aboutsummaryrefslogtreecommitdiff
path: root/ansible
AgeCommit message (Collapse)AuthorFilesLines
23 hoursFix trove-api queue manager process namestable/2026.1Piotr Milewski1-0/+3
Set a unique processname for trove-api to prevent shared-memory file collisions when running under uWSGI. Closes-Bug: #2170958 Change-Id: Iee2c76fd8ba11446688b61a9b109c8bdba0fc820 Signed-off-by: Piotr Milewski <vurmil@gmail.com> (cherry picked from commit 0931b528df42dbd1b9c32feba09ee30716156f32)
8 daysmariadb: Increase healthcheck start_period to 120sMichal Nasiadka1-1/+1
On fresh deployments the monitor user is created in post-deploy, after containers have started — with the default 5s start_period the first healthcheck fires at t+30s (interval) before the user exists. 120s also provides enough margin for SST on larger databases. Change-Id: Ia415f49a5486920426a09509af9df2d436c2d4a8 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> (cherry picked from commit 43d67f0475e8ea4fb2d11e1147fba06dbf22e6b6)
9 daysoctavia: Add OS_CACERT to octavia-openrc.shBartosz Bezak1-0/+3
Support a custom CA, as admin-openrc.sh already does. Closes-Bug: #2172300 Change-Id: I767e0b8b42c90a2173c971af58a12fe1e3b98838 Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com> (cherry picked from commit 0d67c875466b2ff6fb23deae1bc675a32ce807e2)
2026-10-22Merge "Fix Fluentd OpenSearch output address" into stable/2026.1Zuul2-2/+2
2026-10-16Fix container unhealthy checksKuchinskiy Alexey1-2/+2
An issue with skipping "healthy check" checks has been resolved. In task "Fail if containers are unhealthy" in variable "unhealthy_containers" not appending services with status "unhealthy", because path to the status incorrect, and search in filter "selectattr" not work. Tasks skiping, because in variable "unhealthy_containers" not items. Closes-Bug: #2156900 Change-Id: I52f78774536e4487c38a500c2c8941eae4386604 Signed-off-by: Kuchinskiy Alexey <kuchinalser@gmail.com> (cherry picked from commit d30fad4325b80cc82f485a979c0afeaf7647b07f)
2026-10-14Fix Fluentd OpenSearch output addresskkaptanoglu2-2/+2
Prefer opensearch_address when it is set, allowing Fluentd to reach an external or legacy Elasticsearch/OpenSearch endpoint instead of relying only on the opensearch inventory group. Use opensearch_address only when it differs from kolla_internal_fqdn. This keeps the default VIP deployment using the OpenSearch inventory addresses. Closes-Bug: #2163144 Change-Id: Ibde86a916c4fa764100bf33675f4c416b5179532 Signed-off-by: kkaptanoglu <kkaptanoglu@vmind.com.tr> (cherry picked from commit a68e99bbaead4a0415668103fa18a8169101528b)
2026-10-13Merge "Revert^2 "Add HAProxy timeout variables for cloudkitty API"" into ↵Zuul1-0/+12
stable/2026.1
2026-10-12Fix ETCD health check hardcoded to HTTPWarren Jeffs1-1/+3
The ETCD health check assumes HTTP regardless of the configured protocol, causing incorrect health status when ETCD is configured to use TLS/HTTPS. Closes-Bug: #2167236 Change-Id: I55810de8f6b2c3e318cb3dbb6431e9dd09c1a4a8 Signed-off-by: Warren Jeffs <me@warrenjeffs.me> (cherry picked from commit ba60dba12ef0ac5d5f04795982d320e468c9b524)
2026-10-09Merge "Fix ProxySQL not using backup writer node for reads" into stable/2026.1Zuul1-1/+1
2026-10-07Add env option service-uwsgi-config roleMichal Arbet2-0/+4
Allow passing the optional env setting to uWSGI via service_uwsgi_config_env. Required for fix https://review.opendev.org/c/openstack/kolla-ansible/+/997843. Change-Id: I695038732ecc022840a6b1c6b8c22495051be2fa Closes-Bug: #2160218 Signed-off-by: Michal Arbet <michal.arbet@ultimum.io> (cherry picked from commit 03b6a6063dfcc607c9a7b825664d82806d3974a2)
2026-10-05Merge "Fix trailing comma bug in DockerWorker.generate_tls()" into stable/2026.1Zuul1-2/+2
2026-10-01Revert^2 "Add HAProxy timeout variables for cloudkitty API"Dawud1-0/+12
This reverts commit c62d5e509b74fd39b09c272fb731b73088c3a55b. Reason for revert: Fixing broken tests Change-Id: Iea1d9ad71c64642fadb7d02d50f9421cbe64acb7 Signed-off-by: Dawud <dawud@stackhpc.com> (cherry picked from commit 1839ef9a957432b08c81756780e20d7374e5bb89)
2026-09-25Include CA for database TLS on MariaDB backupSeunghun Lee3-0/+20
When database backend TLS was implemented [1], the CA was not set for Mariabackup configuration. [1] https://review.opendev.org/c/openstack/kolla-ansible/+/909912 Closes-bug: #2168443 Change-Id: I2d88af7c61bb609311a5f0a820a501d006f8e454 Signed-off-by: Seunghun Lee <seunghun@stackhpc.com> (cherry picked from commit 7c64ed9ff0509b4001d319f620d4bfe68ae9dfdb)
2026-09-23Merge "kolla-toolbox: remove leftover kolla-toolbox.json.j2" into stable/2026.1Zuul1-42/+0
2026-09-17Fix ProxySQL not using backup writer node for readsFranciszek Przewozny1-1/+1
Set writer_is_also_reader to 2 in the Galera hostgroup configuration so that the backup writer node also serves reads, instead of sitting idle while all read traffic went to the single remaining reader node. The writer node is never added to the reader hostgroup regardless of this setting, only the backup writer is affected. See bug report for performance difference details. Closes-Bug: #2167037 Change-Id: Ib5145c200c3cd70f861824abd967748faf61e1cf Signed-off-by: fprzewozn <przewozny.franciszek@gmail.com> (cherry picked from commit 42eec877ff572fd724af8a1c0fa64acf5e824c7b)
2026-09-16Merge "prometheus: accept vault-encrypted values in precheck" into stable/2026.1Zuul1-4/+4
2026-09-16prometheus: accept vault-encrypted values in precheckFranciszek Przewozny1-4/+4
Ansible's "is string" Jinja test returns False for values encrypted with ansible-vault (AnsibleVaultEncryptedUnicode), so a precheck using such an encrypted password/salt failed incorrectly. Accept the value if it is either a plain string or vault_encrypted. Closes-Bug: #2115495 Change-Id: I0bf783c40ca5be66717193be9dece971805fca55 Signed-off-by: fprzewozn <przewozny.franciszek@gmail.com> (cherry picked from commit ed74de7e9a76fac01554fc876c4a581b857903ea)
2026-09-16Update enable_letsencrypt to boolean validationjayjahns2-6/+6
Fixes the enable_letsencrypt to properly use boolean instead of a string. Currently breaks acme in its current state. Co-Authored-By: Bartosz Bezak <bartosz@stackhpc.com> Closes-bug: #2164956 Change-Id: Iae8770438ba63717030cc4ec8662f5ca0f6c9168 Signed-off-by: jayjahns@gmail.com Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com> (cherry picked from commit e372288577a189d8798e326c3ff2bd104b4a84a0)
2026-09-15Merge "Register keystoneauth options for [glance] config group" into ↵Zuul1-0/+12
stable/2026.1
2026-09-10Fix trailing comma bug in DockerWorker.generate_tls()Tikhon Masalov1-2/+2
In generate_tls(), tls_cert and tls_key were assigned with trailing commas, which caused them to become single-element tuples (None,) instead of None. This made the if tls_cert: check always true, leading to TypeError when check_file() received a tuple instead of a string path. Remove the trailing commas so tls_cert and tls_key are plain values. Remove TestTLS.setUp(_get_host_timezone) for stable branches: _get_host_timezone does not exist in kolla_container_worker.py on older branches, causing AttributeError in TestTLS setUp. Closes-Bug: #2166845 Change-Id: I06b8876838ee2ec3c20c9a98448fc9e5588f32cd Signed-off-by: Tikhon Masalov <t.masalov@maxima-int.com> (cherry picked from commit 2f8958235bc16a89a33c0711f1dfcb7bca87a1a9)
2026-09-10kolla-toolbox: Retry ansible --version checkMichal Nasiadka1-0/+4
We've seen CI failures multiple times when the container was not yet up before this check ran Change-Id: Ib78e27ac4e06a39ed76c410a000ed3d3d647bd2e Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> (cherry picked from commit c35e2181a391aa36e79ab0b8dc7b2cd6583f57ee)
2026-09-09Merge "Remove unsupported ovn_emit_need_to_frag option" into stable/2026.1Zuul1-1/+0
2026-09-08rabbitmq: fix precheck missing backend TLS cert fallbackFranciszek Przewozny1-0/+2
service-cert-copy falls back to kolla_tls_backend_cert/key when no rabbitmq-specific cert is found, but the precheck did not check for this path, causing a false failure when relying on the shared backend certificate. Closes-Bug: #2166283 Change-Id: I75d4b33fc893bcf0793c1280981574bcdf3f3002 Signed-off-by: fprzewozn <przewozny.franciszek@gmail.com> (cherry picked from commit a54ad717f08a8258424004e6224a36ea561393d2)
2026-09-08Remove unsupported ovn_emit_need_to_frag optionPierre Riteau1-1/+0
This option was removed from Neutron in 2026.1 [1]. It was true by default since 2025.1 anyway [2]. [1] https://review.opendev.org/c/openstack/neutron/+/962881 [2] https://review.opendev.org/c/openstack/neutron/+/930608 Change-Id: I7b393ad92eb82506023cffbfd43888d37b305c9a Signed-off-by: Pierre Riteau <pierre@stackhpc.com> (cherry picked from commit 93cab7f37a3b8fd308efb933c357b40dd18a948a)
2026-09-03Fix compare_labels when image doesn't existAlex Welsh2-1/+5
check_image() from kolla_docker_worker returns None when the image doesn't exist locally. This means that when compare_labels tries to read a value from it, it will error out. This chain happens when comparing an image that doesn't exist locally. In the past we didn't hit this because checks ran sequentially and it would exit before hitting this. A recent change [1] means that now all checks run always. This patch fixes the issue in two ways. First, it makes the docker worker return an empty dict from check_image when it doesn't exist. Second, compare_labels now truthy-checks the output before proceeding, and returns straight away if it's False. [1] https://review.opendev.org/c/openstack/kolla-ansible/+/978162 Change-Id: I3c33ac3a474f80bca100005f61c1c0bfedc46170 Signed-off-by: Alex Welsh <alex@stackhpc.com> Closes-Bug: #2166024 (cherry picked from commit ffc50e8d33ade7a0d58ef83b79ed296a28b49608)
2026-09-03Remove Disable Getting Started panel Grafana tasksAlex Welsh3-17/+10
Since Grafana 13.2, the api/user/helpflags/1 endpoint has been removed [1]. This means the "Disable Getting Started panel" deployment task fails with 404 when a custom home dashboard is added. The best alternative I can find is to set default_home_dashboard_path in grafana.ini, which disables the panel anyway [2] [1] https://github.com/grafana/grafana/pull/124916 [2] https://github.com/grafana/grafana/pull/28750 Change-Id: I78b8657b6ca94d81e3becbba9d5a476d9427658f Signed-off-by: Alex Welsh <alex@stackhpc.com> Closes-Bug: #2166048 (cherry picked from commit c8e7b85b2707f762b2560ad8bed9d107a30ff521)
2026-09-01Register keystoneauth options for [glance] config groupPiotr Milewski1-0/+12
Cinder requires service-to-service authentication with Glance to fetch direct image locations (e.g., for RBD CoW cloning). Because keystoneauth parameters were not explicitly registered for the [glance] section, they could not be properly configured and loaded. This lack of authentication led to HTTP 403 Forbidden errors during fetch_image_location, forcing a fallback to slow image downloads. This patch registers the required keystoneauth options in the [glance] group, enabling proper service-to-service communication. Closes-Bug: #2161971 Change-Id: I2cae59b34b1fbd4fa3bf1c5b2da5277ef4712916 Signed-off-by: Piotr Milewski <vurmil@gmail.com> (cherry picked from commit 1056bc652b148bddc5d4cb667c8d3ef26a322aa9)
2026-08-31etcd: Fix deploy with stopped etcd containerBartosz Bezak1-0/+10
Skip leader lookup for stopped etcd containers. This may occur when replacing a controller while preserving Docker volumes. Closes-Bug: #2165007 Change-Id: Id0a9090592980d142413bea23c61c17b43cb7f8a Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com> (cherry picked from commit acf6744ba14a2060e762294b039a5bbb832e8e2e)
2026-08-25mariadb: Back up from the local database instanceBartosz Bezak2-5/+3
Mariabackup copies the data directory of mariadb_backup_host but connected through the load balancer, so backup_replica.sh could redirect it to another Galera member. The backup lock then applied to the wrong node, leaving the copied files unquiesced. Connect to api_interface_address and mariadb_port instead, and always use the local backup script. MariaDB 10.11.19 and 11.4.13 no longer tolerate the mismatch. mariadb_backup_target now has no effect, and full backups are named mysqlbackup-<date>.qp.xbc.xbs.gz, as the restore docs describe. Closes-Bug: #2165011 Related-Bug: #2125124 Change-Id: I33ebd36c728ff50df8ebf13fc5af9882a0e71d23 Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com> (cherry picked from commit f1f2702bbe812e285f0766a5787159ba92fdce8b)
2026-08-24merge_configs: Add lstrip_blocksMichal Nasiadka2-4/+10
Closes-Bug: #2164718 Change-Id: If5b7f30d2467b61c3578d09992faf446b5d25f4e Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> (cherry picked from commit 0f4da209da6fa39739ffc7b7fb1a69dc967734b7)
2026-08-19Extend the nova_scheduler healthcheck timeout.Michael Still1-1/+5
Nova changed in 2026.1 how long their services take to gracefully shutdown. The default value of [DEFAULT]/graceful_shutdown_timeout has been changed from 60 to 180 seconds for all Nova services. [...] Operators using external system (e.g. k8s, systemd) to manage the Nova services should ensure that their service stop timeouts are set to at least graceful_shutdown_timeout to avoid forcefully killing service before Nova finish its graceful shutdown. Kolla-Ansible failed to update the period of time that ansible waits for Nova services to shut down. This causes both CI failures and failures for deployers when trying to manage some Nova containers. Prompt: Michael asked for assistance debugging why CI jobs were failing with nova-scheduler timeouts. Assisted-By: Claude Opus 5 (1M context, high effort) <noreply@anthropic.com> Co-Authored-By: Claude Opus 5 (1M context, high effort) <noreply@anthropic.com> Closes-Bug: #2162860 Change-Id: If7c5a6d885b19e39cfc305440424f10de3a5ea05 Signed-off-by: Michael Still <mikal@stillhq.com> (cherry picked from commit 4ce86ef1db631c15e6e5e142d2908f73348377d4)
2026-08-12fix: Delegate fernet key distribution to correct hostOwen Jones1-4/+2
The key used to group hosts was previously changed[0] but the group not updated in the task used to distribute fernet keys. When migrating hosts this could lead to the task being delegated to a host without keys, resulting in all hosts losing their keys. 0: Change I1db88e28a828ebf073f018b2bae1d9556ec22807 Closes-Bug: #2163158 Change-Id: Ia76f3e6cb41a30b88ac885832755ebe5264ad9fc Signed-off-by: Owen Jones <owen@stackhpc.com> (cherry picked from commit 541a26c7d4dd1988eda64327c6b08aa831ee3162)
2026-08-11kolla-toolbox: remove leftover kolla-toolbox.json.j2Michal Arbet1-42/+0
Template is no longer used as kolla-toolbox is deployed in kolla_toolbox role now. This removes obsolete and unused file. Change-Id: I3c0ea709cd5478257649b7db77c9c97be4874cb2 Signed-off-by: Michal Arbet <michal.arbet@ultimum.io> (cherry picked from commit f5df7b28b86ccf735fe1daf83eb9b8be4a31d476)
2026-08-04Fix Docker cpuset dimension comparisonLoan Harrouin1-0/+8
When enabling cpuset_cpus or cpuset_mems on existing Docker containers, Docker may report the current value as an empty string when no cpuset constraint is configured. These dimensions are cpuset-list strings, not numeric resource values. Compare them as strings in the Docker worker instead of passing them through the numeric dimension comparison logic. Closes-Bug: 2143874 Change-Id: I1b8cd72846b28f556c8f9a0ba114a8af9221e85a Signed-off-by: Loan Harrouin <loan.harrouin@gmail.com> (cherry picked from commit 8304bb3884237bf5aee1c60715d097e88561d56d)
2026-07-30Ensure OpenSearch waits for recovery during upgradeAlex Welsh3-1/+52
Change-Id: I8825f41a1753eb323e0fdf1bf38a679670e01ba7 Signed-off-by: Alex Welsh <alex@stackhpc.com> (cherry picked from commit 37194fcab7883b8626f2eab5a4f6a19246b85ec9)
2026-07-29Merge "cinder: Define backend variables in group_vars/all" into stable/2026.1Zuul2-50/+62
2026-07-29Revert "Ensure OpenSearch waits for recovery during upgrade"Franciszek Przewoźny2-44/+0
This reverts commit 79f6f2a049bad1d3cb51ba50981a01f63503a329. Reason for revert: post-config job leaks OpenSearch secret to logs (see failed prometheus-opensearch jobs) Change-Id: I63432e19c42ac9f3eebebadb474882ccda3780ed Signed-off-by: fprzewozn <przewozny.franciszek@gmail.com>
2026-07-28cinder: Define backend variables in group_vars/allKari Häkkinen2-50/+62
The iscsi role derives the cinder-volume/backup inventory groups from cinder_enabled_backends, but that variable (along with cinder_backends, cinder_ceph_backends and the cinder_backend_*_name variables) was only defined in the cinder role defaults. The iscsi play runs before the cinder play, so the variable is out of scope there and prechecks (and deploy/reconfigure) fail with: 'cinder_enabled_backends' is undefined when a Cinder iSCSI/LVM backend is enabled. Move these backend variable definitions to group_vars/all/cinder.yml so they are in scope for every play, including the iscsi role. This also keeps all cinder backend definitions - including the cinder-backup ceph backend (cinder_backup_backend_ceph_name, cinder_backup_ceph_backend) - in one place. All of their dependencies (the enable_cinder_backend_* flags, cinder_backend_ceph and the ceph_* variables) are already global, and globals.yml is applied as extra-vars, so operator overrides continue to take precedence. Partial-Bug: #2158120 Change-Id: I765f45814382377332ba9f01f1bc52bd4e046170 Signed-off-by: Kari Häkkinen <Kari.Hakkinen@admicom.com> (cherry picked from commit 2df2ee6e49d0fd58b1781c0b490b019e1936e96b)
2026-07-28keystone: allow multiple OIDCXForwardedHeaders optionsMichel Raabe1-1/+1
The OIDCXForwardedHeaders directive from mod_auth_openidc accepts a space-separated list of header names and parses each one as a separate argument. The keystone httpd template wrapped the value in double quotes, so Apache passed the whole list as a single argument. As a result, only a single forwarded header could be configured and setting more than one value failed. Remove the surrounding quotes so that each header name is parsed as an individual argument, allowing more than one forwarded header to be set. Closes-Bug: #2155147 Change-Id: Id23fbdf6c82acdec1ee310b6b29fc4a5dc846f66 Signed-off-by: Michel Raabe <raabe@b1-systems.de> (cherry picked from commit 6a710101850a13518d66bd0e7c27a3ee54a3c2d8)
2026-07-27Merge "Ensure OpenSearch waits for recovery during upgrade" into stable/2026.1Zuul2-0/+44
2026-07-27Merge "Fix valkey-sentinel image tag" into stable/2026.1Zuul1-2/+2
2026-07-27Ensure OpenSearch waits for recovery during upgradeAlex Welsh2-0/+44
There's actually two fixes here The first waits until the OpenSearch state is healthy before moving on to Dashboards. Otherwise, OpenSearch Dashboards does its internal `.kibana` index migration before OpenSearch has fully recovered. This creates a corrupted `.kibana_1` index, making Dashboard enter an infinite polling loop and fail to start. The second adds retries to the "Create OpenSearch Dashboards Index Pattern" task. Dashboards seems to take a while to start up post-upgrade, I think again, it's doing some internal migrations for the latest version. Without first checking the API is ready, it consistently fails to be ready, and throws 503s by the time we try to create index patterns. Change-Id: Ic06ccc6b7ec22fa1b0cfa2a144878672d314e93e Closes-Bug: #2161333 Signed-off-by: Alex Welsh <alex@stackhpc.com> (cherry picked from commit 79f6f2a049bad1d3cb51ba50981a01f63503a329)
2026-07-27Merge "Wait for slaves to sync before the recovery master restart." into ↵Zuul1-0/+24
stable/2026.1
2026-07-27Fix valkey-sentinel image tagSeunghun Lee1-2/+2
Currently, the variable ``valkey_sentinel_tag`` uses the value of ``openstack_tag`` when it needs to inherit the value of ``valkey_tag``. Furthermore, ``valkey_sentinel_image_full`` does not use the tag value from ``valkey_sentinel_tag``. These two problems make valkey container deployment act different to what's expected from deploying other service containers, which leads to confusion. Closes-Bug: #2161716 Change-Id: Iec0b128736f4dde5bb3265b350555f824aba004c Signed-off-by: Seunghun Lee <seunghun@stackhpc.com> (cherry picked from commit 7f038b5b2c12b01e713b2d294112d711d5487286)
2026-07-27Wait for slaves to sync before the recovery master restart.Michael Still1-0/+24
During mariadb_recovery, recover_cluster.yml starts the bootstrap node, starts the slave containers, and then recreates the master container to clear pc.bootstrap. The "Wait for slave MariaDB" task between those steps only waits for the service port to open, but a freshly started slave is still receiving its state transfer (SST then IST) at that point. The master restart is a Galera cluster membership change, and a membership change while a joiner is mid-IST makes the joiner abort with "IST didn't contain all write sets, expected last: N last received: N-1 ... node restart required". The joiner then drops to non-primary, self-leaves, and sits permanently wsrep-disconnected; nothing restarts it, and the Galera readiness check added by commit aed9d890 fails the recovery. Over the last 30 days this hit 16 of 954 mariadb scenario CI runs (1.7%), was terminal in every case, and accounts for about 30% of all failures in those jobs, across Debian, Ubuntu and Rocky. The Ubuntu failures are on MariaDB 11.4.12, which already contains the upstream fixes for MDEV-36621 and MDEV-39643, so this window has to be closed at the orchestration layer. Add a wait for every slave to report wsrep_local_state_comment Synced before the master restart, using the same defensive until pattern as the bootstrap WSREP sync wait. The retry budget is larger than the port waits because a slave may legitimately still be receiving an SST at this point. Prompt: Michael asked for a kerbside-patches patch fixing the mariadb_recovery IST race we diagnosed from the kolla-ansible 989612 gate failures, where the master restart during recovery races slaves that are still receiving state transfer. Assisted-By: Claude Fable 5 (200K context, medium effort) <noreply@anthropic.com> Co-Authored-By: Claude Fable 5 (200K context, medium effort) <noreply@anthropic.com> Closes-Bug: #2161773 Change-Id: Ifd0260fa4875051b1c38ee52de4f0de1806f6cc9 Signed-off-by: Michael Still <mikal@stillhq.com> (cherry picked from commit cb259a3914180234cef888ddfe34b54f60f240a0)
2026-07-25Make the MariaDB WSREP sync wait defensive.Michael Still1-1/+1
The "Wait for first MariaDB service to sync WSREP" handler runs immediately after MariaDB opens its service port, and queries wsrep_local_state_comment via the kolla_toolbox mysql_query module. The first attempt frequently races MariaDB's privilege bootstrap, so mysql_query can return a failure-shaped dict that has no query_result key. The existing until expression then dies with a Jinja AttributeError on result.query_result[0][0]['Value'], and Ansible treats a template error in until as a hard failure instead of "still false, retry". The configured retries: 10 / delay: 6 budget is therefore never spent. Guard the until expression so it only inspects query_result when it is defined. mysql_query failures then leave the conditional cleanly false, and the existing retries: 10 / delay: 6 budget actually gets used. The first successful query lands within one or two retries on every matrix we have seen. Prompt: Michael asked for a patch that makes the MariaDB WSREP sync wait defensive so that the existing retry budget actually applies when the first mysql_query call comes back without a query_result key. Assisted-By: Claude Opus 4.7 (1M context, medium effort) <noreply@anthropic.com> Co-Authored-By: Claude Opus 4.7 (1M context, medium effort) <noreply@anthropic.com> Change-Id: I4e5d7c2a8f9b1d3e6a4c5b8d2f1e0a3c4b5d6e7f Signed-off-by: Michael Still <mikal@stillhq.com> (cherry picked from commit c7792108f78eba3aae3f6278e3e21220b78aa5f9)
2026-07-23Merge "rabbitmq: Bump default rabbit_qos_prefetch_count from 1 to 50" into ↵Zuul1-1/+1
stable/2026.1
2026-07-23Merge "prometheus: Fix Grafana blackbox endpoint checks" into stable/2026.1Zuul1-2/+4
2026-07-23rabbitmq: Bump default rabbit_qos_prefetch_count from 1 to 50Michal Nasiadka1-1/+1
rabbit_qos_prefetch_count was previously set to 1, the lowest value permitted by oslo.messaging when rabbit_stream_fanout is enabled (oslo.messaging requires prefetch_count > 0 for stream queues, since the stream protocol needs a positive credit window to make progress). However, non-zero is not the same as optimal. RabbitMQ's own quorum queue documentation recommends the opposite of what a prefetch of 1 provides: "Quorum queues also benefit from consumers using higher prefetch values to ensure consumers aren't starved whilst acknowledgements are flowing through the system and allowing messages to be delivered in a timely fashion." -- https://www.rabbitmq.com/docs/quorum-queues With rabbit_quorum_queue enabled by default alongside rabbit_stream_fanout, prefetch=1 forces every quorum-queue consumer (nova-conductor, neutron-server, cinder-volume, etc.) into fully serialized delivery: RabbitMQ will not deliver the next message to a channel until the previous one has been acked. Combined with a small worker count, this can turn a burst of RPC traffic into a queueing delay long enough to exceed rpc_response_timeout, surfacing as a false-positive MessagingTimeout with no actual broker outage. Bump the default to 50. This keeps the value legal for stream queues (still > 0), keeps a bound on how much a single consumer can hold in flight, but gives quorum-queue consumers enough headroom to avoid unnecessary serialization and consumer starvation under load. This is a shared value across all services using oslo_messaging_rabbit, so it is intentionally conservative rather than tuned per-service; operators with specific throughput requirements can still override om_rabbitmq_qos_prefetch_count. See [1]. [1]: I541f704bfa2e98068096331afbdb591659cbc40b Change-Id: Iea474a553cb8bd3920ef89c148f63b1c7b1b8dbc Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> (cherry picked from commit 1ccf97e6234dea12811f0a1270055015bd403079)
2026-07-23Merge "[stable-only] Split CA of ProxySQL internal TLS and backend TLS" into ↵Zuul4-1/+35
stable/2026.1
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 14:43:12 +0000