aboutsummaryrefslogtreecommitdiff
path: root/releasenotes
AgeCommit message (Collapse)AuthorFilesLines
2026-10-16Merge "Install syslinux in debian ironic-conductor containers" into ↵Zuul1-0/+8
stable/2026.2
2026-10-16Install syslinux in debian ironic-conductor containersJed Preist1-0/+8
Install syslinux in debian ironic-conductor containers, to provide files required for creating disk images that can be booted with the redfish-virtual-media boot interface Closes-Bug: #2163659 Change-Id: I61360a9062e365a3ae09853908e8aca8e04597bb Signed-off-by: Jed Preist <jed@stackhpc.com> (cherry picked from commit 9a972298bb490d4ead8f2d5ed68f500a2f55f4b9)
2026-10-15keystone: Remove keystone containerMichal Nasiadka1-0/+5
We completed the keystone-api migration in Ib7ef5526e087429dfeb5a3211e19efda4776b52c Change-Id: I6dc81171470a9c7fc6385a9d6867b7d4a584dc8e Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com> (cherry picked from commit f738a5e56be543fc5be1bfc4e256544db03fc682)
2026-10-05Merge "keystone: Introduce keystone-api container"23.0.0.0rc1Zuul1-0/+5
2026-10-01Merge "Fix: Zstd missing from ironic conductor container."Zuul1-0/+5
2026-10-01keystone: Introduce keystone-api containerMichal Nasiadka1-0/+5
It's a clone of keystone container image. After using the new container in Kolla-Ansible - the old keystone container image can be dropped. Change-Id: Ia5684a4c5e5eb25fa5194dac9f841b0793203718 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-09-28Updated from check-sourcesOpenStack Proposal Bot1-0/+7
Change-Id: I9d628acc34bf8568500ec43e0ede2257ff567ab0 Signed-off-by: OpenStack Proposal Bot <openstack-infra@lists.openstack.org> Generated-By: openstack/project-config:playbooks/proposal/propose_update.sh
2026-09-25Updated from check-sourcesOpenStack Proposal Bot1-0/+16
Change-Id: I11fb14bd470e78eb5fe6f75a6494ef61483e67d8 Signed-off-by: OpenStack Proposal Bot <openstack-infra@lists.openstack.org> Generated-By: openstack/project-config:playbooks/proposal/propose_update.sh
2026-09-24Fix: Zstd missing from ironic conductor container.Claudia Watson1-0/+5
Ironic-conductor needs zstd installed to be able to decompress zstd compressed files. Patch installs zstd to docker container. Patch merged in Feb 2025 ( https://review.opendev.org/c/openstack/ironic/+/938904 ) enabled the detection and decompression of zstd compressed files. Zstd is a popular choice for compression, therefore, would be useful to support. Closes-Bug: #2167459 Change-Id: I5fa8ec4dd5d1d4938e0b47c99d07d328286ecda9 Signed-off-by: Claudia Watson <claudia@stackhpc.com>
2026-09-18Merge "grafana: replace deprecated grafana-cli"Zuul1-0/+5
2026-09-16Updated from check-sourcesOpenStack Proposal Bot1-0/+4
Change-Id: I386a9056a6802beaa0d8c110b9fc2f9a7fe8ce5c Signed-off-by: OpenStack Proposal Bot <openstack-infra@lists.openstack.org> Generated-By: openstack/project-config:playbooks/proposal/propose_update.sh
2026-09-11Merge "Drop support for CentOS Stream 10"Zuul1-0/+6
2026-09-10Drop support for CentOS Stream 10Michal Nasiadka1-0/+6
Change-Id: I5973943fe83bbb00cfc8623c0cd4d4b98b369315 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-09-10Updated from check-sourcesOpenStack Proposal Bot1-0/+5
Change-Id: I35291ca92527da34565c84955fad6156d686fdae Signed-off-by: OpenStack Proposal Bot <openstack-infra@lists.openstack.org> Generated-By: openstack/project-config:playbooks/proposal/propose_update.sh
2026-09-09Merge "grafana: install Prometheus datasource plugin"Zuul1-0/+7
2026-09-09Updated from check-sourcesOpenStack Proposal Bot1-0/+7
Change-Id: I9d6a6eb0eaf2eee352b80a0583e87f832659aaf1 Signed-off-by: OpenStack Proposal Bot <openstack-infra@lists.openstack.org> Generated-By: openstack/project-config:playbooks/proposal/propose_update.sh
2026-09-07Updated from check-sourcesOpenStack Proposal Bot1-0/+7
Change-Id: I32526f218776214f1f9516b126e10816769eb220 Signed-off-by: OpenStack Proposal Bot <openstack-infra@lists.openstack.org> Generated-By: openstack/project-config:playbooks/proposal/propose_update.sh
2026-09-02Merge "Ensure openvswitch-base children get ovs repo"Zuul1-0/+6
2026-09-02grafana: replace deprecated grafana-cliPiotr Milewski1-0/+5
Change-Id: I68bd3b2dabe9631f7f15b801aaf020380f95fa7d Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-09-01Merge "Upgrade Prometheus Server to 3.13.x LTS"Zuul1-0/+4
2026-09-01Upgrade Prometheus Server to 3.13.x LTSPiotr Milewski1-0/+4
Upgrade Prometheus Server from the 3.5.x LTS release to the 3.13.x LTS release. Change-Id: I8de87eff00b226e8a85eca317af944e9b6c97b3f Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-09-01Updated from check-sourcesOpenStack Proposal Bot1-0/+9
Change-Id: I5b1271480c4c3c17e202a81379289730f39ba567 Signed-off-by: OpenStack Proposal Bot <openstack-infra@lists.openstack.org> Generated-By: openstack/project-config:playbooks/proposal/propose_update.sh
2026-08-31grafana: install Prometheus datasource pluginPiotr Milewski1-0/+7
Closes-Bug: #2165921 Change-Id: Ib4a0d7185ccc64900b4068dd74995dbf1ba6823c Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-08-27Merge "letsencrypt: Add ACME dns-01 challenge support"Zuul1-0/+14
2026-08-27Ensure openvswitch-base children get ovs repoAlex Welsh1-0/+6
Previously, openvswitch-base would enable the openvswitch repo, and child containers (e.g. ovn-base, ovn-controller, etc) would be built using ovn packages from that repo. Recently [1] builds were changed to clean up repos at the end of the build, so now dependent containers must re-enable the repo manually. Also added an openvswitch repo override to tests to avoid regresssion. [1] Ie5b9970a4575b6258dc238059d3f33ddfe155789 Closes-Bug: #2163314 Change-Id: I4ea1cc812167142743e3ebcbd532281bfe8a9799 Signed-off-by: Alex Welsh <alex@stackhpc.com>
2026-08-26Updated from check-sourcesOpenStack Proposal Bot1-0/+35
Change-Id: If773969cd58b8a17c103f27294171d5dd99ccc9d Signed-off-by: OpenStack Proposal Bot <openstack-infra@lists.openstack.org> Generated-By: openstack/project-config:playbooks/proposal/propose_update.sh
2026-08-05letsencrypt: Add ACME dns-01 challenge supportTimon Schnell1-0/+14
This adds support for the ACME dns-01 challenge while keeping http-01 the default. A new --challenge option (default http-01) selects the challenge type. When dns-01 is selected, --dns-provider names any DNS provider compiled into the bundled lego binary, and an optional --dns-additional-opts passthrough forwards extra lego DNS flags (such as --dns.resolvers or --dns.propagation-disable-ans) for environments where the authoritative name server propagation check cannot be performed. Provider credentials are supplied via --env-file: lego DNS providers read credentials only from environment variables, so the wrapper exports the file's contents before lego runs. The file is parsed like docker --env-file: literal KEY=VALUE pairs split on the first '=', comments and blank lines ignored, values taken verbatim and never executed as shell. Selecting dns-01 without --dns-provider fails fast. Co-Authored-By: Premysl Kouril <premysl.kouril@ultimum.io> Assisted-By: Claude Code Change-Id: I61dc5e3f399f6eec02475c7b90e0f41c85c6093c Signed-off-by: Timon Schnell <timon.schnell@btc-it-services.com> Signed-off-by: Jan Horstmann <horstmann@osism.tech>
2026-08-05Add cleanup_repos to revert build_only overridesMichal Nasiadka1-0/+16
Repos marked build_only: true are backed up before handle_repos() overwrites them and restored at the end of each image build, so CI mirror URLs are not baked into the final image. The cleanup RUN was injected into every Dockerfile, not just images that called handle_repos() for those repos. Child images with no backup fell through to "rm -f", deleting the inherited repo file (e.g. debian.sources in bifrost-base, breaking cpio install). Fix by adding a {repo}.enabled sentinel that handle_repos creates when it processes a build_only repo, making the cleanup conditional on that sentinel. Change-Id: Ie5b9970a4575b6258dc238059d3f33ddfe155789 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-07-31Merge "ironic-pxe: don't fail if symlinks already exist"Zuul1-0/+6
2026-07-30Move PIP_* env variables to ARG and configMichal Nasiadka1-0/+19
Leaving empty CI template_overrides file in case we need to use it in future. Change-Id: Ic46f1a594bcc330536bc78d93ece10e60622f6d4 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-07-22Merge "rabbitmq: Update to 4.3"Zuul1-0/+4
2026-07-21Merge "Bump ansible-core to 2.21"Zuul1-0/+5
2026-07-20rabbitmq: Update to 4.3Piotr Milewski1-0/+4
Erlang 28 is only supported for new clusters. Upgrades of clusters running RabbitMQ with Khepri on Erlang 27 to Erlang 28 have a known issue affecting rolling upgrades. Change-Id: I60d85a92534e8aa9ec6a72d71457057b96d7e554 Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-07-20ironic-pxe: don't fail if symlinks already existOwen Jones1-0/+6
`ironic-pxe` start-up fails if symlinks to efi files have previously been created. Removing test for existence and adding `-f` flag to symlink creation ensures they always exist without failing on start. Closes-Bug: #2160317 Change-Id: Ib736e5beb201409c8987fbc62225c75f89cbfe62 Signed-off-by: Owen Jones <owen@stackhpc.com>
2026-07-10Bump ansible-core to 2.21Michal Nasiadka1-0/+5
Change-Id: I51c63b487b2550f6357aba6068f671b3c22df5da Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-07-09Add support to override base reposMichal Nasiadka1-0/+23
BaseOS and AppStream for CentOS/Rocky ubuntu, ubuntu-security for Ubuntu debian, debian-security for Debian ubuntu-cloud-archive is not really a base repo - so removing it from ubuntu.sources Change-Id: Iab98de963f2e8532389b7563bb572d8aa20c7aa6 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-07-06Merge "Add opt-in SPICE support for Rocky via COPR."Zuul1-0/+24
2026-07-02Merge "Fix parsing of permissions with special bits"Zuul1-0/+6
2026-07-01Fix parsing of permissions with special bitsMichal Arbet1-0/+6
kolla_set_configs currently fails to parse permissions such as 2775 because only legacy values like 0755 are converted to Python octal notation. Accept standard UNIX permission notation for permissions with special mode bits such as SGID, SUID, and sticky bit. Change-Id: I5937a17b0d70f9c1db4b2617854d0180c37fe2c0 Closes-Bug: #2154269 Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/989850 Signed-off-by: Michal Arbet <michal.arbet@ultimum.io>
2026-06-29Merge "kolla-build: fix build-date LABEL invalidating Docker layer cache"Zuul1-0/+6
2026-06-29Add opt-in SPICE support for Rocky via COPR.Michael Still1-0/+24
RHEL9 dropped SPICE support from qemu-kvm, and Rocky Linux followed suit. Up until now the documented guidance has been to use the Debian or Ubuntu container images if you want to serve the ``spice-direct`` console type, because the stock Rocky nova-libvirt image will simply fail to start any SPICE-enabled instance. This change adds a second version of the nova-libvirt container image called nova-libvirt-spice. It is always built, but is identical for all supported container base distributions except for Rocky Linux. In the Rocky Linux case, this container adds the community maintained ligenix/enterprise-qemu-spice COPR repository that provides a rebuild of ``qemu-kvm`` with SPICE support re-enabled for both EPEL 9 and EPEL 10. Which nova-libvirt container should be used in a given deployment is delegated to logic in kolla-ansible, based on the deployer's settings in globals.yml. The COPR is a third-party rebuild with no vendor support contract. The release note and support matrix are updated to describe the opt-in path and call this caveat out explicitly. The earlier "you must use Debian or Ubuntu" wording in the support matrix is softened here, rather than by retroactively editing the kerbside container-build patch that introduced it, so that this feature can land (or not land) independently of the earlier change. Partial-Bug: #2131793 (spice-direct consoles) Prompt: I am interested in seeing how we would go about using https://copr.fedorainfracloud.org/coprs/ligenix/enterprise-qemu-spice/ to add SPICE support back to the Kolla build Rocky Linux containers as a new patch in the kolla/ORDER list. Could you please investigate options here? Assisted-By: Claude Code Co-Authored-By: Claude Opus 4.7 (1M context, medium effort) <noreply@anthropic.com> Change-Id: I410b87b7f8cdd541c48d9a749b3fea634a5f4e6c Signed-off-by: Michael Still <mikal@stillhq.com>
2026-06-24prometheus-mtail: Switch to a new forkMichal Nasiadka1-0/+5
It seems that the original maintainer lost write access to google/mtail repository long time ago, and we still ship versions from 2024. [1]: https://github.com/google/mtail/issues/929 Change-Id: I41c5d0649eb38348ccda413b7d6537830cd82bec Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-24kolla-build: fix build-date LABEL invalidating Docker layer cacheMichal Nasiadka1-0/+6
The build-date label was rendered into a LABEL instruction on line 3 of every Dockerfile template, immediately after FROM. Because Docker invalidates the cache for a changed instruction and all subsequent layers, a date change caused a full rebuild of every image on each new calendar day, even when nothing else had changed. Fix this by removing build-date from the Dockerfile templates and applying it as a --label argument at build time via image.labels. Labels passed on the build command line are not part of the Dockerfile cache key, so the date is still recorded in the image metadata without affecting layer caching. Change-Id: I8ef0d85bab1a999a4d09f7cbf0c088ca00fdcf77 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-19Merge "Update Prometheus to version 3.5.4"Zuul1-0/+4
2026-06-19Merge "Add YAML support to kolla_set_configs engine"Zuul1-0/+7
2026-06-18Update Prometheus to version 3.5.4Pierre Riteau1-0/+4
This release fixes multiple security issues [1]. [1] https://github.com/prometheus/prometheus/releases/tag/v3.5.4 Change-Id: I1ec8f15e14360422aa316779bd19195fd1f4f7a1 Signed-off-by: Pierre Riteau <pierre@stackhpc.com>
2026-06-18kolla-build: Add Docker BuildKit support via docker buildx buildMichal Nasiadka1-0/+22
Add --buildkit flag to use docker buildx build instead of the docker-py SDK. An optional --buildkit-builder selects a named buildx builder instance, enabling docker-container or remote drivers for multi-arch builds. --buildkit and --squash are mutually exclusive and rejected at startup. PushTask is skipped when buildkit is active; push is handled inline. Set buildkit as the new default. Change-Id: Idbf1d1bdc091bb84721f8006c2b916731b999859 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-17Add YAML support to kolla_set_configs enginePiotr Milewski1-0/+7
Following the PTG agreement, this commit extends the container configuration engine (set_configs.py) to support YAML format while maintaining backward compatibility with JSON. - Integrated 'yaml' library as a universal parser for both JSON and YAML formats (YAML is a superset of JSON) - Updated 'load_config' to search for 'config.json', 'config.yaml' - Added 'python3-yaml' (Debian) and 'python3-pyyaml' (RHEL) as required base packages in Dockerfile.j2 This change improves configuration readability and allows for easier maintenance while ensuring no breakage for existing JSON-based deployments. Change-Id: Icfb52b8f94e1036d5952b160c5921348d1427fda Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-06-03Implement container image build for kerbside.Michael Still1-0/+9
This change adds images for Kerbside. Kerbside is a SPICE protocol native proxy used to expose the new spice-direct console type provided by Openstack Compute. This allows high fidelity virtual desktop experiences without requiring transcoding of the console into HTML5 in Horizon, or allowing users direct access to the console ports on your hypervisors. Sadly, Red Hat chose to remove SPICE support from qemu in RHEL9, and Rocky Linux has followed along. You therefore _must_ run the Debian or Ubuntu container images if you wish to use the ``spice-direct`` console type. Architecturally Kerbside has two components -- an API service which turns console access URLs from Nova into URLs to ``.vv`` files, and a proxy service which actually proxies the SPICE traffic. These are handled as separate container images here because they're quite different. One is a WSGI REST API, and the other is a daemon. It is also likely that deployers would choose to host these on different machines. Finally, the proxy service needs to be special cased in load balancing because it strongly expects to terminate TLS itself. The haproxy is therefore configured as a layer 4 proxy in this case. Depends-On: https://review.opendev.org/c/openstack/kolla/+/991249 Change-Id: If60a70745462e1360cfadaab1a5a8d75b7fdeb21 Partial-Bug: #2131793 (spice-direct consoles) Signed-off-by: Michael Still <mikal@stillhq.com>
2026-05-27Merge "Align default tag with Kolla-Ansible"Zuul1-0/+9
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 17:22:27 +0000