From df48e19cb1a58d6bb574270d26cd2f7acd95b09e Mon Sep 17 00:00:00 2001
From: Roger Luethi <luethi@osism.tech>
Date: Sun, 12 Jul 2026 07:13:04 +0200
Subject: [PATCH 01/10] registries: load above the kolla upstream mirror

000-registries.yml holds OSISM's registry host choices
(docker_registry, <service>_docker_registry), but the 000 prefix made
it load before 001-kolla-defaults.yml, the verbatim upstream mirror.
In an Ansible group_vars directory later files win, so any upstream
group_var sharing a name silently overrides the OSISM value -- and
with the 2025.2 re-sync that stops being hypothetical: upstream now
defines docker_registry: "quay.io", which would clobber OSISM's
index.docker.io (the docker login target via auth_registry).

Registry hosts are OSISM opinions like everything else in the 099-*
overlay, so rename the file to 099-registries.yml to load it above
the mirror. File content is unchanged, and no other layer defines any
of its keys, so the rename is behavior-preserving on its own; it
keeps the docker_registry value stable once 001 mirrors the new
upstream key.

Assisted-by: Claude:claude-fable-5
Signed-off-by: Roger Luethi <luethi@osism.tech>
---
 all/{000-registries.yml => 099-registries.yml} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename all/{000-registries.yml => 099-registries.yml} (100%)

diff --git a/all/000-registries.yml b/all/099-registries.yml
similarity index 100%
rename from all/000-registries.yml
rename to all/099-registries.yml

From 9a9deaa59a134d0d4b28155504c1813ae0753130 Mon Sep 17 00:00:00 2001
From: Roger Luethi <luethi@osism.tech>
Date: Mon, 6 Jul 2026 12:03:55 +0200
Subject: [PATCH 02/10] kolla: adopt 2025.2 values; mariadb LB in 099

Mirror the 8 upstream-moved group_vars values into 001 verbatim
(horizon_listen_port, enable_proxysql, database_enable_tls_*,
kolla_base_distro_version_default_map,
mariadb_backup_target/loadbalancer/monitor_user).

Three of these are release-varying: 2025.2 hardcoded the mariadb LB
trio to their ProxySQL values, but OSISM keeps HAProxy for <= 2025.1.
Add 099-kolla.yml overrides with the conditional forms, which resolve
correctly on every release via the existing enable_proxysql gate. The
other release-varying ones are already handled (horizon_listen_port and
enable_proxysql gated in 099; kolla_base_distro_version_default_map is
not deploy-consumed by OSISM). The drift detector cannot catch a
wrong-for-older-release value, so this is verified by release analysis.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Roger Luethi <luethi@osism.tech>
---
 all/001-kolla-defaults.yml | 18 +++++++++---------
 all/099-kolla.yml          |  8 ++++++++
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/all/001-kolla-defaults.yml b/all/001-kolla-defaults.yml
index 88ca9cc..09fefaf 100644
--- a/all/001-kolla-defaults.yml
+++ b/all/001-kolla-defaults.yml
@@ -91,8 +91,8 @@ database_user: "root"
 database_port: "3306"
 database_connection_recycle_time: 10
 database_max_pool_size: 1
-database_enable_tls_backend: "{{ 'yes' if ((kolla_enable_tls_backend | bool ) and ( enable_proxysql | bool)) else 'no' }}"
-database_enable_tls_internal: "{{ 'yes' if ((kolla_enable_tls_internal | bool ) and ( enable_proxysql | bool)) else 'no' }}"
+database_enable_tls_backend: "{{ 'yes' if ((kolla_enable_tls_backend | bool) and (enable_proxysql | bool)) else 'no' }}"
+database_enable_tls_internal: "{{ 'yes' if ((kolla_enable_tls_internal | bool) and (enable_proxysql | bool)) else 'no' }}"
 
 ####################
 # Container engine options
@@ -467,7 +467,7 @@ horizon_public_endpoint: "{{ horizon_external_fqdn | kolla_url(public_protocol,
 
 horizon_port: "80"
 horizon_tls_port: "443"
-horizon_listen_port: "{{ horizon_tls_port if horizon_enable_tls_backend | bool else horizon_port }}"
+horizon_listen_port: "{{ '8080' if enable_haproxy | bool else horizon_tls_port if horizon_enable_tls_backend | bool else horizon_port }}"
 
 influxdb_http_port: "8086"
 
@@ -528,7 +528,7 @@ mariadb_sst_port: "4444"
 mariadb_clustercheck_port: "4569"
 mariadb_enable_tls_backend: "{{ database_enable_tls_backend }}"
 
-mariadb_monitor_user: "{{ 'monitor' if enable_proxysql | bool else 'haproxy' }}"
+mariadb_monitor_user: "monitor"
 
 mariadb_datadir_volume: "mariadb"
 
@@ -537,8 +537,8 @@ mariadb_default_database_shard_hosts: "{% set default_shard = [] %}{% for host i
 mariadb_shard_id: "{{ mariadb_default_database_shard_id }}"
 mariadb_shard_name: "shard_{{ mariadb_shard_id }}"
 mariadb_shard_group: "mariadb_{{ mariadb_shard_name }}"
-mariadb_loadbalancer: "{{ 'proxysql' if enable_proxysql | bool else 'haproxy' }}"
-mariadb_backup_target: "{{ 'active' if mariadb_loadbalancer == 'haproxy' else 'replica' }}"
+mariadb_loadbalancer: proxysql
+mariadb_backup_target: replica
 mariadb_shard_root_user_prefix: "root_shard_"
 mariadb_shard_backup_user_prefix: "backup_shard_"
 mariadb_shards_info: "{{ groups['mariadb'] | database_shards_info() }}"
@@ -941,7 +941,7 @@ enable_ovs_dpdk: "no"
 enable_osprofiler: "no"
 enable_placement: "{{ enable_nova | bool or enable_zun | bool }}"
 enable_prometheus: "no"
-enable_proxysql: "yes"
+enable_proxysql: "{{ enable_mariadb }}"
 enable_redis: "no"
 enable_skyline: "no"
 enable_tacker: "no"
@@ -1368,9 +1368,9 @@ influxdb_internal_endpoint: "{{ kolla_internal_fqdn | kolla_url(internal_protoco
 # Internal Image options
 #########################
 kolla_base_distro_version_default_map: {
-  "centos": "stream9",
+  "centos": "stream10",
   "debian": "bookworm",
-  "rocky": "9",
+  "rocky": "10",
   "ubuntu": "noble",
 }
 
diff --git a/all/099-kolla.yml b/all/099-kolla.yml
index d3bba06..0f2241e 100644
--- a/all/099-kolla.yml
+++ b/all/099-kolla.yml
@@ -68,6 +68,14 @@ haproxy_socket_level_admin: "yes"
 # mariadb
 enable_mariabackup: "yes"
 
+# 2025.2 hardcoded these to their ProxySQL values (upstream made ProxySQL the
+# MariaDB LB default); OSISM keeps HAProxy for <= 2025.1 (enable_proxysql is
+# gated off there). Restore the conditional forms — they resolve correctly on
+# every release via the enable_proxysql gate. 001 mirrors the 2025.2 literals.
+mariadb_loadbalancer: "{{ 'proxysql' if enable_proxysql | bool else 'haproxy' }}"
+mariadb_monitor_user: "{{ 'monitor' if enable_proxysql | bool else 'haproxy' }}"
+mariadb_backup_target: "{{ 'active' if mariadb_loadbalancer == 'haproxy' else 'replica' }}"
+
 # horizon
 horizon_backend_database: "yes"
 # 2025.2 switched Horizon to uWSGI (horizon_wsgi_provider defaults to uwsgi);

From 253e1ae2c92e15778df300af85378b246970e196 Mon Sep 17 00:00:00 2001
From: Roger Luethi <luethi@osism.tech>
Date: Mon, 6 Jul 2026 12:45:13 +0200
Subject: [PATCH 03/10] kolla: mirror upstream group_vars absent from 001

Add docker_registry, docker_namespace, openstack_release and the
default_container_dimensions_docker/_podman ulimit defaults to 001,
verbatim from stable/2025.2 (strict verbatim, no exclusions). The
dimensions keys are new upstream (2025.1); the others are long-standing
upstream keys (docker_registry has defaulted to quay.io since 2021)
that the hand-maintained mirror had excluded since the Yoga sync.
Higher-precedence layers stay the effective source where they supply
one: docker_registry via 099-registries.yml (index.docker.io),
docker_namespace via 099-kolla.yml, openstack_release via the image
versions.yml; the 001 copies are harmless upstream-default baselines.
The dimensions keys are referenced by default_container_dimensions
once a later commit re-syncs its value to the 2025.2 form.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Roger Luethi <luethi@osism.tech>
---
 all/001-kolla-defaults.yml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/all/001-kolla-defaults.yml b/all/001-kolla-defaults.yml
index 09fefaf..ea50c41 100644
--- a/all/001-kolla-defaults.yml
+++ b/all/001-kolla-defaults.yml
@@ -103,6 +103,9 @@ kolla_container_engine: "docker"
 # Docker options
 ####################
 docker_registry_email:
+docker_registry: "quay.io"
+docker_namespace: "openstack.kolla"
+openstack_release: "2025.2"
 docker_image_name_prefix: ""
 docker_image_url: "{{ docker_registry_kolla ~ '/' if docker_registry_kolla else '' }}{{ docker_namespace }}/{{ docker_image_name_prefix }}"
 docker_registry_username:
@@ -208,6 +211,24 @@ default_podman_dimensions_el9:
       soft: 1048576
       hard: 1048576
 
+default_container_dimensions_docker:
+  ulimits:
+    nofile:
+      soft: 1048576
+      hard: 1048576
+
+# NOTE(amir58118): Podman currently lowers RLIMIT_NOFILE and RLIMIT_NPROC
+#                  in kolla_podman_worker.py. These constants are retained here
+#                  for documentation and potential future use.
+default_container_dimensions_podman:
+  ulimits:
+    RLIMIT_NOFILE:
+      soft: 1048576
+      hard: 1048576
+    RLIMIT_NPROC:
+      soft: 1048576
+      hard: 1048576
+
 #####################
 # Healthcheck options
 #####################

From eb2158f890b123bce3e3ded2118dcf11c0972b65 Mon Sep 17 00:00:00 2001
From: Roger Luethi <luethi@osism.tech>
Date: Mon, 6 Jul 2026 12:49:32 +0200
Subject: [PATCH 04/10] kolla: restore drifted defaults to upstream 2025.2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

all/001-kolla-defaults.yml is a verbatim mirror of upstream kolla-ansible's
group_vars/all; OSISM's own overrides belong in the 099-* overlay files,
never in the mirror. Five keys had drifted from upstream — either an OSISM
value edited directly into the mirror, or an older-release upstream value
that was never re-synced: docker_image_url, glance_backend_file,
haproxy_backend_cacert, neutron_bridge_name, rabbitmq_cacert.

Restore each to its upstream stable/2025.2 form. Only docker_image_url is
a genuine OSISM override — OSISM pulls kolla images from its own registry
(docker_registry_kolla) instead of upstream's docker_registry — so its
OSISM form moves to the 099-kolla.yml overlay, which wins over the mirror.
The other four need no override: the cacert change is only in the
RedHat-family branch, which OSISM's ubuntu base image never takes, and
glance_backend_file / neutron_bridge_name only dropped VMware/Swift terms
that OSISM never enables.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Roger Luethi <luethi@osism.tech>
---
 all/001-kolla-defaults.yml | 10 +++++-----
 all/099-kolla.yml          |  4 ++++
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/all/001-kolla-defaults.yml b/all/001-kolla-defaults.yml
index ea50c41..0e7cf4d 100644
--- a/all/001-kolla-defaults.yml
+++ b/all/001-kolla-defaults.yml
@@ -107,7 +107,7 @@ docker_registry: "quay.io"
 docker_namespace: "openstack.kolla"
 openstack_release: "2025.2"
 docker_image_name_prefix: ""
-docker_image_url: "{{ docker_registry_kolla ~ '/' if docker_registry_kolla else '' }}{{ docker_namespace }}/{{ docker_image_name_prefix }}"
+docker_image_url: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ docker_namespace }}/{{ docker_image_name_prefix }}"
 docker_registry_username:
 # Please read the docs carefully before applying docker_registry_insecure.
 docker_registry_insecure: "no"
@@ -1052,7 +1052,7 @@ rabbitmq_monitoring_user: ""
 # Whether to enable TLS encryption for RabbitMQ client-server communication.
 rabbitmq_enable_tls: "no"
 # CA certificate bundle in RabbitMQ container.
-rabbitmq_cacert: "/etc/ssl/certs/{{ 'ca-certificates.crt' if kolla_base_distro in ['debian', 'ubuntu'] else 'ca-bundle.trust.crt' }}"
+rabbitmq_cacert: "/etc/ssl/certs/{{ 'ca-certificates.crt' if kolla_base_distro in ['debian', 'ubuntu'] else 'ca-bundle.crt' }}"
 rabbitmq_datadir_volume: "rabbitmq"
 
 ####################
@@ -1069,7 +1069,7 @@ kolla_external_fqdn_cert: "{{ kolla_certificates_dir }}/haproxy.pem"
 kolla_internal_fqdn_cert: "{{ kolla_certificates_dir }}/haproxy-internal.pem"
 kolla_admin_openrc_cacert: ""
 kolla_copy_ca_into_containers: "no"
-haproxy_backend_cacert: "{{ 'ca-certificates.crt' if kolla_base_distro in ['debian', 'ubuntu'] else 'ca-bundle.trust.crt' }}"
+haproxy_backend_cacert: "{{ 'ca-certificates.crt' if kolla_base_distro in ['debian', 'ubuntu'] else 'ca-bundle.crt' }}"
 haproxy_backend_cacert_dir: "/etc/ssl/certs"
 haproxy_single_external_frontend: false
 haproxy_single_external_frontend_public_port: "{{ '443' if kolla_enable_tls_external | bool else '80' }}"
@@ -1141,7 +1141,7 @@ openstack_auth:
 #######################
 # Glance options
 #######################
-glance_backend_file: "{{ not (glance_backend_ceph | bool or glance_backend_s3 | bool or glance_backend_vmware | bool) }}"
+glance_backend_file: "{{ not (glance_backend_ceph | bool or glance_backend_s3 | bool) }}"
 glance_backend_ceph: "no"
 glance_backend_vmware: "no"
 glance_backend_s3: "no"
@@ -1218,7 +1218,7 @@ designate_notifications_topic_name: "notifications_designate"
 # Neutron options
 #######################
 neutron_bgp_router_id: "1.1.1.1"
-neutron_bridge_name: "{{ 'br-dvs' if neutron_plugin_agent == 'vmware_dvs' else 'br_dpdk' if enable_ovs_dpdk | bool else 'br-ex' }}"
+neutron_bridge_name: "{{ 'br_dpdk' if enable_ovs_dpdk | bool else 'br-ex' }}"
 neutron_physical_networks: "{% for bridge in neutron_bridge_name.split(',') %}physnet{{ loop.index }}{% if not loop.last %},{% endif %}{% endfor %}"
 # Comma-separated type of enabled ml2 type drivers
 neutron_type_drivers: "flat,vlan,vxlan{% if neutron_plugin_agent == 'ovn' %},geneve{% endif %}"
diff --git a/all/099-kolla.yml b/all/099-kolla.yml
index 0f2241e..8fdfdd5 100644
--- a/all/099-kolla.yml
+++ b/all/099-kolla.yml
@@ -50,6 +50,10 @@ node_custom_config: "{{ node_config }}/files/overlays"
 
 docker_namespace: kolla
 docker_registry_kolla: registry.osism.tech
+# 2025.2 switched docker_image_url to build from docker_registry (quay.io);
+# OSISM pulls kolla images from its own registry, so keep the docker_registry_kolla
+# form. 001 mirrors the upstream docker_registry form; this wins.
+docker_image_url: "{{ docker_registry_kolla ~ '/' if docker_registry_kolla else '' }}{{ docker_namespace }}/{{ docker_image_name_prefix }}"
 
 openstack_logging_debug: "False"  # NOTE: This has to be "False", not "false"!
 

From c122ca87a7b9a2fb07c4031cd18cd8830325fdf3 Mon Sep 17 00:00:00 2001
From: Roger Luethi <luethi@osism.tech>
Date: Mon, 6 Jul 2026 13:47:28 +0200
Subject: [PATCH 05/10] kolla: keep redis coordination pre-2025.2

Upstream kolla-ansible replaced Redis with Valkey at stable/2025.2: it
dropped the redis branch from the coordination backends (valkey-only)
and removed redis_connection_string. all/001-kolla-defaults.yml is a
verbatim mirror of upstream, so it takes those 2025.2 forms and drops
enable_redis / redis_connection_string / redis_connection_string_extras.

OSISM still deploys Redis on 2024.1/2024.2/2025.1 (enable_redis is gated
on the release in 099-kolla.yml), so restore the redis-including forms in
the 099-kolla.yml overlay for the six coordination/connection vars, plus
redis_connection_string(_extras). Each is a single expression that stays
correct on every release via the enable_valkey/enable_redis gates
(valkey on 2025.2, redis below), so no per-release file is needed. The
effective values are unchanged from before the re-sync.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Roger Luethi <luethi@osism.tech>
---
 all/001-kolla-defaults.yml | 19 ++++++-------------
 all/099-kolla.yml          | 14 ++++++++++++++
 2 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/all/001-kolla-defaults.yml b/all/001-kolla-defaults.yml
index 0e7cf4d..80a2a11 100644
--- a/all/001-kolla-defaults.yml
+++ b/all/001-kolla-defaults.yml
@@ -577,7 +577,7 @@ masakari_public_endpoint: "{{ masakari_external_fqdn | kolla_url(public_protocol
 masakari_api_port: "15868"
 masakari_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else masakari_api_port }}"
 masakari_api_listen_port: "{{ masakari_api_port }}"
-masakari_coordination_backend: "{{ 'valkey' if enable_valkey | bool else 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}"
+masakari_coordination_backend: "{{ 'valkey' if enable_valkey | bool else 'etcd' if enable_etcd | bool else '' }}"
 
 memcached_port: "11211"
 memcache_security_strategy: "ENCRYPT"
@@ -963,7 +963,6 @@ enable_osprofiler: "no"
 enable_placement: "{{ enable_nova | bool or enable_zun | bool }}"
 enable_prometheus: "no"
 enable_proxysql: "{{ enable_mariadb }}"
-enable_redis: "no"
 enable_skyline: "no"
 enable_tacker: "no"
 enable_telegraf: "no"
@@ -1011,12 +1010,6 @@ enable_opensearch: "{{ enable_central_logging | bool or enable_osprofiler | bool
 enable_opensearch_dashboards: "{{ enable_opensearch | bool }}"
 enable_opensearch_dashboards_external: "{{ enable_opensearch_dashboards | bool }}"
 
-####################
-# Redis options
-####################
-redis_connection_string: "redis://{% for host in groups['redis'] %}{% if host == groups['redis'][0] %}default:{{ redis_master_password }}@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ redis_sentinel_port }}?sentinel=kolla{% else %}&sentinel_fallback={{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ redis_sentinel_port }}{% endif %}{% endfor %}{{ redis_connection_string_extras }}"
-redis_connection_string_extras: "&db=0&socket_timeout=60&retry_on_timeout=yes"
-
 ###################
 # Valkey options
 ###################
@@ -1042,7 +1035,7 @@ valkey_connection_string_extras: "&db=0&socket_timeout=60&retry_on_timeout=yes"
 # valid values: ["elasticsearch", "valkey", "redis"]
 osprofiler_backend: "elasticsearch"
 opensearch_connection_string: "elasticsearch://{{ opensearch_address | put_address_in_context('url') }}:{{ opensearch_port }}"
-osprofiler_backend_connection_string: "{{ valkey_connection_string if osprofiler_backend in ['redis', 'valkey'] and enable_valkey | bool else redis_connection_string if osprofiler_backend in ['redis', 'valkey'] and enable_redis | bool else opensearch_connection_string }}"
+osprofiler_backend_connection_string: "{{ valkey_connection_string if osprofiler_backend in ['redis', 'valkey'] else opensearch_connection_string }}"
 
 ####################
 # RabbitMQ options
@@ -1168,7 +1161,7 @@ barbican_library_path: "/usr/lib/libCryptoki2_64.so"
 gnocchi_backend_storage: "file"
 
 # Valid options are [valkey, redis, '']
-gnocchi_incoming_storage: "{{ 'valkey' if enable_valkey | bool else 'redis' if enable_redis | bool else '' }}"
+gnocchi_incoming_storage: "{{ 'valkey' if enable_valkey | bool else '' }}"
 gnocchi_metric_datadir_volume: "gnocchi"
 
 #################################
@@ -1182,7 +1175,7 @@ cinder_backend_vmware_vstorage_object: "no"
 cinder_volume_group: "cinder-volumes"
 cinder_target_helper: "{{ 'lioadm' if ansible_facts.os_family == 'RedHat' else 'tgtadm' }}"
 # Valid options are [ '', valkey, redis, etcd ]
-cinder_coordination_backend: "{{ 'valkey' if enable_valkey | bool else 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}"
+cinder_coordination_backend: "{{ 'valkey' if enable_valkey | bool else 'etcd' if enable_etcd | bool else '' }}"
 
 # Valid options are [ nfs, ceph, s3 ]
 cinder_backup_driver: "ceph"
@@ -1209,7 +1202,7 @@ designate_ns_record:
 designate_backend_external: "no"
 designate_backend_external_bind9_nameservers: ""
 # Valid options are [ '', valkey, redis ]
-designate_coordination_backend: "{{ 'valkey' if enable_valkey | bool else 'redis' if enable_redis | bool else '' }}"
+designate_coordination_backend: "{{ 'valkey' if enable_valkey | bool else '' }}"
 
 designate_enable_notifications_sink: "no"
 designate_notifications_topic_name: "notifications_designate"
@@ -1416,7 +1409,7 @@ s3_secret_key:
 telegraf_enable_docker_input: "no"
 
 # Valid options are [ '', valkey, redis, etcd ]
-ironic_coordination_backend: "{{ 'valkey' if enable_valkey | bool else 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}"
+ironic_coordination_backend: "{{ 'valkey' if enable_valkey | bool else 'etcd' if enable_etcd | bool else '' }}"
 
 ##########
 # Octavia
diff --git a/all/099-kolla.yml b/all/099-kolla.yml
index 8fdfdd5..890b75f 100644
--- a/all/099-kolla.yml
+++ b/all/099-kolla.yml
@@ -12,6 +12,20 @@ enable_redis: "{{ 'yes' if openstack_version in ['2024.1', '2024.2', '2025.1'] e
 enable_grafana: "yes"
 enable_valkey: "{{ 'no' if openstack_version in ['2024.1', '2024.2', '2025.1'] else 'yes' }}"
 
+# 2025.2 dropped the redis branch from these coordination backends (valkey-only)
+# and removed redis_connection_string; OSISM still runs redis on 2024.1/2024.2/
+# 2025.1 (enable_redis gated above), so restore the redis-including forms here.
+# One expression each, release-correct via the enable_valkey/enable_redis gates;
+# 001 mirrors the 2025.2 valkey-only forms, which these override.
+cinder_coordination_backend: "{{ 'valkey' if enable_valkey | bool else 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}"
+ironic_coordination_backend: "{{ 'valkey' if enable_valkey | bool else 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}"
+masakari_coordination_backend: "{{ 'valkey' if enable_valkey | bool else 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}"
+designate_coordination_backend: "{{ 'valkey' if enable_valkey | bool else 'redis' if enable_redis | bool else '' }}"
+gnocchi_incoming_storage: "{{ 'valkey' if enable_valkey | bool else 'redis' if enable_redis | bool else '' }}"
+osprofiler_backend_connection_string: "{{ valkey_connection_string if osprofiler_backend in ['redis', 'valkey'] and enable_valkey | bool else redis_connection_string if osprofiler_backend in ['redis', 'valkey'] and enable_redis | bool else opensearch_connection_string }}"
+redis_connection_string: "redis://{% for host in groups['redis'] %}{% if host == groups['redis'][0] %}default:{{ redis_master_password }}@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ redis_sentinel_port }}?sentinel=kolla{% else %}&sentinel_fallback={{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ redis_sentinel_port }}{% endif %}{% endfor %}{{ redis_connection_string_extras }}"
+redis_connection_string_extras: "&db=0&socket_timeout=60&retry_on_timeout=yes"
+
 # openstack
 
 enable_cinder: "yes"

From 394c344e5529d0f538143aa9157a2d2d77e820c4 Mon Sep 17 00:00:00 2001
From: Roger Luethi <luethi@osism.tech>
Date: Wed, 8 Jul 2026 13:53:54 +0200
Subject: [PATCH 06/10] kolla: supply older-release group_vars via 010

OSISM's kolla group_vars in all/ are layered by filename prefix: the
001-kolla-defaults.yml file mirrors upstream kolla-ansible's group_vars for
the newest supported release, and the 099-* files hold OSISM's own values,
which load later and win. Upstream removes group_vars over time; some that
newer releases dropped are still defined by older releases OSISM continues
to support. Those keys were absent from all/ altogether, so on an older
release they had no definition at all.

Introduce a middle layer for them. A new all/010-<release>.yml file loads
after 001 and before 099, and carries the group_vars a given older release
still defines, copied verbatim from that release's upstream group_vars/all.
Each file is self-retiring: delete it once that release leaves the
supported range.

- all/010-2024.2.yml: 7 swift keys (enable_swift_recon, enable_swift_s3api,
  the account/container/object server ports, swift_proxy_server_listen_port,
  swift_rsync_port). Upstream removed the Swift role at 2025.1; 2024.2 is
  the newest release that still defines them.
- all/010-2024.1.yml: distro_python_version_map, enable_cinder_backend_hnas_nfs,
  prometheus_msteams_port, prometheus_msteams_webhook_url, and
  swift_internal_endpoint / swift_public_endpoint -- each defined only at
  2024.1.

The keys are never evaluated in practice (the swift role stays disabled;
the others gate features OSISM does not deploy), so defining them on every
release is equivalent to their previous absence. They are disjoint from the
swift variables the per-release container-image-kolla-ansible overlays
supply, so nothing is defined twice.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Roger Luethi <luethi@osism.tech>
---
 all/010-2024.1.yml | 22 ++++++++++++++++++++++
 all/010-2024.2.yml | 18 ++++++++++++++++++
 2 files changed, 40 insertions(+)
 create mode 100644 all/010-2024.1.yml
 create mode 100644 all/010-2024.2.yml

diff --git a/all/010-2024.1.yml b/all/010-2024.1.yml
new file mode 100644
index 0000000..68e3e79
--- /dev/null
+++ b/all/010-2024.1.yml
@@ -0,0 +1,22 @@
+---
+# Self-retiring backward-compat layer for release 2024.1 (parent spec D8).
+#
+# A verbatim copy of upstream kolla-ansible's group_vars/all keys that upstream
+# dropped by 2025.2 but that release 2024.1 still defines. OSISM supports 2024.1,
+# so these keys must stay in the enforced union. This file loads between 001
+# (the 2025.2 verbatim mirror) and 099 (OSISM opinions), extending the mirror
+# for the older release without polluting it. No OSISM edits belong here.
+#
+# Remove this file when 2024.1 leaves the supported release range.
+# Source: openstack/kolla-ansible ansible/group_vars/all.yml @ 2024.1-eom
+distro_python_version_map: {
+  "centos": "3.9",
+  "debian": "3.11",
+  "rocky": "3.9",
+  "ubuntu": "3.10"
+}
+enable_cinder_backend_hnas_nfs: "no"
+prometheus_msteams_port: "9095"
+prometheus_msteams_webhook_url:
+swift_internal_endpoint: "{{ swift_internal_base_endpoint }}/v1/AUTH_%(tenant_id)s"
+swift_public_endpoint: "{{ swift_external_fqdn | kolla_url(public_protocol, swift_proxy_server_port, '/v1/AUTH_%(tenant_id)s') }}"
diff --git a/all/010-2024.2.yml b/all/010-2024.2.yml
new file mode 100644
index 0000000..512b9b6
--- /dev/null
+++ b/all/010-2024.2.yml
@@ -0,0 +1,18 @@
+---
+# Self-retiring backward-compat layer for release 2024.2 (parent spec D8).
+#
+# A verbatim copy of upstream kolla-ansible's group_vars/all keys that upstream
+# dropped by 2025.2 but that release 2024.2 still defines. OSISM supports 2024.2,
+# so these keys must stay in the enforced union. This file loads between 001
+# (the 2025.2 verbatim mirror) and 099 (OSISM opinions), extending the mirror
+# for the older release without polluting it. No OSISM edits belong here.
+#
+# Remove this file when 2024.2 leaves the supported release range.
+# Source: openstack/kolla-ansible ansible/group_vars/all.yml @ 2024.2-eol
+enable_swift_recon: "no"
+enable_swift_s3api: "no"
+swift_account_server_port: "6001"
+swift_container_server_port: "6002"
+swift_object_server_port: "6000"
+swift_proxy_server_listen_port: "{{ swift_proxy_server_port }}"
+swift_rsync_port: "10873"

From 00bed23a1918f3f10a5d98134d5e0d8c8b69c912 Mon Sep 17 00:00:00 2001
From: Roger Luethi <luethi@osism.tech>
Date: Wed, 8 Jul 2026 13:53:54 +0200
Subject: [PATCH 07/10] kolla: relocate 2025.1-only keys to 010-2025.1

all/001-kolla-defaults.yml is meant to hold upstream kolla-ansible's
group_vars for the newest supported release (2025.2) verbatim, with OSISM's
own values kept separately in the 099-* files. It still carried 28 keys
that upstream dropped at 2025.2 and defines only through 2025.1: the venus,
vmware-vcenter and ironic-inspector groups, plus mariadb_clustercheck_port,
neutron_legacy_iptables, neutron_tls_proxy_stats_port and
run_default_subdirectories.

Move them unchanged into all/010-2025.1.yml, the self-retiring layer that
loads between 001 and 099 and holds group_vars an older release still
needs. 2025.1 keeps the keys while 001 converges on the pure 2025.2 mirror.
The values are byte-identical to what 001 held (checked against upstream
stable/2025.1), so this is a pure relocation with no behavior change. Also
drops the now-empty "VMware support" section header left behind in 001.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Roger Luethi <luethi@osism.tech>
---
 all/001-kolla-defaults.yml | 41 -----------------------------------
 all/010-2025.1.yml         | 44 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+), 41 deletions(-)
 create mode 100644 all/010-2025.1.yml

diff --git a/all/001-kolla-defaults.yml b/all/001-kolla-defaults.yml
index 80a2a11..3d1ea8b 100644
--- a/all/001-kolla-defaults.yml
+++ b/all/001-kolla-defaults.yml
@@ -182,13 +182,6 @@ run_default_volumes_podman:
 
 run_default_volumes_docker: []
 
-run_default_subdirectories:
-  - '/run/netns'
-  - '/run/lock/nova'
-  - "/run/libvirt"
-  - "/run/nova"
-  - "/run/openvswitch"
-
 ####################
 # Dimensions options
 ####################
@@ -499,13 +492,6 @@ ironic_public_endpoint: "{{ ironic_external_fqdn | kolla_url(public_protocol, ir
 ironic_api_port: "6385"
 ironic_api_listen_port: "{{ ironic_api_port }}"
 ironic_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else ironic_api_port }}"
-ironic_inspector_internal_fqdn: "{{ kolla_internal_fqdn }}"
-ironic_inspector_external_fqdn: "{{ kolla_external_fqdn }}"
-ironic_inspector_internal_endpoint: "{{ ironic_inspector_internal_fqdn | kolla_url(internal_protocol, ironic_inspector_port) }}"
-ironic_inspector_public_endpoint: "{{ ironic_inspector_external_fqdn | kolla_url(public_protocol, ironic_inspector_public_port) }}"
-ironic_inspector_port: "5050"
-ironic_inspector_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else ironic_inspector_port }}"
-ironic_inspector_listen_port: "{{ ironic_inspector_port }}"
 ironic_http_port: "8089"
 ironic_prometheus_exporter_port: "9608"
 
@@ -546,7 +532,6 @@ mariadb_port: "{{ database_port }}"
 mariadb_wsrep_port: "4567"
 mariadb_ist_port: "4568"
 mariadb_sst_port: "4444"
-mariadb_clustercheck_port: "4569"
 mariadb_enable_tls_backend: "{{ database_enable_tls_backend }}"
 
 mariadb_monitor_user: "monitor"
@@ -597,7 +582,6 @@ neutron_public_endpoint: "{{ neutron_external_fqdn | kolla_url(public_protocol,
 neutron_server_port: "9696"
 neutron_server_listen_port: "{{ neutron_server_port }}"
 neutron_server_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else neutron_server_port }}"
-neutron_tls_proxy_stats_port: "9697"
 
 nova_internal_fqdn: "{{ kolla_internal_fqdn }}"
 nova_external_fqdn: "{{ kolla_external_fqdn }}"
@@ -758,14 +742,6 @@ valkey_sentinel_port: "26379"
 valkey_sentinel_monitor_name: "kolla"
 valkey_sentinel_quorum: 2
 
-venus_internal_fqdn: "{{ kolla_internal_fqdn }}"
-venus_external_fqdn: "{{ kolla_external_fqdn }}"
-venus_internal_endpoint: "{{ venus_internal_fqdn | kolla_url(internal_protocol, venus_api_port) }}"
-venus_public_endpoint: "{{ venus_external_fqdn | kolla_url(public_protocol, venus_api_public_port) }}"
-venus_api_port: "10010"
-venus_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else venus_api_port }}"
-venus_api_listen_port: "{{ venus_api_port }}"
-
 watcher_internal_fqdn: "{{ kolla_internal_fqdn }}"
 watcher_external_fqdn: "{{ kolla_external_fqdn }}"
 watcher_internal_endpoint: "{{ watcher_internal_fqdn | kolla_url(internal_protocol, watcher_api_port) }}"
@@ -905,13 +881,11 @@ enable_horizon_neutron_vpnaas: "{{ enable_neutron_vpnaas | bool }}"
 enable_horizon_octavia: "{{ enable_octavia | bool }}"
 enable_horizon_tacker: "{{ enable_tacker | bool }}"
 enable_horizon_trove: "{{ enable_trove | bool }}"
-enable_horizon_venus: "{{ enable_venus | bool }}"
 enable_horizon_watcher: "{{ enable_watcher | bool }}"
 enable_horizon_zun: "{{ enable_zun | bool }}"
 enable_influxdb: "{{ enable_cloudkitty | bool and cloudkitty_storage_backend == 'influxdb' }}"
 enable_ironic: "no"
 enable_ironic_dnsmasq: "{{ enable_ironic | bool }}"
-enable_ironic_inspector: "no"
 enable_ironic_neutron_agent: "no"
 enable_ironic_prometheus_exporter: "{{ enable_ironic | bool and enable_prometheus | bool }}"
 enable_ironic_pxe_filter: "no"
@@ -969,7 +943,6 @@ enable_telegraf: "no"
 enable_trove: "no"
 enable_trove_singletenant: "no"
 enable_valkey: "no"
-enable_venus: "no"
 enable_watcher: "no"
 enable_zun: "no"
 
@@ -1136,7 +1109,6 @@ openstack_auth:
 #######################
 glance_backend_file: "{{ not (glance_backend_ceph | bool or glance_backend_s3 | bool) }}"
 glance_backend_ceph: "no"
-glance_backend_vmware: "no"
 glance_backend_s3: "no"
 enable_glance_image_cache: "no"
 glance_file_datadir_volume: "glance"
@@ -1170,8 +1142,6 @@ gnocchi_metric_datadir_volume: "gnocchi"
 cinder_backend_ceph: "no"
 cinder_backend_huawei: "no"
 cinder_backend_huawei_xml_files: []
-cinder_backend_vmwarevc_vmdk: "no"
-cinder_backend_vmware_vstorage_object: "no"
 cinder_volume_group: "cinder-volumes"
 cinder_target_helper: "{{ 'lioadm' if ansible_facts.os_family == 'RedHat' else 'tgtadm' }}"
 # Valid options are [ '', valkey, redis, etcd ]
@@ -1226,9 +1196,6 @@ computes_need_external_bridge: "{{ (enable_neutron_dvr | bool and neutron_comput
 # Default DNS resolvers for virtual networks
 neutron_dnsmasq_dns_servers: "1.1.1.1,8.8.8.8,8.8.4.4"
 
-# Set legacy iptables to allow kernels not supporting iptables-nft
-neutron_legacy_iptables: "no"
-
 # Enable distributed floating ip for OVN deployments
 neutron_ovn_distributed_fip: "no"
 
@@ -1312,14 +1279,6 @@ ceph_gnocchi_user: "gnocchi"
 ceph_manila_user: "manila"
 ceph_nova_user: "{{ ceph_cinder_user }}"
 
-#####################
-# VMware support
-######################
-vmware_vcenter_host_ip: "127.0.0.1"
-vmware_vcenter_host_username: "username"
-vmware_vcenter_cluster_name: "cluster-1"
-vmware_vcenter_insecure: "True"
-
 #############################################
 # MariaDB component-specific database details
 #############################################
diff --git a/all/010-2025.1.yml b/all/010-2025.1.yml
new file mode 100644
index 0000000..bdf10b4
--- /dev/null
+++ b/all/010-2025.1.yml
@@ -0,0 +1,44 @@
+---
+# Self-retiring backward-compat layer for release 2025.1 (parent spec D8).
+#
+# A verbatim copy of upstream kolla-ansible's group_vars/all keys that upstream
+# dropped by 2025.2 but that release 2025.1 still defines. OSISM supports 2025.1,
+# so these keys must stay in the enforced union. This file loads between 001
+# (the 2025.2 verbatim mirror) and 099 (OSISM opinions), extending the mirror
+# for the older release without polluting it. No OSISM edits belong here.
+#
+# Remove this file when 2025.1 leaves the supported release range.
+# Source: openstack/kolla-ansible ansible/group_vars/all.yml @ stable/2025.1
+cinder_backend_vmware_vstorage_object: "no"
+cinder_backend_vmwarevc_vmdk: "no"
+enable_horizon_venus: "{{ enable_venus | bool }}"
+enable_ironic_inspector: "no"
+enable_venus: "no"
+glance_backend_vmware: "no"
+ironic_inspector_external_fqdn: "{{ kolla_external_fqdn }}"
+ironic_inspector_internal_endpoint: "{{ ironic_inspector_internal_fqdn | kolla_url(internal_protocol, ironic_inspector_port) }}"
+ironic_inspector_internal_fqdn: "{{ kolla_internal_fqdn }}"
+ironic_inspector_listen_port: "{{ ironic_inspector_port }}"
+ironic_inspector_port: "5050"
+ironic_inspector_public_endpoint: "{{ ironic_inspector_external_fqdn | kolla_url(public_protocol, ironic_inspector_public_port) }}"
+ironic_inspector_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else ironic_inspector_port }}"
+mariadb_clustercheck_port: "4569"
+neutron_legacy_iptables: "no"
+neutron_tls_proxy_stats_port: "9697"
+run_default_subdirectories:
+  - '/run/netns'
+  - '/run/lock/nova'
+  - "/run/libvirt"
+  - "/run/nova"
+  - "/run/openvswitch"
+venus_api_listen_port: "{{ venus_api_port }}"
+venus_api_port: "10010"
+venus_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else venus_api_port }}"
+venus_external_fqdn: "{{ kolla_external_fqdn }}"
+venus_internal_endpoint: "{{ venus_internal_fqdn | kolla_url(internal_protocol, venus_api_port) }}"
+venus_internal_fqdn: "{{ kolla_internal_fqdn }}"
+venus_public_endpoint: "{{ venus_external_fqdn | kolla_url(public_protocol, venus_api_public_port) }}"
+vmware_vcenter_cluster_name: "cluster-1"
+vmware_vcenter_host_ip: "127.0.0.1"
+vmware_vcenter_host_username: "username"
+vmware_vcenter_insecure: "True"

From 207adc1854e01304dba6c9e21dfcebf761ac96e8 Mon Sep 17 00:00:00 2001
From: Roger Luethi <luethi@osism.tech>
Date: Sun, 12 Jul 2026 07:53:09 +0200
Subject: [PATCH 08/10] kolla: adopt 2025.2 dimensions, keep 2024.x el9

Upstream 2025.1 replaced the el9-conditional container-dimensions
machinery with engine-keyed ulimit defaults applied on every distro
(commit 3f519184b, "Fix ulimit defaults for Debian family container
engines"): default_container_dimensions now selects between the
default_container_dimensions_docker/_podman keys, and the three
*_el9 keys are gone. Our 001 still carried the old form.

Re-sync 001 to the 2025.2 expression (the _docker/_podman keys were
mirrored in an earlier commit) and relocate the three *_el9 keys to
010-2024.2.yml -- 2024.2 is the newest release that still defines
them, and they stay upstream-vanilla (parent pattern: relocate, not
099). The value itself is release-varying, so 099-kolla.yml gets a
backward-compat override: 2024.x keeps its el9-conditional form,
newer releases resolve to the upstream 2025.2 expression. The drift
detector cannot catch a wrong-for-older-release value, so this is
verified by comparing the value across release branches.

Assisted-by: Claude:claude-fable-5
Signed-off-by: Roger Luethi <luethi@osism.tech>
---
 all/001-kolla-defaults.yml | 32 ++++++++++++++------------------
 all/010-2024.2.yml         | 14 ++++++++++++++
 all/099-kolla.yml          |  5 +++++
 3 files changed, 33 insertions(+), 18 deletions(-)

diff --git a/all/001-kolla-defaults.yml b/all/001-kolla-defaults.yml
index 3d1ea8b..fe34724 100644
--- a/all/001-kolla-defaults.yml
+++ b/all/001-kolla-defaults.yml
@@ -185,24 +185,20 @@ run_default_volumes_docker: []
 ####################
 # Dimensions options
 ####################
-# Dimension options for Docker Containers
-# NOTE(mnasiadka): Lower 1073741816 nofile limit on EL9 (RHEL9/CentOS Stream 9/Rocky Linux 9)
-#                  fixes at least rabbitmq and mariadb
-default_container_dimensions: "{{ default_container_dimensions_el9 if ansible_facts.os_family == 'RedHat' else '{}' }}"
-default_container_dimensions_el9: "{{ default_docker_dimensions_el9 if kolla_container_engine == 'docker' else default_podman_dimensions_el9 }}"
-default_docker_dimensions_el9:
-  ulimits:
-    nofile:
-      soft: 1048576
-      hard: 1048576
-default_podman_dimensions_el9:
-  ulimits:
-    RLIMIT_NOFILE:
-      soft: 1048576
-      hard: 1048576
-    RLIMIT_NPROC:
-      soft: 1048576
-      hard: 1048576
+# Dimension options for container runtimes
+#
+# NOTE(amir58118): Some container runtimes do not apply ulimits by default unless they
+#                  are explicitly configured. Defining file descriptor and process
+#                  limits at the container level helps ensure stable operation of
+#                  services that are sensitive to resource limits (e.g. message brokers
+#                  and databases).
+#
+default_container_dimensions: >-
+  {{
+    default_container_dimensions_docker
+    if kolla_container_engine == 'docker'
+    else default_container_dimensions_podman
+  }}
 
 default_container_dimensions_docker:
   ulimits:
diff --git a/all/010-2024.2.yml b/all/010-2024.2.yml
index 512b9b6..3cbf908 100644
--- a/all/010-2024.2.yml
+++ b/all/010-2024.2.yml
@@ -9,6 +9,20 @@
 #
 # Remove this file when 2024.2 leaves the supported release range.
 # Source: openstack/kolla-ansible ansible/group_vars/all.yml @ 2024.2-eol
+default_container_dimensions_el9: "{{ default_docker_dimensions_el9 if kolla_container_engine == 'docker' else default_podman_dimensions_el9 }}"
+default_docker_dimensions_el9:
+  ulimits:
+    nofile:
+      soft: 1048576
+      hard: 1048576
+default_podman_dimensions_el9:
+  ulimits:
+    RLIMIT_NOFILE:
+      soft: 1048576
+      hard: 1048576
+    RLIMIT_NPROC:
+      soft: 1048576
+      hard: 1048576
 enable_swift_recon: "no"
 enable_swift_s3api: "no"
 swift_account_server_port: "6001"
diff --git a/all/099-kolla.yml b/all/099-kolla.yml
index 890b75f..0bc4fed 100644
--- a/all/099-kolla.yml
+++ b/all/099-kolla.yml
@@ -227,6 +227,11 @@ om_enable_rabbitmq_transient_quorum_queue: "{{ om_enable_rabbitmq_quorum_queues
 # This has to be set to true in environments/kolla/configuration.yml for >= 2025.1.
 om_enable_rabbitmq_stream_fanout: "{{ om_enable_rabbitmq_quorum_queues | bool and om_enable_rabbitmq_transient_quorum_queue | bool }}"
 
+# 2025.1 replaced the el9-conditional container dimensions with engine-keyed
+# ulimit defaults; 2024.x still uses the el9 form (its keys live in
+# 010-2024.2.yml). 001 mirrors the 2025.2 expression, which this overrides.
+default_container_dimensions: "{{ (default_container_dimensions_el9 if ansible_facts.os_family == 'RedHat' else '{}') if openstack_version in ['2024.1', '2024.2'] else (default_container_dimensions_docker if kolla_container_engine == 'docker' else default_container_dimensions_podman) }}"
+
 ##########################################################
 # Bugfixes
 

From 2a92f46969126f17d748fbcf3204ff5a34073b0c Mon Sep 17 00:00:00 2001
From: Roger Luethi <luethi@osism.tech>
Date: Wed, 8 Jul 2026 13:53:54 +0200
Subject: [PATCH 09/10] kolla: drop proxysql_version already supplied by 099

all/001-kolla-defaults.yml should hold only upstream kolla-ansible
group_vars for the newest supported release (2025.2); OSISM's own
values belong in the 099-* files. proxysql_version broke that rule:
upstream 2025.2 does not define it, and OSISM already sets it from
099-kolla.yml, so keeping it in 001 both diverged from the upstream
mirror and duplicated the OSISM value.

Remove it from 001; the 099 definition remains the single source.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Roger Luethi <luethi@osism.tech>
---
 all/001-kolla-defaults.yml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/all/001-kolla-defaults.yml b/all/001-kolla-defaults.yml
index fe34724..18758f2 100644
--- a/all/001-kolla-defaults.yml
+++ b/all/001-kolla-defaults.yml
@@ -685,10 +685,6 @@ prometheus_blackbox_exporter_port: "9115"
 prometheus_instance_label:
 
 proxysql_admin_port: "6032"
-# Integer variable to set ProxySQL version. Valid options are 2 and 3
-# When it's set to 2 (Default), ProxySQL 2.7.x is deployed.
-# When it's set to 3, ProxySQL 3.0.x is used.
-proxysql_version: 2
 
 rabbitmq_port: "{{ '5671' if rabbitmq_enable_tls | bool else '5672' }}"
 rabbitmq_management_port: "15672"

From c3d557fa2911e061208cb8b85bcbb74d3f6c8d2d Mon Sep 17 00:00:00 2001
From: Roger Luethi <luethi@osism.tech>
Date: Thu, 9 Jul 2026 06:37:03 +0200
Subject: [PATCH 10/10] kolla: document the group_vars/all directory

Describe what all/ is and how to work in it. all/ is a native Ansible
group_vars/all directory shipped in OSISM's Ansible container images; for
the kolla-ansible container it replaces upstream kolla-ansible's own
group_vars/all.

The README covers:

- file layout and load precedence (the numeric prefixes; later files win);
- the two-layer model -- 001-kolla-defaults.yml is a verbatim upstream
  mirror, never hand-edited, and every OSISM opinion lives in a 099-*
  overlay that loads later and wins;
- where a new, changed, or upstream-dropped variable goes, pointing at the
  osism/release drift detector (check-drift.py, docs/check-drift-kolla.md)
  for the per-case mechanics rather than restating them;
- the split between these defaults and the operator's configuration.yml,
  and why release-gated values must live here;
- how external tooling must resolve these values (through Ansible
  templating, not the raw configuration file);
- a file-by-file reference and the 099-kolla.yml section convention.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Roger Luethi <luethi@osism.tech>
---
 all/README.md | 167 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 167 insertions(+)
 create mode 100644 all/README.md

diff --git a/all/README.md b/all/README.md
new file mode 100644
index 0000000..11037e9
--- /dev/null
+++ b/all/README.md
@@ -0,0 +1,167 @@
+# `all/` — shared Ansible `group_vars/all`
+
+The `*.yml` files here are loaded as a native Ansible `group_vars/all/` directory
+and shipped into OSISM's Ansible container images. They provide the defaults for
+**kolla-ansible** and, in the same tree, for OSISM's other Ansible layers
+(**ceph-ansible**, **k3s-ansible**) and its own playbooks. For the kolla-ansible
+container this directory **replaces** upstream kolla-ansible's own `group_vars/all`.
+
+These are **defaults only** — an operator's inventory, `host_vars`, and extra-vars
+still override anything set here.
+
+## File layout and precedence
+
+Ansible loads a `group_vars/all/` directory in **lexical filename order; later
+files override earlier ones**. The numeric prefixes exist only to control that
+order. Effective precedence, low → high:
+
+| Prefix | File(s) | Purpose |
+|--------|---------|---------|
+| `001-` | `001-kolla-defaults.yml` | Verbatim mirror of upstream kolla-ansible `group_vars/all`. |
+| `002-` | `002-images-kolla.yml`, `002-images-ceph.yml` | Image name + tag **catalogue** (shape, not tag values). |
+| `003-` | `003-kolla-overlays.yml` | Near-frozen legacy; fold into `099-kolla.yml` when convenient. |
+| `010-` | `010-<release>.yml` | Upstream values an *older* release still needs; self-retiring. |
+| `099-` | `099-*.yml` | OSISM's overlay — overrides, invented vars, per domain. |
+| `100-` | `100-ansible.yml` | Must-win Ansible connection vars (e.g. the Python interpreter). |
+
+One layer sits **higher, in another repo**: for the kolla container,
+`osism/container-image-kolla-ansible` ships per-release
+`overlays/<release>/kolla-ansible.yml` files applied on top of this whole
+directory, so an overlay entry wins over `099-*`. **That layer is deprecated** and
+being drained — add nothing to it; existing entries expire as their release ages
+out, or migrate into `099-*`.
+
+## The two layers: upstream mirror + OSISM overlay
+
+- **`001-kolla-defaults.yml` is a verbatim mirror** of upstream kolla-ansible's
+  `group_vars/all`. Treat it as generated: **never hand-edit `001`** to change
+  OSISM behaviour; it is re-synced wholesale from each new upstream release.
+- **`099-*` is OSISM's overlay.** Every OSISM opinion — a changed default, an
+  enable/disable choice, an invented variable — lives in a `099-*` file, which
+  loads later and wins. This keeps OSISM's deltas auditable in one place and `001`
+  cleanly diffable against upstream.
+
+The kolla container's *effective* `group_vars/all` is assembled from **three**
+sources, all of which the `osism/release` drift detector counts: this repo's
+`all/*.yml`; the container-image build's rendered `versions.yml.j2`
+(`openstack_release`, the `kolla_*_version` pins); and the deprecated per-release
+overlays above.
+
+## Where a variable goes
+
+One shared `defaults` tag builds **every** supported release (currently
+2024.1–2025.2), so placement is by *what the variable is*, not by which release
+ships it:
+
+- **Override an upstream value, or add an OSISM-invented variable** → the matching
+  `099-*` domain file (kolla values in `099-kolla.yml`). Never edit `001`.
+- **An OSISM opinion that varies by release** → a `099` inline `openstack_version`
+  gate. Make it **forward-safe**: list the *older* releases and `else` the current
+  value, so new releases resolve with no edit.
+- **An upstream variable dropped from the newest release that an older supported
+  release still needs** → a self-retiring **`010-<last-release>.yml`** (e.g.
+  `010-2025.1.yml` = keys upstream had through 2025.1 and dropped at 2025.2). It
+  carries the plain upstream value, loads before `099`, and is deleted (`rm`) when
+  that release ages out. Not `099`, not the drift allowlist.
+- **A new kolla image** → `002-images-kolla.yml`, following the `<service>_image` /
+  `<service>_tag` pattern (shape only; the tag *values* come from the release
+  manifests, never from here).
+
+**The drift allowlist (`osism/release`) is never a home for a `group_var`.** OSISM
+carries the *full* upstream `group_vars` union — a var for a service OSISM does not
+deploy is still supplied (in `001` if upstream-current, else `010`/`099`); it is
+just never evaluated. Even an upstream typo is mirrored into `001`, not
+allowlisted (2025.2's `eutron_external_interface` was mirrored until upstream
+fixed it).
+
+**To add or verify a variable, run the drift detector** — `osism/release`'s
+`check-drift.py`. Its findings name the exact destination for each case and catch
+vars that are missing, mis-placed, or orphaned; see `osism/release`
+`docs/check-drift-kolla.md`. One thing the detector **cannot** catch: a value that
+must *differ by release*. When a new upstream release changes or hardcodes a value
+that older releases need differently, `001` (shared across all releases) now
+carries the new value for all of them — add a `099`/`002` `openstack_version` gate
+to keep older releases correct, and find these by **comparing the value across
+releases**, not by trusting the detector. (Example: 2025.2 hardcoded
+`mariadb_loadbalancer: proxysql`; `099-kolla.yml` restores the
+`enable_proxysql`-conditional form so 2024.x keeps HAProxy.)
+
+## Defaults here vs the operator's `configuration.yml`
+
+A value can live in three places; pick by **who owns it and when it is decided**:
+
+| Home | Owns | Decided | Examples |
+|------|------|---------|----------|
+| `all/*` (this repo) | OSISM | re-evaluated every run | `enable_proxysql`, `database_enable_tls_internal`, every release-gated or derived default |
+| operator `environments/kolla/configuration.yml` (cfg-cookiecutter) | the site | frozen at project generation | `kolla_internal_vip_address`, `*_fqdn` — site inputs; plus stable policy toggles (`kolla_enable_tls_internal`) |
+| release manifests (`osism/release`) | the release | per release tag | image tag *values* (`kolla_image_version`, …) |
+
+Anything whose correct answer **changes with `openstack_version` or another
+variable** belongs **here**, never in cfg-cookiecutter's `configuration.yml`.
+cfg-cookiecutter runs once, so a value it emits is frozen at generation time and
+cannot follow an upgrade — leaving the deployment on the wrong default when the
+release moves. Keeping it here — evaluated fresh each run, maintained in one place
+— is the whole point of the split.
+
+## Consuming these values from code
+
+These are Ansible `group_vars`; their values are correct **only** after Ansible
+templating in the target host's variable context. External tooling (e.g.
+python-osism) must resolve them the way the deployment does:
+
+- **Never** read a value from the operator's raw `configuration.yml` as effective —
+  that file is the override layer only, so a `defaults/all` value is absent from it
+  and `dict.get(key, default)` silently returns your fallback.
+- **`ansible-inventory --host` is not enough** — it returns the variable as-defined
+  (the raw `{{ … }}` for anything Jinja-gated), because the gate is evaluated at
+  play time.
+- Resolve through templating in the host context (e.g. `ansible <host> -m debug -a
+  "var=enable_proxysql"`), or design the consumer so it does not need the value.
+  Re-implementing a gate expression in the consumer is forbidden — it rots at the
+  next release, exactly like duplicating it into cfg-cookiecutter.
+
+## File-by-file
+
+- **`001-kolla-defaults.yml`** — the upstream mirror (see above).
+- **`002-images-kolla.yml`** — the kolla image catalogue (`<service>_image` /
+  `<service>_tag`), a **superset across all supported releases**; shape only, tag
+  values come from the build's `versions.yml` and the release manifests.
+- **`002-images-ceph.yml`** — the `osism/ceph-daemon` image name, tag wired to
+  `ceph_image_version` (supplied externally).
+- **`003-kolla-overlays.yml`** — near-frozen; the only load-bearing entry is
+  `ironic_notification_topics`. Do not add here; prefer `099-kolla.yml` (this file
+  could be folded in and deleted).
+- **`010-<release>.yml`** — upstream-vanilla values an older release still needs
+  (see *Where a variable goes*); self-retiring.
+- **`099-kolla.yml`** — the primary kolla overlay (see below).
+- **`099-interfaces.yml`** — network interface / address-family bindings (kolla,
+  ceph-ansible, k3s, playbooks).
+- **`099-generic.yml`** — host/OS-level config (docker, chrony, hardening, operator
+  user); not kolla.
+- **`099-hosts.yml`** — OSISM playbook control vars.
+- **`099-infrastructure.yml`** — OSISM "infrastructure" services (cephclient,
+  openstackclient, traefik, squid, …).
+- **`099-ceph.yml`** — **ceph-ansible** defaults + the OpenStack pool/keyring
+  topology (not a kolla overlay). `ceph_uid: 64045` is load-bearing (it matches the
+  `osism/ceph-daemon` image). Prefer the `*_extra` list vars to extend.
+- **`099-k3s.yml`** — OSISM's k3s cluster; entirely OSISM-invented.
+- **`099-registries.yml`** — registry *hosts* only (`docker_registry`,
+  `<service>_docker_registry`). No image names or tags. Lives in the overlay so
+  an upstream registry default mirrored into `001` (e.g. 2025.2's
+  `docker_registry: "quay.io"`) can never override OSISM's choice.
+- **`100-ansible.yml`** — `ansible_python_interpreter`; numbered `100` so it wins.
+
+## `099-kolla.yml` sections
+
+Keep this file organised by its `####`-delimited headers; add a new variable under
+the matching one:
+
+- **Enable services** — services OSISM turns on by default.
+- **Disable services** — upstream defaults OSISM turns off (add a reason).
+- **Set default configurations** — value overrides of upstream defaults (the bulk).
+- **Custom features** — OSISM-invented variables with no upstream counterpart.
+- **Backward compatibility** — an OSISM *opinion* that differs from upstream for
+  older releases (a gate); an upstream-vanilla var an older release needs goes in a
+  `010-<release>.yml` file instead. Label a block with its retire trigger:
+  `# Backward compatibility for 2025.1  (drop when 2025.1 support ends)`.
+- **Bugfixes** — workarounds; annotate with the `osism/issues#NNN` ticket.