kolla: sync image definitions with kolla-ansible#287
Conversation
Reconcile all/002-images-kolla.yml with the upstream openstack/kolla-ansible role defaults (ansible/roles/*/defaults/main.yml). Add the image and tag defaults for neutron-ovn-agent, neutron-rpc-server, neutron-periodic-worker, neutron-ovn-maintenance-worker, the keystone httpd image, ironic-pxe-filter and the valkey role (valkey-server, valkey-sentinel). neutron-rpc-server, neutron-periodic-worker and neutron-ovn-maintenance-worker reuse the neutron-server image upstream (no dedicated image is built for them), so they point at neutron_server_image. Add contrib/compare-kolla-images.py to compare the image parameters in all/002-images-kolla.yml against the kolla-ansible role defaults (reports missing, obsolete, aliased and differing image variables). Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Christian Berendt <berendt@osism.tech>
| neutron-eswitchd); review case by case. | ||
|
|
||
| The exit code is non-zero when images are MISSING or have an ALIAS mismatch, | ||
| so the script can be used as a CI guard. |
There was a problem hiding this comment.
This "CI guard" framing won't hold as a pass/fail gate: all/002-images-kolla.yml is a single file covering all supported releases, while this compares it against one upstream kolla-ansible checkout. A superset-vs-single-branch comparison always produces noise — MISSING when the branch is newer than the file's coverage, OBSOLETE for vars belonging to other releases — so the exit code can't cleanly mean "out of sync."
It's a genuinely useful manual diff tool as-is. To gate on it you'd need to compare against the union of all supported release branches (or run per-release with per-release expectations). Until then, suggest softening this to describe it as a manual helper, so nobody wires it into CI expecting a reliable signal.
| m = ALIAS_RE.match(value) | ||
| if m: | ||
| return resolve_image_name(m.group("ref"), values, _seen) | ||
| return value # unknown pattern, surface it verbatim |
There was a problem hiding this comment.
The resolver expects {{ docker_image_url }} to be immediately followed by a name, so conditional values like mariadb_image and prometheus_server_image (which insert a second {{ … }} there) fall through to here and return the raw template string as the "name." That surfaces as spurious entries under --show-differs and can flip --strict to a non-zero exit; the default run is unaffected.
Suggest: if the resolved name still contains {{, treat it as unresolved (skip / flag separately) rather than returning the template as a name.
| candidates += [ | ||
| repo_root.parent / "kolla-ansible", | ||
| repo_root.parent.parent / "kolla-ansible", | ||
| Path("~/Repositories/kolla-ansible").expanduser(), |
There was a problem hiding this comment.
Please drop this contributor-specific path. The --kolla-ansible flag, $KOLLA_ANSIBLE_PATH, and the two sibling-checkout candidates above already cover real layouts.
Clone the kolla-ansible repository to compare against instead of probing
for a local checkout: add --repo (default openstack/kolla-ansible) and
--branch (default master), shallow-clone into a temporary directory and
remove it afterwards.
Describe the script as a manual helper rather than a CI gate, and report
unresolved "{{ ... }}" templates (e.g. the conditional mariadb and
prometheus_server images) as unresolved instead of surfacing the raw
template string.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Christian Berendt <berendt@osism.tech>
ideaship
left a comment
ideaship
left a comment
There was a problem hiding this comment.
I'm assuming that osism/container-image-kolla-ansible#920 will be addressed in time.
3 participants
Summary
Reconcile
all/002-images-kolla.ymlwith the upstreamopenstack/kolla-ansiblerole defaults (ansible/roles/*/defaults/main.yml).Added image/tag definitions
neutron-ovn-agent(role: neutron)keystone httpdimage (role: keystone)ironic-pxe-filter(role: ironic)valkeyrole:valkey-serverandvalkey-sentinelneutron-rpc-server,neutron-periodic-worker,neutron-ovn-maintenance-workerAliases
neutron-rpc-server,neutron-periodic-workerandneutron-ovn-maintenance-workerreuse theneutron-serverimage upstream (no dedicated image is built for them), so they point atneutron_server_imageinstead of an invented image name.Tooling
Adds
contrib/compare-kolla-images.py, which extracts the image parameters from the kolla-ansible role defaults and reports missing, obsolete, aliased and differing image variables. It exits non-zero on missing/alias-mismatch, so it can be used as a CI guard.Intentionally left unchanged: 55 obsolete variables (services removed upstream but still shipped by OSISM, e.g. monasca/sahara/senlin/swift) and 5 intentional/conditional differences (e.g.
neutron-eswitchd,mariadb,prometheus_server).🤖 Generated with Claude Code