From 76f1e7febe0ea904d05f1db5c123c9e06d5e1a65 Mon Sep 17 00:00:00 2001 From: Pierre Riteau Date: Fri, 9 Oct 2026 22:52:07 +0200 Subject: [PATCH 01/11] Switch to downloading CentOS Stream 10 IPA images CentOS Stream 10 images are available for master and stable/2026.2 [1]. Add variable `ipa_images_upstream_os` to let operators choose the CentOS Stream version of these images. [1] https://tarballs.opendev.org/openstack/ironic-python-agent/dib/files/ Change-Id: Icfbc3531d998234cbb90d9fb964ccb887b9368cd Signed-off-by: Pierre Riteau --- ansible/inventory/group_vars/all/ipa | 8 ++++++-- .../configuration/reference/ironic-python-agent.rst | 11 +++++++---- etc/kayobe/ipa.yml | 4 ++++ releasenotes/notes/ipa-centos10-68d14814840f2a77.yaml | 6 ++++++ 4 files changed, 23 insertions(+), 6 deletions(-) create mode 100644 releasenotes/notes/ipa-centos10-68d14814840f2a77.yaml diff --git a/ansible/inventory/group_vars/all/ipa b/ansible/inventory/group_vars/all/ipa index eb0873271..8b3dbbba7 100644 --- a/ansible/inventory/group_vars/all/ipa +++ b/ansible/inventory/group_vars/all/ipa @@ -110,6 +110,10 @@ ipa_build_dib_upper_constraints_file: "" ############################################################################### # Ironic Python Agent (IPA) images configuration. +# OS version of upstream Ironic deployment image files. Valid options are +# "centos9" and "centos10". Default is "centos10". +ipa_images_upstream_os: "centos10" + # Suffix of upstream Ironic deployment image files. Default is based on # {{ openstack_branch }}. ipa_images_upstream_url_suffix: "-{{ openstack_branch | replace('/', '-') }}" @@ -118,7 +122,7 @@ ipa_images_upstream_url_suffix: "-{{ openstack_branch | replace('/', '-') }}" ipa_images_kernel_name: "ipa.kernel" # URL of Ironic deployment kernel image to download. -ipa_kernel_upstream_url: "https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos9{{ ipa_images_upstream_url_suffix }}.kernel" +ipa_kernel_upstream_url: "https://tarballs.opendev.org/openstack/ironic-python-agent/dib/files/ipa-{{ ipa_images_upstream_os }}{{ ipa_images_upstream_url_suffix }}.kernel" # URL of checksum of Ironic deployment kernel image. ipa_kernel_checksum_url: "{{ ipa_kernel_upstream_url }}.{{ ipa_kernel_checksum_algorithm }}" @@ -130,7 +134,7 @@ ipa_kernel_checksum_algorithm: "sha256" ipa_images_ramdisk_name: "ipa.initramfs" # URL of Ironic deployment ramdisk image to download. -ipa_ramdisk_upstream_url: "https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos9{{ ipa_images_upstream_url_suffix }}.initramfs" +ipa_ramdisk_upstream_url: "https://tarballs.opendev.org/openstack/ironic-python-agent/dib/files/ipa-{{ ipa_images_upstream_os }}{{ ipa_images_upstream_url_suffix }}.initramfs" # URL of checksum of Ironic deployment ramdisk image. ipa_ramdisk_checksum_url: "{{ ipa_ramdisk_upstream_url }}.{{ ipa_ramdisk_checksum_algorithm }}" diff --git a/doc/source/configuration/reference/ironic-python-agent.rst b/doc/source/configuration/reference/ironic-python-agent.rst index 3ece11e96..dfc6bf6fe 100644 --- a/doc/source/configuration/reference/ironic-python-agent.rst +++ b/doc/source/configuration/reference/ironic-python-agent.rst @@ -261,6 +261,9 @@ The following options configure the source of Ironic Python Agent images for inspection and deployment. Consult the :ironic-python-agent-doc:`Ironic Python Agent documentation <>` for full details. +``ipa_images_upstream_os`` + OS version of upstream Ironic deployment image files. Valid options are + ``centos9`` and ``centos10``. Default is ``centos10``. ``ipa_images_upstream_url_suffix`` Suffix of upstream Ironic deployment image files. Default is based on ``{{ openstack_branch }}``. @@ -269,8 +272,8 @@ Agent documentation <>` for full details. ``ipa.kernel``. ``ipa_kernel_upstream_url`` URL of Ironic deployment kernel image to download. Default is - ``https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos9{{ - ipa_images_upstream_url_suffix }}.kernel``. + ``https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-{{ + ipa_images_upstream_os }}{{ ipa_images_upstream_url_suffix }}.kernel``. ``ipa_kernel_checksum_url`` URL of checksum of Ironic deployment kernel image. Default is ``{{ ipa_kernel_upstream_url }}.{{ ipa_kernel_checksum_algorithm }}``. @@ -282,8 +285,8 @@ Agent documentation <>` for full details. ``ipa.initramfs``. ``ipa_ramdisk_upstream_url`` URL of Ironic deployment ramdisk image to download. Default is - ``https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos9{{ - ipa_images_upstream_url_suffix }}.initramfs``. + ``https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-{{ + ipa_images_upstream_os }}{{ ipa_images_upstream_url_suffix }}.initramfs``. ``ipa_ramdisk_checksum_url`` URL of checksum of Ironic deployment ramdisk image. Default is ``{{ ipa_ramdisk_upstream_url }}.{{ ipa_ramdisk_checksum_algorithm }}``. diff --git a/etc/kayobe/ipa.yml b/etc/kayobe/ipa.yml index 093a425c5..27303a4d2 100644 --- a/etc/kayobe/ipa.yml +++ b/etc/kayobe/ipa.yml @@ -88,6 +88,10 @@ ############################################################################### # Ironic Python Agent (IPA) images configuration. +# OS version of upstream Ironic deployment image files. Valid options are +# "centos9" and "centos10". Default is "centos10". +#ipa_images_upstream_os: + # Suffix of upstream Ironic deployment image files. Default is based on # {{ openstack_branch }}. #ipa_images_upstream_url_suffix: diff --git a/releasenotes/notes/ipa-centos10-68d14814840f2a77.yaml b/releasenotes/notes/ipa-centos10-68d14814840f2a77.yaml new file mode 100644 index 000000000..63e2a99e2 --- /dev/null +++ b/releasenotes/notes/ipa-centos10-68d14814840f2a77.yaml @@ -0,0 +1,6 @@ +--- +upgrade: + - | + When not building Ironic Python Agent (IPA) images locally, images are now + based on CentOS Stream 10. CentOS Stream 9 images can still be used by + setting ``ipa_images_upstream_os`` to ``centos9``. From f86f662b3647c6581e9c4e172b3620bfac387319 Mon Sep 17 00:00:00 2001 From: Claudia Watson Date: Mon, 29 Sep 2025 15:19:20 +0100 Subject: [PATCH 02/11] Add default config for ipa-ntp-server Adds default configuration to Kolla Ansible for the `ipa-ntp-server` kernel command line argument used by IPA during provisioning and cleaning. This ensures correct system time during certificate creation, preventing issues where Ironic fails to communicate with the Ironic Python Agent due to invalid certificate timestamps. The default NTP server can be overridden by changing `kolla_ironic_ntp_server`. Change-Id: I4da3046a521cf5e5b93526bc767a5eca63b6f2ed Signed-off-by: Claudia Watson Signed-off-by: Hollie Hutchinson --- ansible/inventory/group_vars/all/ironic | 6 ++++++ ansible/roles/kolla-ansible/templates/kolla/globals.yml | 3 +++ etc/kayobe/ironic.yml | 5 +++++ ...t-config-for-the-ipa-ntp-server-b2ab9345e4bf524d.yaml | 9 +++++++++ 4 files changed, 23 insertions(+) create mode 100644 releasenotes/notes/add-default-config-for-the-ipa-ntp-server-b2ab9345e4bf524d.yaml diff --git a/ansible/inventory/group_vars/all/ironic b/ansible/inventory/group_vars/all/ironic index 0e37aba9d..f6eb715b4 100644 --- a/ansible/inventory/group_vars/all/ironic +++ b/ansible/inventory/group_vars/all/ironic @@ -100,6 +100,11 @@ kolla_ironic_inspection_network: "{{ kolla_ironic_provisioning_network if inspec # Name of the Neutron network to use for provisioning. kolla_ironic_provisioning_network: 'provision-net' +# Address of the Ironic Python Agent (IPA) NTP server. The default value maps +# to the IP address of each controller on the internal API, which should be +# running chronyd. +kolla_ironic_ntp_server: "{% raw %}{{ hostvars[inventory_hostname].ansible_facts[api_interface | replace('-', '_')]['ipv4']['address'] }}{% endraw %}" + # List of default kernel parameters to append for baremetal PXE boot. kolla_ironic_pxe_append_params_default: "{{ kolla_ironic_kernel_append_params_default }}" @@ -116,6 +121,7 @@ kolla_ironic_kernel_append_params_default: - vga=normal - console=tty0 - console=ttyS0,115200n8 + - ipa-ntp-server={% if kolla_ironic_ntp_server is not none and kolla_ironic_ntp_server | length > 0 %}{{ kolla_ironic_ntp_server }}{% endif %} # List of additional kernel parameters to append for baremetal boot. kolla_ironic_kernel_append_params_extra: [] diff --git a/ansible/roles/kolla-ansible/templates/kolla/globals.yml b/ansible/roles/kolla-ansible/templates/kolla/globals.yml index 577f6c988..76d3bfe3c 100644 --- a/ansible/roles/kolla-ansible/templates/kolla/globals.yml +++ b/ansible/roles/kolla-ansible/templates/kolla/globals.yml @@ -399,6 +399,9 @@ ironic_dnsmasq_dhcp_ranges: {% if kolla_inspector_dns_servers %} dns_servers: "{{ kolla_inspector_dns_servers | join(',') }}" {% endif %} +{% if kolla_ironic_ntp_server is defined and kolla_ironic_ntp_server is not none and kolla_ironic_ntp_server | length > 0 %} + ntp_server: "{{ kolla_ironic_ntp_server }}" +{% endif %} {% endif %} {% if kolla_inspector_extra_kernel_options %} ironic_kernel_cmdline_extras: diff --git a/etc/kayobe/ironic.yml b/etc/kayobe/ironic.yml index 442c5411f..74c3091ec 100644 --- a/etc/kayobe/ironic.yml +++ b/etc/kayobe/ironic.yml @@ -100,6 +100,11 @@ # Name of the Neutron network to use for provisioning. #kolla_ironic_provisioning_network: +# Address of the Ironic Python Agent (IPA) NTP server. The default value maps +# to the IP address of each controller on the internal API, which should be +# running chronyd. +#kolla_ironic_ntp_server: + # List of default kernel parameters to append for baremetal PXE boot. #kolla_ironic_pxe_append_params_default: diff --git a/releasenotes/notes/add-default-config-for-the-ipa-ntp-server-b2ab9345e4bf524d.yaml b/releasenotes/notes/add-default-config-for-the-ipa-ntp-server-b2ab9345e4bf524d.yaml new file mode 100644 index 000000000..6af3c57a1 --- /dev/null +++ b/releasenotes/notes/add-default-config-for-the-ipa-ntp-server-b2ab9345e4bf524d.yaml @@ -0,0 +1,9 @@ +--- +features: + - | + Adds default configuration to Kolla Ansible for the ``ipa-ntp-server`` + kernel command line argument used by IPA during provisioning and cleaning. + Ensures correct system time during certificate creation, preventing issues + where Ironic fails to communicate with the Ironic Python Agent due to + invalid certificate timestamps. The default NTP server can be overridden by + changing ``kolla_ironic_ntp_server``. From 361b24afe613f5b65646cc49a76458abe471325d Mon Sep 17 00:00:00 2001 From: Rafal Lewandowski Date: Fri, 9 Oct 2026 17:34:05 +0200 Subject: [PATCH 03/11] Sync inventory and feature flags from KA 2026.2 Following the steps in the Kayobe release guide[1,2] [1] https://docs.openstack.org/kayobe/latest/contributor/releases.html#synchronise-with-kolla-ansible-feature-flags [2] https://docs.openstack.org/kayobe/latest/contributor/releases.html#synchronise-with-kolla-ansible-inventory Change-Id: I73182e9609994189fa287d3ff5c3a1e848a9bc22 Signed-off-by: Rafal Lewandowski --- .../kolla-ansible/templates/kolla/globals.yml | 14 +++++++------- .../templates/overcloud-components.j2 | 4 ---- ansible/roles/kolla-ansible/vars/main.yml | 2 ++ etc/kayobe/kolla.yml | 2 ++ ...olla-feature-flags-2026-2-b945b5f6ea601f94.yaml | 7 +++++++ zuul.d/jobs.yaml | 1 + 6 files changed, 19 insertions(+), 11 deletions(-) create mode 100644 releasenotes/notes/sync-kolla-feature-flags-2026-2-b945b5f6ea601f94.yaml diff --git a/ansible/roles/kolla-ansible/templates/kolla/globals.yml b/ansible/roles/kolla-ansible/templates/kolla/globals.yml index 577f6c988..c387d0779 100644 --- a/ansible/roles/kolla-ansible/templates/kolla/globals.yml +++ b/ansible/roles/kolla-ansible/templates/kolla/globals.yml @@ -292,7 +292,7 @@ enable_{{ feature_flag }}: {{ hostvars[inventory_hostname]['kolla_enable_' ~ fea #################### # Osprofiler options #################### -# valid values: ["elasticsearch", "redis"] +# valid values: ["elasticsearch", "valkey"] #osprofiler_backend: "elasticsearch" ################## @@ -308,8 +308,8 @@ enable_{{ feature_flag }}: {{ hostvars[inventory_hostname]['kolla_enable_' ~ fea # Valid options are [ file, ceph ] #gnocchi_backend_storage: "{% raw %}{{ 'ceph' if enable_ceph|bool else 'file' }}{% endraw %}" -# Valid options are [redis, ''] -#gnocchi_incoming_storage: "{% raw %}{{ 'redis' if enable_redis | bool else '' }}{% endraw %}" +# Valid options are [valkey, ''] +#gnocchi_incoming_storage: "{% raw %}{{ 'valkey' if enable_valkey | bool else '' }}{% endraw %}" ################################ # Cinder - Block Storage Options @@ -318,8 +318,8 @@ enable_{{ feature_flag }}: {{ hostvars[inventory_hostname]['kolla_enable_' ~ fea #cinder_backend_ceph: "{% raw %}{{ enable_ceph }}{% endraw %}" #cinder_backend_vmwarevc_vmdk: "no" #cinder_volume_group: "cinder-volumes" -# Valid options are [ '', redis, etcd ] -#cinder_coordination_backend: "{% raw %}{{ 'redis' if enable_redis|bool else 'etcd' if enable_etcd|bool else '' }}{% endraw %}" +# Valid options are [ '', valkey, etcd ] +#cinder_coordination_backend: "{% raw %}{{ 'valkey' if enable_valkey|bool else 'etcd' if enable_etcd|bool else '' }}{% endraw %}" # Valid options are [ nfs, ceph, s3 ] #cinder_backup_driver: "ceph" @@ -344,8 +344,8 @@ enable_{{ feature_flag }}: {{ hostvars[inventory_hostname]['kolla_enable_' ~ fea # Valid options are [ bind9 ] #designate_backend: "bind9" #designate_ns_record: "sample.openstack.org" -# Valid options are [ '', redis, etcd ] -#designate_coordination_backend: "{% raw %}{{ 'redis' if enable_redis|bool else 'etcd' if enable_etcd|bool else '' }}{% endraw %}" +# Valid options are [ '', valkey ] +#designate_coordination_backend: "{% raw %}{{ 'valkey' if enable_valkey|bool else '' }}{% endraw %}" ######################## # Nova - Compute Options diff --git a/ansible/roles/kolla-ansible/templates/overcloud-components.j2 b/ansible/roles/kolla-ansible/templates/overcloud-components.j2 index 3eea3b95c..544b6c71b 100644 --- a/ansible/roles/kolla-ansible/templates/overcloud-components.j2 +++ b/ansible/roles/kolla-ansible/templates/overcloud-components.j2 @@ -137,10 +137,6 @@ deployment [skyline:children] control -# TODO(vurmil): Remove after G/2026.1 release as Redis migration is no longer required -[redis:children] -control - [valkey:children] control diff --git a/ansible/roles/kolla-ansible/vars/main.yml b/ansible/roles/kolla-ansible/vars/main.yml index c94dbe66e..aa8bdcb64 100644 --- a/ansible/roles/kolla-ansible/vars/main.yml +++ b/ansible/roles/kolla-ansible/vars/main.yml @@ -96,6 +96,7 @@ kolla_feature_flags: - cinder_backend_pure_nvme_tcp - cinder_backend_pure_roce - cinder_backend_quobyte + - cinder_backend_vast - cinder_backup - cinder_horizon_policy_file - cloudkitty @@ -157,6 +158,7 @@ kolla_feature_flags: - manila_backend_generic - manila_backend_glusterfs_nfs - manila_backend_hnas + - manila_backend_vast - mariabackup - mariadb - masakari diff --git a/etc/kayobe/kolla.yml b/etc/kayobe/kolla.yml index 9ff4f8c4a..a0ae36a73 100644 --- a/etc/kayobe/kolla.yml +++ b/etc/kayobe/kolla.yml @@ -308,6 +308,7 @@ #kolla_enable_cinder_backend_pure_nvme_tcp: #kolla_enable_cinder_backend_pure_roce: #kolla_enable_cinder_backend_quobyte: +#kolla_enable_cinder_backend_vast: #kolla_enable_cinder_backup: #kolla_enable_cinder_horizon_policy_file: #kolla_enable_cloudkitty: @@ -369,6 +370,7 @@ #kolla_enable_manila_backend_generic: #kolla_enable_manila_backend_glusterfs_nfs: #kolla_enable_manila_backend_hnas: +#kolla_enable_manila_backend_vast: #kolla_enable_mariabackup: #kolla_enable_mariadb: #kolla_enable_masakari: diff --git a/releasenotes/notes/sync-kolla-feature-flags-2026-2-b945b5f6ea601f94.yaml b/releasenotes/notes/sync-kolla-feature-flags-2026-2-b945b5f6ea601f94.yaml new file mode 100644 index 000000000..4c1052006 --- /dev/null +++ b/releasenotes/notes/sync-kolla-feature-flags-2026-2-b945b5f6ea601f94.yaml @@ -0,0 +1,7 @@ +upgrade: + - | + Synchronises Kayobe feature flags and inventory with Kolla Ansible + 2026.2. The ``redis`` inventory group has been removed following + completion of the Redis to Valkey migration; use + ``kolla_enable_valkey`` instead. Redis references in the Kolla Ansible + ``globals.yml`` template have been updated to Valkey to match. diff --git a/zuul.d/jobs.yaml b/zuul.d/jobs.yaml index 25d65a9c4..a2575cb67 100644 --- a/zuul.d/jobs.yaml +++ b/zuul.d/jobs.yaml @@ -9,6 +9,7 @@ - playbooks/kayobe-tox-ansible-syntax/pre.yml required-projects: - name: openstack/ansible-collection-kolla + timeout: 3600 vars: tox_envlist: ansible-syntax # Use the site's OpenDev Galaxy mirror for role/collection installs. From b51f901bf541a8d50dc5bc2f02b9ea53498c4083 Mon Sep 17 00:00:00 2001 From: MurrayGroves Date: Tue, 13 Oct 2026 16:23:42 +0100 Subject: [PATCH 04/11] Bump stackhpc.libvirt-vm to 1.17.2 Closes-Bug: #2170208 Change-Id: I407f672a85f639f793e695000b6eb8e65d4c99ed Signed-off-by: MurrayGroves --- .../handle-304-in-image-download-8ceafad810dae83e.yaml | 6 ++++++ requirements.yml | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) create mode 100644 releasenotes/notes/handle-304-in-image-download-8ceafad810dae83e.yaml diff --git a/releasenotes/notes/handle-304-in-image-download-8ceafad810dae83e.yaml b/releasenotes/notes/handle-304-in-image-download-8ceafad810dae83e.yaml new file mode 100644 index 000000000..adf5cd0c4 --- /dev/null +++ b/releasenotes/notes/handle-304-in-image-download-8ceafad810dae83e.yaml @@ -0,0 +1,6 @@ +--- +fixes: + - | + Fixes an error when downloading already downloaded VM images caused by HTTP + 304 Not Modified. + `LP#2170208 `__ diff --git a/requirements.yml b/requirements.yml index 4a71f7021..e13bb4622 100644 --- a/requirements.yml +++ b/requirements.yml @@ -59,7 +59,7 @@ roles: - src: stackhpc.libvirt-host version: v1.15.1 - src: stackhpc.libvirt-vm - version: v1.17.1 + version: v1.17.2 - src: stackhpc.luks version: 0.4.4 - src: stackhpc.os-ironic-state From feb68c3d64ed27d23256924504fff791efc1ff70 Mon Sep 17 00:00:00 2001 From: Pierre Riteau Date: Mon, 12 May 2025 09:09:08 +0200 Subject: [PATCH 05/11] CI: Test overcloud provisioning with Bifrost Change-Id: Ib9b9b531973dd6e32fd15b645e33384b00e64fe0 Signed-off-by: Will Szumski Signed-off-by: Murray Groves --- dev/tenks-deploy-config-overcloud.yml | 6 ++++ .../kayobe-seed-base/bifrost-overrides.yml.j2 | 11 ++++--- playbooks/kayobe-seed-base/run.yml | 30 +++++++++++++++++++ 3 files changed, 43 insertions(+), 4 deletions(-) diff --git a/dev/tenks-deploy-config-overcloud.yml b/dev/tenks-deploy-config-overcloud.yml index 86209e874..8226653b4 100644 --- a/dev/tenks-deploy-config-overcloud.yml +++ b/dev/tenks-deploy-config-overcloud.yml @@ -40,3 +40,9 @@ wait_for_placement: false # Nested virtualisation is not working well in CI currently. Force the use of # QEMU. libvirt_vm_engine: "qemu" + +# NOTE(priteau): Disable libvirt_vm_trust_guest_rx_filters, which when enabled +# triggers the following errors when booting baremetal instances with Tenks on +# Libvirt 9: Cannot set interface flags on 'macvtap1': Value too large for +# defined data type +libvirt_vm_trust_guest_rx_filters: false diff --git a/playbooks/kayobe-seed-base/bifrost-overrides.yml.j2 b/playbooks/kayobe-seed-base/bifrost-overrides.yml.j2 index b429c01c1..c42e40a0b 100644 --- a/playbooks/kayobe-seed-base/bifrost-overrides.yml.j2 +++ b/playbooks/kayobe-seed-base/bifrost-overrides.yml.j2 @@ -1,7 +1,10 @@ --- -# Don't build an IPA deployment image. +# Don't build an IPA deployment image, instead download upstream images. create_ipa_image: false -download_ipa: false +download_ipa: true -# Don't build a disk image. It takes time and can be unreliable. -create_image_via_dib: false +# Use a CirrOS image +use_cirros: true +custom_deploy_image_upstream_url: https://download.cirros-cloud.net/0.5.3/cirros-0.5.3-x86_64-disk.img +custom_deploy_image_checksum_url: https://download.cirros-cloud.net/0.5.3/MD5SUMS +custom_deploy_image_checksum_algorithm: md5 \ No newline at end of file diff --git a/playbooks/kayobe-seed-base/run.yml b/playbooks/kayobe-seed-base/run.yml index 7d760d895..7cb4e8f23 100644 --- a/playbooks/kayobe-seed-base/run.yml +++ b/playbooks/kayobe-seed-base/run.yml @@ -10,6 +10,36 @@ cmd: "{{ kayobe_src_dir }}/dev/seed-deploy.sh &> {{ logs_dir }}/ansible/seed-deploy" executable: /bin/bash + - name: Ensure test Tenks cluster is deployed + shell: + # Pass absolute source directory, since otherwise the `chdir` will + # cause this to fail. + cmd: dev/tenks-deploy-overcloud.sh '{{ tenks_src_dir }}' &> {{ logs_dir }}/ansible/tenks-deploy-overcloud + chdir: "{{ kayobe_src_dir }}" + executable: /bin/bash + + - name: Perform overcloud inventory discovery + shell: + cmd: (source dev/environment-setup.sh && kayobe overcloud inventory discover) &> {{ logs_dir }}/ansible/overcloud-inventory-discover + chdir: "{{ kayobe_src_dir }}" + executable: /bin/bash + + - name: Perform overcloud hardware inspection + shell: + cmd: (source dev/environment-setup.sh && kayobe overcloud hardware inspect) &> {{ logs_dir }}/ansible/overcloud-hardware-inspect + chdir: "{{ kayobe_src_dir }}" + executable: /bin/bash + + - name: Perform overcloud provisioning + shell: + cmd: (source dev/environment-setup.sh && kayobe overcloud provision) &> {{ logs_dir }}/ansible/overcloud-provision + chdir: "{{ kayobe_src_dir }}" + executable: /bin/bash + + - name: Test network connectivity to the overcloud host + shell: + cmd: ping -c1 -W1 192.168.33.3 &> {{ logs_dir }}/ansible/overcloud-test + - block: # NOTE(mgoddard): The stack user cannot read the kolla source code, which # lives in the zuul user's home directory. Copy it to a readable location. From 54a475aff7bfb136f9edc8611b20f3d326abc321 Mon Sep 17 00:00:00 2001 From: Rafal Lewandowski Date: Wed, 14 Oct 2026 11:08:06 +0000 Subject: [PATCH 06/11] CI: Increase timeout of seed and infra VM jobs Increase the timeout of the kayobe-seed-base, kayobe-seed-upgrade-base, kayobe-seed-vm-base and kayobe-infra-vm-base jobs from 90 to 120 minutes. This is to workaround slow mirrors. Change-Id: I7e5a43e55c6acfa12bff22157fe1f26bae7f83fc Signed-off-by: Will Szumski --- zuul.d/jobs.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/zuul.d/jobs.yaml b/zuul.d/jobs.yaml index a2575cb67..8bc738bc9 100644 --- a/zuul.d/jobs.yaml +++ b/zuul.d/jobs.yaml @@ -270,7 +270,7 @@ Configures the primary VM as a seed. pre-run: playbooks/kayobe-seed-base/pre.yml run: playbooks/kayobe-seed-base/run.yml - timeout: 5400 + timeout: 7200 vars: build_images: false @@ -375,7 +375,7 @@ and upgrades it to the current release. pre-run: playbooks/kayobe-seed-upgrade-base/pre.yml run: playbooks/kayobe-seed-upgrade-base/run.yml - timeout: 5400 + timeout: 7200 - job: name: kayobe-seed-upgrade-rocky10 @@ -407,7 +407,7 @@ as a VM. pre-run: playbooks/kayobe-seed-vm-base/pre.yml run: playbooks/kayobe-seed-vm-base/run.yml - timeout: 5400 + timeout: 7200 - job: name: kayobe-seed-vm-rocky10 @@ -465,7 +465,7 @@ infra VM. pre-run: playbooks/kayobe-infra-vm-base/pre.yml run: playbooks/kayobe-infra-vm-base/run.yml - timeout: 5400 + timeout: 7200 - job: name: kayobe-infra-vm-rocky10 From d9620f276f799a0e2f67aeb58345401da893f4f1 Mon Sep 17 00:00:00 2001 From: Rafal Lewandowski Date: Sun, 11 Oct 2026 17:46:48 +0200 Subject: [PATCH 07/11] [release] Use OpenStack 2026.2 release Switch all dependencies to use the OpenStack 2026.2 release. This commit should be reverted on the master branch once the Kayobe stable/2026.2 branch has been cut and RC1 released. Change-Id: Ib7f274b176e44c02b88f0ae511c7a5b5520b37dc Signed-off-by: Rafal Lewandowski --- ansible/inventory/group_vars/all/openstack | 6 +++--- etc/kayobe/openstack.yml | 4 ++-- requirements.yml | 2 +- tox.ini | 8 ++++---- zuul.d/jobs.yaml | 8 ++++++++ 5 files changed, 18 insertions(+), 10 deletions(-) diff --git a/ansible/inventory/group_vars/all/openstack b/ansible/inventory/group_vars/all/openstack index 430293d3f..be905c902 100644 --- a/ansible/inventory/group_vars/all/openstack +++ b/ansible/inventory/group_vars/all/openstack @@ -2,10 +2,10 @@ ############################################################################### # OpenStack release configuration. -# Name of the current OpenStack release. Default is "master". -openstack_release: "master" +# Name of the current OpenStack release. Default is "2026.2". +openstack_release: "2026.2" -# Name of the current OpenStack branch. Default is "master". +# Name of the current OpenStack branch. Default is "stable/2026.2". openstack_branch: >- {% if openstack_release != 'master' %}stable/{% endif %}{{ openstack_release | lower }} diff --git a/etc/kayobe/openstack.yml b/etc/kayobe/openstack.yml index 1acfd0756..d4a919d40 100644 --- a/etc/kayobe/openstack.yml +++ b/etc/kayobe/openstack.yml @@ -2,10 +2,10 @@ ############################################################################### # OpenStack release configuration. -# Name of the current OpenStack release. Default is "master". +# Name of the current OpenStack release. Default is "2026.2". #openstack_release: -# Name of the current OpenStack branch. Default is "master". +# Name of the current OpenStack branch. Default is "stable/2026.2". #openstack_branch: ############################################################################### diff --git a/requirements.yml b/requirements.yml index 4a71f7021..fab370f02 100644 --- a/requirements.yml +++ b/requirements.yml @@ -4,7 +4,7 @@ collections: version: 1.3.0 - name: https://opendev.org/openstack/ansible-collection-kolla type: git - version: master + version: stable/2026.2 - name: cisco.nxos version: 13.0.0 - name: community.docker diff --git a/tox.ini b/tox.ini index 582a843cd..bcbf5d7db 100644 --- a/tox.ini +++ b/tox.ini @@ -20,7 +20,7 @@ setenv = OS_TEST_TIMEOUT=60 ANSIBLE_VERBOSITY=3 deps = - -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master} + -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/2026.2} -r{toxinidir}/requirements.txt -r{toxinidir}/test-requirements.txt commands = stestr run {posargs} @@ -43,7 +43,7 @@ commands = [testenv:venv] deps = - -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master} + -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/2026.2} -r{toxinidir}/test-requirements.txt -r{toxinidir}/doc/requirements.txt commands = {posargs} @@ -61,7 +61,7 @@ commands = [testenv:molecule] deps = - -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master} + -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/2026.2} -r{toxinidir}/requirements.txt -r{toxinidir}/molecule-requirements.txt commands = @@ -131,7 +131,7 @@ commands = [testenv:docs] deps = - -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master} + -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/2026.2} -r{toxinidir}/doc/requirements.txt commands = rm -rf doc/build/html diff --git a/zuul.d/jobs.yaml b/zuul.d/jobs.yaml index 8bc738bc9..87e91dec5 100644 --- a/zuul.d/jobs.yaml +++ b/zuul.d/jobs.yaml @@ -93,11 +93,19 @@ required-projects: # Include kayobe to ensure other projects can use this job. - name: openstack/ansible-collection-kolla + # TODO(rlewandowski): Remove when kayobe stable/2026.2 exists. + override-checkout: stable/2026.2 - name: openstack/kayobe - name: openstack/kayobe-config-dev - name: openstack/kolla + # TODO(rlewandowski): Remove when kayobe stable/2026.2 exists. + override-checkout: stable/2026.2 - name: openstack/kolla-ansible + # TODO(rlewandowski): Remove when kayobe stable/2026.2 exists. + override-checkout: stable/2026.2 - name: openstack/requirements + # TODO(rlewandowski): Remove when kayobe stable/2026.2 exists. + override-checkout: stable/2026.2 - name: openstack/tenks irrelevant-files: - ^\..+ From 23e989ad79eede7e942def1101d9f39088d32bc7 Mon Sep 17 00:00:00 2001 From: Will Szumski Date: Wed, 14 Oct 2026 11:59:05 +0000 Subject: [PATCH 08/11] Remove deprecated manage-containers aliases The seed-deploy-containers and seed-manage-containers tags, and the deploy_containers_defaults, deploy_containers_docker_api_timeout and seed_deploy_containers_registry_attempt_login variables, were deprecated when the custom containers feature was extended beyond the seed, and were scheduled for removal in the Hibiscus cycle. The container deployment tasks now consume manage_containers_defaults directly, so overrides of it take effect. Generated-By: Claude Code claude-opus-5-5 Change-Id: I6f41bdfa7e6c29e5f88a47551f7238abc380824a Signed-off-by: Will Szumski --- ansible/inventory/group_vars/all/seed | 8 +------- ansible/manage-containers.yml | 4 ---- ansible/roles/manage-containers/defaults/main.yml | 8 ++------ .../manage-containers/tasks/deploy-container.yml | 10 +++++----- ...precated-manage-containers-b074ff60b3f75be7.yaml | 13 +++++++++++++ 5 files changed, 21 insertions(+), 22 deletions(-) create mode 100644 releasenotes/notes/remove-deprecated-manage-containers-b074ff60b3f75be7.yaml diff --git a/ansible/inventory/group_vars/all/seed b/ansible/inventory/group_vars/all/seed index 3dc104904..1e469a23c 100644 --- a/ansible/inventory/group_vars/all/seed +++ b/ansible/inventory/group_vars/all/seed @@ -143,15 +143,9 @@ seed_users: "{{ users_default }}" # seed_containers: {} -# (Deprecated) Whether to attempt a basic authentication login to a registry when -# deploying seed containers. -# TODO(mattcrees): remove seed_deploy_containers_registry_attempt_login in the -# Hibiscus cycle. -seed_deploy_containers_registry_attempt_login: "{{ kolla_docker_registry_username is truthy and kolla_docker_registry_password is truthy }}" - # Whether to attempt a basic authentication login to a registry when # deploying seed containers. -seed_manage_containers_registry_attempt_login: "{{ seed_deploy_containers_registry_attempt_login }}" +seed_manage_containers_registry_attempt_login: "{{ kolla_docker_registry_username is truthy and kolla_docker_registry_password is truthy }}" ############################################################################### # Seed node firewalld configuration. diff --git a/ansible/manage-containers.yml b/ansible/manage-containers.yml index 054034039..fc7c0e79b 100644 --- a/ansible/manage-containers.yml +++ b/ansible/manage-containers.yml @@ -2,10 +2,6 @@ - name: "Ensure defined container images are {{ kayobe_action | default('deploy') }}ed" hosts: "{{ manage_containers_target_hosts | default('seed') }}" tags: - # Kept for backward compatibility. - # TODO(mattcrees): Will be removed in the Hibiscus release. - - seed-deploy-containers - - seed-manage-containers - manage-containers tasks: - import_role: diff --git a/ansible/roles/manage-containers/defaults/main.yml b/ansible/roles/manage-containers/defaults/main.yml index e79c8ec75..f8d532360 100644 --- a/ansible/roles/manage-containers/defaults/main.yml +++ b/ansible/roles/manage-containers/defaults/main.yml @@ -2,10 +2,7 @@ # Action to perform: One of: "deploy", "destroy". manage_containers_action: "deploy" -#TODO(mattcrees): remove deploy_containers_defaults in Hibiscus cycle -manage_containers_defaults: "{{ deploy_containers_defaults }}" - -deploy_containers_defaults: +manage_containers_defaults: comparisons: image: strict env: strict @@ -18,8 +15,7 @@ deploy_containers_defaults: manage_custom_containers: [] -#TODO(mattcrees): remove deploy_containers_docker_api_timeout in Hibiscus cycle. -manage_containers_docker_api_timeout: "{{ deploy_containers_docker_api_timeout | default(120) }}" +manage_containers_docker_api_timeout: 120 manage_containers_registry: manage_containers_registry_username: diff --git a/ansible/roles/manage-containers/tasks/deploy-container.yml b/ansible/roles/manage-containers/tasks/deploy-container.yml index c29912758..872e697d5 100644 --- a/ansible/roles/manage-containers/tasks/deploy-container.yml +++ b/ansible/roles/manage-containers/tasks/deploy-container.yml @@ -14,18 +14,18 @@ kayobe_container: capabilities: "{{ container_config.capabilities | default(omit) }}" command: "{{ container_config.command | default(omit) }}" - comparisons: "{{ container_config.comparisons | default(deploy_containers_defaults.comparisons) }}" - detach: "{{ container_config.detach | default(deploy_containers_defaults.detach) }}" + comparisons: "{{ container_config.comparisons | default(manage_containers_defaults.comparisons) }}" + detach: "{{ container_config.detach | default(manage_containers_defaults.detach) }}" env: "{{ container_config.env | default(omit) }}" name: "{{ container_name }}" - network_mode: "{{ container_config.network_mode | default(deploy_containers_defaults.network_mode) }}" + network_mode: "{{ container_config.network_mode | default(manage_containers_defaults.network_mode) }}" image: "{{ container_config.image }}:{{ container_config.tag | default('latest') }}" - init: "{{ container_config.init | default(deploy_containers_defaults.init) }}" + init: "{{ container_config.init | default(manage_containers_defaults.init) }}" ipc_mode: "{{ container_config.ipc_mode | default(omit) }}" pid_mode: "{{ container_config.pid_mode | default(omit) }}" ports: "{{ container_config.ports | default(omit) }}" privileged: "{{ container_config.privileged | default(omit) }}" - restart_policy: "{{ container_config.restart_policy | default(deploy_containers_defaults.restart_policy) }}" + restart_policy: "{{ container_config.restart_policy | default(manage_containers_defaults.restart_policy) }}" shm_size: "{{ container_config.shm_size | default(omit) }}" sysctls: "{{ container_config.sysctls | default(omit) }}" timeout: "{{ manage_containers_docker_api_timeout }}" diff --git a/releasenotes/notes/remove-deprecated-manage-containers-b074ff60b3f75be7.yaml b/releasenotes/notes/remove-deprecated-manage-containers-b074ff60b3f75be7.yaml new file mode 100644 index 000000000..0a9e1ff92 --- /dev/null +++ b/releasenotes/notes/remove-deprecated-manage-containers-b074ff60b3f75be7.yaml @@ -0,0 +1,13 @@ +--- +upgrade: + - | + The deprecated tags ``seed-deploy-containers`` and + ``seed-manage-containers`` have been removed. Use the + ``manage-containers`` tag instead. + - | + The deprecated variables ``deploy_containers_defaults``, + ``deploy_containers_docker_api_timeout`` and + ``seed_deploy_containers_registry_attempt_login`` have been removed. Use + ``manage_containers_defaults``, ``manage_containers_docker_api_timeout`` + and ``seed_manage_containers_registry_attempt_login`` respectively + instead. From 968e3ec17c40b87e3fa888daf6bdb6b0ffd0a5c4 Mon Sep 17 00:00:00 2001 From: Will Szumski Date: Thu, 15 Oct 2026 16:38:28 +0000 Subject: [PATCH 09/11] Add dummy variable to hostname.yml Kayobe passes each configuration file under etc/kayobe to Ansible as extra variables using -e @. A file that contains only comments is parsed as null, which Ansible rejects as invalid extra vars data. Add the workaround_ansible_issue_8743 dummy variable used in all other configuration files so that the default hostname.yml can be loaded. Generated-By: Claude Opus 5.5 Change-Id: Iad3673203d300d7634a721681f3175cfb7413ce3 Signed-off-by: Will Szumski --- etc/kayobe/hostname.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/etc/kayobe/hostname.yml b/etc/kayobe/hostname.yml index 34b4b420c..07312a870 100644 --- a/etc/kayobe/hostname.yml +++ b/etc/kayobe/hostname.yml @@ -7,3 +7,7 @@ # Custom hostname to set. Default is "{{ inventory_hostname }}". #kayobe_custom_hostname: + +############################################################################### +# Dummy variable to allow Ansible to accept this file. +workaround_ansible_issue_8743: yes From 1dea9135cfd17f24b01783323df62c92e03aceeb Mon Sep 17 00:00:00 2001 From: Pierre Riteau Date: Fri, 16 Oct 2026 11:39:58 +0200 Subject: [PATCH 10/11] Bump community.docker to 5.4.0 Change-Id: I78a77ba2b8c6f2c50a5027abfacc76bfa5e9fbbd Signed-off-by: Pierre Riteau --- requirements.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.yml b/requirements.yml index 05985ffd8..02984f8eb 100644 --- a/requirements.yml +++ b/requirements.yml @@ -8,7 +8,7 @@ collections: - name: cisco.nxos version: 13.0.0 - name: community.docker - version: 5.3.0 + version: 5.4.0 - name: community.network version: 5.1.0 - name: dellemc.enterprise_sonic From 6438da00623b58090002ea6b8f411020b1369fba Mon Sep 17 00:00:00 2001 From: Pierre Riteau Date: Fri, 16 Oct 2026 11:47:58 +0200 Subject: [PATCH 11/11] Bump robertdebock.fail2ban to 5.0.7 This allows us to drop the fail2ban_sender override. Change-Id: I5869fb3f012120978c1c938a9bb2810f82686b1f Signed-off-by: Pierre Riteau --- ansible/fail2ban.yml | 3 --- requirements.yml | 2 +- 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/ansible/fail2ban.yml b/ansible/fail2ban.yml index 5f85f0a0e..febd3c530 100644 --- a/ansible/fail2ban.yml +++ b/ansible/fail2ban.yml @@ -12,6 +12,3 @@ - role: robertdebock.fail2ban become: true when: fail2ban_enabled | bool - vars: - # TODO (L-Chams): Remove fail2ban_sender override when PR https://github.com/robertdebock/ansible-role-fail2ban/pull/18 is merged. - fail2ban_sender: root@{{ ansible_facts.fqdn }} diff --git a/requirements.yml b/requirements.yml index 05985ffd8..c30bfa695 100644 --- a/requirements.yml +++ b/requirements.yml @@ -49,7 +49,7 @@ roles: - src: mrlesmithjr.mdadm version: v0.1.9 - src: robertdebock.fail2ban - version: 5.0.6 + version: 5.0.7 - src: singleplatform-eng.users version: v1.2.6 - src: stackhpc.drac