aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
22 hoursFix trove-api queue manager process namestable/2026.1Piotr Milewski2-0/+10
Set a unique processname for trove-api to prevent shared-memory file collisions when running under uWSGI. Closes-Bug: #2170958 Change-Id: Iee2c76fd8ba11446688b61a9b109c8bdba0fc820 Signed-off-by: Piotr Milewski <vurmil@gmail.com> (cherry picked from commit 0931b528df42dbd1b9c32feba09ee30716156f32)
3 daysMerge "CI: Emulate Redfish baremetal with Tenks" into stable/2026.1Zuul2-41/+69
8 daysmariadb: Increase healthcheck start_period to 120sMichal Nasiadka1-1/+1
On fresh deployments the monitor user is created in post-deploy, after containers have started — with the default 5s start_period the first healthcheck fires at t+30s (interval) before the user exists. 120s also provides enough margin for SST on larger databases. Change-Id: Ia415f49a5486920426a09509af9df2d436c2d4a8 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> (cherry picked from commit 43d67f0475e8ea4fb2d11e1147fba06dbf22e6b6)
9 daysoctavia: Add OS_CACERT to octavia-openrc.shBartosz Bezak1-0/+3
Support a custom CA, as admin-openrc.sh already does. Closes-Bug: #2172300 Change-Id: I767e0b8b42c90a2173c971af58a12fe1e3b98838 Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com> (cherry picked from commit 0d67c875466b2ff6fb23deae1bc675a32ce807e2)
2026-10-22Merge "Fix Fluentd OpenSearch output address" into stable/2026.1Zuul2-2/+2
2026-10-16Fix container unhealthy checksKuchinskiy Alexey2-2/+7
An issue with skipping "healthy check" checks has been resolved. In task "Fail if containers are unhealthy" in variable "unhealthy_containers" not appending services with status "unhealthy", because path to the status incorrect, and search in filter "selectattr" not work. Tasks skiping, because in variable "unhealthy_containers" not items. Closes-Bug: #2156900 Change-Id: I52f78774536e4487c38a500c2c8941eae4386604 Signed-off-by: Kuchinskiy Alexey <kuchinalser@gmail.com> (cherry picked from commit d30fad4325b80cc82f485a979c0afeaf7647b07f)
2026-10-16[stable-2026.1-only] Fix proxysql-ca.pem location in release noteBartosz Bezak1-1/+1
The release note added in https://review.opendev.org/c/openstack/kolla-ansible/+/994258 refers to certificates_internal_dir, but proxysql-ca.pem is read from kolla_certificates_dir in stable/2026.1 and older branches. Change-Id: Id4b352f102124135216579066c32e9ca575a874c Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
2026-10-15CI: Emulate Redfish baremetal with TenksJed Preist2-41/+69
Emulate baremetal using Tenks to test the deployment of Redfish baremetal with Ironic. Depends-On: https://review.opendev.org/c/openstack/tenks/+/995697 Change-Id: I2df2287c15d1afaba9d63956bcfa2fc7e71c3530 Signed-off-by: Jed Preist <jed@stackhpc.com> (cherry picked from commit 06da80983a66e88251f08535b43ce984f4729e4f)
2026-10-15Merge "CI: Don't fail on Neutron wrapper managed containers" into stable/2026.1Zuul1-7/+23
2026-10-14Fix Fluentd OpenSearch output addresskkaptanoglu2-2/+2
Prefer opensearch_address when it is set, allowing Fluentd to reach an external or legacy Elasticsearch/OpenSearch endpoint instead of relying only on the opensearch inventory group. Use opensearch_address only when it differs from kolla_internal_fqdn. This keeps the default VIP deployment using the OpenSearch inventory addresses. Closes-Bug: #2163144 Change-Id: Ibde86a916c4fa764100bf33675f4c416b5179532 Signed-off-by: kkaptanoglu <kkaptanoglu@vmind.com.tr> (cherry picked from commit a68e99bbaead4a0415668103fa18a8169101528b)
2026-10-13Merge "Revert^2 "Add HAProxy timeout variables for cloudkitty API"" into ↵Zuul2-0/+22
stable/2026.1
2026-10-12Fix ETCD health check hardcoded to HTTPWarren Jeffs1-1/+3
The ETCD health check assumes HTTP regardless of the configured protocol, causing incorrect health status when ETCD is configured to use TLS/HTTPS. Closes-Bug: #2167236 Change-Id: I55810de8f6b2c3e318cb3dbb6431e9dd09c1a4a8 Signed-off-by: Warren Jeffs <me@warrenjeffs.me> (cherry picked from commit ba60dba12ef0ac5d5f04795982d320e468c9b524)
2026-10-09Merge "Fix ProxySQL not using backup writer node for reads" into stable/2026.1Zuul2-1/+14
2026-10-07Add env option service-uwsgi-config roleMichal Arbet2-0/+4
Allow passing the optional env setting to uWSGI via service_uwsgi_config_env. Required for fix https://review.opendev.org/c/openstack/kolla-ansible/+/997843. Change-Id: I695038732ecc022840a6b1c6b8c22495051be2fa Closes-Bug: #2160218 Signed-off-by: Michal Arbet <michal.arbet@ultimum.io> (cherry picked from commit 03b6a6063dfcc607c9a7b825664d82806d3974a2)
2026-10-05Merge "Fix trailing comma bug in DockerWorker.generate_tls()" into stable/2026.1Zuul2-2/+62
2026-10-01Revert^2 "Add HAProxy timeout variables for cloudkitty API"Dawud2-0/+22
This reverts commit c62d5e509b74fd39b09c272fb731b73088c3a55b. Reason for revert: Fixing broken tests Change-Id: Iea1d9ad71c64642fadb7d02d50f9421cbe64acb7 Signed-off-by: Dawud <dawud@stackhpc.com> (cherry picked from commit 1839ef9a957432b08c81756780e20d7374e5bb89)
2026-09-30CI: Don't fail on Neutron wrapper managed containersMichal Nasiadka1-7/+23
Filter out the ones in state removing and also by name Change-Id: I0ea5522b1a3a3dbb2071ff93f6800f898858f41b Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> (cherry picked from commit 983379e1e4bc9c0db9965315e0cdfd76aa2921bd)
2026-09-25Include CA for database TLS on MariaDB backupSeunghun Lee3-0/+20
When database backend TLS was implemented [1], the CA was not set for Mariabackup configuration. [1] https://review.opendev.org/c/openstack/kolla-ansible/+/909912 Closes-bug: #2168443 Change-Id: I2d88af7c61bb609311a5f0a820a501d006f8e454 Signed-off-by: Seunghun Lee <seunghun@stackhpc.com> (cherry picked from commit 7c64ed9ff0509b4001d319f620d4bfe68ae9dfdb)
2026-09-24CI: Prefer ipv4 over ipv6 and disable docker mirrorMichal Nasiadka2-0/+15
We're getting some ipv6 issues in VexxHost's ca-ymq-1 region, this should at least work around them. Change-Id: I26412e410e9aebb24bc98c943f418f824032be40 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com> (cherry picked from commit 2f64452fbad843816d74b7584ea81d33d8054a14)
2026-09-23Merge "kolla-toolbox: remove leftover kolla-toolbox.json.j2" into stable/2026.1Zuul1-42/+0
2026-09-17Remove leftover mention of Linux bridge driverPierre Riteau1-4/+4
This reference was missed during the removal of the Linux bridge mechanism driver [1]. [1] https://review.opendev.org/c/openstack/kolla-ansible/+/962278 Change-Id: Iff92e75a594a4888cf4cd179d7ac5de46e5c7f09 Signed-off-by: Pierre Riteau <pierre@stackhpc.com> (cherry picked from commit bf02dd405a084ffd680bc5a835b8ab48e76485f6)
2026-09-17Fix ProxySQL not using backup writer node for readsFranciszek Przewozny2-1/+14
Set writer_is_also_reader to 2 in the Galera hostgroup configuration so that the backup writer node also serves reads, instead of sitting idle while all read traffic went to the single remaining reader node. The writer node is never added to the reader hostgroup regardless of this setting, only the backup writer is affected. See bug report for performance difference details. Closes-Bug: #2167037 Change-Id: Ib5145c200c3cd70f861824abd967748faf61e1cf Signed-off-by: fprzewozn <przewozny.franciszek@gmail.com> (cherry picked from commit 42eec877ff572fd724af8a1c0fa64acf5e824c7b)
2026-09-16Merge "prometheus: accept vault-encrypted values in precheck" into stable/2026.1Zuul2-4/+14
2026-09-16prometheus: accept vault-encrypted values in precheckFranciszek Przewozny2-4/+14
Ansible's "is string" Jinja test returns False for values encrypted with ansible-vault (AnsibleVaultEncryptedUnicode), so a precheck using such an encrypted password/salt failed incorrectly. Accept the value if it is either a plain string or vault_encrypted. Closes-Bug: #2115495 Change-Id: I0bf783c40ca5be66717193be9dece971805fca55 Signed-off-by: fprzewozn <przewozny.franciszek@gmail.com> (cherry picked from commit ed74de7e9a76fac01554fc876c4a581b857903ea)
2026-09-16Update enable_letsencrypt to boolean validationjayjahns2-6/+6
Fixes the enable_letsencrypt to properly use boolean instead of a string. Currently breaks acme in its current state. Co-Authored-By: Bartosz Bezak <bartosz@stackhpc.com> Closes-bug: #2164956 Change-Id: Iae8770438ba63717030cc4ec8662f5ca0f6c9168 Signed-off-by: jayjahns@gmail.com Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com> (cherry picked from commit e372288577a189d8798e326c3ff2bd104b4a84a0)
2026-09-15Merge "Register keystoneauth options for [glance] config group" into ↵Zuul2-0/+21
stable/2026.1
2026-09-10Fix trailing comma bug in DockerWorker.generate_tls()Tikhon Masalov2-2/+62
In generate_tls(), tls_cert and tls_key were assigned with trailing commas, which caused them to become single-element tuples (None,) instead of None. This made the if tls_cert: check always true, leading to TypeError when check_file() received a tuple instead of a string path. Remove the trailing commas so tls_cert and tls_key are plain values. Remove TestTLS.setUp(_get_host_timezone) for stable branches: _get_host_timezone does not exist in kolla_container_worker.py on older branches, causing AttributeError in TestTLS setUp. Closes-Bug: #2166845 Change-Id: I06b8876838ee2ec3c20c9a98448fc9e5588f32cd Signed-off-by: Tikhon Masalov <t.masalov@maxima-int.com> (cherry picked from commit 2f8958235bc16a89a33c0711f1dfcb7bca87a1a9)
2026-09-10kolla-toolbox: Retry ansible --version checkMichal Nasiadka1-0/+4
We've seen CI failures multiple times when the container was not yet up before this check ran Change-Id: Ib78e27ac4e06a39ed76c410a000ed3d3d647bd2e Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> (cherry picked from commit c35e2181a391aa36e79ab0b8dc7b2cd6583f57ee)
2026-09-09Merge "Remove unsupported ovn_emit_need_to_frag option" into stable/2026.1Zuul1-1/+0
2026-09-08rabbitmq: fix precheck missing backend TLS cert fallbackFranciszek Przewozny2-0/+10
service-cert-copy falls back to kolla_tls_backend_cert/key when no rabbitmq-specific cert is found, but the precheck did not check for this path, causing a false failure when relying on the shared backend certificate. Closes-Bug: #2166283 Change-Id: I75d4b33fc893bcf0793c1280981574bcdf3f3002 Signed-off-by: fprzewozn <przewozny.franciszek@gmail.com> (cherry picked from commit a54ad717f08a8258424004e6224a36ea561393d2)
2026-09-08Remove unsupported ovn_emit_need_to_frag optionPierre Riteau1-1/+0
This option was removed from Neutron in 2026.1 [1]. It was true by default since 2025.1 anyway [2]. [1] https://review.opendev.org/c/openstack/neutron/+/962881 [2] https://review.opendev.org/c/openstack/neutron/+/930608 Change-Id: I7b393ad92eb82506023cffbfd43888d37b305c9a Signed-off-by: Pierre Riteau <pierre@stackhpc.com> (cherry picked from commit 93cab7f37a3b8fd308efb933c357b40dd18a948a)
2026-09-03Fix compare_labels when image doesn't existAlex Welsh5-1/+24
check_image() from kolla_docker_worker returns None when the image doesn't exist locally. This means that when compare_labels tries to read a value from it, it will error out. This chain happens when comparing an image that doesn't exist locally. In the past we didn't hit this because checks ran sequentially and it would exit before hitting this. A recent change [1] means that now all checks run always. This patch fixes the issue in two ways. First, it makes the docker worker return an empty dict from check_image when it doesn't exist. Second, compare_labels now truthy-checks the output before proceeding, and returns straight away if it's False. [1] https://review.opendev.org/c/openstack/kolla-ansible/+/978162 Change-Id: I3c33ac3a474f80bca100005f61c1c0bfedc46170 Signed-off-by: Alex Welsh <alex@stackhpc.com> Closes-Bug: #2166024 (cherry picked from commit ffc50e8d33ade7a0d58ef83b79ed296a28b49608)
2026-09-03Remove Disable Getting Started panel Grafana tasksAlex Welsh5-17/+18
Since Grafana 13.2, the api/user/helpflags/1 endpoint has been removed [1]. This means the "Disable Getting Started panel" deployment task fails with 404 when a custom home dashboard is added. The best alternative I can find is to set default_home_dashboard_path in grafana.ini, which disables the panel anyway [2] [1] https://github.com/grafana/grafana/pull/124916 [2] https://github.com/grafana/grafana/pull/28750 Change-Id: I78b8657b6ca94d81e3becbba9d5a476d9427658f Signed-off-by: Alex Welsh <alex@stackhpc.com> Closes-Bug: #2166048 (cherry picked from commit c8e7b85b2707f762b2560ad8bed9d107a30ff521)
2026-09-01Register keystoneauth options for [glance] config groupPiotr Milewski2-0/+21
Cinder requires service-to-service authentication with Glance to fetch direct image locations (e.g., for RBD CoW cloning). Because keystoneauth parameters were not explicitly registered for the [glance] section, they could not be properly configured and loaded. This lack of authentication led to HTTP 403 Forbidden errors during fetch_image_location, forcing a fallback to slow image downloads. This patch registers the required keystoneauth options in the [glance] group, enabling proper service-to-service communication. Closes-Bug: #2161971 Change-Id: I2cae59b34b1fbd4fa3bf1c5b2da5277ef4712916 Signed-off-by: Piotr Milewski <vurmil@gmail.com> (cherry picked from commit 1056bc652b148bddc5d4cb667c8d3ef26a322aa9)
2026-08-31etcd: Fix deploy with stopped etcd containerBartosz Bezak1-0/+10
Skip leader lookup for stopped etcd containers. This may occur when replacing a controller while preserving Docker volumes. Closes-Bug: #2165007 Change-Id: Id0a9090592980d142413bea23c61c17b43cb7f8a Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com> (cherry picked from commit acf6744ba14a2060e762294b039a5bbb832e8e2e)
2026-08-25mariadb: Back up from the local database instanceBartosz Bezak3-5/+19
Mariabackup copies the data directory of mariadb_backup_host but connected through the load balancer, so backup_replica.sh could redirect it to another Galera member. The backup lock then applied to the wrong node, leaving the copied files unquiesced. Connect to api_interface_address and mariadb_port instead, and always use the local backup script. MariaDB 10.11.19 and 11.4.13 no longer tolerate the mismatch. mariadb_backup_target now has no effect, and full backups are named mysqlbackup-<date>.qp.xbc.xbs.gz, as the restore docs describe. Closes-Bug: #2165011 Related-Bug: #2125124 Change-Id: I33ebd36c728ff50df8ebf13fc5af9882a0e71d23 Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com> (cherry picked from commit f1f2702bbe812e285f0766a5787159ba92fdce8b)
2026-08-24merge_configs: Add lstrip_blocksMichal Nasiadka4-4/+83
Closes-Bug: #2164718 Change-Id: If5b7f30d2467b61c3578d09992faf446b5d25f4e Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> (cherry picked from commit 0f4da209da6fa39739ffc7b7fb1a69dc967734b7)
2026-08-19Extend the nova_scheduler healthcheck timeout.Michael Still3-1/+33
Nova changed in 2026.1 how long their services take to gracefully shutdown. The default value of [DEFAULT]/graceful_shutdown_timeout has been changed from 60 to 180 seconds for all Nova services. [...] Operators using external system (e.g. k8s, systemd) to manage the Nova services should ensure that their service stop timeouts are set to at least graceful_shutdown_timeout to avoid forcefully killing service before Nova finish its graceful shutdown. Kolla-Ansible failed to update the period of time that ansible waits for Nova services to shut down. This causes both CI failures and failures for deployers when trying to manage some Nova containers. Prompt: Michael asked for assistance debugging why CI jobs were failing with nova-scheduler timeouts. Assisted-By: Claude Opus 5 (1M context, high effort) <noreply@anthropic.com> Co-Authored-By: Claude Opus 5 (1M context, high effort) <noreply@anthropic.com> Closes-Bug: #2162860 Change-Id: If7c5a6d885b19e39cfc305440424f10de3a5ea05 Signed-off-by: Michael Still <mikal@stillhq.com> (cherry picked from commit 4ce86ef1db631c15e6e5e142d2908f73348377d4)
2026-08-12fix: Delegate fernet key distribution to correct hostOwen Jones2-4/+8
The key used to group hosts was previously changed[0] but the group not updated in the task used to distribute fernet keys. When migrating hosts this could lead to the task being delegated to a host without keys, resulting in all hosts losing their keys. 0: Change I1db88e28a828ebf073f018b2bae1d9556ec22807 Closes-Bug: #2163158 Change-Id: Ia76f3e6cb41a30b88ac885832755ebe5264ad9fc Signed-off-by: Owen Jones <owen@stackhpc.com> (cherry picked from commit 541a26c7d4dd1988eda64327c6b08aa831ee3162)
2026-08-11kolla-toolbox: remove leftover kolla-toolbox.json.j2Michal Arbet1-42/+0
Template is no longer used as kolla-toolbox is deployed in kolla_toolbox role now. This removes obsolete and unused file. Change-Id: I3c0ea709cd5478257649b7db77c9c97be4874cb2 Signed-off-by: Michal Arbet <michal.arbet@ultimum.io> (cherry picked from commit f5df7b28b86ccf735fe1daf83eb9b8be4a31d476)
2026-08-04Fix Docker cpuset dimension comparisonLoan Harrouin3-0/+69
When enabling cpuset_cpus or cpuset_mems on existing Docker containers, Docker may report the current value as an empty string when no cpuset constraint is configured. These dimensions are cpuset-list strings, not numeric resource values. Compare them as strings in the Docker worker instead of passing them through the numeric dimension comparison logic. Closes-Bug: 2143874 Change-Id: I1b8cd72846b28f556c8f9a0ba114a8af9221e85a Signed-off-by: Loan Harrouin <loan.harrouin@gmail.com> (cherry picked from commit 8304bb3884237bf5aee1c60715d097e88561d56d)
2026-07-30Ensure OpenSearch waits for recovery during upgradeAlex Welsh4-1/+58
Change-Id: I8825f41a1753eb323e0fdf1bf38a679670e01ba7 Signed-off-by: Alex Welsh <alex@stackhpc.com> (cherry picked from commit 37194fcab7883b8626f2eab5a4f6a19246b85ec9)
2026-07-30CI: add opensearch jobs to gate and make them votingBartosz Bezak1-1/+8
Change-Id: I77c4d442645a7d5253b458ce6584f2ba599bc4c3 Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com> (cherry picked from commit e975285743d08dda7e5b6ca70018441b9d7bd249)
2026-07-29Merge "cinder: Define backend variables in group_vars/all" into stable/2026.1Zuul3-50/+72
2026-07-29Revert "Ensure OpenSearch waits for recovery during upgrade"Franciszek Przewoźny3-50/+0
This reverts commit 79f6f2a049bad1d3cb51ba50981a01f63503a329. Reason for revert: post-config job leaks OpenSearch secret to logs (see failed prometheus-opensearch jobs) Change-Id: I63432e19c42ac9f3eebebadb474882ccda3780ed Signed-off-by: fprzewozn <przewozny.franciszek@gmail.com>
2026-07-29Merge "keystone: allow multiple OIDCXForwardedHeaders options" into ↵Zuul2-1/+9
stable/2026.1
2026-07-28cinder: Define backend variables in group_vars/allKari Häkkinen3-50/+72
The iscsi role derives the cinder-volume/backup inventory groups from cinder_enabled_backends, but that variable (along with cinder_backends, cinder_ceph_backends and the cinder_backend_*_name variables) was only defined in the cinder role defaults. The iscsi play runs before the cinder play, so the variable is out of scope there and prechecks (and deploy/reconfigure) fail with: 'cinder_enabled_backends' is undefined when a Cinder iSCSI/LVM backend is enabled. Move these backend variable definitions to group_vars/all/cinder.yml so they are in scope for every play, including the iscsi role. This also keeps all cinder backend definitions - including the cinder-backup ceph backend (cinder_backup_backend_ceph_name, cinder_backup_ceph_backend) - in one place. All of their dependencies (the enable_cinder_backend_* flags, cinder_backend_ceph and the ceph_* variables) are already global, and globals.yml is applied as extra-vars, so operator overrides continue to take precedence. Partial-Bug: #2158120 Change-Id: I765f45814382377332ba9f01f1bc52bd4e046170 Signed-off-by: Kari Häkkinen <Kari.Hakkinen@admicom.com> (cherry picked from commit 2df2ee6e49d0fd58b1781c0b490b019e1936e96b)
2026-07-28CI: Install kernel-modules-extra for running kernelMichal Nasiadka1-1/+1
Currently we're installing kernel-modules-extra for newest kernel, which is not always the case for OpenDev images. Change-Id: Ic1a196d690b0a92aaf3f1ddc6cd466894bf1cbc5 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> (cherry picked from commit 0484f7b66d1541710bc820e8af88d6d9117c5f63)
2026-07-28keystone: allow multiple OIDCXForwardedHeaders optionsMichel Raabe2-1/+9
The OIDCXForwardedHeaders directive from mod_auth_openidc accepts a space-separated list of header names and parses each one as a separate argument. The keystone httpd template wrapped the value in double quotes, so Apache passed the whole list as a single argument. As a result, only a single forwarded header could be configured and setting more than one value failed. Remove the surrounding quotes so that each header name is parsed as an individual argument, allowing more than one forwarded header to be set. Closes-Bug: #2155147 Change-Id: Id23fbdf6c82acdec1ee310b6b29fc4a5dc846f66 Signed-off-by: Michel Raabe <raabe@b1-systems.de> (cherry picked from commit 6a710101850a13518d66bd0e7c27a3ee54a3c2d8)
2026-07-27Merge "Ensure OpenSearch waits for recovery during upgrade" into stable/2026.1Zuul3-0/+50
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 13:29:00 +0000