aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2026-04-16Add OpenStack Network Exporter for PrometheusDoug Szumski21-0/+153
This is for gathering OVS/OVN related metrics. See: https://github.com/openstack-k8s-operators/openstack-network-exporter Depends-On: https://review.opendev.org/c/openstack/kolla/+/951971 Change-Id: I5752b3fe6457dcf2f191326a85c548584b5675b1 Signed-off-by: Doug Szumski <doug@stackhpc.com>
2026-04-15Merge "Fix keystone with IDP configured."Zuul15-198/+609
2026-04-15Merge "kolla-toolbox: Template clouds.yaml and use it"Zuul23-98/+225
2026-04-15Fix keystone with IDP configured.Taavi Ansper15-198/+609
1. Add CI coverage for keystone_identity_providers under federation scenario. 2. Add fix for federation config in keystone role if keystone_identity_providers is defined. 3. Update Horizon tests with federation example. 4. Use openstack.cloud ansible modules instead of python-openstackclient in register_identity_providers.yml Closes-Bug: #2134455 Change-Id: Id03bc5770c3856c7c09a34e327b33786d7b7d859 Signed-off-by: Taavi Ansper <taaviansperr@gmail.com>
2026-04-15kolla-toolbox: Template clouds.yaml and use itMichal Nasiadka23-98/+225
Basically Ansible heuristic obfuscation methods mark auth: that we pass to openstack.* modules as no_log_values and then obfuscates it's values in other runs (which then end up as **** e.g. auth_url, domain_id, domain name, etc) Example return: "domains": [ { "description": "The ******** domain", "id": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER", "is_enabled": true, "links": { "self": "********/v3/domains/********" }, "name": "Default", "options": {}, "tags": [] } This patch adds clouds.yaml to files templated for kolla-toolbox (but without the password) and only uses password from Kolla-Ansible secrets instead of storing that on disk on all of the nodes. Change-Id: I479445563d5b5dc2e45601e936d89def647da841 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-15CI: Exclude rbd secrets from leak checkMichal Nasiadka1-0/+4
Change-Id: I0d9a62e3ade10fc8735500a8ecb068e8108b90c1 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-15Merge "common: Rename role to kolla_toolbox"Zuul27-61/+61
2026-04-14common: Rename role to kolla_toolboxMichal Nasiadka27-61/+61
Renaming it to kolla_toolbox to comply with Ansible Galaxy role naming standard Change-Id: I5e3cbcd5e8028574eeab148f1e2222378f121a22 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-14CI: Add more passwords to leak check exceptionsMichal Nasiadka1-0/+10
These are from other CI jobs that AIO and cephadm Change-Id: I127d1717eaa662919431c69520378f17f6804133 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-14Merge "Break out clouds.yaml/openrc creation from common role"Zuul8-5/+8
2026-04-14Merge "CI: Bump wsrep_slave_threads to 8"Zuul2-0/+2
2026-04-14Merge "CI: Test for leaked passwords in syslog"Zuul5-0/+441
2026-04-14CI: Bump wsrep_slave_threads to 8Michal Nasiadka2-0/+2
We sometimes get mariadb healthcheck issues in CI (check-failure phase) where MariaDB has IST transfer failure in the logs that would require a restart of MariaDB node - let's try bumping wsrep_slave_threads to have the IST finish faster and be less prone on network/cpu issues. Change-Id: I0fdc8a42f282dfa8b7b0e7d5e1a297000f294c7d Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-14Break out clouds.yaml/openrc creation from common roleMichal Nasiadka8-5/+8
It currently only holds kolla-toolbox and due to introducing clouds.yaml for kolla-toolbox usage we should separate these two for readability. Change-Id: I0b4d3b8ab199260cd5087c10cf916f9d43f346cc Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-14Fix Prometheus scraping for ProxySQL and ValkeyPiotr Milewski2-20/+28
The configuration for ProxySQL and Valkey exporters was incorrectly nested inside the 'enable_prometheus_alertmanager' block. This caused the scrape jobs to be missing from prometheus.yml when Alertmanager was disabled, even if the exporters themselves were enabled. This commit moves these exporter blocks outside the Alertmanager conditional to ensure metrics are collected independently. Closes-Bug: #2148279 Change-Id: Ib4ac95cfce2272529cdc8b98c40dc7f21c50e27f Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-04-13Stop setting ha_vrrp_health_check_interval by defaultJohn Garbutt2-3/+8
When there are a moderate number of l3 routers, we have been unable to find a safe value for ha_vrrp_health_check_interval. As such, lets keep the default value of zero for all cases. Note this does not affect the VRRP based checks that keepalived is already doing. But it also means no one is checking the gateway is up. Although its unclear what extra benefit this would bring. Change-Id: If5d0054ecb3e4d73d9d6e533e71ce44e6b55220d Signed-off-by: John Garbutt <john.garbutt@stackhpc.com>
2026-04-13CI: Test for leaked passwords in syslogMichal Nasiadka5-0/+441
Change-Id: I611a61dc90aa6e1aa16971e2dd17a959f7587947 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-12Fix: Update outdated documentationPiotr Milewski39-127/+130
Change-Id: I5dc53f74afd9a5b565201dc9d3039d82cb65dabc Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-04-12Standardize API health check endpointsPiotr Milewski30-57/+225
Configure dedicated health check endpoints for Load Balancers Standardize health check paths in OpenStack and Grafana Ansible defaults to improve Load Balancer (HAProxy) reliability. The 'httpchk' configuration for the modified roles now uses dedicated health check endpoints (e.g., /healthcheck or /api/health) and enforces an HTTP 200 OK expectation. This ensures faster and more robust failure detection. Additionally, by moving health checks away from generic endpoints (such as OPTIONS /), application logs are now much cleaner. The log files will no longer be flooded every second with HAProxy probe entries like: "OPTIONS / HTTP/1.0" 200 94 0.000954 NOTE: The following services are exceptions to this standardization and still use the root endpoint (`/`) for health checks due to the lack of a dedicated health check middleware in their default API paste configuration: **cyborg_api**, **masakari**, **mistral_api**, **nova_api**, **octavia_api**, **placement**, **tacker**, **venus**, and **watcher**. Updated roles: * aodh * barbican * cinder * cloudkitty * cyborg * designate * etcd * glance * gnocchi * grafana * heat * horizon * influxdb * ironic * keystone * loadbalancer * magnum * manila * masakari * mistral * neutron * nova * nova-cell * octavia * opensearch * placement * rabbitmq * skyline * tacker * trove * venus * watcher * zun Change-Id: Ibbb9fda45a98565ab12e784bbef80be787bd6638 Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-04-10Merge "release: Retarget removal of ironic-inspector"Zuul2-3/+3
2026-04-10Merge "fluentd: drop unused infra.var.log.kolla filter"Zuul1-7/+0
2026-04-10Merge "release: Remove grafana volume by default"Zuul1-2/+1
2026-04-09Merge "kolla-logs: break out from common role"Zuul7-21/+55
2026-04-09kolla-logs: break out from common roleMichal Nasiadka7-21/+55
In the process of renaming common role to kolla-toolbox - the only non-toolbox tasks are creation of kolla_logs volume and establishing a link in /var/log/kolla Change-Id: I12a0c0276ca4c915afc98363ab329331dc79f6bc Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-08Simplify cron jobs for log rotateMichael Still48-135/+13
There was a lot of repetitive jinja for the cron templates for logrotate, but they were also fairly infrequently overriden from the default. Let's DRY up this code by having a default template and only overriding it when required. Co-Authored-By: Doug Szumski <doug@stackhpc.com> Change-Id: I23c3dd66e71a6729a42ea7988931a46ce20d4fc6 Signed-off-by: Michael Still <mikal@stillhq.com>
2026-04-08fluentd: drop unused infra.var.log.kolla filterMichal Arbet1-7/+0
The Fluentd config contains a record_transformer filter for `infra.var.log.kolla.*.*.log`, but no input source or rewrite_tag_filter produces tags matching that pattern. Kolla service logs are tagged under `kolla.*`, and infrastructure logs use `infra.*`. Since `infra.var.log.kolla.*.*.log` is never generated, the filter is effectively dead code. Remove it to keep the tag pipeline accurate and easier to follow. Change-Id: I8ec4a294c8204efeb1957730684fdede22a880a7 Signed-off-by: Michal Arbet <michal.arbet@ultimum.io>
2026-04-07release: ovn TODOMichal Nasiadka1-9/+2
Change-Id: I083a6dc921a2fb11edce4deb8bd8528cd8be8121 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-07Remove deleted mod_auth_openidc optionPierre Riteau1-3/+3
The option OIDCTokenBindingPolicy was deleted from mod_auth_openidc [1]. Remove it from our documentation. SSO with Keycloak was successfully tested without it. Keep documentation about keystone_federation_oidc_additional_options by using OIDCOutgoingProxy instead. [1] https://github.com/OpenIDC/mod_auth_openidc/commit/f9a52507acee0817b9cc91ec194bcea894f77ee0 Change-Id: Icfe4ef0f6070a97c4e43f691643169e71cc2772a Signed-off-by: Pierre Riteau <pierre@stackhpc.com>
2026-04-07release: Retarget removal of ironic-inspectorMichal Nasiadka2-3/+3
Some tasks have been mistakenly marked as to be removed in Gazpacho instead of after Gazpacho/in Hibiscus. Change-Id: I6b6f98371546ab4fa316c53effb2be1954c3a84b Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-07Merge "release: cinder TODO"Zuul2-7/+14
2026-04-07release: Remove grafana volume by defaultMichal Nasiadka1-2/+1
Change-Id: I15eb7f618909d8c55507a66b2c941bd15fa36cd8 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-03Merge "release: valkey TODO"Zuul1-1/+1
2026-04-03release: cinder TODOMichal Nasiadka2-7/+14
Change-Id: I11167abf2bfab89f199b93abda80a01cc31a6731 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-03Merge "ironic: update TODO"Zuul1-1/+1
2026-04-03Merge "keystone: Limit OIDCHTMLErrorTemplate to Ubuntu"Zuul1-0/+3
2026-04-03ironic: update TODOBartosz Bezak1-1/+1
inspector still needs to be handled in G for slurp Change-Id: Ibeefbc4f2818e51b40524a8b5b69118870ec37c6 Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
2026-04-03release: valkey TODOMichal Nasiadka1-1/+1
Change-Id: I8a1f0207a70bcd6a2773d593ff85e84477a8a0cc Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-03octavia: update [neutron] configuration sectionPierre Riteau1-1/+8
Add authentication settings for Neutron and replace deprecated configuration. See change I686cfdef78de927fa4bc1921c15e8d5853fd2ef9 for more details [1]. [1] https://review.opendev.org/c/openstack/octavia/+/866327 Change-Id: I212dbfc7d555c731f629c1f73ae518351dd713f6 Signed-off-by: Pierre Riteau <pierre@stackhpc.com>
2026-04-03Add additional SPICE configuration optionsMichael Still7-10/+49
Recent changes to OpenStack Compute have added a number of new configuration options for SPICE VDI consoles. Additionally, it is not always desirable to enable the HTML5 transcoding proxy for SPICE consoles in Horizon. This patch adds configuration to globals.yml for most of these new options. Specifically: * nova_spice_html5: whether to enable the HTML5 transcoding proxy or not. Defaults to the previous behaviour of enabling the proxy. Notably, nova_spice_require_secure is not exposed here as it implies that qemu is configured to support TLS, and that TLS certificates have been configured in the nova_libvirt container. These changes are large, and are included in a separate patch for clarity. Additionally, OpenStack Compute added these configuration options in 2023.1, and they are exposed as well: * nova_spice_image_compression: "auto_glz" * nova_spice_jpeg_compression: "auto" * nova_spice_zlib_compression: "auto" * nova_spice_playback_compression: true * nova_spice_streaming_mode: "filter" All configuration options and their various values are documented by OpenStack Compute in their documentation. Partial-Bug: #2131793 (spice-direct consoles) Change-Id: I07f6890f1c7c4e543667d3cbd7b3e82bd9ec83e3 Signed-off-by: Michael Still <mikal@stillhq.com>
2026-04-02Merge "Revert "Add HAProxy timeout variables for cloudkitty API""Zuul2-23/+0
2026-04-02keystone: Limit OIDCHTMLErrorTemplate to UbuntuMichal Nasiadka1-0/+3
This feature has been deprecated in mod_auth_openidc since version 2.4.14 and removed in 2.4.16.2/2.4.18.1. Only Ubuntu Noble from currently supported distros has enough old version to support it. Closes-Bug: #2146990 Change-Id: If7d35df7f9f4853d05442d53fa580a34393804cd Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> Signed-off-by: Taavi Ansper <taaviansperr@gmail.com>
2026-04-02Merge "destroy: fix Octavia interface cleanup permissions"Zuul2-0/+6
2026-04-02Revert "Add HAProxy timeout variables for cloudkitty API"Michal Nasiadka2-23/+0
This reverts commit 7aab7e997e4e99e4d227a997ffc90d376bb49ab1. Reason for revert: This broke cloudkitty Change-Id: I8735eb5ef07b9a3c7d15ac730a7fccec9ced64e2 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-01Merge "Add HAProxy timeout variables for cloudkitty API"Zuul2-0/+23
2026-03-31Merge "CI: move aarch64 jobs to 16G ram nodes"Zuul3-5/+54
2026-03-31Merge "glance: Add configuration for cinder backend"Zuul1-0/+11
2026-03-31glance: Add configuration for cinder backendMichal Nasiadka1-0/+11
This is required as per [1]. [1]: https://docs.openstack.org/glance/latest/configuration/configuring.html#configuring-the-cinder-storage-backend Closes-Bug: #2007261 Change-Id: I914ad9d9b76727bc3761bfff0972b37cf31ff088 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-03-31CI: move aarch64 jobs to 16G ram nodesBartosz Bezak3-5/+54
Change-Id: I3e2fcee68efeae8c7ea9428156b63b9a9cfc1be0 Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
2026-03-31Merge "CI: fix prometheus-valkey-exporter inventory group"Zuul1-0/+3
2026-03-30Merge "mariadb: add support for custom Galera notification script"Zuul5-0/+144
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 17:51:05 +0000