From 8f85eb1871c2d5abf1815980c425bf1a44418ee3 Mon Sep 17 00:00:00 2001 From: Roger Luethi Date: Fri, 3 Jul 2026 15:46:02 +0200 Subject: [PATCH 1/3] kolla: add missing 2025.2 group_vars all/001-kolla-defaults.yml mirrors upstream kolla-ansible's global group_vars/all but is synced to stable/2025.1 and never picked up several variables added during the 2025.2 cycle. Because OSISM's defaults replace kolla-ansible's own group_vars/all at deploy time, those variables are undefined on a 2025.2 deploy/upgrade, aborting the service tasks that reference them (keystone is simply the first wall the upgrade reaches). Add, verbatim from upstream stable/2025.2: - keystone_listen_port: used by the keystone role's uWSGI config (keystone_wsgi_provider defaults to uwsgi in 2025.2); when undefined it aborts the keystone service upgrade on every control node. - enable_ironic_pxe_filter: referenced by the ironic role's service dict; bites where ironic is enabled (e.g. metalbox). - nova_database_{address,name,user} and nova_cell0_database_{address,name,password,shard_id,user}: the nova cells database globals; the nova_cell0_database_* values reference the nova_database_* ones and are consumed by the nova role's bootstrap and map_cell0 tasks. The change is purely additive and union-safe: these variables are new in 2025.2, so they are inert on older supported releases (their roles do not reference them) and defined for 2025.2. nova_cell0_database_password resolves to the nova_database_password secret from passwords.yml, which lives outside these defaults. This is a targeted forward-port; the broader remedy is a full re-sync of osism/defaults against upstream stable/2025.2. UpgradeImpact Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Roger Luethi --- all/001-kolla-defaults.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/all/001-kolla-defaults.yml b/all/001-kolla-defaults.yml index d756d10..88ca9cc 100644 --- a/all/001-kolla-defaults.yml +++ b/all/001-kolla-defaults.yml @@ -494,6 +494,7 @@ keystone_public_port: "{{ haproxy_single_external_frontend_public_port if haprox keystone_public_listen_port: "5000" keystone_internal_port: "5000" keystone_internal_listen_port: "{{ keystone_internal_port }}" +keystone_listen_port: "{{ keystone_internal_listen_port }}" keystone_ssh_port: "8023" @@ -892,6 +893,7 @@ enable_ironic_dnsmasq: "{{ enable_ironic | bool }}" enable_ironic_inspector: "no" enable_ironic_neutron_agent: "no" enable_ironic_prometheus_exporter: "{{ enable_ironic | bool and enable_prometheus | bool }}" +enable_ironic_pxe_filter: "no" enable_iscsid: "{{ enable_cinder | bool and enable_cinder_backend_iscsi | bool }}" enable_kuryr: "no" enable_letsencrypt: "no" @@ -1243,7 +1245,16 @@ nova_console: "novnc" ####################### # Nova Database ####################### +nova_database_address: "{{ database_address | put_address_in_context('url') }}:{{ database_port }}" +nova_database_name: "nova" nova_database_shard_id: "{{ mariadb_default_database_shard_id | int }}" +nova_database_user: "{% if use_preconfigured_databases | bool and use_common_mariadb_user | bool %}{{ database_user }}{% else %}nova{% endif %}" + +nova_cell0_database_address: "{{ nova_database_address }}" +nova_cell0_database_name: "{{ nova_database_name }}_cell0" +nova_cell0_database_password: "{{ nova_database_password }}" +nova_cell0_database_shard_id: "{{ nova_database_shard_id | int }}" +nova_cell0_database_user: "{{ nova_database_user }}" ####################### # Horizon options From faf19b86fd8142ac9acfe6a3bff9eb74f3149dda Mon Sep 17 00:00:00 2001 From: Roger Luethi Date: Fri, 3 Jul 2026 15:46:12 +0200 Subject: [PATCH 2/3] kolla: gate proxysql enable by release kolla-ansible 2025.2 made ProxySQL the default MariaDB load balancer (enable_proxysql now defaults to enable_mariadb) and removed the internal HAProxy MariaDB frontend from the mariadb role. OSISM's defaults set enable_proxysql unconditionally to "no", a 2025.1-era assumption. On 2025.2 that combination leaves MariaDB with no load-balancer frontend from any source: services.d/mariadb.cfg (HAProxy) renders empty, so there is no :3306 listener on the internal VIP and access to MariaDB through the VIP is refused, failing the mariadb role's own "wait for MariaDB through VIP" readiness gate. Gate enable_proxysql on openstack_version -- off for 2024.1, 2024.2 and 2025.1, on for 2025.2 and later -- mirroring the enable_redis and enable_valkey release gate. mariadb_loadbalancer already derives from enable_proxysql, so the load-balancer selection follows automatically. Note: enable_proxysql=no is no longer a working HAProxy escape hatch on 2025.2, since the internal HAProxy MariaDB frontend was removed upstream; ProxySQL is effectively required for MariaDB HA there (unless enable_external_mariadb_load_balancer is used). UpgradeImpact Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Roger Luethi --- all/099-kolla.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/all/099-kolla.yml b/all/099-kolla.yml index a0ba351..1653814 100644 --- a/all/099-kolla.yml +++ b/all/099-kolla.yml @@ -28,8 +28,10 @@ enable_prometheus_openstack_exporter: "no" # We don't usually use heat anywhere. Enable it explicitly if required. enable_heat: "no" -# Backward compatibility for < 2025.1 -enable_proxysql: "no" +# ProxySQL became the default MariaDB load balancer in 2025.2 (the internal +# HAProxy MariaDB frontend was removed upstream); enable it for 2025.2+, keep +# HAProxy for <= 2025.1. +enable_proxysql: "{{ 'no' if openstack_version in ['2024.1', '2024.2', '2025.1'] else 'yes' }}" proxysql_version: 3 From ff3ca5f84610d02225696d29ce86865e5703623d Mon Sep 17 00:00:00 2001 From: Roger Luethi Date: Fri, 3 Jul 2026 16:10:23 +0200 Subject: [PATCH 3/3] kolla: fix horizon listen port for 2025.2 uWSGI kolla-ansible 2025.2 switched Horizon to uWSGI by default (horizon_wsgi_provider defaults to "uwsgi"; commit 2b591fb09), the same migration that added keystone_listen_port. The Horizon role now serves uWSGI on horizon_listen_port, and upstream added an "'8080' if enable_haproxy" branch to that variable: behind HAProxy the uWSGI backend must listen on the unprivileged 8080 while HAProxy fronts the privileged 80. OSISM did not pick up that branch. all/001-kolla-defaults.yml carries the pre-uWSGI value (horizon_tls_port if TLS backend else horizon_port, i.e. 80 in the common no-TLS case), and OSISM enables HAProxy by default. On a 2025.2 deploy the uWSGI backend would target the privileged 80 instead of 8080, breaking Horizon behind HAProxy. Override horizon_listen_port in all/099-kolla.yml, release-gated on openstack_version: for 2025.2+ with HAProxy use 8080 (matching upstream), and for 2024.1/2024.2/2025.1 keep the exact previous value so older releases (which still use Apache/mod_wsgi) are unchanged. UpgradeImpact Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Roger Luethi --- all/099-kolla.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/all/099-kolla.yml b/all/099-kolla.yml index 1653814..d3bba06 100644 --- a/all/099-kolla.yml +++ b/all/099-kolla.yml @@ -70,6 +70,11 @@ enable_mariabackup: "yes" # horizon horizon_backend_database: "yes" +# 2025.2 switched Horizon to uWSGI (horizon_wsgi_provider defaults to uwsgi); +# behind HAProxy the uWSGI backend must listen on the unprivileged 8080, not +# the privileged 80. Match upstream for 2025.2+, keep the pre-uWSGI value for +# <= 2025.1. +horizon_listen_port: "{{ '8080' if (enable_haproxy | bool and openstack_version not in ['2024.1', '2024.2', '2025.1']) else horizon_tls_port if horizon_enable_tls_backend | bool else horizon_port }}" # ironic ironic_agent_files_directory: /share/ironic