aboutsummaryrefslogtreecommitdiff
path: root/roles
AgeCommit message (Collapse)AuthorFilesLines
2026-05-06Merge "prechecks: Add a precheck if using test images (quay.io/openstack.kolla)"Zuul3-0/+3
2026-05-05prechecks: Add a precheck if using test images (quay.io/openstack.kolla)Michal Nasiadka3-0/+3
Change-Id: I2babda3d1388f1ee825fa79a1d85d3113b5ecbd4 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-27Drop zun and kuryrMichal Nasiadka1-2/+0
Zun is broken in 2026.1, it has been released broken and there are no reviews on the patch to fix it [1]. [1]: https://review.opendev.org/c/openstack/zun/+/982362 Depends-On: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/986150 Change-Id: I8ced621754d03c44b7672dd94fc3d7d2173ac734 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-24Support multiple Nova Compute Ironic instancesDoug Szumski1-1/+1
Adds support for deploying multiple instances of the Nova Compute Ironic service on the same host. This is useful in large baremetal deployments, where the sharding and/or conductor group feature is used to scale out the service. A further patch to support deploying multiple Ironic conductor instances will follow. Co-Authored-By: Bartosz Bezak <bartosz@stackhpc.com> Co-Authored-By: Bertrand Lanson <bertrand.lanson@protonmail.com> Change-Id: Ibbddfd87e831a3775c3ed66c80b18e5070cedc90 Signed-off-by: Doug Szumski <doug@stackhpc.com>
2026-04-21CI: Fix ovn-upgrade jobsMichal Nasiadka5-0/+0
Since we use the same globals before upgrade and after upgrade, we need to not enable vpnaas before the upgrade, because there's no additional logic for configuring neutron-ovn-vpn-agent in previous release. Rename the role under /roles to fit out naming and ensure no clashes with other role names Change-Id: I3ccef6b1e75224a60036e9bf49500804ee76eba6 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-17Implement neutron-ovn-vpn-agentMaximilian Stinsky6-0/+382
This patch implements vpnaas for OVN environments. It deploys a standalone neutron-ovn-vpn-agent on neutron nodes. The container no longer requires 'privileged: true'. Running as the 'neutron' user with specific kernel capabilities ensures the agent can manage network namespaces and interfaces without full privileges. Added capabilities: - NET_ADMIN # manage interfaces, IPs, routing, firewall - SYS_ADMIN # create/manage network namespaces - SYS_PTRACE # allow 'ip netns exec' attach to processes - DAC_OVERRIDE # bypass file read/write restrictions - DAC_READ_SEARCH # allow directory traversal and file read - SETPCAP # retain capabilities for privileged ops Added security options: - apparmor=unconfined # disable AppArmor confinement - seccomp=unconfined # disable seccomp filtering - label=disable # disable SELinux/labeling Depends-On: https://review.opendev.org/c/openstack/kolla/+/924302 Closes-Bug: #2048392 Change-Id: I961b1407ae1402d146f0c09924df8e007e331af5 Signed-off-by: Joachim de Groot <joachim.de.groot@menzel-it.net> Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-04-15Merge "Fix keystone with IDP configured."Zuul1-0/+1
2026-04-15Fix keystone with IDP configured.Taavi Ansper1-0/+1
1. Add CI coverage for keystone_identity_providers under federation scenario. 2. Add fix for federation config in keystone role if keystone_identity_providers is defined. 3. Update Horizon tests with federation example. 4. Use openstack.cloud ansible modules instead of python-openstackclient in register_identity_providers.yml Closes-Bug: #2134455 Change-Id: Id03bc5770c3856c7c09a34e327b33786d7b7d859 Signed-off-by: Taavi Ansper <taaviansperr@gmail.com>
2026-04-15CI: Exclude rbd secrets from leak checkMichal Nasiadka1-0/+4
Change-Id: I0d9a62e3ade10fc8735500a8ecb068e8108b90c1 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-14CI: Add more passwords to leak check exceptionsMichal Nasiadka1-0/+10
These are from other CI jobs that AIO and cephadm Change-Id: I127d1717eaa662919431c69520378f17f6804133 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-14Merge "CI: Test for leaked passwords in syslog"Zuul4-0/+437
2026-04-13CI: Test for leaked passwords in syslogMichal Nasiadka4-0/+437
Change-Id: I611a61dc90aa6e1aa16971e2dd17a959f7587947 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-03-31Merge "CI: move aarch64 jobs to 16G ram nodes"Zuul1-0/+19
2026-03-31CI: move aarch64 jobs to 16G ram nodesBartosz Bezak1-0/+19
Change-Id: I3e2fcee68efeae8c7ea9428156b63b9a9cfc1be0 Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
2026-03-24ansible-lint: Fix fqcn[actions]Michal Nasiadka1-2/+2
Change-Id: I3f9e5aada1059d882d2013e0721c10708f43d1cf Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-03-24ansible-lint: Fix fqcn[actions-core] for internal rolesMichal Nasiadka3-9/+9
Change-Id: I670728bafe597d180b208278c0f87846188edc3c Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-03-24ansible-lint: Fix fqcn[actions-core] for roles/cephadmMichal Nasiadka3-16/+16
Change-Id: Ib2fd85b4c392266d718508eb8442dd7b6062e4bd Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-03-13ansible-lint: fix yaml[line-length] in test rolesBertrand Lanson3-6/+32
Change-Id: If3a5ac62502e14160e0a5e638d3bc1234a201731 Signed-off-by: Bertrand Lanson <bertrand.lanson@infomaniak.com>
2026-02-16ci: improve verbosity of idempotence checkBertrand Lanson1-2/+14
We print the list of containers that failed idempotence check if the check fails to avoid having to dig in logs just to know which containers have failed the check. Change-Id: Ice16753fba80e5fac437c9738f6258be2c2684ab Signed-off-by: Bertrand Lanson <bertrand.lanson@infomaniak.com>
2026-02-11Merge "CI: Switch reconfigure role to docker_host_info"Zuul1-11/+8
2026-02-09CI: Switch reconfigure role to docker_host_infoMichal Nasiadka1-11/+8
Change-Id: I945f84e4d9ebf37541f4f395ca49b92f4e3892c5 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-01-27tests: Change Selenium port from 4444 to 4500Piotr Milewski1-2/+9
The default Selenium port (4444) conflicts with MariaDB SST (State Snapshot Transfer), which also uses port 4444. This overlap caused intermittent test failures and MariaDB timeouts during CI runs. This commit shifts the Selenium standalone container to port 4500 to ensure environment stability. Change-Id: Ie259629617d47367c412336434069e5d4f5cae3a Signed-off-by: Piotr Milewski <vurmil@gmail.com> (cherry picked from commit 2da3a2c0555c5671d8d473ef71c763cc0437b3b1)
2026-01-22CI: use proper arch in tempest aarch64 jobsBartosz Bezak1-1/+2
Change-Id: Ia43a5be4ec14ea4e9324bfd96e597342abe67270 Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
2026-01-09ansible-lint: Rework validate-all-file into custom rulesMichal Nasiadka18-47/+117
Test roles/ subdirectories as well (used by Zuul) In addition to that container_exec_become will also fail when "docker exec" or "podman exec" will be used instead of "{{ kolla_container_engine }} exec" Generated-By: Claude Change-Id: I75c1e48c36bb0284e2927b1cb354ce9ec47967d7 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-01-08Merge "Test idempotence of reconfigure command in CI"Zuul1-0/+170
2025-12-18tempest: Rework regex to a listMichal Nasiadka2-4/+4
Change-Id: I7505f8feeb85f606df92a20bf4a4700d5ea36a51 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-12-09CI: Use u-c in tempest roleMichal Nasiadka2-0/+2
Change-Id: I725349bccca3779f886c2636086e1a76fa357bad Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-11-29Test idempotence of reconfigure command in CIBertrand Lanson1-0/+170
Idempotence isn't tested in CI and seems to have led to bugs, especially in podman, where it would just break, and reconfiguring would restart the entire cluster. Let's test it in CI to ensure this doesn't happen. Change-Id: I810fa1818bb9a0a11f200da2b782c2fde72f3b3a Signed-off-by: Bertrand Lanson <bertrand.lanson@protonmail.com>
2025-11-21CI: Bump tempest compute.build_timeout to 900sMichal Nasiadka2-0/+2
It's often failing with 300s Change-Id: Id71c82a557745f9b47ea92a5eeecf1d859719821 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-11-07CI: Retry Selenium container pullsMichal Nasiadka1-0/+8
Change-Id: Ic4dfba427e6874556bb70c8b808d5f7069dc0f53 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-29CI: Bump tempest timeout to 3600Michal Nasiadka1-1/+1
Change-Id: I85c8a2b833b8b4e46bb33124deb594fb2a2b9f78 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-29CI: test-dashboard: Use http/https where configuredMichal Nasiadka1-0/+2
Also move zuul_return to run only on primary Change-Id: I5b27663e8c539715e6aeb18b179a4f0b98103f7f Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-28CI: Fix task name in upgradeMichal Nasiadka1-1/+1
Change-Id: I7409c3f955faa6281fb19c85bbb4a9aa03f9f219 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-27CI: Use selenium in Horizon testsMichal Nasiadka1-0/+59
Change-Id: I814413fdb1a74675846a4ee2d5fbada9592fceef Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-20CI: Switch test-core-openstack.sh to Tempest runMichal Nasiadka2-0/+60
Unfortunately that will lead to dropping DNS integration tests for internal DNS, because neutron-tempest-plugin does not have such tests. Change-Id: Ic1e0a6643e67467a22e91d277a9947c027935f09 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-20CI: Rework setup_disks.sh into Ansible roleMichal Nasiadka2-0/+57
Change-Id: Icd8648399a7d0a74419c80d573792397f971ff3c Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-15CI: Rework reconfigure.sh to Ansible roleMichal Nasiadka1-0/+63
Change-Id: Ibe21c342ae4c4d79c16d4058f90f5763e94d231c Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-13CI: rework upgrade.sh to Ansible roleMichal Nasiadka2-1/+66
Change-Id: I73ca974aa6eef071e53dcbb9b66af2713ac655a8 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-10CI: Rework test-dashboard.sh to Ansible roleMichal Nasiadka1-0/+21
Change-Id: Iaeb6786625c8c0c71c7b4e0ab9450c67bc13ed1c Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-10CI: Rework test/deploy/upgrade-bifrost.sh into Ansible rolesMichal Nasiadka3-0/+52
Change-Id: I55ea22002ea81085a43dc053f619bb61cd497c69 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-09CI: Rework deploy.sh to an Ansible roleMichal Nasiadka3-0/+105
Change-Id: Iecb212c38732d38f704f1a7d43036f8bbade496a Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-02Move to for Rocky Linux 10Michal Nasiadka2-3/+6
CephAdm, Octavia, OVN and NFV jobs are not added here, because these rely on Valkey/Redis available. Ironic jobs are not added, because ipxe.efi is not packaged in EL10 and needs a followup patch. Let's Encrypt jobs are also not added, due to ssl certificate validation errors. Depends-On: https://review.opendev.org/c/openstack/kolla/+/956554 Depends-On: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/961237 Change-Id: I51823808c4e4ac08ae8f080aacf6a3759589571d Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-09-22CI: Reorganise scenarios into project templatesMichal Nasiadka1-3/+3
This patch moves into using project templates, which is easier to organise. base_distro and upgrade variables are derived from base.yaml and respective job name - so don't need to be specified in each job anymore. All jobs will now also have an OS release specified, so it's easier to add different OS release jobs (e.g. when backporting new release support to stable branch). Change-Id: I1f08f9b9064d9f7e95b07944db0e7ebac3120c57 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-09-15Merge "CI: Add telemetry scenario"Zuul1-0/+4
2025-09-15CI: Add telemetry scenarioMichal Nasiadka1-0/+4
Removing python-ceilometerclient since it didn't have a release since 2017 Change-Id: I4c20d268c202e1699f44f7d672c159d3ffa895eb Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-09-05Remove ironic-inspector deploymentMichal Nasiadka1-2/+0
Ironic Inspector has been retired and its functionality has been moved to Ironic. Added a change to service-ks-register to make password optional (to able to remove user without a password being passed in). Using the opportunity - increasing CI coverage to include inspection. Change-Id: If178c23249370c7c69744843737e61a6309d6a19 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-04-16Merge "Replace ipaddr with ansible.utils.ipaddr"Zuul1-1/+1
2025-03-21Remove Swift roleMichal Nasiadka1-4/+0
Since Swift is broken and since deprecation nobody did pick up the work to make it working - let's remove swift role and associated integrations/CI scripts. Change-Id: I08e92aaeea644053fd25f80ce1f276a495cebbfc
2024-12-06Replace ipaddr with ansible.utils.ipaddrMichal Nasiadka1-1/+1
[DEPRECATION WARNING]: Filter "ansible.netcommon.ipaddr" has been deprecated. Use 'ansible.utils.ipaddr' module instead. This feature will be removed from ansible.netcommon in a release after 2024-01-01. Deprecation warnings can be disabled by setting deprecation_warnings=False in ansible.cfg. Change-Id: Ibcef3e642e5ff87aab6d8f73bda9860016cf715a
2024-10-25CI: cephadm: Add python3-yaml to Ubuntu packagesMichal Nasiadka1-0/+1
Ubuntu package does not have that in dependencies and cephadm fails without that. See [1]. [1]: https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/2085603 Change-Id: I5124f7078e15645979b68986dceb51948c89a520
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 14:39:14 +0000