kolla-ansible: migrate redis password to valkey in mergepwd

When migrating from Redis to Valkey, 'valkey_master_password' is
introduced as a new requirement. During an upgrade, 'kolla-mergepwd'
previously left the newly generated random password for Valkey,
ignoring the existing Redis password.

This caused critical authentication failures. Specifically, for users
utilizing custom Keystone caching solutions, starting Valkey with a new
password would seriously damage the entire cluster. Furthermore, in
standard upgrades, Octavia stops working due to the password change,
leaving the service unstable until the upgrade is complete.

This patch updates 'mergepwd.py' to detect when 'valkey_master_password'
is a new entry and automatically assigns it the value of the existing
'redis_master_password'. This ensures a seamless transition and
maintains cloud stability during the Redis-to-Valkey migration.

Closes-Bug: #2138461
Change-Id: Id0eb88e739c44016a0bd118793f81ff66a624655
Signed-off-by: Piotr Milewski <vurmil@gmail.com>

1 files changed, 10 insertions, 0 deletions

diff --git a/kolla_ansible/cmd/mergepwd.py b/kolla_ansible/cmd/mergepwd.py
index 00f38d976..fa99f57fb 100755
--- a/kolla_ansible/cmd/mergepwd.py
+++ b/kolla_ansible/cmd/mergepwd.py
@@ -46,6 +46,16 @@ def mergepwd(old, new, final, clean=False):
         print("ERROR: New passwords file not in expected key/value format")
         sys.exit(1)
 
+    # TODO(vurmil): Remove in H/2026.2 release as Redis migration is
+    # no longer required
+    if 'valkey_master_password' in new_passwords and \
+       'redis_master_password' in old_passwords and \
+       'valkey_master_password' not in old_passwords:
+
+        old_redis_pass = old_passwords.get('redis_master_password')
+        if old_redis_pass:
+            new_passwords['valkey_master_password'] = old_redis_pass
+
     if clean:
         # keep only new keys
         for key in new_passwords: