diff options
| -rw-r--r-- | ansible/roles/loadbalancer/templates/haproxy/haproxy.json.j2 | 3 | ||||
| -rw-r--r-- | kolla_ansible/cli/commands.py | 36 | ||||
| -rw-r--r-- | releasenotes/notes/prelude-2026-1-8c2eb8f328c8dd14.yaml | 95 |
3 files changed, 125 insertions, 9 deletions
diff --git a/ansible/roles/loadbalancer/templates/haproxy/haproxy.json.j2 b/ansible/roles/loadbalancer/templates/haproxy/haproxy.json.j2 index ab19dee27..05b892626 100644 --- a/ansible/roles/loadbalancer/templates/haproxy/haproxy.json.j2 +++ b/ansible/roles/loadbalancer/templates/haproxy/haproxy.json.j2 @@ -39,8 +39,7 @@ "owner": "haproxy", "perm": "0600", "optional": {{ (not kolla_enable_tls_internal | bool) | string | lower }} - } - {% endif %}{% if kolla_copy_ca_into_containers | bool %}, + }{% endif %}{% if kolla_copy_ca_into_containers | bool %}, { "source": "{{ container_config_directory }}/ca-certificates", "dest": "/var/lib/kolla/share/ca-certificates", diff --git a/kolla_ansible/cli/commands.py b/kolla_ansible/cli/commands.py index 15e82f02c..b36601831 100644 --- a/kolla_ansible/cli/commands.py +++ b/kolla_ansible/cli/commands.py @@ -83,9 +83,12 @@ class GatherFacts(KollaAnsibleMixin, Command): def take_action(self, parsed_args): self.app.LOG.info("Gathering Ansible facts") + extra_vars = {} + extra_vars["kolla_action"] = "gather-facts" + playbooks = _choose_playbooks(parsed_args, "gather-facts") - self.run_playbooks(parsed_args, playbooks) + self.run_playbooks(parsed_args, playbooks, extra_vars=extra_vars) class InstallDeps(KollaAnsibleMixin, Command): @@ -202,9 +205,12 @@ class Certificates(KollaAnsibleMixin, Command): def take_action(self, parsed_args): self.app.LOG.info("Generate TLS Certificates") + extra_vars = {} + extra_vars["kolla_action"] = "certificates" + playbooks = _choose_playbooks(parsed_args, "certificates") - self.run_playbooks(parsed_args, playbooks) + self.run_playbooks(parsed_args, playbooks, extra_vars=extra_vars) class OctaviaCertificates(KollaAnsibleMixin, Command): @@ -223,6 +229,7 @@ class OctaviaCertificates(KollaAnsibleMixin, Command): def take_action(self, parsed_args): extra_vars = { + "kolla_action": "octavia-certificates", "ansible_python_interpreter": sys.executable } @@ -274,9 +281,12 @@ class Postdeploy(KollaAnsibleMixin, Command): def take_action(self, parsed_args): self.app.LOG.info("Post-Deploying Playbooks") + extra_vars = {} + extra_vars["kolla_action"] = "post-deploy" + playbooks = _choose_playbooks(parsed_args, "post-deploy") - self.run_playbooks(parsed_args, playbooks) + self.run_playbooks(parsed_args, playbooks, extra_vars=extra_vars) class Upgrade(KollaAnsibleMixin, Command): @@ -388,9 +398,12 @@ class PruneImages(KollaAnsibleMixin, Command): def take_action(self, parsed_args): self.app.LOG.info("Prune orphaned Kolla images") + extra_vars = {} + extra_vars["kolla_action"] = "prune-images" + playbooks = _choose_playbooks(parsed_args, "prune-images") - self.run_playbooks(parsed_args, playbooks) + self.run_playbooks(parsed_args, playbooks, extra_vars=extra_vars) class BifrostDeploy(KollaAnsibleMixin, Command): @@ -441,9 +454,12 @@ class RabbitMQResetState(KollaAnsibleMixin, Command): def take_action(self, parsed_args): self.app.LOG.info("Force reset the state of RabbitMQ") + extra_vars = {} + extra_vars["kolla_action"] = "rabbitmq-reset-state" + playbooks = _choose_playbooks(parsed_args, "rabbitmq-reset-state") - self.run_playbooks(parsed_args, playbooks) + self.run_playbooks(parsed_args, playbooks, extra_vars=extra_vars) class MariaDBBackup(KollaAnsibleMixin, Command): @@ -499,9 +515,12 @@ class NovaLibvirtCleanup(KollaAnsibleMixin, Command): def take_action(self, parsed_args): self.app.LOG.info("Cleanup disabled nova_libvirt containers") + extra_vars = {} + extra_vars["kolla_action"] = "nova-libvirt-cleanup" + playbooks = _choose_playbooks(parsed_args, "nova-libvirt-cleanup") - self.run_playbooks(parsed_args, playbooks) + self.run_playbooks(parsed_args, playbooks, extra_vars=extra_vars) class Check(KollaAnsibleMixin, Command): @@ -526,6 +545,9 @@ class MigrateContainerEngine(KollaAnsibleMixin, Command): "Migrate the container engine of the deployed Openstack" ) + extra_vars = {} + extra_vars["kolla_action"] = "migrate-container-engine" + playbooks = _choose_playbooks(parsed_args, "migrate-container-engine") - self.run_playbooks(parsed_args, playbooks) + self.run_playbooks(parsed_args, playbooks, extra_vars=extra_vars) diff --git a/releasenotes/notes/prelude-2026-1-8c2eb8f328c8dd14.yaml b/releasenotes/notes/prelude-2026-1-8c2eb8f328c8dd14.yaml new file mode 100644 index 000000000..58131554a --- /dev/null +++ b/releasenotes/notes/prelude-2026-1-8c2eb8f328c8dd14.yaml @@ -0,0 +1,95 @@ +--- +prelude: | + The Kolla Ansible ``22.0.0`` (Prelude) release continues the momentum of + the previous cycle with a strong focus on service modernisation, role + restructuring, and operator quality-of-life improvements. Highlights + include: + + * **Service retirements and removals.** + + - ``Zun`` and ``Kuryr`` dropped (``Zun`` is broken in 2026.1). + - ``InfluxDB`` (community EOL v1) and ``Telegraf`` removed. + - ``Venus`` removed due to the project being inactive. + - ``Neutron`` Linux Bridge mechanism driver support removed following + its upstream retirement. + + * **Role restructuring.** + + - The ``common`` role has been renamed to ``kolla_toolbox`` (inventory + group ``kolla-toolbox`` → ``kolla_toolbox``). + - Log-rotation tasks extracted into a dedicated ``cron`` role. + - Log collection tasks extracted into a dedicated ``kolla_logs`` role. + - Host bootstrap tasks moved into ``ansible-collection-kolla``. + + * **Unified uWSGI for all API services.** + + - All OpenStack API services now run under uWSGI using the shared + ``service-uwsgi-config`` role, dropping Apache WSGI support entirely. + - The remaining services (``Barbican``, ``Designate``, ``Glance``, and + ``Magnum``) have been migrated in this cycle. + - The now-unnecessary ``glance-tls-proxy`` container is removed during + upgrade. + - HTTP chunked input and configurable thread counts are available to all + uWSGI services. + + * **RabbitMQ 4.2 support and upgrade paths.** + + - Dynamic upgrade path validation via ``rabbitmq_allowed_upgrades`` and + seamless 4.2 upgrade paths are provided out of the box. + - Management interface TLS support via ``rabbitmq_enable_tls``. + - Stream retention policy configurable via + ``rabbitmq_stream_max_segment_size_bytes`` and + ``rabbitmq_stream_segment_max_age``. + + * **Cinder deployment group changes.** + + - ``cinder-volume`` and ``cinder-backup`` now default to the ``cinder`` + (control) group instead of ``storage``. + - New inventory groups ``cinder-volume-lvm``, ``cinder-volume-multiple``, + ``cinder-backup-lvm``, and ``cinder-backup-multiple`` support advanced + LVM back-end topologies. + + * **Neutron and OVN enhancements.** + + - ``neutron-ovn-vpn-agent`` is now deployable to enable VPNaaS in OVN + environments. + - Neutron agent wrappers are enabled by default, allowing DHCP and L3 + agents to restart without disturbing the main container processes and + reducing dataplane disruption. + - OVN metadata-agent HAProxy processes run in separate wrapper containers. + - ``ovn-northd`` command-line arguments and OVN DB environment variables + are configurable. + + * **Observability additions.** + + - New ``OpenStack Network Exporter`` for Prometheus gathers OVS/OVN + metrics. + - ``Valkey Exporter`` for Prometheus is now supported. + - Grafana gains an Alertmanager datasource and optional LDAP + authentication. + - ``OpenSearch Dashboards`` index patterns are created automatically. + - ``Fluentd`` ships logs directly to OpenSearch node IPs and + ``OpenSearch Dashboards`` connects directly to data nodes, removing + intermediate HAProxy hops. + - API health-check endpoints have been standardised across all services. + + * **Ironic improvements.** + + - Multiple Nova Compute Ironic instances on the same host are now + supported for large bare-metal deployments. + - The experimental ``ironic-pxe-filter`` service is available. + - Legacy (non-rolling) Ironic upgrade support has been dropped. + - DNS configuration can now be supplied through Ironic DHCP ranges for + IPA NTP and FQDN endpoint reachability. + + * **Security hardening.** + + - HAProxy TLS settings hardened to follow Mozilla SSL Modern + recommendations for HAProxy 2.8+ / OpenSSL 3.x. + - ``Skyline`` gains TLS 1.2/1.3 support for HTTPS upstream endpoints. + - Keystone ``mod_auth_openidc`` now supports templated OIDC metadata + files and customisable authentication error pages. + + * **Ansible version bump.** The minimum supported version is now Ansible + ``12`` (ansible-core 2.19) and the maximum is Ansible ``13`` + (ansible-core 2.20). |