aboutsummaryrefslogtreecommitdiff
path: root/doc/source/reference
AgeCommit message (Collapse)AuthorFilesLines
2026-09-17Remove leftover mention of Linux bridge driverPierre Riteau1-4/+4
This reference was missed during the removal of the Linux bridge mechanism driver [1]. [1] https://review.opendev.org/c/openstack/kolla-ansible/+/962278 Change-Id: Iff92e75a594a4888cf4cd179d7ac5de46e5c7f09 Signed-off-by: Pierre Riteau <pierre@stackhpc.com> (cherry picked from commit bf02dd405a084ffd680bc5a835b8ab48e76485f6)
2026-09-03Remove Disable Getting Started panel Grafana tasksAlex Welsh1-0/+3
Since Grafana 13.2, the api/user/helpflags/1 endpoint has been removed [1]. This means the "Disable Getting Started panel" deployment task fails with 404 when a custom home dashboard is added. The best alternative I can find is to set default_home_dashboard_path in grafana.ini, which disables the panel anyway [2] [1] https://github.com/grafana/grafana/pull/124916 [2] https://github.com/grafana/grafana/pull/28750 Change-Id: I78b8657b6ca94d81e3becbba9d5a476d9427658f Signed-off-by: Alex Welsh <alex@stackhpc.com> Closes-Bug: #2166048 (cherry picked from commit c8e7b85b2707f762b2560ad8bed9d107a30ff521)
2026-06-29Tune libvirtd connection limits for OpenStackMichael Still1-0/+23
The libvirt daemon ships with max_workers=20 and max_client_requests=5. Those defaults suit a multi-tenant host serving many mutually distrustful clients, where the per-client request cap protects the daemon from any single client monopolising it. Under Kolla-Ansible, nova-compute is effectively the sole privileged client of libvirtd, so the cap of 5 concurrent requests per client becomes the binding constraint rather than a safety net. When several instances build at once -- as they do during the tempest run of the upgrade jobs -- nova-compute's concurrent libvirt RPCs (instance defineXML calls plus the resource-tracker periodic) exceed five. Further requests queue, the connection's keepalive responses are starved, and after keepalive_interval (5s) x keepalive_count (5) = 25s libvirtd closes the connection. nova then sees "Cannot recv data: Input/output error" mid-defineXML, the build is rescheduled, and once all hosts are exhausted the instance is left in ERROR. This presents as flaky upgrade-job failures. Example failure, on the voting kolla-ansible-debian-bookworm-upgrade job (stable/2025.2): https://zuul.opendev.org/t/openstack/build/73ff5a97567d4e05b1774170e0f4aada with primary/logs/kolla/libvirt/libvirtd.txt showing libvirt's own recommendation to tune this parameter: warning : Client hit max requests limit 5. This may result in keep-alive timeouts. Consider tuning the max_client_requests server parameter ... error : connection closed due to keepalive timeout Raise the per-client cap to 20 -- comfortably above the handful of concurrent builds plus periodics seen in practice -- and the worker pool to 50 so that lifting the per-client limit does not starve other connections such as live migration, health checks and periodic tasks. Both values are exposed as variables (libvirt_max_client_requests and libvirt_max_workers) so operators can tune them further. This is not a Kolla-specific workaround -- the stock libvirtd.conf comment warns that setting max_client_requests too low "may cause keepalive timeouts", and since 2022 libvirtd emits the runtime warning quoted above. As Daniel Berrange explained when he added that warning, the keepalive packets "are subject to the 'max_client_requests' limit just like any API calls", so a client that saturates the limit can have its connection dropped: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/5NIJPA7SJVY55VSK7RTEDEHKWOZYJKT6/ Red Hat documents the same tuning for libvirt hosts under load in its knowledge base, notably "Too many active clients are dropping the connection" at https://access.redhat.com/solutions/28146. Assisted-By: Claude Opus 4.8 (1M context, medium effort) Partial-Bug: 2158515 Change-Id: I131c3d4d57dc73ca4dd421cc8f28465248c9830e (cherry picked from commit 5acd2f91d22213ef04bd6988a2a0261982b0cf05) Signed-off-by: Michael Still <mikal@stillhq.com>
2026-06-19docs: warn about password resets in ceph RGW docBertrand Lanson1-0/+9
Keeping this value to true with external RGW as object storage endpoints can cause outages that are annoying to recover from. We should warn operators about this. Change-Id: I37965382bed6b9762782ec3f9ec3103143d738cc Signed-off-by: Bertrand Lanson <bertrand.lanson@infomaniak.com> (cherry picked from commit 8510b763fec5fbfdcd677177809c682eb69e97dc)
2026-05-06Merge "opensearch: automate index pattern creation in dashboards"Zuul1-14/+32
2026-04-27opensearch: automate index pattern creation in dashboardsPiotr Milewski1-14/+32
Previously, operators had to manually create the default index pattern after the first login to OpenSearch Dashboards. This commit automates the creation of the default index pattern using the OpenSearch Dashboards Saved Objects API during the post-config phase. The pattern is dynamically named based on the opensearch_log_index_prefix variable (defaulting to "flog-*") and automatically sets "@timestamp" as the time field. Documentation has been updated to reflect that the first-login manual setup is no longer required for the default log indices. Change-Id: I8d49a270ace187b3b13103452e93d305505f6cbb Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-04-27Merge "Drop zun and kuryr"Zuul5-214/+1
2026-04-27Merge "Make RabbitMQ stream retention policy configurable"Zuul1-0/+31
2026-04-27Drop zun and kuryrMichal Nasiadka5-214/+1
Zun is broken in 2026.1, it has been released broken and there are no reviews on the patch to fix it [1]. [1]: https://review.opendev.org/c/openstack/zun/+/982362 Depends-On: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/986150 Change-Id: I8ced621754d03c44b7672dd94fc3d7d2173ac734 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-24Make RabbitMQ stream retention policy configurableSeunghun Lee1-0/+31
When fanout queues are set to be RabbitMQ stream, number of ready messages in stream queues grow large. This is because retention policy of stream is only applied when stream segments hit the maximum size. This change make the maximum size of RabbitMQ stream segment and the retention time configurable by new variables ``rabbitmq_stream_max_segment_size_bytes`` and ``rabbitmq_stream_segment_max_age`` respectively. NOTE: These are only applied when ``om_enable_rabbitmq_stream_fanout`` is set to ``true``. Change-Id: Iade5e525f0de8981a0e03e3340ad7552c2f40121 Signed-off-by: Seunghun Lee <seunghun@stackhpc.com>
2026-04-20Merge "cinder: Change default destination for cinder-volume/backup containers"Zuul1-34/+13
2026-04-17Merge "Implement neutron-ovn-vpn-agent"Zuul1-15/+26
2026-04-17cinder: Change default destination for cinder-volume/backup containersMichal Nasiadka1-34/+13
Kolla-Ansible defaulted for long time to deploy cinder-volume/backup containers on storage group, which is good for Cinder LVM deployments. Problem is - majority of deployments does not use Cinder LVM backend - they use mainly Ceph (based on OpenStack User Survey) and probably some other proprietary vendors which are API driven. Let's change the default to reflect reality. If a user has cinder lvm enabled - we will deploy it as it was before If a user has both cinder lvm and something else enabled - we will deploy cinder-volume and cinder-backup in both places (cinder group and storage group) If a user doesn't have cinder lvm enabled - we deploy only in the cinder group Change-Id: Ia4a874de8f1b8eab8ff688eab4c6af013449c18c Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-17Implement neutron-ovn-vpn-agentMaximilian Stinsky1-15/+26
This patch implements vpnaas for OVN environments. It deploys a standalone neutron-ovn-vpn-agent on neutron nodes. The container no longer requires 'privileged: true'. Running as the 'neutron' user with specific kernel capabilities ensures the agent can manage network namespaces and interfaces without full privileges. Added capabilities: - NET_ADMIN # manage interfaces, IPs, routing, firewall - SYS_ADMIN # create/manage network namespaces - SYS_PTRACE # allow 'ip netns exec' attach to processes - DAC_OVERRIDE # bypass file read/write restrictions - DAC_READ_SEARCH # allow directory traversal and file read - SETPCAP # retain capabilities for privileged ops Added security options: - apparmor=unconfined # disable AppArmor confinement - seccomp=unconfined # disable seccomp filtering - label=disable # disable SELinux/labeling Depends-On: https://review.opendev.org/c/openstack/kolla/+/924302 Closes-Bug: #2048392 Change-Id: I961b1407ae1402d146f0c09924df8e007e331af5 Signed-off-by: Joachim de Groot <joachim.de.groot@menzel-it.net> Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-04-16Merge "Fix: Update outdated documentation"Zuul30-88/+78
2026-04-15Fix keystone with IDP configured.Taavi Ansper1-0/+5
1. Add CI coverage for keystone_identity_providers under federation scenario. 2. Add fix for federation config in keystone role if keystone_identity_providers is defined. 3. Update Horizon tests with federation example. 4. Use openstack.cloud ansible modules instead of python-openstackclient in register_identity_providers.yml Closes-Bug: #2134455 Change-Id: Id03bc5770c3856c7c09a34e327b33786d7b7d859 Signed-off-by: Taavi Ansper <taaviansperr@gmail.com>
2026-04-12Fix: Update outdated documentationPiotr Milewski30-88/+78
Change-Id: I5dc53f74afd9a5b565201dc9d3039d82cb65dabc Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-04-07Remove deleted mod_auth_openidc optionPierre Riteau1-3/+3
The option OIDCTokenBindingPolicy was deleted from mod_auth_openidc [1]. Remove it from our documentation. SSO with Keycloak was successfully tested without it. Keep documentation about keystone_federation_oidc_additional_options by using OIDCOutgoingProxy instead. [1] https://github.com/OpenIDC/mod_auth_openidc/commit/f9a52507acee0817b9cc91ec194bcea894f77ee0 Change-Id: Icfe4ef0f6070a97c4e43f691643169e71cc2772a Signed-off-by: Pierre Riteau <pierre@stackhpc.com>
2026-04-03Add additional SPICE configuration optionsMichael Still1-0/+15
Recent changes to OpenStack Compute have added a number of new configuration options for SPICE VDI consoles. Additionally, it is not always desirable to enable the HTML5 transcoding proxy for SPICE consoles in Horizon. This patch adds configuration to globals.yml for most of these new options. Specifically: * nova_spice_html5: whether to enable the HTML5 transcoding proxy or not. Defaults to the previous behaviour of enabling the proxy. Notably, nova_spice_require_secure is not exposed here as it implies that qemu is configured to support TLS, and that TLS certificates have been configured in the nova_libvirt container. These changes are large, and are included in a separate patch for clarity. Additionally, OpenStack Compute added these configuration options in 2023.1, and they are exposed as well: * nova_spice_image_compression: "auto_glz" * nova_spice_jpeg_compression: "auto" * nova_spice_zlib_compression: "auto" * nova_spice_playback_compression: true * nova_spice_streaming_mode: "filter" All configuration options and their various values are documented by OpenStack Compute in their documentation. Partial-Bug: #2131793 (spice-direct consoles) Change-Id: I07f6890f1c7c4e543667d3cbd7b3e82bd9ec83e3 Signed-off-by: Michael Still <mikal@stillhq.com>
2026-03-30Merge "mariadb: add support for custom Galera notification script"Zuul1-0/+105
2026-03-30mariadb: add support for custom Galera notification scriptPiotr Milewski1-0/+105
This patch adds the ability for operators to provide a custom wsrep-notify.sh script to handle Galera cluster events (e.g., node status changes, membership updates). If a script is placed in the custom configuration directory on the control host (/etc/kolla/config/mariadb/wsrep-notify.sh), Kolla Ansible will copy it to the nodes, mount it into the MariaDB container at /usr/local/bin/ and enable 'wsrep_notify_cmd'. This enables integration with external systems like Alertmanager or local logging without hardcoding scripts into the roles. Change-Id: I7887889cb2e4038baeb566884cb847a71b5f99a6 Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-03-27kolla-ansible: Add RabbitMQ 4.2 support and dynamic upgrade pathsPiotr Milewski1-0/+31
The RabbitMQ version check currently hardcodes allowed version jumps. This makes supporting new major/minor releases (like 4.2) rigid and requires modifying the core task file. This commit introduces the `rabbitmq_allowed_upgrades` variable in the role's defaults. This allows operators to define explicit version jumps (e.g., 3.13 to 4.2) and makes the upgrade logic more flexible. The version validation logic now: 1. Checks for standard minor increments (e.g., 4.1 -> 4.2). 2. Checks for explicitly defined jumps in `rabbitmq_allowed_upgrades`. By moving these definitions to defaults, operators can easily override them in globals.yml if necessary. Depends-On: https://review.opendev.org/c/openstack/kolla/+/966017 Change-Id: I0e19cf109eb5665045806b7d925779e82164c2dc Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-03-27Merge "RabbitMQ: document handling stream replicas"Zuul1-0/+19
2026-03-25Merge "ovn-db: add support for ovn-northd extra command-line arguments"Zuul1-0/+9
2026-03-18Merge "Fix for Prometheus documentation"Zuul1-1/+1
2026-03-18Fix for Prometheus documentationRafal Lewandowski1-1/+1
Closes-Bug: #2102239 Change-Id: Ia8e551c62fc5d2d775098026d5d85611b81934fc Signed-off-by: Rafal Lewandowski <rafal@stackhpc.com>
2026-03-16Merge "Ironic parameter rework and default NTP server"Zuul1-0/+16
2026-03-16Merge "grafana: Add LDAP authentication support"Zuul1-0/+49
2026-03-16Ironic parameter rework and default NTP serverDoug Szumski1-0/+16
This patch moves the default Ironic kernel parameters from templates into variables located in the 'Kernel Parameters' section. Existing configurations are supported using existing variables. Default NTP configuration for the Ironic Python Agent (IPA) was also added in this patch. Change-Id: I2ef63233eae661ed056bfa215b2875f44e0b6134 Signed-off-by: Doug Szumski <doug@stackhpc.com>
2026-03-14Merge "influxdb/telegraf: Drop deployment"Zuul4-31/+2
2026-03-13grafana: Add LDAP authentication supportPiotr Milewski1-0/+49
This commit adds the ability to enable and configure LDAP authentication for Grafana. It introduces a new variable 'grafana_ldap_enabled' and automates the process of copying the 'ldap.toml' configuration file and updating 'grafana.ini'. Change-Id: I1f9de8202629904757840f5b2b5d0b8429e42f96 Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-03-04ovn-db: add support for ovn-northd extra command-line argumentsAntony Messerli1-0/+9
Adds the ovn_northd_cmdline_extras variable to allow operators to pass additional command-line arguments to the ovn-northd daemon. This enables customization of performance-related parameters such as thread count (--n-threads), parallel build (--use-parallel-build), and inactivity probe timeout (--inactivity-probe). The implementation follows the established cmdline_extras pattern used throughout kolla-ansible for services like Prometheus exporters. Closes-Bug: #2142316 Change-Id: I870034da10f80ff2208bbad529fa7de9a2548c06 Signed-off-by: Antony Messerli <antony@mes.ser.li>
2026-02-18RabbitMQ: document handling stream replicasMatt Crees1-0/+19
Closes-Bug: #2138290 Change-Id: Ic5fc1b7e801b28a2bb20b4a60146ac443ffe5ef0 Signed-off-by: Matt Crees <mattc@stackhpc.com>
2026-01-23influxdb/telegraf: Drop deploymentMichal Nasiadka4-31/+2
Kolla delivers InfluxDB v1, which is EOL (unless you have paid support). There are no plans in upgrading InfluxDB to v2 - so let's drop it. Telegraf was deprecated in June 2025. Removing both in one patch for convenience. Change-Id: Ieee2be3a06a5ac9504a822cc0a727e662146b260 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-01-06Standardize naming for MariaDB recovery and backup filesPiotr Milewski1-1/+1
This commit addresses and corrects the inconsistency in naming across multiple files within the project. Specifically, the terms mariadb_recovery and mariadb_backup have been replaced with mariadb-recovery and mariadb-backup respectively to adhere to the project's naming conventions and improve clarity. Change-Id: I47b80eaa0dc0487f506b47ca065951b5140e0d62 Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2025-12-23Merge "Add RabbitMQ management interface SSL"Zuul1-1/+0
2025-12-23Merge "Add support for libvirt swtpm (vTPM) configuration."Zuul1-0/+10
2025-12-15Add support for libvirt swtpm (vTPM) configuration.Franciszek Przewozny1-0/+10
Since both nova-compute and nova-libvirt Kolla images have swtpm packages installed [1], it is possible to configure vTPM for libvirt instances. This patch adds support for such configuration in kolla-ansible. [1] https://bugs.launchpad.net/kolla/+bug/2062572 Closes-Bug: #2106219 Change-Id: Ic7969b05bde258c38ee31fe2821aeb4e9c77a567 Signed-off-by: fprzewozn <przewozny.franciszek@gmail.com>
2025-12-11Merge "Add DNS server config for Ironic DHCP"Zuul1-0/+10
2025-11-17Add DNS server config for Ironic DHCPThomas Sell1-0/+10
Closes-Bug: #2061131 Change-Id: I061cdcf10e22beabe658687b3e67f8071f20df1a Signed-off-by: Thomas Sell <thomas.sell@bih-charite.de>
2025-11-06Replace Redis with ValkeyGrzegorz Koper1-3/+3
This change replaces Redis with Valkey, which is non-existent on Rocky Linux 10 / CentOS Stream 10 due to licensing issues. Co-Authored-By: Bartosz Bezak <bartosz@stackhpc.com> Co-Authored-By: Michal Nasiadka <mnasiadka@gmail.com> Change-Id: Ifcc6ec6e943c20867d969b0bdb0e4cbac53eea1e Signed-off-by: Grzegorz Koper <grzegorzk@stackhpc.com> Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com> Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-30Merge "Enable Neutron agent wrappers by default"Zuul1-1/+1
2025-10-30Merge "Support ironic-pxe-filter"Zuul1-0/+20
2025-10-30Merge "Run neutron-ovn-metadata-agent haproxy processes in separate containers"Zuul1-2/+3
2025-10-29Enable Neutron agent wrappers by defaultBartosz Bezak1-1/+1
Neutron agent wrappers are now enabled by default. Wrapper containers restart DHCP, L3, and related agents without having to respawn the main service containers, which reduces dataplane disruptions during upgrades and restarts. Operators who need the previous behaviour can set ``neutron_agents_wrappers`` to ``"no"`` in ``/etc/kolla/globals.yml``. Change-Id: I755e3dfcd326f7c1c05c1e9275dda93753db5873 Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
2025-10-29Run neutron-ovn-metadata-agent haproxy processes in separate containersMaximilian Stinsky1-2/+3
Follow up on Iaa1e687152db8351bc0e9b10e66f412860ac13a5 This patch implements the same experimental feature of running processes in seperated containers to the neutron-ovn-metadata-agent Co-Authored-By: Bartosz Bezak <bartosz@stackhpc.com> Depends-On: https://review.opendev.org/c/openstack/kolla/+/960726 Change-Id: If42aa11735bee963afc33d2e06541e1d9aab0515 Signed-off-by: Maximilian Stinsky <maximilian.stinsky-damke@wiit.cloud> Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
2025-10-24Support ironic-pxe-filterWill Szumski1-0/+20
Closes-Bug: #2094790 Depends-On: https://review.opendev.org/c/openstack/kolla/+/939256 Change-Id: I1b5329d814432604640990b0ecc28906845e29d6 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> Signed-off-by: Will Szumski <will@stackhpc.com>
2025-10-17Add RabbitMQ management interface SSLFranciszek Przewozny1-1/+0
This change implements RabbitMQ management interface SSL configuration when ``rabbitmq_enable_tls`` is enabled. Change-Id: Iaedad0e13f81b546af3a8e0c1e6ae7ca9da994a4 Signed-off-by: fprzewozn <przewozny.franciszek@gmail.com>
2025-10-10Merge "Customize the authentication error timeout page in modOIDC"Zuul1-0/+14
2025-10-09Customize the authentication error timeout page in modOIDCRafael Weingärtner1-0/+14
There is a situation that happens when a user triggers an authentication in OpenStack that uses Identity federation, which leads users to a blank page with an error message that might not be that clear to users. If the user takes too long to enter his/her credentials in the login page of the IdP, the user sees a page saying that the authentication took too much and that the user must try it again. However, if the user tries again, she/he is already logged in to the IdP, and then the user gets access direct to Horizon. This whole process can be a bit confusing for users, and they saw an error page after the login, which leads them to think that there was an error in the authentication, but then when he/she tries again, everything just works. Therefore, to handle such cases we propose Kolla-ansble to use a custom error page that has an automatic redirect if the error happens. The timeout is managed by "OIDCStateTimeout" variable. The default (which is what we have in place now) is 300 seconds (5 minutes): https://github.com/zmartzone/mod_auth_openidc/blob/d13ee0e4bd2cef94c4d2b55829310175288e0bdf/src/mod_auth_openidc.c#L651). I would not recommend the increase of this timeout though. I would rather decrease this value; 5 minutes to such an operation is already too much. This variable can be overridden via wsgi-keystone.conf file. To customize the error page we have the following variable "OIDCHTMLErrorTemplate". The template is processed in the following line: https://github.com/zmartzone/mod_auth_openidc/blob/f2b8315cd48faba04320e9a06fc52b57f0989dcb/src/util.c#L1619. As we can see, there is no default page. The default HTML is hardcoded in C++, and the template requires two "%s" placeholders that will receive the title of the error message and the full description of the error. Change-Id: Iebda3ca7a5f9cef7e5e0930fc4f70764774d6ed5 Signed-off-by: Rafael Weingärtner <rafael@apache.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 19:13:21 +0000