlimited retries (applies only to 'on-failure' policy)
+docker_restart_policy_retry: "10"
+
+# Timeout after Docker sends SIGTERM before sending SIGKILL.
+docker_graceful_timeout: 60
+
+# Common options used throughout Docker
+docker_common_options:
+  auth_email: "{{ docker_registry_email }}"
+  auth_password: "{{ docker_registry_password }}"
+  auth_registry: "{{ docker_registry }}"
+  auth_username: "{{ docker_registry_username }}"
+  environment:
+    KOLLA_CONFIG_STRATEGY: "{{ config_strategy }}"
+  restart_policy: "{{ docker_restart_policy }}"
+  restart_retries: "{{ docker_restart_policy_retry }}"
+  graceful_timeout: "{{ docker_graceful_timeout }}"
+  client_timeout: "{{ docker_client_timeout }}"
+  container_engine: "{{ kolla_container_engine }}"
+
+# Container engine specific volume paths
+docker_volumes_path: "{{ docker_runtime_directory or '/var/lib/docker' }}/volumes"
+podman_volumes_path: "{{ docker_runtime_directory or '/var/lib/containers' }}/storage/volumes"
+container_engine_volumes_path: "{{ docker_volumes_path if kolla_container_engine == 'docker' else podman_volumes_path }}"
+
+#####################
+# Volumes under /run
+#####################
+# Podman has problem with mounting whole /run directory
+# described here: https://github.com/containers/podman/issues/16305
+run_default_volumes_podman:
+  - '/run/netns:/run/netns:shared'
+  - '/run/lock/nova:/run/lock/nova:shared'
+  - "/run/libvirt:/run/libvirt:shared"
+  - "/run/nova:/run/nova:shared"
+  - "/run/openvswitch:/run/openvswitch:shared"
+
+run_default_volumes_docker: []
+
+run_default_subdirectories:
+  - '/run/netns'
+  - '/run/lock/nova'
+  - "/run/libvirt"
+  - "/run/nova"
+  - "/run/openvswitch"
+
+####################
+# Dimensions options
+####################
+# Dimension options for Docker Containers
+# NOTE(mnasiadka): Lower 1073741816 nofile limit on EL9 (RHEL9/CentOS Stream 9/Rocky Linux 9)
+#                  fixes at least rabbitmq and mariadb
+default_container_dimensions: "{{ default_container_dimensions_el9 if ansible_facts.os_family == 'RedHat' else '{}' }}"
+default_container_dimensions_el9: "{{ default_docker_dimensions_el9 if kolla_container_engine == 'docker' else default_podman_dimensions_el9 }}"
+default_docker_dimensions_el9:
+  ulimits:
+    nofile:
+      soft: 1048576
+      hard: 1048576
+default_podman_dimensions_el9:
+  ulimits:
+    RLIMIT_NOFILE:
+      soft: 1048576
+      hard: 1048576
+    RLIMIT_NPROC:
+      soft: 1048576
+      hard: 1048576
+
+#####################
+# Healthcheck options
+#####################
+enable_container_healthchecks: "yes"
+# Healthcheck options for Docker containers
+# interval/timeout/start_period are in seconds
+default_container_healthcheck_interval: 30
+default_container_healthcheck_timeout: 30
+default_container_healthcheck_retries: 3
+default_container_healthcheck_start_period: 5
+
+#######################
+# Extra volumes options
+#######################
+# Extra volumes for Docker Containers
+default_extra_volumes: []
+
+##################
+# Firewall options
+##################
+enable_external_api_firewalld: "false"
+external_api_firewalld_zone: "public"
+
+##################
+# Backend options
+##################
+kolla_httpd_keep_alive: "60"
+kolla_httpd_timeout: "60"
+
+# The "temp" files that are created before merge need to stay persistent due
+# to the fact that ansible will register a "change" if it has to create them
+# again. Persistent files allow for idempotency
+container_config_directory: "/var/lib/kolla/config_files"
+
+# The directory on the deploy host containing globals.yml.
+node_config: "{{ CONFIG_DIR | default('/etc/kolla') }}"
+
+# The directory to merge custom config files the kolla's config files
+node_custom_config: "{{ node_config }}/config"
+
+# The directory to store the config files on the destination node
+node_config_directory: "/etc/kolla"
+
+# The group which own node_config_directory, you can use a non-root
+# user to deploy kolla
+config_owner_user: "root"
+config_owner_group: "root"
+
+###################
+# Kolla options
+###################
+# Valid options are [ COPY_ONCE, COPY_ALWAYS ]
+config_strategy: "COPY_ALWAYS"
+
+# Valid options are ['centos', 'debian', 'rocky', 'ubuntu']
+kolla_base_distro: "rocky"
+
+kolla_internal_vip_address: "{{ kolla_internal_address | default('') }}"
+kolla_internal_fqdn: "{{ kolla_internal_vip_address }}"
+kolla_external_vip_address: "{{ kolla_internal_vip_address }}"
+kolla_same_external_internal_vip: "{{ kolla_external_vip_address | ansible.utils.ipaddr('address') == kolla_internal_vip_address | ansible.utils.ipaddr('address') }}"
+kolla_external_fqdn: "{{ kolla_internal_fqdn if kolla_same_external_internal_vip | bool else kolla_external_vip_address }}"
+
+kolla_dev_repos_directory: "/opt/stack/"
+kolla_dev_repos_git: "https://opendev.org/openstack"
+kolla_dev_repos_pull: "no"
+kolla_dev_mode: "no"
+kolla_source_version: "{% if openstack_release == 'master' %}master{% else %}stable/{{ openstack_release }}{% endif %}"
+
+# Proxy settings for containers such as magnum that need internet access
+container_http_proxy: ""
+container_https_proxy: ""
+container_no_proxy: "localhost,127.0.0.1"
+
+container_proxy_no_proxy_entries:
+  - "{{ container_no_proxy }}"
+  - "{{ api_interface_address }}"
+  - "{{ kolla_internal_vip_address | default('') }}"
+
+container_proxy:
+  http_proxy: "{{ container_http_proxy }}"
+  https_proxy: "{{ container_https_proxy }}"
+  no_proxy: "{{ container_proxy_no_proxy_entries | select | join(',') }}"
+
+# By default, Kolla API services bind to the network address assigned
+# to the api_interface.  Allow the bind address to be an override.
+api_interface_address: "{{ 'api' | kolla_address }}"
+
+####################
+# Container engine options
+####################
+kolla_container_engine: "docker"
+
+
+#########################
+# Internal Image options
+#########################
+kolla_base_distro_version_default_map: {
+  "centos": "stream9",
+  "debian": "bookworm",
+  "rocky": "9",
+  "ubuntu": "noble",
+}
+
+distro_python_version: "3"
+
+kolla_base_distro_version: "{{ kolla_base_distro_version_default_map[kolla_base_distro] }}"
+
+####################
+# Networking options
+####################
+network_interface: "eth0"
+kolla_external_vip_interface: "{{ network_interface }}"
+api_interface: "{{ network_interface }}"
+
+# Configure the address family (AF) per network.
+# Valid options are [ ipv4, ipv6 ]
+network_address_family: "ipv4"
+api_address_family: "{{ network_address_family }}"
+
+public_protocol: "{{ 'https' if kolla_enable_tls_external | bool else 'http' }}"
+internal_protocol: "{{ 'https' if kolla_enable_tls_internal | bool else 'http' }}"
+
+# Additional optional OpenStack features and services are specified here
+enable_central_logging: "no"
+
+# Clean images options are specified here
+enable_destroy_images: "no"
+
+####################
+# Global Options
+####################
+# List of containers to skip during stop command in YAML list format
+# skip_stop_containers:
+#   - container1
+#   - container2
+skip_stop_containers: []
+
+###################
+# Messaging options
+###################
+# oslo.messaging rpc transport valid options are [ rabbit, amqp ]
+om_rpc_transport: "rabbit"
+om_rpc_user: "{{ rabbitmq_user }}"
+om_rpc_password: "{{ rabbitmq_password }}"
+om_rpc_port: "{{ rabbitmq_port }}"
+om_rpc_group: "rabbitmq"
+om_rpc_vhost: "/"
+
+rpc_transport_url: "{{ om_rpc_transport }}://{% for host in groups[om_rpc_group] %}{{ om_rpc_user }}:{{ om_rpc_password }}@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ om_rpc_port }}{% if not loop.last %},{% endif %}{% endfor %}/{{ om_rpc_vhost }}"
+
+# oslo.messaging notify transport valid options are [ rabbit ]
+om_notify_transport: "rabbit"
+om_notify_user: "{{ rabbitmq_user }}"
+om_notify_password: "{{ rabbitmq_password }}"
+om_notify_port: "{{ rabbitmq_port }}"
+om_notify_group: "rabbitmq"
+om_notify_vhost: "/"
+
+notify_transport_url: "{{ om_notify_transport }}://{% for host in groups[om_notify_group] %}{{ om_notify_user }}:{{ om_notify_password }}@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ om_notify_port }}{% if not loop.last %},{% endif %}{% endfor %}/{{ om_notify_vhost }}"
+
+# Whether to enable TLS for oslo.messaging communication with RabbitMQ.
+om_enable_rabbitmq_tls: "{{ rabbitmq_enable_tls | bool }}"
+# CA certificate bundle in containers using oslo.messaging with RabbitMQ TLS.
+om_rabbitmq_cacert: "{{ rabbitmq_cacert }}"
+om_rabbitmq_qos_prefetch_count: "1"
+
+om_enable_rabbitmq_stream_fanout: true
+
+# OpenStack authentication string. You should only need to override these if you
+# are changing the admin tenant/project or user.
+openstack_auth:
+  auth_url: "{{ keystone_internal_url }}"
+  username: "{{ keystone_admin_user }}"
+  password: "{{ keystone_admin_password }}"
+  project_name: "{{ keystone_admin_project }}"
+  domain_name: "default"
+  user_domain_name: "default"
+
+####################
+# OpenStack options
+####################
+openstack_release: "master"
+# Docker image tag used by default.
+openstack_tag: "{{ openstack_release }}-{{ kolla_base_distro }}-{{ kolla_base_distro_version }}{{ openstack_tag_suffix }}"
+openstack_tag_suffix: ""
+openstack_logging_debug: "False"
+
+openstack_region_name: "RegionOne"
+
+# A list of policy file formats that are supported by Oslo.policy
+supported_policy_format_list:
+  - policy.yaml
+  - policy.json
+
+# In the context of multi-regions, list here the name of all your regions.
+multiple_regions_names:
+  - "{{ openstack_region_name }}"
+
+openstack_service_workers: "{{ [ansible_facts.processor_vcpus, 5] | min }}"
+openstack_service_rpc_workers: "{{ [ansible_facts.processor_vcpus, 3] | min }}"
+
+# Endpoint type used to connect with OpenStack services with ansible modules.
+# Valid options are [ public, internal ]
+openstack_interface: "internal"
+
+# Openstack CA certificate bundle file
+# CA bundle file must be added to both the Horizon and Kolla Toolbox containers
+openstack_cacert: ""
+
+# Enable core OpenStack services. This includes:
+# glance, keystone, neutron, nova, heat, and horizon.
+enable_openstack_core: "yes"
+
+enable_osprofiler: "no"
+
+####################
+# Osprofiler options
+####################
+# valid values: ["elasticsearch", "redis"]
+osprofiler_backend: "elasticsearch"
+opensearch_connection_string: "elasticsearch://{{ opensearch_address | put_address_in_context('url') }}:{{ opensearch_port }}"
+osprofiler_backend_connection_string: "{{ redis_connection_string if osprofiler_backend == 'redis' else opensearch_connection_string }}"
+
+######################
+# Backend TLS options
+######################
+kolla_enable_tls_backend: "no"
+kolla_verify_tls_backend: "yes"
+kolla_tls_backend_cert: "{{ kolla_certificates_dir }}/backend-cert.pem"
+kolla_tls_backend_key: "{{ kolla_certificates_dir }}/backend-key.pem"
+
+####################
+# Database options
+####################
+database_address: "{{ kolla_internal_fqdn }}"
+database_user: "root"
+database_port: "3306"
+database_connection_recycle_time: 10
+database_max_pool_size: 1
+database_enable_tls_backend: "{{ 'yes' if ((kolla_enable_tls_backend | bool ) and ( enable_proxysql | bool)) else 'no' }}"
+database_enable_tls_internal: "{{ 'yes' if ((kolla_enable_tls_internal | bool ) and ( enable_proxysql | bool)) else 'no' }}"
+
+# Optionally allow Kolla to set sysctl values
+set_sysctl: "yes"
+
+# Optionally change the path to sysctl.conf modified by Kolla Ansible plays.
+kolla_sysctl_conf_path: /etc/sysctl.conf
diff --git a/ansible/group_vars/all/cyborg.yml b/ansible/group_vars/all/cyborg.yml
new file mode 100644
index 000000000..f8346b5ef
--- /dev/null
+++ b/ansible/group_vars/all/cyborg.yml
@@ -0,0 +1,8 @@
+---
+enable_cyborg: "no"
+
+cyborg_internal_fqdn: "{{ kolla_internal_fqdn }}"
+cyborg_external_fqdn: "{{ kolla_external_fqdn }}"
+cyborg_api_port: "6666"
+cyborg_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else cyborg_api_port }}"
+cyborg_api_listen_port: "{{ cyborg_api_port }}"
diff --git a/ansible/group_vars/all/database.yml b/ansible/group_vars/all/database.yml
new file mode 100644
index 000000000..7e0e1bd03
--- /dev/null
+++ b/ansible/group_vars/all/database.yml
@@ -0,0 +1,11 @@
+---
+####################
+# Database options
+####################
+database_address: "{{ kolla_internal_fqdn }}"
+database_user: "root"
+database_port: "3306"
+database_connection_recycle_time: 10
+database_max_pool_size: 1
+database_enable_tls_backend: "{{ 'yes' if ((kolla_enable_tls_backend | bool ) and ( enable_proxysql | bool)) else 'no' }}"
+database_enable_tls_internal: "{{ 'yes' if ((kolla_enable_tls_internal | bool ) and ( enable_proxysql | bool)) else 'no' }}"
diff --git a/ansible/group_vars/all/designate.yml b/ansible/group_vars/all/designate.yml
new file mode 100644
index 000000000..e9916c542
--- /dev/null
+++ b/ansible/group_vars/all/designate.yml
@@ -0,0 +1,33 @@
+---
+enable_designate: "no"
+
+designate_keystone_user: "designate"
+
+#######################
+# Designate options
+#######################
+# Valid options are [ bind9, infoblox ]
+designate_backend: "bind9"
+designate_ns_record:
+  - "ns1.example.org"
+designate_backend_external: "no"
+designate_backend_external_bind9_nameservers: ""
+# Valid options are [ '', redis ]
+designate_coordination_backend: "{{ 'redis' if enable_redis | bool else '' }}"
+
+designate_enable_notifications_sink: "no"
+designate_notifications_topic_name: "notifications_designate"
+
+dns_interface: "{{ network_interface }}"
+dns_address_family: "{{ network_address_family }}"
+
+designate_internal_fqdn: "{{ kolla_internal_fqdn }}"
+designate_external_fqdn: "{{ kolla_external_fqdn }}"
+designate_internal_endpoint: "{{ designate_internal_fqdn | kolla_url(internal_protocol, designate_api_port) }}"
+designate_public_endpoint: "{{ designate_external_fqdn | kolla_url(public_protocol, designate_api_public_port) }}"
+designate_api_port: "9001"
+designate_api_listen_port: "{{ designate_api_port }}"
+designate_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else designate_api_port }}"
+designate_bind_port: "53"
+designate_mdns_port: "{{ '53' if designate_backend == 'infoblox' else '5354' }}"
+designate_rndc_port: "953"
diff --git a/ansible/group_vars/all/etcd.yml b/ansible/group_vars/all/etcd.yml
new file mode 100644
index 000000000..a6b160119
--- /dev/null
+++ b/ansible/group_vars/all/etcd.yml
@@ -0,0 +1,7 @@
+---
+enable_etcd: "no"
+
+etcd_client_port: "2379"
+etcd_peer_port: "2380"
+etcd_enable_tls: "{{ kolla_enable_tls_backend }}"
+etcd_protocol: "{{ 'https' if etcd_enable_tls | bool else 'http' }}"
diff --git a/ansible/group_vars/all/fluentd.yml b/ansible/group_vars/all/fluentd.yml
new file mode 100644
index 000000000..13f41522d
--- /dev/null
+++ b/ansible/group_vars/all/fluentd.yml
@@ -0,0 +1,6 @@
+---
+enable_fluentd: "yes"
+enable_fluentd_systemd: "{{ (enable_fluentd | bool) and (enable_central_logging | bool) }}"
+
+fluentd_syslog_port: "5140"
+syslog_udp_port: "{{ fluentd_syslog_port }}"
diff --git a/ansible/group_vars/all/glance.yml b/ansible/group_vars/all/glance.yml
new file mode 100644
index 000000000..baf705736
--- /dev/null
+++ b/ansible/group_vars/all/glance.yml
@@ -0,0 +1,28 @@
+---
+enable_glance: "{{ enable_openstack_core | bool }}"
+
+glance_keystone_user: "glance"
+
+#######################
+# Glance options
+#######################
+glance_backend_file: "{{ not (glance_backend_ceph | bool or glance_backend_s3 | bool) }}"
+glance_backend_ceph: "no"
+glance_backend_s3: "no"
+enable_glance_image_cache: "no"
+glance_file_datadir_volume: "glance"
+glance_enable_rolling_upgrade: "no"
+glance_enable_property_protection: "no"
+glance_enable_interoperable_image_import: "no"
+glance_api_hosts: "{{ [groups['glance-api'] | first] if glance_backend_file | bool and glance_file_datadir_volume == 'glance' else groups['glance-api'] }}"
+# NOTE(mnasiadka): For use in common role
+glance_enable_tls_backend: "{{ kolla_enable_tls_backend }}"
+
+glance_internal_fqdn: "{{ kolla_internal_fqdn }}"
+glance_external_fqdn: "{{ kolla_external_fqdn }}"
+glance_internal_endpoint: "{{ glance_internal_fqdn | kolla_url(internal_protocol, glance_api_port) }}"
+glance_public_endpoint: "{{ glance_external_fqdn | kolla_url(public_protocol, glance_api_public_port) }}"
+glance_api_port: "9292"
+glance_api_listen_port: "{{ glance_api_port }}"
+glance_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else glance_api_port }}"
+glance_tls_proxy_stats_port: "9293"
diff --git a/ansible/group_vars/all/gnocchi.yml b/ansible/group_vars/all/gnocchi.yml
new file mode 100644
index 000000000..f103736b4
--- /dev/null
+++ b/ansible/group_vars/all/gnocchi.yml
@@ -0,0 +1,21 @@
+---
+enable_gnocchi: "no"
+enable_gnocchi_statsd: "no"
+
+#################
+# Gnocchi options
+#################
+# Valid options are [ file, ceph ]
+gnocchi_backend_storage: "file"
+
+# Valid options are [redis, '']
+gnocchi_incoming_storage: "{{ 'redis' if enable_redis | bool else '' }}"
+gnocchi_metric_datadir_volume: "gnocchi"
+
+gnocchi_internal_fqdn: "{{ kolla_internal_fqdn }}"
+gnocchi_external_fqdn: "{{ kolla_external_fqdn }}"
+gnocchi_internal_endpoint: "{{ gnocchi_internal_fqdn | kolla_url(internal_protocol, gnocchi_api_port) }}"
+gnocchi_public_endpoint: "{{ gnocchi_external_fqdn | kolla_url(public_protocol, gnocchi_api_public_port) }}"
+gnocchi_api_port: "8041"
+gnocchi_api_listen_port: "{{ gnocchi_api_port }}"
+gnocchi_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else gnocchi_api_port }}"
diff --git a/ansible/group_vars/all/grafana.yml b/ansible/group_vars/all/grafana.yml
new file mode 100644
index 000000000..97c7d1294
--- /dev/null
+++ b/ansible/group_vars/all/grafana.yml
@@ -0,0 +1,11 @@
+---
+enable_grafana: "no"
+enable_grafana_external: "{{ enable_grafana | bool }}"
+
+grafana_internal_fqdn: "{{ kolla_internal_fqdn }}"
+grafana_external_fqdn: "{{ kolla_external_fqdn }}"
+grafana_internal_endpoint: "{{ grafana_internal_fqdn | kolla_url(internal_protocol, grafana_server_port) }}"
+grafana_public_endpoint: "{{ grafana_external_fqdn | kolla_url(public_protocol, grafana_server_public_port) }}"
+grafana_server_port: "3000"
+grafana_server_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else grafana_server_port }}"
+grafana_server_listen_port: "{{ grafana_server_port }}"
diff --git a/ansible/group_vars/all/hacluster.yml b/ansible/group_vars/all/hacluster.yml
new file mode 100644
index 000000000..15a92447c
--- /dev/null
+++ b/ansible/group_vars/all/hacluster.yml
@@ -0,0 +1,9 @@
+---
+enable_hacluster: "{{ enable_masakari_hostmonitor | bool }}"
+
+####################
+# Corosync options
+####################
+
+# this is UDP port
+hacluster_corosync_port: 5405
diff --git a/ansible/group_vars/all/haproxy.yml b/ansible/group_vars/all/haproxy.yml
new file mode 100644
index 000000000..d2e5a14a2
--- /dev/null
+++ b/ansible/group_vars/all/haproxy.yml
@@ -0,0 +1,48 @@
+---
+enable_haproxy: "yes"
+
+####################
+# HAProxy options
+####################
+haproxy_user: "openstack"
+haproxy_enable_external_vip: "{{ 'no' if kolla_same_external_internal_vip | bool else 'yes' }}"
+haproxy_enable_http2: "yes"
+haproxy_http2_protocol: "alpn h2,http/1.1"
+kolla_enable_tls_internal: "no"
+kolla_enable_tls_external: "{{ kolla_enable_tls_internal if kolla_same_external_internal_vip | bool else 'no' }}"
+kolla_certificates_dir: "{{ node_config }}/certificates"
+kolla_external_fqdn_cert: "{{ kolla_certificates_dir }}/haproxy.pem"
+kolla_internal_fqdn_cert: "{{ kolla_certificates_dir }}/haproxy-internal.pem"
+kolla_admin_openrc_cacert: ""
+kolla_copy_ca_into_containers: "no"
+haproxy_backend_cacert: "{{ 'ca-certificates.crt' if kolla_base_distro in ['debian', 'ubuntu'] else 'ca-bundle.crt' }}"
+haproxy_backend_cacert_dir: "/etc/ssl/certs"
+haproxy_single_external_frontend: false
+haproxy_single_external_frontend_public_port: "{{ '443' if kolla_enable_tls_external | bool else '80' }}"
+
+# configure SSL/TLS settings for haproxy config, one of [modern, intermediate, legacy]:
+kolla_haproxy_ssl_settings: "modern"
+
+haproxy_ssl_settings: "{{ ssl_legacy_settings if kolla_haproxy_ssl_settings == 'legacy' else ssl_intermediate_settings if kolla_haproxy_ssl_settings == 'intermediate' else ssl_modern_settings | default(ssl_modern_settings) }}"
+
+ssl_legacy_settings: |
+    ssl-default-bind-ciphers DEFAULT:!MEDIUM:!3DES
+    ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11
+
+ssl_intermediate_settings: |
+    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
+    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
+    ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
+    ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
+    ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
+    ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
+
+ssl_modern_settings: |
+    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
+    ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets
+    ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
+    ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets
+
+haproxy_stats_port: "1984"
+haproxy_monitor_port: "61313"
+haproxy_ssh_port: "2985"
diff --git a/ansible/group_vars/all/heat.yml b/ansible/group_vars/all/heat.yml
new file mode 100644
index 000000000..8a8768226
--- /dev/null
+++ b/ansible/group_vars/all/heat.yml
@@ -0,0 +1,17 @@
+---
+enable_heat: "{{ enable_openstack_core | bool }}"
+
+heat_internal_fqdn: "{{ kolla_internal_fqdn }}"
+heat_external_fqdn: "{{ kolla_external_fqdn }}"
+heat_internal_base_endpoint: "{{ heat_internal_fqdn | kolla_url(internal_protocol, heat_api_port) }}"
+heat_public_base_endpoint: "{{ heat_external_fqdn | kolla_url(public_protocol, heat_api_public_port) }}"
+heat_api_port: "8004"
+heat_api_listen_port: "{{ heat_api_port }}"
+heat_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else heat_api_port }}"
+heat_cfn_internal_fqdn: "{{ kolla_internal_fqdn }}"
+heat_cfn_external_fqdn: "{{ kolla_external_fqdn }}"
+heat_cfn_internal_base_endpoint: "{{ heat_cfn_internal_fqdn | kolla_url(internal_protocol, heat_api_cfn_port) }}"
+heat_cfn_public_base_endpoint: "{{ heat_cfn_external_fqdn | kolla_url(public_protocol, heat_api_cfn_public_port) }}"
+heat_api_cfn_port: "8000"
+heat_api_cfn_listen_port: "{{ heat_api_cfn_port }}"
+heat_api_cfn_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else heat_api_cfn_port }}"
diff --git a/ansible/group_vars/all/horizon.yml b/ansible/group_vars/all/horizon.yml
new file mode 100644
index 000000000..f01082827
--- /dev/null
+++ b/ansible/group_vars/all/horizon.yml
@@ -0,0 +1,49 @@
+---
+enable_horizon: "{{ enable_openstack_core | bool }}"
+enable_horizon_blazar: "{{ enable_blazar | bool }}"
+enable_horizon_cloudkitty: "{{ enable_cloudkitty | bool }}"
+enable_horizon_designate: "{{ enable_designate | bool }}"
+enable_horizon_fwaas: "{{ enable_neutron_fwaas | bool }}"
+enable_horizon_heat: "{{ enable_heat | bool }}"
+enable_horizon_ironic: "{{ enable_ironic | bool }}"
+enable_horizon_magnum: "{{ enable_magnum | bool }}"
+enable_horizon_manila: "{{ enable_manila | bool }}"
+enable_horizon_masakari: "{{ enable_masakari | bool }}"
+enable_horizon_mistral: "{{ enable_mistral | bool }}"
+enable_horizon_neutron_vpnaas: "{{ enable_neutron_vpnaas | bool }}"
+enable_horizon_octavia: "{{ enable_octavia | bool }}"
+enable_horizon_tacker: "{{ enable_tacker | bool }}"
+enable_horizon_trove: "{{ enable_trove | bool }}"
+enable_horizon_venus: "{{ enable_venus | bool }}"
+enable_horizon_watcher: "{{ enable_watcher | bool }}"
+enable_horizon_zun: "{{ enable_zun | bool }}"
+
+#######################
+# Horizon options
+#######################
+horizon_backend_database: false
+horizon_keystone_multidomain: false
+
+# Enable deploying custom horizon policy files for services that don't have a
+# horizon plugin but have a policy file. Override these when you have services
+# not deployed by kolla-ansible but want custom policy files deployed for them
+# in horizon.
+enable_ceilometer_horizon_policy_file: "{{ enable_ceilometer }}"
+enable_cinder_horizon_policy_file: "{{ enable_cinder }}"
+enable_glance_horizon_policy_file: "{{ enable_glance }}"
+enable_heat_horizon_policy_file: "{{ enable_heat }}"
+enable_keystone_horizon_policy_file: "{{ enable_keystone }}"
+enable_neutron_horizon_policy_file: "{{ enable_neutron }}"
+enable_nova_horizon_policy_file: "{{ enable_nova }}"
+
+# TLS
+horizon_enable_tls_backend: "{{ kolla_enable_tls_backend }}"
+
+# Ports
+horizon_internal_fqdn: "{{ kolla_internal_fqdn }}"
+horizon_external_fqdn: "{{ kolla_external_fqdn }}"
+horizon_internal_endpoint: "{{ kolla_internal_fqdn | kolla_url(internal_protocol, horizon_tls_port if kolla_enable_tls_internal | bool else horizon_port) }}"
+horizon_public_endpoint: "{{ kolla_external_fqdn | kolla_url(public_protocol, horizon_tls_port if kolla_enable_tls_external | bool else horizon_port) }}"
+horizon_port: "80"
+horizon_tls_port: "443"
+horizon_listen_port: "{{ horizon_tls_port if horizon_enable_tls_backend | bool else horizon_port }}"
diff --git a/ansible/group_vars/all/influxdb.yml b/ansible/group_vars/all/influxdb.yml
new file mode 100644
index 000000000..c6ddb3c99
--- /dev/null
+++ b/ansible/group_vars/all/influxdb.yml
@@ -0,0 +1,12 @@
+---
+enable_influxdb: "{{ enable_cloudkitty | bool and cloudkitty_storage_backend == 'influxdb' }}"
+
+####################
+# InfluxDB options
+####################
+influxdb_address: "{{ kolla_internal_fqdn }}"
+influxdb_datadir_volume: "influxdb"
+
+influxdb_internal_endpoint: "{{ kolla_internal_fqdn | kolla_url(internal_protocol, influxdb_http_port) }}"
+
+influxdb_http_port: "8086"
diff --git a/ansible/group_vars/all/ironic.yml b/ansible/group_vars/all/ironic.yml
new file mode 100644
index 000000000..48e017975
--- /dev/null
+++ b/ansible/group_vars/all/ironic.yml
@@ -0,0 +1,33 @@
+---
+enable_ironic: "no"
+enable_ironic_dnsmasq: "{{ enable_ironic | bool }}"
+enable_ironic_neutron_agent: "no"
+enable_ironic_prometheus_exporter: "{{ enable_ironic | bool and enable_prometheus | bool }}"
+
+# Keystone user
+ironic_keystone_user: "ironic"
+
+# Coordination backend
+ironic_coordination_backend: "{{ 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}"
+
+# Network interfaces
+ironic_http_interface: "{{ api_interface }}"
+ironic_tftp_interface: "{{ api_interface }}"
+
+# Address family
+ironic_http_address_family: "{{ api_address_family }}"
+ironic_tftp_address_family: "{{ api_address_family }}"
+
+# Addresses
+ironic_http_interface_address: "{{ 'ironic_http' | kolla_address }}"
+ironic_tftp_interface_address: "{{ 'ironic_tftp' | kolla_address }}"
+
+ironic_internal_fqdn: "{{ kolla_internal_fqdn }}"
+ironic_external_fqdn: "{{ kolla_external_fqdn }}"
+ironic_internal_endpoint: "{{ ironic_internal_fqdn | kolla_url(internal_protocol, ironic_api_port) }}"
+ironic_public_endpoint: "{{ ironic_external_fqdn | kolla_url(public_protocol, ironic_api_public_port) }}"
+ironic_api_port: "6385"
+ironic_api_listen_port: "{{ ironic_api_port }}"
+ironic_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else ironic_api_port }}"
+ironic_http_port: "8089"
+ironic_prometheus_exporter_port: "9608"
diff --git a/ansible/group_vars/all/iscsi.yml b/ansible/group_vars/all/iscsi.yml
new file mode 100644
index 000000000..20773bf86
--- /dev/null
+++ b/ansible/group_vars/all/iscsi.yml
@@ -0,0 +1,4 @@
+---
+enable_iscsid: "{{ enable_cinder | bool and enable_cinder_backend_iscsi | bool }}"
+
+iscsi_port: "3260"
diff --git a/ansible/group_vars/all/keepalived.yml b/ansible/group_vars/all/keepalived.yml
new file mode 100644
index 000000000..b32dcdd4f
--- /dev/null
+++ b/ansible/group_vars/all/keepalived.yml
@@ -0,0 +1,8 @@
+---
+enable_keepalived: "{{ enable_haproxy | bool }}"
+
+####################
+# keepalived options
+####################
+# Arbitrary unique number from 0..255
+keepalived_virtual_router_id: "51"
diff --git a/ansible/group_vars/all/keystone.yml b/ansible/group_vars/all/keystone.yml
new file mode 100644
index 000000000..8a644bd82
--- /dev/null
+++ b/ansible/group_vars/all/keystone.yml
@@ -0,0 +1,86 @@
+---
+enable_keystone: "{{ enable_openstack_core | bool }}"
+enable_keystone_federation: "{{ (keystone_identity_providers | length > 0) and (keystone_identity_mappings | length > 0) }}"
+
+####################
+# Keystone options
+####################
+keystone_internal_fqdn: "{{ kolla_internal_fqdn }}"
+keystone_external_fqdn: "{{ kolla_external_fqdn }}"
+
+keystone_internal_url: "{{ keystone_internal_fqdn | kolla_url(internal_protocol, keystone_internal_port) }}"
+keystone_public_url: "{{ keystone_external_fqdn | kolla_url(public_protocol, keystone_public_port) }}"
+
+keystone_admin_user: "admin"
+keystone_admin_project: "admin"
+
+# Whether or not to apply changes to service user passwords when services are
+# reconfigured
+update_keystone_service_user_passwords: true
+
+default_project_domain_name: "Default"
+default_project_domain_id: "default"
+
+default_user_domain_name: "Default"
+default_user_domain_id: "default"
+
+# Keystone fernet token expiry in seconds. Default is 1 day.
+fernet_token_expiry: 86400
+# Keystone window to allow expired fernet tokens. Default is 2 days.
+fernet_token_allow_expired_window: 172800
+# Keystone fernet key rotation interval in seconds. Default is sum of token
+# expiry and allow expired window, 3 days. This ensures the minimum number
+# of keys are active. If this interval is lower than the sum of the token
+# expiry and allow expired window, multiple active keys will be necessary.
+fernet_key_rotation_interval: "{{ fernet_token_expiry + fernet_token_allow_expired_window }}"
+
+keystone_default_user_role: "member"
+
+###################################
+# Identity federation configuration
+###################################
+# Here we configure all of the IdPs meta information that will be required to implement identity federation with OpenStack Keystone.
+# We require the administrator to enter the following metadata:
+# * name (internal name of the IdP in Keystone);
+# * openstack_domain (the domain in Keystone that the IdP belongs to)
+# * protocol (the federated protocol used by the IdP; e.g. openid or saml);
+# * identifier (the IdP identifier; e.g. https://accounts.google.com);
+# * public_name (the public name that will be shown for users in Horizon);
+# * attribute_mapping (the attribute mapping to be used for this IdP. This mapping is configured in the "keystone_identity_mappings" configuration);
+# * metadata_folder (folder containing all the identity provider metadata as jsons named as the identifier without the protocol
+#   and with '/' escaped as %2F followed with '.provider' or '.client' or '.conf'; e.g. accounts.google.com.provider; PS, all .conf,
+#   .provider and .client jsons must be in the folder, even if you dont override any conf in the .conf json, you must leave it as an empty json '{}');
+# * certificate_file (the path to the Identity Provider certificate file, the file must be named as 'certificate-key-id.pem';
+#   e.g. LRVweuT51StjMdsna59jKfB3xw0r8Iz1d1J1HeAbmlw.pem; You can find the key-id in the Identity provider '.well-known/openid-configuration' jwks_uri as kid);
+#
+# The IdPs meta information are to be presented to Kolla-Ansible as the following example:
+# keystone_identity_providers:
+#   - name: "myidp1"
+#     openstack_domain: "my-domain"
+#     protocol: "openid"
+#     identifier: "https://accounts.google.com"
+#     public_name: "Authenticate via myidp1"
+#     attribute_mapping: "mappingId1"
+#     metadata_folder: "path/to/metadata/folder"
+#     certificate_file: "path/to/certificate/file.pem"
+#
+# We also need to configure the attribute mapping that is used by IdPs.
+# The configuration of attribute mappings is a list of objects, where each
+# object must have a 'name' (that mapps to the 'attribute_mapping' to the IdP
+# object in the IdPs set), and the 'file' with a full qualified path to a mapping file.
+# keystone_identity_mappings:
+#   - name: "mappingId1"
+#     file: "/full/qualified/path/to/mapping/json/file/to/mappingId1"
+#   - name: "mappingId2"
+#     file: "/full/qualified/path/to/mapping/json/file/to/mappingId2"
+#   - name: "mappingId3"
+#     file: "/full/qualified/path/to/mapping/json/file/to/mappingId3"
+keystone_identity_providers: []
+keystone_identity_mappings: []
+
+keystone_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else keystone_public_listen_port }}"
+keystone_public_listen_port: "5000"
+keystone_internal_port: "5000"
+keystone_internal_listen_port: "{{ keystone_internal_port }}"
+keystone_listen_port: "{{ keystone_internal_listen_port }}"
+keystone_ssh_port: "8023"
diff --git a/ansible/group_vars/all/kuryr.yml b/ansible/group_vars/all/kuryr.yml
new file mode 100644
index 000000000..69464a031
--- /dev/null
+++ b/ansible/group_vars/all/kuryr.yml
@@ -0,0 +1,4 @@
+---
+enable_kuryr: "no"
+
+kuryr_port: "23750"
diff --git a/ansible/group_vars/all/letsencrypt.yml b/ansible/group_vars/all/letsencrypt.yml
new file mode 100644
index 000000000..50007e885
--- /dev/null
+++ b/ansible/group_vars/all/letsencrypt.yml
@@ -0,0 +1,13 @@
+---
+enable_letsencrypt: "no"
+
+#####################
+# ACME client options
+#####################
+acme_client_lego: "server lego {{ api_interface_address }}:{{ letsencrypt_webserver_port }}"
+acme_client_servers: "{% set arr = [] %}{% if enable_letsencrypt | bool %}{{ arr.append(acme_client_lego) }}{% endif %}{{ arr }}"
+
+letsencrypt_webserver_port: "8081"
+letsencrypt_managed_certs: "{{ '' if not enable_letsencrypt | bool else ('internal' if letsencrypt_internal_cert_server != '' and kolla_same_external_internal_vip | bool else ('internal,external' if letsencrypt_internal_cert_server != '' and letsencrypt_external_cert_server != '' else ('internal' if letsencrypt_internal_cert_server != '' else ('external' if letsencrypt_external_cert_server != '' and not kolla_same_external_internal_vip | bool else '')))) }}"
+letsencrypt_external_cert_server: "https://acme-v02.api.letsencrypt.org/directory"
+letsencrypt_internal_cert_server: ""
diff --git a/ansible/group_vars/all/loadbalancer.yml b/ansible/group_vars/all/loadbalancer.yml
new file mode 100644
index 000000000..ef47f2555
--- /dev/null
+++ b/ansible/group_vars/all/loadbalancer.yml
@@ -0,0 +1,2 @@
+---
+enable_loadbalancer: "{{ enable_haproxy | bool or enable_keepalived | bool or enable_proxysql | bool }}"
diff --git a/ansible/group_vars/all/magnum.yml b/ansible/group_vars/all/magnum.yml
new file mode 100644
index 000000000..279e17d98
--- /dev/null
+++ b/ansible/group_vars/all/magnum.yml
@@ -0,0 +1,10 @@
+---
+enable_magnum: "no"
+
+magnum_internal_fqdn: "{{ kolla_internal_fqdn }}"
+magnum_external_fqdn: "{{ kolla_external_fqdn }}"
+magnum_internal_base_endpoint: "{{ magnum_internal_fqdn | kolla_url(internal_protocol, magnum_api_port) }}"
+magnum_public_base_endpoint: "{{ magnum_external_fqdn | kolla_url(public_protocol, magnum_api_public_port) }}"
+magnum_api_port: "9511"
+magnum_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else magnum_api_port }}"
+magnum_api_listen_port: "{{ magnum_api_port }}"
diff --git a/ansible/group_vars/all/manila.yml b/ansible/group_vars/all/manila.yml
new file mode 100644
index 000000000..526707331
--- /dev/null
+++ b/ansible/group_vars/all/manila.yml
@@ -0,0 +1,18 @@
+---
+enable_manila: "no"
+enable_manila_backend_generic: "no"
+enable_manila_backend_hnas: "no"
+enable_manila_backend_cephfs_native: "no"
+enable_manila_backend_cephfs_nfs: "no"
+enable_manila_backend_glusterfs_nfs: "no"
+enable_manila_backend_flashblade: "no"
+
+ceph_manila_user: "manila"
+
+manila_internal_fqdn: "{{ kolla_internal_fqdn }}"
+manila_external_fqdn: "{{ kolla_external_fqdn }}"
+manila_internal_base_endpoint: "{{ manila_internal_fqdn | kolla_url(internal_protocol, manila_api_port) }}"
+manila_public_base_endpoint: "{{ manila_external_fqdn | kolla_url(public_protocol, manila_api_public_port) }}"
+manila_api_port: "8786"
+manila_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else manila_api_port }}"
+manila_api_listen_port: "{{ manila_api_port }}"
diff --git a/ansible/group_vars/all/mariadb.yml b/ansible/group_vars/all/mariadb.yml
new file mode 100644
index 000000000..ea6c9fda9
--- /dev/null
+++ b/ansible/group_vars/all/mariadb.yml
@@ -0,0 +1,37 @@
+---
+enable_mariadb: "yes"
+enable_mariabackup: "no"
+
+#############################################
+# MariaDB component-specific database details
+#############################################
+# Whether to configure haproxy to load balance
+# the external MariaDB server(s)
+enable_external_mariadb_load_balancer: "no"
+# Whether to use pre-configured databases / users
+use_preconfigured_databases: "no"
+# whether to use a common, preconfigured user
+# for all component databases
+use_common_mariadb_user: "no"
+
+mariadb_port: "{{ database_port }}"
+mariadb_wsrep_port: "4567"
+mariadb_ist_port: "4568"
+mariadb_sst_port: "4444"
+mariadb_clustercheck_port: "4569"
+mariadb_enable_tls_backend: "{{ database_enable_tls_backend }}"
+
+mariadb_monitor_user: "{{ 'monitor' if enable_proxysql | bool else 'haproxy' }}"
+
+mariadb_datadir_volume: "mariadb"
+
+mariadb_default_database_shard_id: 0
+mariadb_default_database_shard_hosts: "{% set default_shard = [] %}{% for host in groups['mariadb'] %}{% if hostvars[host]['mariadb_shard_id'] is not defined or hostvars[host]['mariadb_shard_id'] == mariadb_default_database_shard_id %}{{ default_shard.append(host) }}{% endif %}{% endfor %}{{ default_shard }}"
+mariadb_shard_id: "{{ mariadb_default_database_shard_id }}"
+mariadb_shard_name: "shard_{{ mariadb_shard_id }}"
+mariadb_shard_group: "mariadb_{{ mariadb_shard_name }}"
+mariadb_loadbalancer: "{{ 'proxysql' if enable_proxysql | bool else 'haproxy' }}"
+mariadb_backup_target: "{{ 'active' if mariadb_loadbalancer == 'haproxy' else 'replica' }}"
+mariadb_shard_root_user_prefix: "root_shard_"
+mariadb_shard_backup_user_prefix: "backup_shard_"
+mariadb_shards_info: "{{ groups['mariadb'] | database_shards_info() }}"
diff --git a/ansible/group_vars/all/masakari.yml b/ansible/group_vars/all/masakari.yml
new file mode 100644
index 000000000..bef390e71
--- /dev/null
+++ b/ansible/group_vars/all/masakari.yml
@@ -0,0 +1,13 @@
+---
+enable_masakari: "no"
+enable_masakari_instancemonitor: "{{ enable_masakari | bool }}"
+enable_masakari_hostmonitor: "{{ enable_masakari | bool }}"
+
+masakari_internal_fqdn: "{{ kolla_internal_fqdn }}"
+masakari_external_fqdn: "{{ kolla_external_fqdn }}"
+masakari_internal_endpoint: "{{ masakari_internal_fqdn | kolla_url(internal_protocol, masakari_api_port) }}"
+masakari_public_endpoint: "{{ masakari_external_fqdn | kolla_url(public_protocol, masakari_api_public_port) }}"
+masakari_api_port: "15868"
+masakari_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else masakari_api_port }}"
+masakari_api_listen_port: "{{ masakari_api_port }}"
+masakari_coordination_backend: "{{ 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}"
diff --git a/ansible/group_vars/all/memcached.yml b/ansible/group_vars/all/memcached.yml
new file mode 100644
index 000000000..282138b41
--- /dev/null
+++ b/ansible/group_vars/all/memcached.yml
@@ -0,0 +1,10 @@
+---
+enable_memcached: "yes"
+
+# NOTE: Most memcached clients handle load-balancing via client side
+# hashing (consistent or not) logic, so going under the covers and messing
+# with things that the clients are not aware of is generally wrong
+enable_haproxy_memcached: "no"
+
+memcached_port: "11211"
+memcache_security_strategy: "ENCRYPT"
diff --git a/ansible/group_vars/all/mistral.yml b/ansible/group_vars/all/mistral.yml
new file mode 100644
index 000000000..2e72f3cc6
--- /dev/null
+++ b/ansible/group_vars/all/mistral.yml
@@ -0,0 +1,10 @@
+---
+enable_mistral: "no"
+
+mistral_internal_fqdn: "{{ kolla_internal_fqdn }}"
+mistral_external_fqdn: "{{ kolla_external_fqdn }}"
+mistral_internal_base_endpoint: "{{ mistral_internal_fqdn | kolla_url(internal_protocol, mistral_api_port) }}"
+mistral_public_base_endpoint: "{{ mistral_external_fqdn | kolla_url(public_protocol, mistral_api_public_port) }}"
+mistral_api_port: "8989"
+mistral_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else mistral_api_port }}"
+mistral_api_listen_port: "{{ mistral_api_port }}"
diff --git a/ansible/group_vars/all/multipathd.yml b/ansible/group_vars/all/multipathd.yml
new file mode 100644
index 000000000..bae55e51c
--- /dev/null
+++ b/ansible/group_vars/all/multipathd.yml
@@ -0,0 +1,2 @@
+---
+enable_multipathd: "no"
diff --git a/ansible/group_vars/all/neutron.yml b/ansible/group_vars/all/neutron.yml
new file mode 100644
index 000000000..0ef47e2ed
--- /dev/null
+++ b/ansible/group_vars/all/neutron.yml
@@ -0,0 +1,75 @@
+---
+enable_neutron: "{{ enable_openstack_core | bool }}"
+
+enable_neutron_vpnaas: "no"
+enable_neutron_sriov: "no"
+enable_neutron_mlnx: "no"
+enable_neutron_dvr: "no"
+enable_neutron_fwaas: "no"
+enable_neutron_qos: "no"
+enable_neutron_agent_ha: "no"
+enable_neutron_bgp_dragent: "no"
+enable_neutron_provider_networks: "no"
+enable_neutron_segments: "no"
+enable_neutron_packet_logging: "no"
+enable_neutron_sfc: "no"
+enable_neutron_taas: "no"
+enable_neutron_trunk: "no"
+enable_neutron_metering: "no"
+enable_neutron_infoblox_ipam_agent: "no"
+enable_neutron_port_forwarding: "no"
+neutron_enable_ovn_agent: "no"
+
+neutron_keystone_user: "neutron"
+
+# Valid options are [ openvswitch, ovn, linuxbridge ]
+# Do note linuxbridge is *EXPERIMENTAL* in Neutron since Zed and it requires extra tweaks to config to be usable.
+# For details, see: https://docs.openstack.org/neutron/latest/admin/config-experimental-framework.html
+neutron_plugin_agent: "openvswitch"
+
+# Valid options are [ internal, infoblox ]
+neutron_ipam_driver: "internal"
+
+eutron_external_interface: "eth1"
+
+#######################
+# Neutron options
+#######################
+neutron_bgp_router_id: "1.1.1.1"
+neutron_bridge_name: "{{ 'br_dpdk' if enable_ovs_dpdk | bool else 'br-ex' }}"
+neutron_physical_networks: "{% for bridge in neutron_bridge_name.split(',') %}physnet{{ loop.index }}{% if not loop.last %},{% endif %}{% endfor %}"
+# Comma-separated type of enabled ml2 type drivers
+neutron_type_drivers: "flat,vlan,vxlan{% if neutron_plugin_agent == 'ovn' %},geneve{% endif %}"
+# Comma-separated types of tenant networks (should be listed in 'neutron_type_drivers')
+# NOTE: for ironic this list should also contain 'flat'
+neutron_tenant_network_types: "{% if neutron_plugin_agent == 'ovn' %}geneve{% else %}vxlan{% endif %}"
+
+# valid values: ["dvr", "dvr_no_external"]
+neutron_compute_dvr_mode: "dvr"
+computes_need_external_bridge: "{{ (enable_neutron_dvr | bool and neutron_compute_dvr_mode == 'dvr') or enable_neutron_provider_networks | bool or neutron_ovn_distributed_fip | bool }}"
+
+# Default DNS resolvers for virtual networks
+neutron_dnsmasq_dns_servers: "1.1.1.1,8.8.8.8,8.8.4.4"
+
+# Set legacy iptables to allow kernels not supporting iptables-nft
+neutron_legacy_iptables: "no"
+
+# Enable distributed floating ip for OVN deployments
+neutron_ovn_distributed_fip: "no"
+
+# SRIOV physnet:interface mappings when SRIOV is enabled
+# "sriovnet1" and tunnel_interface used here as placeholders
+neutron_sriov_physnet_mappings:
+  sriovnet1: "{{ tunnel_interface }}"
+neutron_enable_tls_backend: "{{ kolla_enable_tls_backend }}"
+
+# Set OVN network availability zones
+neutron_ovn_availability_zones: []
+
+neutron_internal_fqdn: "{{ kolla_internal_fqdn }}"
+neutron_external_fqdn: "{{ kolla_external_fqdn }}"
+neutron_internal_endpoint: "{{ neutron_internal_fqdn | kolla_url(internal_protocol, neutron_server_port) }}"
+neutron_public_endpoint: "{{ neutron_external_fqdn | kolla_url(public_protocol, neutron_server_public_port) }}"
+neutron_server_port: "9696"
+neutron_server_listen_port: "{{ neutron_server_port }}"
+neutron_server_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else neutron_server_port }}"
diff --git a/ansible/group_vars/all/nova.yml b/ansible/group_vars/all/nova.yml
new file mode 100644
index 000000000..48811be62
--- /dev/null
+++ b/ansible/group_vars/all/nova.yml
@@ -0,0 +1,69 @@
+---
+enable_cells: "no"
+enable_nova: "{{ enable_openstack_core | bool }}"
+enable_nova_libvirt_container: "{{ nova_compute_virt_type in ['kvm', 'qemu'] }}"
+enable_nova_serialconsole_proxy: "no"
+enable_nova_ssh: "yes"
+
+#######################
+# Nova options
+#######################
+nova_backend_ceph: "no"
+nova_backend: "{{ 'rbd' if nova_backend_ceph | bool else 'default' }}"
+# Valid options are [ kvm, qemu ]
+nova_compute_virt_type: "kvm"
+nova_instance_datadir_volume: "{{ 'nova_compute' if enable_nova_libvirt_container | bool else '/var/lib/nova' }}"
+nova_safety_upgrade: "no"
+# Valid options are [ none, novnc, spice ]
+nova_console: "novnc"
+
+#######################
+# Nova Database
+#######################
+nova_database_shard_id: "{{ mariadb_default_database_shard_id | int }}"
+nova_cell0_database_shard_id: "{{ nova_database_shard_id | int }}"
+
+# These are kept for backwards compatibility, as cell0 references them.
+nova_database_name: "nova"
+nova_database_user: "{% if use_preconfigured_databases | bool and use_common_mariadb_user | bool %}{{ database_user }}{% else %}nova{% endif %}"
+nova_database_address: "{{ database_address | put_address_in_context('url') }}:{{ database_port }}"
+
+nova_cell0_database_name: "{{ nova_database_name }}_cell0"
+nova_cell0_database_user: "{{ nova_database_user }}"
+nova_cell0_database_address: "{{ nova_database_address }}"
+nova_cell0_database_password: "{{ nova_database_password }}"
+
+# Nova fake driver and the number of fake driver per compute node
+enable_nova_fake: "no"
+num_nova_fake_per_node: 5
+
+migration_interface: "{{ api_interface }}"
+migration_interface_address: "{{ 'migration' | kolla_address }}"
+migration_address_family: "{{ api_address_family }}"
+
+nova_keystone_user: "nova"
+
+nova_internal_fqdn: "{{ kolla_internal_fqdn }}"
+nova_external_fqdn: "{{ kolla_external_fqdn }}"
+nova_internal_base_endpoint: "{{ nova_internal_fqdn | kolla_url(internal_protocol, nova_api_port) }}"
+nova_public_base_endpoint: "{{ nova_external_fqdn | kolla_url(public_protocol, nova_api_public_port) }}"
+nova_api_port: "8774"
+nova_api_listen_port: "{{ nova_api_port }}"
+nova_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else nova_api_port }}"
+nova_metadata_internal_fqdn: "{{ kolla_internal_fqdn }}"
+nova_metadata_external_fqdn: "{{ kolla_external_fqdn }}"
+nova_metadata_port: "8775"
+nova_metadata_listen_port: "{{ nova_metadata_port }}"
+nova_novncproxy_fqdn: "{{ kolla_external_fqdn }}"
+nova_novncproxy_port: "6080"
+nova_novncproxy_listen_port: "{{ nova_novncproxy_port }}"
+nova_novncproxy_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else nova_novncproxy_port }}"
+nova_spicehtml5proxy_fqdn: "{{ kolla_external_fqdn }}"
+nova_spicehtml5proxy_port: "6082"
+nova_spicehtml5proxy_listen_port: "{{ nova_spicehtml5proxy_port }}"
+nova_spicehtml5proxy_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else nova_spicehtml5proxy_port }}"
+nova_serialproxy_fqdn: "{{ kolla_external_fqdn }}"
+nova_serialproxy_port: "6083"
+nova_serialproxy_listen_port: "{{ nova_serialproxy_port }}"
+nova_serialproxy_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else nova_serialproxy_port }}"
+nova_serialproxy_protocol: "{{ 'wss' if kolla_enable_tls_external | bool else 'ws' }}"
diff --git a/ansible/group_vars/all/octavia.yml b/ansible/group_vars/all/octavia.yml
new file mode 100644
index 000000000..c0a152cf4
--- /dev/null
+++ b/ansible/group_vars/all/octavia.yml
@@ -0,0 +1,33 @@
+---
+enable_octavia: "no"
+enable_octavia_driver_agent: "{{ enable_octavia | bool and neutron_plugin_agent == 'ovn' }}"
+enable_octavia_jobboard: "{{ enable_octavia | bool and 'amphora' in octavia_provider_drivers }}"
+
+##########
+# Octavia
+##########
+# Whether to run Kolla-Ansible's automatic configuration for Octavia.
+# NOTE: if you upgrade from Ussuri, you must set `octavia_auto_configure` to `no`
+# and keep your other Octavia config like before.
+octavia_auto_configure: "{{ 'amphora' in octavia_provider_drivers }}"
+
+# Octavia network type options are [ tenant, provider ]
+# * tenant indicates that we will create a tenant network and a network
+#   interface on the Octavia worker nodes for communication with amphorae.
+# * provider indicates that we will create a flat or vlan provider network.
+#   In this case octavia_network_interface should be set to a network interface
+#   on the Octavia worker nodes on the same provider network.
+octavia_network_type: "provider"
+
+octavia_network_interface: "{{ 'o-hm0' if octavia_network_type == 'tenant' else api_interface }}"
+octavia_network_address_family: "{{ api_address_family }}"
+octavia_network_interface_address: "{{ 'octavia_network' | kolla_address }}"
+
+octavia_internal_fqdn: "{{ kolla_internal_fqdn }}"
+octavia_external_fqdn: "{{ kolla_external_fqdn }}"
+octavia_internal_endpoint: "{{ octavia_internal_fqdn | kolla_url(internal_protocol, octavia_api_port) }}"
+octavia_public_endpoint: "{{ octavia_external_fqdn | kolla_url(public_protocol, octavia_api_public_port) }}"
+octavia_api_port: "9876"
+octavia_api_listen_port: "{{ octavia_api_port }}"
+octavia_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else octavia_api_port }}"
+octavia_health_manager_port: "5555"
diff --git a/ansible/group_vars/all/opensearch.yml b/ansible/group_vars/all/opensearch.yml
new file mode 100644
index 000000000..21c208c67
--- /dev/null
+++ b/ansible/group_vars/all/opensearch.yml
@@ -0,0 +1,33 @@
+---
+####################
+# Logging options
+####################
+
+# NOTE: If an external ElasticSearch cluster address is configured, all
+# services with ElasticSearch endpoints should be configured to log
+# to the external cluster by default. This is for backwards compatibility.
+opensearch_address: "{{ elasticsearch_address if elasticsearch_address is defined else kolla_internal_fqdn }}"
+enable_opensearch: "{{ enable_central_logging | bool or enable_osprofiler | bool or (enable_cloudkitty | bool and cloudkitty_storage_backend == 'opensearch') }}"
+enable_opensearch_dashboards: "{{ enable_opensearch | bool }}"
+enable_opensearch_dashboards_external: "{{ enable_opensearch_dashboards | bool }}"
+
+#######################
+## Opensearch Options
+########################
+opensearch_datadir_volume: "opensearch"
+
+opensearch_internal_endpoint: "{{ opensearch_address | kolla_url(internal_protocol, opensearch_port) }}"
+opensearch_dashboards_internal_fqdn: "{{ kolla_internal_fqdn }}"
+opensearch_dashboards_external_fqdn: "{{ kolla_external_fqdn }}"
+opensearch_dashboards_internal_endpoint: "{{ opensearch_dashboards_internal_fqdn | kolla_url(internal_protocol, opensearch_dashboards_port) }}"
+opensearch_dashboards_external_endpoint: "{{ opensearch_dashboards_external_fqdn | kolla_url(public_protocol, opensearch_dashboards_port_external) }}"
+opensearch_dashboards_user: "opensearch"
+opensearch_log_index_prefix: "{{ kibana_log_prefix if kibana_log_prefix is defined else 'flog' }}"
+
+# NOTE: If an external ElasticSearch cluster port is specified,
+# we default to using that port in services with ElasticSearch
+# endpoints. This is for backwards compatibility.
+opensearch_port: "{{ elasticsearch_port | default('9200') }}"
+opensearch_dashboards_port: "5601"
+opensearch_dashboards_port_external: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else opensearch_dashboards_port }}"
+opensearch_dashboards_listen_port: "{{ opensearch_dashboards_port }}"
diff --git a/ansible/group_vars/all/openvswitch.yml b/ansible/group_vars/all/openvswitch.yml
new file mode 100644
index 000000000..68a813b43
--- /dev/null
+++ b/ansible/group_vars/all/openvswitch.yml
@@ -0,0 +1,14 @@
+---
+enable_openvswitch: "{{ enable_neutron | bool and neutron_plugin_agent != 'linuxbridge' }}"
+enable_ovs_dpdk: "no"
+
+ovs_datapath: "{{ 'netdev' if enable_ovs_dpdk | bool else 'system' }}"
+
+tunnel_address_family: "{{ network_address_family }}"
+dpdk_tunnel_address_family: "{{ network_address_family }}"
+tunnel_interface: "{{ network_interface }}"
+dpdk_tunnel_interface: "{{ neutron_external_interface }}"
+tunnel_interface_address: "{{ 'tunnel' | kolla_address }}"
+dpdk_tunnel_interface_address: "{{ 'dpdk_tunnel' | kolla_address }}"
+
+ovsdb_port: "6640"
diff --git a/ansible/group_vars/all/ovn.yml b/ansible/group_vars/all/ovn.yml
new file mode 100644
index 000000000..dc9b4b6e8
--- /dev/null
+++ b/ansible/group_vars/all/ovn.yml
@@ -0,0 +1,16 @@
+---
+enable_ovn: "{{ enable_neutron | bool and neutron_plugin_agent == 'ovn' }}"
+enable_ovn_sb_db_relay: "{{ enable_ovn | bool }}"
+
+ovn_nb_db_port: "6641"
+ovn_sb_db_port: "6642"
+# OVN SB Relay related variables
+ovn_sb_db_relay_count: "{{ ((groups['ovn-controller'] | length) / ovn_sb_db_relay_compute_per_relay | int) | round(0, 'ceil') | int }}"
+ovn_sb_db_relay_compute_per_relay: "50"
+ovn_sb_db_relay_port_prefix: "1664"
+ovn_sb_db_relay_port: "{{ ovn_sb_db_relay_port_prefix ~ ovn_sb_db_relay_client_group_id }}"
+ovn_sb_db_relay_client_group_id: "{{ range(1, ovn_sb_db_relay_count | int + 1) | random(seed=inventory_hostname) }}"
+ovn_nb_connection: "{% for host in groups['ovn-nb-db'] %}tcp:{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ ovn_nb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}"
+ovn_sb_connection: "{{ ovn_sb_connection_relay if enable_ovn_sb_db_relay | bool else ovn_sb_connection_no_relay }}"
+ovn_sb_connection_no_relay: "{% for host in groups['ovn-sb-db'] %}tcp:{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ ovn_sb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}"
+ovn_sb_connection_relay: "{% for host in groups['ovn-sb-db-relay'] %}tcp:{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ ovn_sb_db_relay_port }}{% if not loop.last %},{% endif %}{% endfor %}"
diff --git a/ansible/group_vars/all/placement.yml b/ansible/group_vars/all/placement.yml
new file mode 100644
index 000000000..4949393ea
--- /dev/null
+++ b/ansible/group_vars/all/placement.yml
@@ -0,0 +1,13 @@
+---
+enable_placement: "{{ enable_nova | bool or enable_zun | bool }}"
+
+placement_keystone_user: "placement"
+
+placement_internal_fqdn: "{{ kolla_internal_fqdn }}"
+placement_external_fqdn: "{{ kolla_external_fqdn }}"
+placement_internal_endpoint: "{{ placement_internal_fqdn | kolla_url(internal_protocol, placement_api_port) }}"
+placement_public_endpoint: "{{ placement_external_fqdn | kolla_url(public_protocol, placement_api_public_port) }}"
+# Default Placement API port of 8778 already in use
+placement_api_port: "8780"
+placement_api_listen_port: "{{ placement_api_port }}"
+placement_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else placement_api_port }}"
diff --git a/ansible/group_vars/all/prometheus.yml b/ansible/group_vars/all/prometheus.yml
new file mode 100644
index 000000000..e372bf642
--- /dev/null
+++ b/ansible/group_vars/all/prometheus.yml
@@ -0,0 +1,78 @@
+---
+enable_prometheus: "no"
+
+############
+# Prometheus
+############
+enable_prometheus_server: "{{ enable_prometheus | bool }}"
+enable_prometheus_haproxy_exporter: "{{ enable_haproxy | bool }}"
+enable_prometheus_mysqld_exporter: "{{ enable_mariadb | bool }}"
+enable_prometheus_node_exporter: "{{ enable_prometheus | bool }}"
+enable_prometheus_memcached_exporter: "{{ enable_memcached | bool }}"
+enable_prometheus_cadvisor: "{{ enable_prometheus | bool }}"
+enable_prometheus_fluentd_integration: "{{ enable_prometheus | bool and enable_fluentd | bool }}"
+enable_prometheus_alertmanager: "{{ enable_prometheus | bool }}"
+enable_prometheus_alertmanager_external: "{{ enable_prometheus_alertmanager | bool }}"
+enable_prometheus_ceph_mgr_exporter: "no"
+enable_prometheus_openstack_exporter: "{{ enable_prometheus | bool }}"
+enable_prometheus_openstack_exporter_external: "no"
+enable_prometheus_elasticsearch_exporter: "{{ enable_prometheus | bool and enable_opensearch | bool }}"
+enable_prometheus_blackbox_exporter: "{{ enable_prometheus | bool }}"
+enable_prometheus_rabbitmq_exporter: "{{ enable_prometheus | bool and enable_rabbitmq | bool }}"
+enable_prometheus_libvirt_exporter: "{{ enable_prometheus | bool and enable_nova | bool and nova_compute_virt_type in ['kvm', 'qemu'] }}"
+enable_prometheus_etcd_integration: "{{ enable_prometheus | bool and enable_etcd | bool }}"
+enable_prometheus_proxysql_exporter: "{{ enable_prometheus | bool and enable_proxysql | bool }}"
+
+prometheus_alertmanager_user: "admin"
+prometheus_ceph_exporter_interval: "{{ prometheus_scrape_interval }}"
+prometheus_grafana_user: "grafana"
+prometheus_haproxy_user: "haproxy"
+prometheus_skyline_user: "skyline"
+prometheus_scrape_interval: "60s"
+prometheus_openstack_exporter_interval: "{{ prometheus_scrape_interval }}"
+prometheus_openstack_exporter_timeout: "45s"
+prometheus_elasticsearch_exporter_interval: "{{ prometheus_scrape_interval }}"
+prometheus_cmdline_extras:
+prometheus_ceph_mgr_exporter_endpoints: []
+prometheus_openstack_exporter_endpoint_type: "internal"
+prometheus_openstack_exporter_compute_api_version: "latest"
+prometheus_libvirt_exporter_interval: "60s"
+
+prometheus_internal_fqdn: "{{ kolla_internal_fqdn }}"
+prometheus_external_fqdn: "{{ kolla_external_fqdn }}"
+prometheus_internal_endpoint: "{{ prometheus_internal_fqdn | kolla_url(internal_protocol, prometheus_port) }}"
+prometheus_public_endpoint: "{{ prometheus_external_fqdn | kolla_url(public_protocol, prometheus_public_port) }}"
+prometheus_port: "9091"
+prometheus_listen_port: "{{ prometheus_port }}"
+prometheus_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else prometheus_port }}"
+prometheus_node_exporter_port: "9100"
+prometheus_mysqld_exporter_port: "9104"
+prometheus_haproxy_exporter_port: "9101"
+prometheus_memcached_exporter_port: "9150"
+prometheus_rabbitmq_exporter_port: "{{ rabbitmq_prometheus_port }}"
+# Default cadvisor port of 8080 already in use
+prometheus_cadvisor_port: "18080"
+prometheus_fluentd_integration_port: "24231"
+prometheus_libvirt_exporter_port: "9177"
+prometheus_etcd_integration_port: "{{ etcd_client_port }}"
+proxysql_prometheus_exporter_port: "6070"
+
+# Prometheus alertmanager ports
+prometheus_alertmanager_internal_fqdn: "{{ kolla_internal_fqdn }}"
+prometheus_alertmanager_external_fqdn: "{{ kolla_external_fqdn }}"
+prometheus_alertmanager_internal_endpoint: "{{ prometheus_alertmanager_internal_fqdn | kolla_url(internal_protocol, prometheus_alertmanager_port) }}"
+prometheus_alertmanager_public_endpoint: "{{ prometheus_alertmanager_external_fqdn | kolla_url(public_protocol, prometheus_alertmanager_public_port) }}"
+prometheus_alertmanager_port: "9093"
+prometheus_alertmanager_cluster_port: "9094"
+prometheus_alertmanager_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else prometheus_alertmanager_port }}"
+prometheus_alertmanager_listen_port: "{{ prometheus_alertmanager_port }}"
+
+# Prometheus openstack-exporter ports
+prometheus_openstack_exporter_port: "9198"
+prometheus_elasticsearch_exporter_port: "9108"
+
+# Prometheus blackbox-exporter ports
+prometheus_blackbox_exporter_port: "9115"
+
+# Prometheus instance label to use for metrics
+prometheus_instance_label:
diff --git a/ansible/group_vars/all/proxysql.yml b/ansible/group_vars/all/proxysql.yml
new file mode 100644
index 000000000..822483d09
--- /dev/null
+++ b/ansible/group_vars/all/proxysql.yml
@@ -0,0 +1,4 @@
+---
+enable_proxysql: "yes"
+
+proxysql_admin_port: "6032"
diff --git a/ansible/group_vars/all/rabbitmq.yml b/ansible/group_vars/all/rabbitmq.yml
new file mode 100644
index 000000000..4773c1444
--- /dev/null
+++ b/ansible/group_vars/all/rabbitmq.yml
@@ -0,0 +1,19 @@
+---
+enable_rabbitmq: "{{ 'yes' if om_rpc_transport == 'rabbit' or om_notify_transport == 'rabbit' else 'no' }}"
+
+####################
+# RabbitMQ options
+####################
+rabbitmq_user: "openstack"
+rabbitmq_monitoring_user: ""
+# Whether to enable TLS encryption for RabbitMQ client-server communication.
+rabbitmq_enable_tls: "no"
+# CA certificate bundle in RabbitMQ container.
+rabbitmq_cacert: "/etc/ssl/certs/{{ 'ca-certificates.crt' if kolla_base_distro in ['debian', 'ubuntu'] else 'ca-bundle.crt' }}"
+rabbitmq_datadir_volume: "rabbitmq"
+
+rabbitmq_port: "{{ '5671' if rabbitmq_enable_tls | bool else '5672' }}"
+rabbitmq_management_port: "15672"
+rabbitmq_cluster_port: "25672"
+rabbitmq_epmd_port: "4369"
+rabbitmq_prometheus_port: "15692"
diff --git a/ansible/group_vars/all/redis.yml b/ansible/group_vars/all/redis.yml
new file mode 100644
index 000000000..bea98be6e
--- /dev/null
+++ b/ansible/group_vars/all/redis.yml
@@ -0,0 +1,11 @@
+---
+enable_redis: "no"
+
+####################
+# Redis options
+####################
+redis_connection_string: "redis://{% for host in groups['redis'] %}{% if host == groups['redis'][0] %}default:{{ redis_master_password }}@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ redis_sentinel_port }}?sentinel=kolla{% else %}&sentinel_fallback={{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ redis_sentinel_port }}{% endif %}{% endfor %}{{ redis_connection_string_extras }}"
+redis_connection_string_extras: "&db=0&socket_timeout=60&retry_on_timeout=yes"
+
+redis_port: "6379"
+redis_sentinel_port: "26379"
diff --git a/ansible/group_vars/all/s3.yml b/ansible/group_vars/all/s3.yml
new file mode 100644
index 000000000..c42e45931
--- /dev/null
+++ b/ansible/group_vars/all/s3.yml
@@ -0,0 +1,7 @@
+---
+#############
+# Common options for S3 Cinder Backup and Glance S3 backend.
+s3_url:
+s3_bucket:
+s3_access_key:
+s3_secret_key:
diff --git a/ansible/group_vars/all/skyline.yml b/ansible/group_vars/all/skyline.yml
new file mode 100644
index 000000000..56225268a
--- /dev/null
+++ b/ansible/group_vars/all/skyline.yml
@@ -0,0 +1,18 @@
+---
+enable_skyline: "no"
+
+skyline_apiserver_internal_fqdn: "{{ kolla_internal_fqdn }}"
+skyline_apiserver_external_fqdn: "{{ kolla_external_fqdn }}"
+skyline_apiserver_internal_endpoint: "{{ skyline_apiserver_internal_fqdn | kolla_url(internal_protocol, skyline_apiserver_port) }}"
+skyline_apiserver_public_endpoint: "{{ skyline_apiserver_external_fqdn | kolla_url(public_protocol, skyline_apiserver_public_port) }}"
+skyline_console_internal_fqdn: "{{ kolla_internal_fqdn }}"
+skyline_console_external_fqdn: "{{ kolla_external_fqdn }}"
+skyline_console_internal_endpoint: "{{ skyline_console_internal_fqdn | kolla_url(internal_protocol, skyline_console_port) }}"
+skyline_console_public_endpoint: "{{ skyline_console_external_fqdn | kolla_url(public_protocol, skyline_console_public_port) }}"
+skyline_apiserver_port: "9998"
+skyline_apiserver_listen_port: "{{ skyline_apiserver_port }}"
+skyline_apiserver_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else skyline_apiserver_port }}"
+skyline_console_port: "9999"
+skyline_console_listen_port: "{{ skyline_console_port }}"
+skyline_console_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else skyline_console_port }}"
+skyline_enable_sso: "{{ enable_keystone_federation | bool and keystone_identity_providers | selectattr('protocol', 'equalto', 'openid') | list | count > 0 }}"
diff --git a/ansible/group_vars/all/tacker.yml b/ansible/group_vars/all/tacker.yml
new file mode 100644
index 000000000..936f5fbea
--- /dev/null
+++ b/ansible/group_vars/all/tacker.yml
@@ -0,0 +1,10 @@
+---
+enable_tacker: "no"
+
+tacker_internal_fqdn: "{{ kolla_internal_fqdn }}"
+tacker_external_fqdn: "{{ kolla_external_fqdn }}"
+tacker_internal_endpoint: "{{ tacker_internal_fqdn | kolla_url(internal_protocol, tacker_server_port) }}"
+tacker_public_endpoint: "{{ tacker_external_fqdn | kolla_url(public_protocol, tacker_server_public_port) }}"
+tacker_server_port: "9890"
+tacker_server_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else tacker_server_port }}"
+tacker_server_listen_port: "{{ tacker_server_port }}"
diff --git a/ansible/group_vars/all/telegraf.yml b/ansible/group_vars/all/telegraf.yml
new file mode 100644
index 000000000..1ad350fd9
--- /dev/null
+++ b/ansible/group_vars/all/telegraf.yml
@@ -0,0 +1,9 @@
+---
+enable_telegraf: "no"
+
+##########
+# Telegraf
+##########
+# Configure telegraf to use the docker daemon itself as an input for
+# telemetry data.
+telegraf_enable_docker_input: "no"
diff --git a/ansible/group_vars/all/trove.yml b/ansible/group_vars/all/trove.yml
new file mode 100644
index 000000000..420efad5e
--- /dev/null
+++ b/ansible/group_vars/all/trove.yml
@@ -0,0 +1,11 @@
+---
+enable_trove: "no"
+enable_trove_singletenant: "no"
+
+trove_internal_fqdn: "{{ kolla_internal_fqdn }}"
+trove_external_fqdn: "{{ kolla_external_fqdn }}"
+trove_internal_base_endpoint: "{{ trove_internal_fqdn | kolla_url(internal_protocol, trove_api_port) }}"
+trove_public_base_endpoint: "{{ trove_external_fqdn | kolla_url(public_protocol, trove_api_public_port) }}"
+trove_api_port: "8779"
+trove_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else trove_api_port }}"
+trove_api_listen_port: "{{ trove_api_port }}"
diff --git a/ansible/group_vars/all/venus.yml b/ansible/group_vars/all/venus.yml
new file mode 100644
index 000000000..85908647b
--- /dev/null
+++ b/ansible/group_vars/all/venus.yml
@@ -0,0 +1,10 @@
+---
+enable_venus: "no"
+
+venus_internal_fqdn: "{{ kolla_internal_fqdn }}"
+venus_external_fqdn: "{{ kolla_external_fqdn }}"
+venus_internal_endpoint: "{{ venus_internal_fqdn | kolla_url(internal_protocol, venus_api_port) }}"
+venus_public_endpoint: "{{ venus_external_fqdn | kolla_url(public_protocol, venus_api_public_port) }}"
+venus_api_port: "10010"
+venus_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else venus_api_port }}"
+venus_api_listen_port: "{{ venus_api_port }}"
diff --git a/ansible/group_vars/all/watcher.yml b/ansible/group_vars/all/watcher.yml
new file mode 100644
index 000000000..87d919c8f
--- /dev/null
+++ b/ansible/group_vars/all/watcher.yml
@@ -0,0 +1,10 @@
+---
+enable_watcher: "no"
+
+watcher_internal_fqdn: "{{ kolla_internal_fqdn }}"
+watcher_external_fqdn: "{{ kolla_external_fqdn }}"
+watcher_internal_endpoint: "{{ watcher_internal_fqdn | kolla_url(internal_protocol, watcher_api_port) }}"
+watcher_public_endpoint: "{{ watcher_external_fqdn | kolla_url(public_protocol, watcher_api_public_port) }}"
+watcher_api_port: "9322"
+watcher_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else watcher_api_port }}"
+watcher_api_listen_port: "{{ watcher_api_port }}"
diff --git a/ansible/group_vars/all/zun.yml b/ansible/group_vars/all/zun.yml
new file mode 100644
index 000000000..ed10ea546
--- /dev/null
+++ b/ansible/group_vars/all/zun.yml
@@ -0,0 +1,31 @@
+---
+enable_zun: "no"
+
+# Extra docker options for Zun
+docker_configure_for_zun: "no"
+docker_zun_options: -H tcp://{{ api_interface_address | put_address_in_context('url') }}:2375
+docker_zun_config: {}
+
+# Extra containerd options for Zun
+containerd_configure_for_zun: "no"
+
+# Enable Ceph backed Cinder Volumes for zun
+zun_configure_for_cinder_ceph: "no"
+
+# 42463 is the static group id of the zun user in the Zun image.
+# If users customize this value on building the Zun images,
+# they need to change this config accordingly.
+containerd_grpc_gid: 42463
+
+zun_api_port: "9517"
+zun_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else zun_api_port }}"
+zun_api_listen_port: "{{ zun_api_port }}"
+zun_wsproxy_internal_fqdn: "{{ kolla_internal_fqdn }}"
+zun_wsproxy_external_fqdn: "{{ kolla_external_fqdn }}"
+zun_wsproxy_port: "6784"
+zun_wsproxy_protocol: "{{ 'wss' if kolla_enable_tls_external | bool else 'ws' }}"
+zun_cni_daemon_port: "9036"
+zun_internal_fqdn: "{{ kolla_internal_fqdn }}"
+zun_external_fqdn: "{{ kolla_external_fqdn }}"
+zun_internal_base_endpoint: "{{ zun_internal_fqdn | kolla_url(internal_protocol, zun_api_port) }}"
+zun_public_base_endpoint: "{{ zun_external_fqdn | kolla_url(public_protocol, zun_api_public_port) }}"
diff --git a/ansible/group_vars/baremetal.yml b/ansible/group_vars/baremetal/ansible-python-interpreter.yml
index 00d4ef5ba..00d4ef5ba 100644
--- a/ansible/group_vars/baremetal.yml
+++ b/ansible/group_vars/baremetal/ansible-python-interpreter.yml
diff --git a/ansible/module_utils/kolla_podman_worker.py b/ansible/module_utils/kolla_podman_worker.py
index 2f323eff2..f26846ded 100644
--- a/ansible/module_utils/kolla_podman_worker.py
+++ b/ansible/module_utils/kolla_podman_worker.py
@@ -220,7 +220,7 @@ class PodmanWorker(ContainerWorker):
             # NOTE(m.hiner): default ulimits have to be filtered out because
             # Podman would treat them as new ulimits and break the container
             # as a result. Names are a copy of
-            # default_podman_dimensions_el9 in /ansible/group_vars/all.yml
+            # default_podman_dimensions_el9 in group_vars
             for name in ['RLIMIT_NOFILE', 'RLIMIT_NPROC']:
                 ulimits.pop(name, None)
 
diff --git a/doc/source/reference/containers/kuryr-guide.rst b/doc/source/reference/containers/kuryr-guide.rst
index fbcbfd419..f748d16c5 100644
--- a/doc/source/reference/containers/kuryr-guide.rst
+++ b/doc/source/reference/containers/kuryr-guide.rst
@@ -26,7 +26,8 @@ The IP address is host running the etcd service. ```2375``` is port that
 allows Docker daemon to be accessed remotely. ```2379``` is the etcd listening
 port.
 
-By default etcd and kuryr are disabled in the ``group_vars/all.yml``.
+By default etcd and kuryr are disabled in the ``group_vars/all/etcd.yml`` and
+``group_vars/all/kuryr.yml`` files.
 In order to enable them, you need to edit the file globals.yml and set the
 following variables
 
diff --git a/doc/source/reference/databases/mariadb-guide.rst b/doc/source/reference/databases/mariadb-guide.rst
index 71b51f77c..e34e4bf0a 100644
--- a/doc/source/reference/databases/mariadb-guide.rst
+++ b/doc/source/reference/databases/mariadb-guide.rst
@@ -52,9 +52,9 @@ inventory file in the way described below:
 .. note::
 
    If ``mariadb_shard_id`` is not defined for host in inventory file it will be set automatically
-   to ``mariadb_default_database_shard_id`` (default 0) from ``group_vars/all.yml`` and can be
-   overwritten in ``/etc/kolla/globals.yml``. Shard which is marked as default is special in case
-   of backup or loadbalance, as it is described below.
+   to ``mariadb_default_database_shard_id`` (default 0) from ``group_vars/all/mariadb.yml`` and
+   can be overwritten in ``/etc/kolla/globals.yml``. Shard which is marked as default is
+   special in case of backup or loadbalance, as it is described below.
 
 Loadbalancer
 ------------
diff --git a/doc/source/reference/orchestration-and-nfv/tacker-guide.rst b/doc/source/reference/orchestration-and-nfv/tacker-guide.rst
index 78fdf4821..4c99e72e1 100644
--- a/doc/source/reference/orchestration-and-nfv/tacker-guide.rst
+++ b/doc/source/reference/orchestration-and-nfv/tacker-guide.rst
@@ -30,7 +30,7 @@ Preparation and Deployment
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 By default tacker and required services are disabled in
-the ``group_vars/all.yml`` file.
+the ``group_vars/all/tacker.yml`` file.
 In order to enable them, you need to edit the file
 ``/etc/kolla/globals.yml`` and set the following variables:
 
diff --git a/doc/source/user/multinode.rst b/doc/source/user/multinode.rst
index 21bf67fa4..5a0db7cf2 100644
--- a/doc/source/user/multinode.rst
+++ b/doc/source/user/multinode.rst
@@ -136,7 +136,7 @@ host or group variables:
 <https://docs.ansible.com/ansible/latest/user_guide/playbooks_variables.html#ansible-variable-precedence>`__
 are quite complex, but it is worth becoming familiar with them if using host
 and group variables. The playbook group variables in
-``ansible/group_vars/all.yml`` define global defaults, and these take
+``ansible/group_vars/all/`` define global defaults, and these take
 precedence over variables defined in an inventory file and inventory
 ``group_vars/all``, but not over inventory ``group_vars/*``. Variables in
 'extra' files (``globals.yml``) have the highest precedence, so any variables
diff --git a/doc/source/user/troubleshooting.rst b/doc/source/user/troubleshooting.rst
index d00a94ca7..76a9ac604 100644
--- a/doc/source/user/troubleshooting.rst
+++ b/doc/source/user/troubleshooting.rst
@@ -88,13 +88,13 @@ You can find all kolla logs in there.
    /var/lib/docker/volumes/kolla_logs/_data
 
 When ``enable_central_logging`` is enabled, to view the logs in a web browser
-using Kibana, go to
-``http://<kolla_internal_vip_address>:<kibana_server_port>`` or
-``http://<kolla_external_vip_address>:<kibana_server_port>``. Authenticate
-using ``<kibana_user>`` and ``<kibana_password>``.
+using OpenSearch Dashboards, go to
+``http://<kolla_internal_vip_address>:<opensearch_dashboards_port>`` or
+``http://<kolla_external_vip_address>:<opensearch_dashboards_port>``. Authenticate
+using ``opensearch`` and ``<opensearch_dashboards_password>``.
 
 The values ``<kolla_internal_vip_address>``, ``<kolla_external_vip_address>``
-``<kibana_server_port>`` and ``<kibana_user>`` can be found in
-``<kolla_install_path>/kolla/ansible/group_vars/all.yml`` or if the default
-values are overridden, in ``/etc/kolla/globals.yml``. The value of
-``<kibana_password>`` can be found in ``/etc/kolla/passwords.yml``.
+``<opensearch_dashboards_port>`` can be found in
+``<kolla_install_path>/kolla/ansible/group_vars/all/opensearch.yml``. The value
+of ``<opensearch_dashboards_password>`` can be found in
+``/etc/kolla/passwords.yml``.
diff --git a/etc/kolla/globals.yml b/etc/kolla/globals.yml
index cb0e651d5..9d4f00a0a 100644
--- a/etc/kolla/globals.yml
+++ b/etc/kolla/globals.yml
@@ -1,7 +1,7 @@
 ---
 # You can use this file to override _any_ variable throughout Kolla.
 # Additional options can be found in the
-# 'kolla-ansible/ansible/group_vars/all.yml' file. Default value of all the
+# 'kolla-ansible/ansible/group_vars/all' directory. Default value of all the
 # commented parameters are shown here, To override the default value uncomment
 # the parameter and change its value.
 
diff --git a/zuul.d/base.yaml b/zuul.d/base.yaml
index 4d9d263dd..13db98ca6 100644
--- a/zuul.d/base.yaml
+++ b/zuul.d/base.yaml
@@ -91,7 +91,7 @@
     parent: kolla-ansible-base
     name: kolla-ansible-scenario-base
     files:
-      - ^ansible/group_vars/all.yml
+      - ^ansible/group_vars/all/(baremetal|common|fluentd|glance|heat|horizon|keepalived|keystone|loadbalancer|neutron|nova|openvswitch|placement|proxysql|rabbitmq).yml
       - ^ansible/roles/common/
       - ^requirements-core.yml
       - ^tests/check-logs.sh