aboutsummaryrefslogtreecommitdiff
path: root/ansible/group_vars
AgeCommit message (Collapse)AuthorFilesLines
2026-07-28cinder: Define backend variables in group_vars/allKari Häkkinen1-0/+57
The iscsi role derives the cinder-volume/backup inventory groups from cinder_enabled_backends, but that variable (along with cinder_backends, cinder_ceph_backends and the cinder_backend_*_name variables) was only defined in the cinder role defaults. The iscsi play runs before the cinder play, so the variable is out of scope there and prechecks (and deploy/reconfigure) fail with: 'cinder_enabled_backends' is undefined when a Cinder iSCSI/LVM backend is enabled. Move these backend variable definitions to group_vars/all/cinder.yml so they are in scope for every play, including the iscsi role. This also keeps all cinder backend definitions - including the cinder-backup ceph backend (cinder_backup_backend_ceph_name, cinder_backup_ceph_backend) - in one place. All of their dependencies (the enable_cinder_backend_* flags, cinder_backend_ceph and the ceph_* variables) are already global, and globals.yml is applied as extra-vars, so operator overrides continue to take precedence. Partial-Bug: #2158120 Change-Id: I765f45814382377332ba9f01f1bc52bd4e046170 Signed-off-by: Kari Häkkinen <Kari.Hakkinen@admicom.com> (cherry picked from commit 2df2ee6e49d0fd58b1781c0b490b019e1936e96b)
2026-07-23rabbitmq: Bump default rabbit_qos_prefetch_count from 1 to 50Michal Nasiadka1-1/+1
rabbit_qos_prefetch_count was previously set to 1, the lowest value permitted by oslo.messaging when rabbit_stream_fanout is enabled (oslo.messaging requires prefetch_count > 0 for stream queues, since the stream protocol needs a positive credit window to make progress). However, non-zero is not the same as optimal. RabbitMQ's own quorum queue documentation recommends the opposite of what a prefetch of 1 provides: "Quorum queues also benefit from consumers using higher prefetch values to ensure consumers aren't starved whilst acknowledgements are flowing through the system and allowing messages to be delivered in a timely fashion." -- https://www.rabbitmq.com/docs/quorum-queues With rabbit_quorum_queue enabled by default alongside rabbit_stream_fanout, prefetch=1 forces every quorum-queue consumer (nova-conductor, neutron-server, cinder-volume, etc.) into fully serialized delivery: RabbitMQ will not deliver the next message to a channel until the previous one has been acked. Combined with a small worker count, this can turn a burst of RPC traffic into a queueing delay long enough to exceed rpc_response_timeout, surfacing as a false-positive MessagingTimeout with no actual broker outage. Bump the default to 50. This keeps the value legal for stream queues (still > 0), keeps a bound on how much a single consumer can hold in flight, but gives quorum-queue consumers enough headroom to avoid unnecessary serialization and consumer starvation under load. This is a shared value across all services using oslo_messaging_rabbit, so it is intentionally conservative rather than tuned per-service; operators with specific throughput requirements can still override om_rabbitmq_qos_prefetch_count. See [1]. [1]: I541f704bfa2e98068096331afbdb591659cbc40b Change-Id: Iea474a553cb8bd3920ef89c148f63b1c7b1b8dbc Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> (cherry picked from commit 1ccf97e6234dea12811f0a1270055015bd403079)
2026-07-09Fix typo in neutron group varsNicolas MAILLET-CONTOZ1-1/+1
Closes-Bug: 2160035 Change-Id: I2f3ef4ef1085c93fd7e697c03fd530885795bcc4 Signed-off-by: alma.maillet-contoz <alma.maillet-contoz@infomaniak.com> (cherry picked from commit 4784eee7086043610c49c3f06d5e77eb816c9a2e)
2026-06-17Fix OVN SB relay port calculation for relay counts > 9amir581181-1/+1
The OVN SB relay port was generated using string concatenation between the port prefix and relay group ID. When the relay count exceeded 9, this resulted in invalid port numbers such as 166410. Update the port calculation to use numeric addition instead, ensuring ports remain within the expected and valid range. Closes-Bug: #2131191 Change-Id: I4738339431483c3d38fb322c18888fe61cae1a62 Signed-off-by: amir58118 <sahahmadi96@gmail.com> Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> (cherry picked from commit 6c2b9225d52cf2470d7ed85fa5fde833d764bb3c)
2026-05-11Switch openstack_release to 2026.1Michal Nasiadka1-1/+1
Change-Id: Icf7b5877f6865191f7b80d903608a6f7d5962527 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-28haproxy: fix missing user in rabbitmq healthcheckPiotr Milewski1-1/+1
RabbitMQ HAProxy config was missing user/auth in health checks, causing backend to be marked DOWN and HTTP 500 errors. Closes-Bug: #2150569 Change-Id: I1949210687bbe8f896e6b973950ddbea03c1f804 Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-04-27Drop zun and kuryrMichal Nasiadka4-36/+1
Zun is broken in 2026.1, it has been released broken and there are no reviews on the patch to fix it [1]. [1]: https://review.opendev.org/c/openstack/zun/+/982362 Depends-On: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/986150 Change-Id: I8ced621754d03c44b7672dd94fc3d7d2173ac734 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-16Merge "horizon: add Valkey session cache backend and prefer it"Zuul1-0/+6
2026-04-16Merge "Add OpenStack Network Exporter for Prometheus"Zuul1-0/+4
2026-04-16horizon: add Valkey session cache backend and prefer itPiotr Milewski1-0/+6
Horizon may display "Something went wrong!" when a memcached node becomes unavailable. Add support for Valkey as a Horizon session cache backend using django-redis with Sentinel. Valkey is now preferred when enabled. If Valkey is not enabled, Memcached is used instead. This improves Horizon availability when cache nodes fail. Depends-On: https://review.opendev.org/c/openstack/kolla/+/980779 Closes-Bug: #2093414 Change-Id: I771754acc0febb466f4f921fdf29946d9e54f0c3 Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-04-16Add OpenStack Network Exporter for PrometheusDoug Szumski1-0/+4
This is for gathering OVS/OVN related metrics. See: https://github.com/openstack-k8s-operators/openstack-network-exporter Depends-On: https://review.opendev.org/c/openstack/kolla/+/951971 Change-Id: I5752b3fe6457dcf2f191326a85c548584b5675b1 Signed-off-by: Doug Szumski <doug@stackhpc.com>
2026-04-15kolla-toolbox: Template clouds.yaml and use itMichal Nasiadka2-7/+6
Basically Ansible heuristic obfuscation methods mark auth: that we pass to openstack.* modules as no_log_values and then obfuscates it's values in other runs (which then end up as **** e.g. auth_url, domain_id, domain name, etc) Example return: "domains": [ { "description": "The ******** domain", "id": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER", "is_enabled": true, "links": { "self": "********/v3/domains/********" }, "name": "Default", "options": {}, "tags": [] } This patch adds clouds.yaml to files templated for kolla-toolbox (but without the password) and only uses password from Kolla-Ansible secrets instead of storing that on disk on all of the nodes. Change-Id: I479445563d5b5dc2e45601e936d89def647da841 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-03Merge "release: valkey TODO"Zuul1-1/+1
2026-04-03release: valkey TODOMichal Nasiadka1-1/+1
Change-Id: I8a1f0207a70bcd6a2773d593ff85e84477a8a0cc Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-03Add additional SPICE configuration optionsMichael Still1-4/+11
Recent changes to OpenStack Compute have added a number of new configuration options for SPICE VDI consoles. Additionally, it is not always desirable to enable the HTML5 transcoding proxy for SPICE consoles in Horizon. This patch adds configuration to globals.yml for most of these new options. Specifically: * nova_spice_html5: whether to enable the HTML5 transcoding proxy or not. Defaults to the previous behaviour of enabling the proxy. Notably, nova_spice_require_secure is not exposed here as it implies that qemu is configured to support TLS, and that TLS certificates have been configured in the nova_libvirt container. These changes are large, and are included in a separate patch for clarity. Additionally, OpenStack Compute added these configuration options in 2023.1, and they are exposed as well: * nova_spice_image_compression: "auto_glz" * nova_spice_jpeg_compression: "auto" * nova_spice_zlib_compression: "auto" * nova_spice_playback_compression: true * nova_spice_streaming_mode: "filter" All configuration options and their various values are documented by OpenStack Compute in their documentation. Partial-Bug: #2131793 (spice-direct consoles) Change-Id: I07f6890f1c7c4e543667d3cbd7b3e82bd9ec83e3 Signed-off-by: Michael Still <mikal@stillhq.com>
2026-03-30Merge "prometheus: add valkey exporter support"Zuul1-0/+2
2026-03-25Merge "Fix ulimit defaults for Debian family container engines"Zuul1-7/+22
2026-03-16prometheus: add valkey exporter supportPiotr Milewski1-0/+2
Add prometheus-valkey-exporter deployment to enable monitoring of Valkey servers. Depends-On: https://review.opendev.org/c/openstack/kolla/+/976650 Change-Id: I0ff56028f34a0ad21c4c122da3f27cf73d0e0b00 Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-03-16Merge "grafana: Add LDAP authentication support"Zuul1-0/+2
2026-03-14Merge "influxdb/telegraf: Drop deployment"Zuul3-27/+1
2026-03-13grafana: Add LDAP authentication supportPiotr Milewski1-0/+2
This commit adds the ability to enable and configure LDAP authentication for Grafana. It introduces a new variable 'grafana_ldap_enabled' and automates the process of copying the 'ldap.toml' configuration file and updating 'grafana.ini'. Change-Id: I1f9de8202629904757840f5b2b5d0b8429e42f96 Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-02-25Fix ulimit defaults for Debian family container enginesamir581181-7/+22
When using containerd, ulimits are not enforced by default. On Debian-based systems this commonly results in missing nofile limits and service startup failures. This change introduces sane default ulimit values for Debian-based distributions while keeping existing EL9 behavior unchanged. Closes-Bug: #2132378 Change-Id: I6c6c61df96aea8a12bde2f17afc09adfd5aa2b31 Signed-off-by: amir58118 <sahahmadi96@gmail.com>
2026-02-17harden: update HAProxy TLS settings for OpenSSL 3.xPiotr Milewski1-4/+12
Update HAProxy SSL configuration to follow Mozilla modern and intermediate recommendations for HAProxy 2.8.5 on OpenSSL 3.x (Rocky Linux, Ubuntu). Change-Id: I9baba63210d3e856907b5a04464bad1f7c2fc7f5 Signed-off-by: Piotr Milewski <vurmil@gmail.com> Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-02-11Merge "Increase innodb_log_file_size to 2GB"Zuul1-0/+6
2026-01-23influxdb/telegraf: Drop deploymentMichal Nasiadka3-27/+1
Kolla delivers InfluxDB v1, which is EOL (unless you have paid support). There are no plans in upgrading InfluxDB to v2 - so let's drop it. Telegraf was deprecated in June 2025. Removing both in one patch for convenience. Change-Id: Ieee2be3a06a5ac9504a822cc0a727e662146b260 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-01-07ansible-lint: fix yaml[line-length] in group_varsaxel.jacquet8-21/+99
Change-Id: I1d399edcd2910b5e13583ffd2f9b83aaed0086ba Signed-off-by: Axel Jacquet <axel.jacquet@infomaniak.com>
2025-12-19Add support for Debian Trixie (13)Michal Nasiadka1-1/+1
Remove /etc/timezone bind mount since Debian does not provide that file anymore. Depends-On: https://review.opendev.org/c/openstack/kolla/+/964793 Change-Id: If1a289068093843184f0d7b495815db006f2d563 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-12-12glance: Switch to use uWSGIMichal Nasiadka1-1/+0
Glance is removing their warning around running in WSGI [1], so let's switch. [1]: https://review.opendev.org/c/openstack/glance/+/963294 Change-Id: Iae2c5ef5251d6695daf3262ed208c4bd914d7fb3 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-11-28ansible-lint: Remove yaml[truthy] from excludesMichal Nasiadka42-141/+135
Normalize quotes and some other easy fixes done by ansible-lint --fix Also drop etc from excludes and ignore comment check in etc/kolla/globals.yml Pinning to ansible-lint<25.11.0 because 25.11.1 is breaking without any messages Change-Id: I7dee3866191cef84cd12b1816cdab0a02380ec7f Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-11-27Merge "Remove distro_python_version variable"Zuul1-2/+0
2025-11-08Merge "ansible-lint: Fix jinja[spacing]"Zuul2-4/+4
2025-11-06ansible-lint: Fix jinja[spacing]Michal Nasiadka2-4/+4
Change-Id: I2e30c04bd1597ec15e4c681b31443c7886154194 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-11-06Replace Redis with ValkeyGrzegorz Koper8-20/+39
This change replaces Redis with Valkey, which is non-existent on Rocky Linux 10 / CentOS Stream 10 due to licensing issues. Co-Authored-By: Bartosz Bezak <bartosz@stackhpc.com> Co-Authored-By: Michal Nasiadka <mnasiadka@gmail.com> Change-Id: Ifcc6ec6e943c20867d969b0bdb0e4cbac53eea1e Signed-off-by: Grzegorz Koper <grzegorzk@stackhpc.com> Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com> Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-30Merge "Support ironic-pxe-filter"Zuul1-0/+1
2025-10-30Increase innodb_log_file_size to 2GBSeunghun Lee1-0/+6
Sometimes test_backup at test_mariadb.sh fails with message "try increasing innodb_log_file_size". This will fix random backup failure. Closes-bug: #2129930 Change-Id: I3d7c9f9b7b060f93bf2ef408b4b4495a32ef648e Signed-off-by: Seunghun Lee <seunghun@stackhpc.com>
2025-10-29Remove distro_python_version variableMichal Arbet1-2/+0
This patch drops the ``distro_python_version`` variable from Kolla Ansible, as it is no longer needed, the paths have already been handled at the image level. More details can be found in [1]. [1] https://review.opendev.org/q/topic:%22kolla-distro-python-version%22 Change-Id: I1b972c607c1d9fd387e977b73a7529c3e2574387 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-28Drop venusMichal Nasiadka2-11/+0
It has been marked as inactive and venus dashboard plugin is breaking Horizon Kolla builds. Change-Id: I78cf7a33bf1025f5c8e4b76ecfeef7d8a3126d61 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-28Bump ansible-core to 2.18/2.19Michal Nasiadka1-1/+1
Bumped collections in requirements-core.yml to Ansible 12 major versions, see [1]. [1]: https://github.com/ansible-community/ansible-build-data/blob/main/12/ansible-12.1.0.yaml Depends-On: https://review.opendev.org/c/openstack/kolla/+/960307 Co-authored-by: Doug Szumski doug@stackhpc.com Change-Id: If8a29052d8a43ffc0fef11514adabb5e4ab9d977 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-27Merge "Move tasks from k-a role common to a-c-k"Zuul1-7/+0
2025-10-24neutron: Remove support for linux bridge mechanism driverTakashi Kajinami2-4/+2
... because it was removed from neutron during 2025.1 cycle[1]. [1] https://review.opendev.org/c/openstack/neutron/+/927216 Depends-On: https://review.opendev.org/c/openstack/kolla/+/962279 Change-Id: I79d896d7dea299641bc5a7f0f2a0735c9719a16d Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
2025-10-24Support ironic-pxe-filterWill Szumski1-0/+1
Closes-Bug: #2094790 Depends-On: https://review.opendev.org/c/openstack/kolla/+/939256 Change-Id: I1b5329d814432604640990b0ecc28906845e29d6 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> Signed-off-by: Will Szumski <will@stackhpc.com>
2025-10-24neutron: Drop neutron_legacy_iptablesMichal Nasiadka1-3/+0
Change-Id: Ic2b9c8cbb431435c7622b0ec03e21a2d246f066c Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-15fix: use `FQDN` for `horizon` endpointsJack Hodgkiss1-2/+2
The `public` and `internal` endpoints for `Horizon` have been set explicitly to `kolla_external_fqdn` and `kolla_internal_fqdn` this setup does not work if using `HAProxy` single frontend configuration and can lead to `CORS` blocked when attempting to upload images via the `Horizon` dashboard. This change brings `Horizon` configuration inline with other services. Closes-Bug: 2111125 Change-Id: I3a8f40a06d64ac5ebd321c4da7fe577c1c4c380a Signed-off-by: Jack Hodgkiss <jack@stackhpc.com>
2025-10-13Merge "Drop support for DB Loadbalancing with HAProxy + clustercheck"Zuul2-5/+4
2025-10-13Drop support for DB Loadbalancing with HAProxy + clustercheckSeunghun Lee2-5/+4
MariaDB Clustercheck has not been updated for a long time and ProxySQL has been working well as the default. Dropped DB Loadbalancing with HAProxy and MariaDB clustercheck support and ProxySQL now gets enabled automatically when MariaDB is enabled. Replaced MariaDB container healthcheck method with healthcheck.sh from official MariaDB docker images. Performing service upgrade with this patch will remove remaining mariadb_clustercheck container. Depends-on: https://review.opendev.org/c/openstack/kolla/+/962657 Change-Id: Ib655eae79ba73f4582b29fef82c2d882a474329b Signed-off-by: Seunghun Lee <seunghun@stackhpc.com>
2025-10-06Move tasks from k-a role common to a-c-kRoman Krček1-7/+0
Move tasks that modified host configuration from kolla-ansible role common to a-c-k as they need to be run only once on the boostrap of the host and are not strongly related to the common services. Depends-On: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/948525 Change-Id: I21c36df43425e2390b62f2d0257e99940e098734 Signed-off-by: Roman Krček <roman.krcek@tietoevry.com>
2025-10-02Move to for Rocky Linux 10Michal Nasiadka1-2/+2
CephAdm, Octavia, OVN and NFV jobs are not added here, because these rely on Valkey/Redis available. Ironic jobs are not added, because ipxe.efi is not packaged in EL10 and needs a followup patch. Let's Encrypt jobs are also not added, due to ssl certificate validation errors. Depends-On: https://review.opendev.org/c/openstack/kolla/+/956554 Depends-On: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/961237 Change-Id: I51823808c4e4ac08ae8f080aacf6a3759589571d Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-09-25horizon: Add support for using uWSGIMichal Nasiadka1-1/+1
Switching the default to uWSGI due to the changes that are happening in OpenStack - with projects dropping wsgi_file(s) and moving to modules. Separate Apache/mod_wsgi container that will serve for OIDC/SAML cases will be posted as a follow-up. Depends-On: https://review.opendev.org/c/openstack/kolla/+/961676 Change-Id: Ia6b719847033f7861e814b4e1d8da810dafcc2aa Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-09-25group_vars: Reorganize huge all.yml into smaller filesMichal Nasiadka59-1413/+1488
This will help us to trigger scenario jobs on changes in given group_vars files. Changes to Zuul config to trigger given scenarios will be posted as a follow-up. Change-Id: I3f17adf655d2d0c1fc2969153dddb0c72b11397a Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-09-18keystone: Add support for using uWSGIMichal Nasiadka1-0/+1
Switching the default to uWSGI due to the changes that are happening in OpenStack - with projects dropping wsgi_file(s) and moving to modules. Depends-On: https://review.opendev.org/c/openstack/kolla/+/938402 Signed-Off-By: Michal Nasiadka <mnasiadka@gmail.com> Change-Id: I33d9f32dd842a12b893f5062f2e1e278af7b30a1
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 16:11:26 +0000