kolla: re-sync 001 group_vars to upstream 2025.2 (+ 010 layers)#297
Merged
Conversation
ideaship
force-pushed
the
kolla-groupvars-2025.2
branch
from
bc6b85d to
ce14d51
Compare
berendt
requested changes
Jul 11, 2026
000-registries.yml holds OSISM's registry host choices (docker_registry, <service>_docker_registry), but the 000 prefix made it load before 001-kolla-defaults.yml, the verbatim upstream mirror. In an Ansible group_vars directory later files win, so any upstream group_var sharing a name silently overrides the OSISM value -- and with the 2025.2 re-sync that stops being hypothetical: upstream now defines docker_registry: "quay.io", which would clobber OSISM's index.docker.io (the docker login target via auth_registry). Registry hosts are OSISM opinions like everything else in the 099-* overlay, so rename the file to 099-registries.yml to load it above the mirror. File content is unchanged, and no other layer defines any of its keys, so the rename is behavior-preserving on its own; it keeps the docker_registry value stable once 001 mirrors the new upstream key. Assisted-by: Claude:claude-fable-5 Signed-off-by: Roger Luethi <luethi@osism.tech>
Mirror the 8 upstream-moved group_vars values into 001 verbatim (horizon_listen_port, enable_proxysql, database_enable_tls_*, kolla_base_distro_version_default_map, mariadb_backup_target/loadbalancer/monitor_user). Three of these are release-varying: 2025.2 hardcoded the mariadb LB trio to their ProxySQL values, but OSISM keeps HAProxy for <= 2025.1. Add 099-kolla.yml overrides with the conditional forms, which resolve correctly on every release via the existing enable_proxysql gate. The other release-varying ones are already handled (horizon_listen_port and enable_proxysql gated in 099; kolla_base_distro_version_default_map is not deploy-consumed by OSISM). The drift detector cannot catch a wrong-for-older-release value, so this is verified by release analysis. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Roger Luethi <luethi@osism.tech>
Add docker_registry, docker_namespace, openstack_release and the default_container_dimensions_docker/_podman ulimit defaults to 001, verbatim from stable/2025.2 (strict verbatim, no exclusions). The dimensions keys are new upstream (2025.1); the others are long-standing upstream keys (docker_registry has defaulted to quay.io since 2021) that the hand-maintained mirror had excluded since the Yoga sync. Higher-precedence layers stay the effective source where they supply one: docker_registry via 099-registries.yml (index.docker.io), docker_namespace via 099-kolla.yml, openstack_release via the image versions.yml; the 001 copies are harmless upstream-default baselines. The dimensions keys are referenced by default_container_dimensions once a later commit re-syncs its value to the 2025.2 form. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Roger Luethi <luethi@osism.tech>
all/001-kolla-defaults.yml is a verbatim mirror of upstream kolla-ansible's group_vars/all; OSISM's own overrides belong in the 099-* overlay files, never in the mirror. Five keys had drifted from upstream — either an OSISM value edited directly into the mirror, or an older-release upstream value that was never re-synced: docker_image_url, glance_backend_file, haproxy_backend_cacert, neutron_bridge_name, rabbitmq_cacert. Restore each to its upstream stable/2025.2 form. Only docker_image_url is a genuine OSISM override — OSISM pulls kolla images from its own registry (docker_registry_kolla) instead of upstream's docker_registry — so its OSISM form moves to the 099-kolla.yml overlay, which wins over the mirror. The other four need no override: the cacert change is only in the RedHat-family branch, which OSISM's ubuntu base image never takes, and glance_backend_file / neutron_bridge_name only dropped VMware/Swift terms that OSISM never enables. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Roger Luethi <luethi@osism.tech>
Upstream kolla-ansible replaced Redis with Valkey at stable/2025.2: it dropped the redis branch from the coordination backends (valkey-only) and removed redis_connection_string. all/001-kolla-defaults.yml is a verbatim mirror of upstream, so it takes those 2025.2 forms and drops enable_redis / redis_connection_string / redis_connection_string_extras. OSISM still deploys Redis on 2024.1/2024.2/2025.1 (enable_redis is gated on the release in 099-kolla.yml), so restore the redis-including forms in the 099-kolla.yml overlay for the six coordination/connection vars, plus redis_connection_string(_extras). Each is a single expression that stays correct on every release via the enable_valkey/enable_redis gates (valkey on 2025.2, redis below), so no per-release file is needed. The effective values are unchanged from before the re-sync. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Roger Luethi <luethi@osism.tech>
OSISM's kolla group_vars in all/ are layered by filename prefix: the 001-kolla-defaults.yml file mirrors upstream kolla-ansible's group_vars for the newest supported release, and the 099-* files hold OSISM's own values, which load later and win. Upstream removes group_vars over time; some that newer releases dropped are still defined by older releases OSISM continues to support. Those keys were absent from all/ altogether, so on an older release they had no definition at all. Introduce a middle layer for them. A new all/010-<release>.yml file loads after 001 and before 099, and carries the group_vars a given older release still defines, copied verbatim from that release's upstream group_vars/all. Each file is self-retiring: delete it once that release leaves the supported range. - all/010-2024.2.yml: 7 swift keys (enable_swift_recon, enable_swift_s3api, the account/container/object server ports, swift_proxy_server_listen_port, swift_rsync_port). Upstream removed the Swift role at 2025.1; 2024.2 is the newest release that still defines them. - all/010-2024.1.yml: distro_python_version_map, enable_cinder_backend_hnas_nfs, prometheus_msteams_port, prometheus_msteams_webhook_url, and swift_internal_endpoint / swift_public_endpoint -- each defined only at 2024.1. The keys are never evaluated in practice (the swift role stays disabled; the others gate features OSISM does not deploy), so defining them on every release is equivalent to their previous absence. They are disjoint from the swift variables the per-release container-image-kolla-ansible overlays supply, so nothing is defined twice. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Roger Luethi <luethi@osism.tech>
all/001-kolla-defaults.yml is meant to hold upstream kolla-ansible's group_vars for the newest supported release (2025.2) verbatim, with OSISM's own values kept separately in the 099-* files. It still carried 28 keys that upstream dropped at 2025.2 and defines only through 2025.1: the venus, vmware-vcenter and ironic-inspector groups, plus mariadb_clustercheck_port, neutron_legacy_iptables, neutron_tls_proxy_stats_port and run_default_subdirectories. Move them unchanged into all/010-2025.1.yml, the self-retiring layer that loads between 001 and 099 and holds group_vars an older release still needs. 2025.1 keeps the keys while 001 converges on the pure 2025.2 mirror. The values are byte-identical to what 001 held (checked against upstream stable/2025.1), so this is a pure relocation with no behavior change. Also drops the now-empty "VMware support" section header left behind in 001. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Roger Luethi <luethi@osism.tech>
Upstream 2025.1 replaced the el9-conditional container-dimensions machinery with engine-keyed ulimit defaults applied on every distro (commit 3f519184b, "Fix ulimit defaults for Debian family container engines"): default_container_dimensions now selects between the default_container_dimensions_docker/_podman keys, and the three *_el9 keys are gone. Our 001 still carried the old form. Re-sync 001 to the 2025.2 expression (the _docker/_podman keys were mirrored in an earlier commit) and relocate the three *_el9 keys to 010-2024.2.yml -- 2024.2 is the newest release that still defines them, and they stay upstream-vanilla (parent pattern: relocate, not 099). The value itself is release-varying, so 099-kolla.yml gets a backward-compat override: 2024.x keeps its el9-conditional form, newer releases resolve to the upstream 2025.2 expression. The drift detector cannot catch a wrong-for-older-release value, so this is verified by comparing the value across release branches. Assisted-by: Claude:claude-fable-5 Signed-off-by: Roger Luethi <luethi@osism.tech>
all/001-kolla-defaults.yml should hold only upstream kolla-ansible group_vars for the newest supported release (2025.2); OSISM's own values belong in the 099-* files. proxysql_version broke that rule: upstream 2025.2 does not define it, and OSISM already sets it from 099-kolla.yml, so keeping it in 001 both diverged from the upstream mirror and duplicated the OSISM value. Remove it from 001; the 099 definition remains the single source. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Roger Luethi <luethi@osism.tech>
Describe what all/ is and how to work in it. all/ is a native Ansible group_vars/all directory shipped in OSISM's Ansible container images; for the kolla-ansible container it replaces upstream kolla-ansible's own group_vars/all. The README covers: - file layout and load precedence (the numeric prefixes; later files win); - the two-layer model -- 001-kolla-defaults.yml is a verbatim upstream mirror, never hand-edited, and every OSISM opinion lives in a 099-* overlay that loads later and wins; - where a new, changed, or upstream-dropped variable goes, pointing at the osism/release drift detector (check-drift.py, docs/check-drift-kolla.md) for the per-case mechanics rather than restating them; - the split between these defaults and the operator's configuration.yml, and why release-gated values must live here; - how external tooling must resolve these values (through Ansible templating, not the raw configuration file); - a file-by-file reference and the 099-kolla.yml section convention. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Roger Luethi <luethi@osism.tech>
ideaship
force-pushed
the
kolla-groupvars-2025.2
branch
from
ce14d51 to
c3d557f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bring OSISM's kolla
group_varsinall/back in line with upstream kolla-ansible(synced to the current
stable/2025.2tip), using a clean layered model:001-kolla-defaults.yml= verbatim upstream mirror at the newest supportedrelease (2025.2): restores keys that had drifted (OSISM values edited into the
mirror, or stale older-release values), mirrors upstream keys the hand-maintained
file had excluded, and adopts upstream's 2025.2 values. Never hand-edited.
099-registries.yml(renamed from000-registries.yml): registry hosts movedabove the mirror. Upstream defaults
docker_registry: quay.io; with the old000-prefix the mirror silently overrode OSISM'sindex.docker.io. As a099-*file the OSISM registry hosts win, like every other OSISM setting.
099-kolla.ymlholds OSISM's own diverging values, moved out of the mirror —release-gated where needed (mariadb LB via the
enable_proxysqlgate; rediscoordination kept for <= 2025.1; container dimensions kept on the el9 form for
2024.x) so every supported release resolves correctly.
010-<release>.yml= self-retiring layers for group_vars an older supportedrelease still defines but 2025.2 dropped (
010-2024.1,010-2024.2,010-2025.1), copied verbatim from that release's upstream. Loads between 001 and099; deleted when the release ages out.
README.mddocuments the layout, load precedence, and where each kind ofvariable goes.
Independent of the orphaned-var cleanup PR (disjoint files); both bring
all/to thestate the drift checks expect.
Effective value changes (merged
all/*.yml, main vs this PR)Diff of the merged effective group_vars (all files in load order) — the semantic
view the per-file diff hides:
default_container_dimensionsglance_backend_file,neutron_bridge_namehaproxy_backend_cacert,rabbitmq_cacertca-bundle.trust.crt→ca-bundle.crt(RedHat-family branch only)kolla_base_distro_version_default_mapdatabase_enable_tls_backend,database_enable_tls_internaldocker_registryindex.docker.io) — kept effective by the099-registries.ymlmoveopenstack_release,default_container_dimensions_docker/_podman, …) and010-*older-release keys (swift, prometheus-msteams, …)No keys are removed from the effective union.
Related
all/in line with