kolla: re-sync 001 group_vars to upstream 2025.2 (+ 010 layers)

all/001-kolla-defaults.yml

@@ -91,8 +91,8 @@ database_user: "root"
 database_port: "3306"
 database_connection_recycle_time: 10
 database_max_pool_size: 1
-database_enable_tls_backend: "{{ 'yes' if ((kolla_enable_tls_backend | bool ) and ( enable_proxysql | bool)) else 'no' }}"
-database_enable_tls_internal: "{{ 'yes' if ((kolla_enable_tls_internal | bool ) and ( enable_proxysql | bool)) else 'no' }}"
+database_enable_tls_backend: "{{ 'yes' if ((kolla_enable_tls_backend | bool) and (enable_proxysql | bool)) else 'no' }}"
+database_enable_tls_internal: "{{ 'yes' if ((kolla_enable_tls_internal | bool) and (enable_proxysql | bool)) else 'no' }}"
 
 ####################
 # Container engine options
@@ -103,8 +103,11 @@ kolla_container_engine: "docker"
 # Docker options
 ####################
 docker_registry_email:
+docker_registry: "quay.io"
+docker_namespace: "openstack.kolla"
+openstack_release: "2025.2"
 docker_image_name_prefix: ""
-docker_image_url: "{{ docker_registry_kolla ~ '/' if docker_registry_kolla else '' }}{{ docker_namespace }}/{{ docker_image_name_prefix }}"
+docker_image_url: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ docker_namespace }}/{{ docker_image_name_prefix }}"
 docker_registry_username:
 # Please read the docs carefully before applying docker_registry_insecure.
 docker_registry_insecure: "no"
@@ -179,27 +182,34 @@ run_default_volumes_podman:
 
 run_default_volumes_docker: []
 
-run_default_subdirectories:
-  - '/run/netns'
-  - '/run/lock/nova'
-  - "/run/libvirt"
-  - "/run/nova"
-  - "/run/openvswitch"
-
 ####################
 # Dimensions options
 ####################
-# Dimension options for Docker Containers
-# NOTE(mnasiadka): Lower 1073741816 nofile limit on EL9 (RHEL9/CentOS Stream 9/Rocky Linux 9)
-#                  fixes at least rabbitmq and mariadb
-default_container_dimensions: "{{ default_container_dimensions_el9 if ansible_facts.os_family == 'RedHat' else '{}' }}"
-default_container_dimensions_el9: "{{ default_docker_dimensions_el9 if kolla_container_engine == 'docker' else default_podman_dimensions_el9 }}"
-default_docker_dimensions_el9:
+# Dimension options for container runtimes
+#
+# NOTE(amir58118): Some container runtimes do not apply ulimits by default unless they
+#                  are explicitly configured. Defining file descriptor and process
+#                  limits at the container level helps ensure stable operation of
+#                  services that are sensitive to resource limits (e.g. message brokers
+#                  and databases).
+#
+default_container_dimensions: >-
+  {{
+    default_container_dimensions_docker
+    if kolla_container_engine == 'docker'
+    else default_container_dimensions_podman
+  }}
+
+default_container_dimensions_docker:
   ulimits:
     nofile:
       soft: 1048576
       hard: 1048576
-default_podman_dimensions_el9:
+
+# NOTE(amir58118): Podman currently lowers RLIMIT_NOFILE and RLIMIT_NPROC
+#                  in kolla_podman_worker.py. These constants are retained here
+#                  for documentation and potential future use.
+default_container_dimensions_podman:
   ulimits:
     RLIMIT_NOFILE:
       soft: 1048576
@@ -467,7 +477,7 @@ horizon_public_endpoint: "{{ horizon_external_fqdn | kolla_url(public_protocol,
 
 horizon_port: "80"
 horizon_tls_port: "443"
-horizon_listen_port: "{{ horizon_tls_port if horizon_enable_tls_backend | bool else horizon_port }}"
+horizon_listen_port: "{{ '8080' if enable_haproxy | bool else horizon_tls_port if horizon_enable_tls_backend | bool else horizon_port }}"
 
 influxdb_http_port: "8086"
 
@@ -478,13 +488,6 @@ ironic_public_endpoint: "{{ ironic_external_fqdn | kolla_url(public_protocol, ir
 ironic_api_port: "6385"
 ironic_api_listen_port: "{{ ironic_api_port }}"
 ironic_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else ironic_api_port }}"
-ironic_inspector_internal_fqdn: "{{ kolla_internal_fqdn }}"
-ironic_inspector_external_fqdn: "{{ kolla_external_fqdn }}"
-ironic_inspector_internal_endpoint: "{{ ironic_inspector_internal_fqdn | kolla_url(internal_protocol, ironic_inspector_port) }}"
-ironic_inspector_public_endpoint: "{{ ironic_inspector_external_fqdn | kolla_url(public_protocol, ironic_inspector_public_port) }}"
-ironic_inspector_port: "5050"
-ironic_inspector_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else ironic_inspector_port }}"
-ironic_inspector_listen_port: "{{ ironic_inspector_port }}"
 ironic_http_port: "8089"
 ironic_prometheus_exporter_port: "9608"
 
@@ -525,10 +528,9 @@ mariadb_port: "{{ database_port }}"
 mariadb_wsrep_port: "4567"
 mariadb_ist_port: "4568"
 mariadb_sst_port: "4444"
-mariadb_clustercheck_port: "4569"
 mariadb_enable_tls_backend: "{{ database_enable_tls_backend }}"
 
-mariadb_monitor_user: "{{ 'monitor' if enable_proxysql | bool else 'haproxy' }}"
+mariadb_monitor_user: "monitor"
 
 mariadb_datadir_volume: "mariadb"
 
@@ -537,8 +539,8 @@ mariadb_default_database_shard_hosts: "{% set default_shard = [] %}{% for host i
 mariadb_shard_id: "{{ mariadb_default_database_shard_id }}"
 mariadb_shard_name: "shard_{{ mariadb_shard_id }}"
 mariadb_shard_group: "mariadb_{{ mariadb_shard_name }}"
-mariadb_loadbalancer: "{{ 'proxysql' if enable_proxysql | bool else 'haproxy' }}"
-mariadb_backup_target: "{{ 'active' if mariadb_loadbalancer == 'haproxy' else 'replica' }}"
+mariadb_loadbalancer: proxysql
+mariadb_backup_target: replica
 mariadb_shard_root_user_prefix: "root_shard_"
 mariadb_shard_backup_user_prefix: "backup_shard_"
 mariadb_shards_info: "{{ groups['mariadb'] | database_shards_info() }}"
@@ -556,7 +558,7 @@ masakari_public_endpoint: "{{ masakari_external_fqdn | kolla_url(public_protocol
 masakari_api_port: "15868"
 masakari_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else masakari_api_port }}"
 masakari_api_listen_port: "{{ masakari_api_port }}"
-masakari_coordination_backend: "{{ 'valkey' if enable_valkey | bool else 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}"
+masakari_coordination_backend: "{{ 'valkey' if enable_valkey | bool else 'etcd' if enable_etcd | bool else '' }}"
 
 memcached_port: "11211"
 memcache_security_strategy: "ENCRYPT"
@@ -576,7 +578,6 @@ neutron_public_endpoint: "{{ neutron_external_fqdn | kolla_url(public_protocol,
 neutron_server_port: "9696"
 neutron_server_listen_port: "{{ neutron_server_port }}"
 neutron_server_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else neutron_server_port }}"
-neutron_tls_proxy_stats_port: "9697"
 
 nova_internal_fqdn: "{{ kolla_internal_fqdn }}"
 nova_external_fqdn: "{{ kolla_external_fqdn }}"
@@ -684,10 +685,6 @@ prometheus_blackbox_exporter_port: "9115"
 prometheus_instance_label:
 
 proxysql_admin_port: "6032"
-# Integer variable to set ProxySQL version. Valid options are 2 and 3
-# When it's set to 2 (Default), ProxySQL 2.7.x is deployed.
-# When it's set to 3, ProxySQL 3.0.x is used.
-proxysql_version: 2
 
 rabbitmq_port: "{{ '5671' if rabbitmq_enable_tls | bool else '5672' }}"
 rabbitmq_management_port: "15672"
@@ -737,14 +734,6 @@ valkey_sentinel_port: "26379"
 valkey_sentinel_monitor_name: "kolla"
 valkey_sentinel_quorum: 2
 
-venus_internal_fqdn: "{{ kolla_internal_fqdn }}"
-venus_external_fqdn: "{{ kolla_external_fqdn }}"
-venus_internal_endpoint: "{{ venus_internal_fqdn | kolla_url(internal_protocol, venus_api_port) }}"
-venus_public_endpoint: "{{ venus_external_fqdn | kolla_url(public_protocol, venus_api_public_port) }}"
-venus_api_port: "10010"
-venus_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else venus_api_port }}"
-venus_api_listen_port: "{{ venus_api_port }}"
-
 watcher_internal_fqdn: "{{ kolla_internal_fqdn }}"
 watcher_external_fqdn: "{{ kolla_external_fqdn }}"
 watcher_internal_endpoint: "{{ watcher_internal_fqdn | kolla_url(internal_protocol, watcher_api_port) }}"
@@ -884,13 +873,11 @@ enable_horizon_neutron_vpnaas: "{{ enable_neutron_vpnaas | bool }}"
 enable_horizon_octavia: "{{ enable_octavia | bool }}"
 enable_horizon_tacker: "{{ enable_tacker | bool }}"
 enable_horizon_trove: "{{ enable_trove | bool }}"
-enable_horizon_venus: "{{ enable_venus | bool }}"
 enable_horizon_watcher: "{{ enable_watcher | bool }}"
 enable_horizon_zun: "{{ enable_zun | bool }}"
 enable_influxdb: "{{ enable_cloudkitty | bool and cloudkitty_storage_backend == 'influxdb' }}"
 enable_ironic: "no"
 enable_ironic_dnsmasq: "{{ enable_ironic | bool }}"
-enable_ironic_inspector: "no"
 enable_ironic_neutron_agent: "no"
 enable_ironic_prometheus_exporter: "{{ enable_ironic | bool and enable_prometheus | bool }}"
 enable_ironic_pxe_filter: "no"
@@ -941,15 +928,13 @@ enable_ovs_dpdk: "no"
 enable_osprofiler: "no"
 enable_placement: "{{ enable_nova | bool or enable_zun | bool }}"
 enable_prometheus: "no"
-enable_proxysql: "yes"
-enable_redis: "no"
+enable_proxysql: "{{ enable_mariadb }}"
 enable_skyline: "no"
 enable_tacker: "no"
 enable_telegraf: "no"
 enable_trove: "no"
 enable_trove_singletenant: "no"
 enable_valkey: "no"
-enable_venus: "no"
 enable_watcher: "no"
 enable_zun: "no"
 
@@ -990,12 +975,6 @@ enable_opensearch: "{{ enable_central_logging | bool or enable_osprofiler | bool
 enable_opensearch_dashboards: "{{ enable_opensearch | bool }}"
 enable_opensearch_dashboards_external: "{{ enable_opensearch_dashboards | bool }}"
 
-####################
-# Redis options
-####################
-redis_connection_string: "redis://{% for host in groups['redis'] %}{% if host == groups['redis'][0] %}default:{{ redis_master_password }}@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ redis_sentinel_port }}?sentinel=kolla{% else %}&sentinel_fallback={{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ redis_sentinel_port }}{% endif %}{% endfor %}{{ redis_connection_string_extras }}"
-redis_connection_string_extras: "&db=0&socket_timeout=60&retry_on_timeout=yes"
-
 ###################
 # Valkey options
 ###################
@@ -1021,7 +1000,7 @@ valkey_connection_string_extras: "&db=0&socket_timeout=60&retry_on_timeout=yes"
 # valid values: ["elasticsearch", "valkey", "redis"]
 osprofiler_backend: "elasticsearch"
 opensearch_connection_string: "elasticsearch://{{ opensearch_address | put_address_in_context('url') }}:{{ opensearch_port }}"
-osprofiler_backend_connection_string: "{{ valkey_connection_string if osprofiler_backend in ['redis', 'valkey'] and enable_valkey | bool else redis_connection_string if osprofiler_backend in ['redis', 'valkey'] and enable_redis | bool else opensearch_connection_string }}"
+osprofiler_backend_connection_string: "{{ valkey_connection_string if osprofiler_backend in ['redis', 'valkey'] else opensearch_connection_string }}"
 
 ####################
 # RabbitMQ options
@@ -1031,7 +1010,7 @@ rabbitmq_monitoring_user: ""
 # Whether to enable TLS encryption for RabbitMQ client-server communication.
 rabbitmq_enable_tls: "no"
 # CA certificate bundle in RabbitMQ container.
-rabbitmq_cacert: "/etc/ssl/certs/{{ 'ca-certificates.crt' if kolla_base_distro in ['debian', 'ubuntu'] else 'ca-bundle.trust.crt' }}"
+rabbitmq_cacert: "/etc/ssl/certs/{{ 'ca-certificates.crt' if kolla_base_distro in ['debian', 'ubuntu'] else 'ca-bundle.crt' }}"
 rabbitmq_datadir_volume: "rabbitmq"
 
 ####################
@@ -1048,7 +1027,7 @@ kolla_external_fqdn_cert: "{{ kolla_certificates_dir }}/haproxy.pem"
 kolla_internal_fqdn_cert: "{{ kolla_certificates_dir }}/haproxy-internal.pem"
 kolla_admin_openrc_cacert: ""
 kolla_copy_ca_into_containers: "no"
-haproxy_backend_cacert: "{{ 'ca-certificates.crt' if kolla_base_distro in ['debian', 'ubuntu'] else 'ca-bundle.trust.crt' }}"
+haproxy_backend_cacert: "{{ 'ca-certificates.crt' if kolla_base_distro in ['debian', 'ubuntu'] else 'ca-bundle.crt' }}"
 haproxy_backend_cacert_dir: "/etc/ssl/certs"
 haproxy_single_external_frontend: false
 haproxy_single_external_frontend_public_port: "{{ '443' if kolla_enable_tls_external | bool else '80' }}"
@@ -1120,9 +1099,8 @@ openstack_auth:
 #######################
 # Glance options
 #######################
-glance_backend_file: "{{ not (glance_backend_ceph | bool or glance_backend_s3 | bool or glance_backend_vmware | bool) }}"
+glance_backend_file: "{{ not (glance_backend_ceph | bool or glance_backend_s3 | bool) }}"
 glance_backend_ceph: "no"
-glance_backend_vmware: "no"
 glance_backend_s3: "no"
 enable_glance_image_cache: "no"
 glance_file_datadir_volume: "glance"
@@ -1147,7 +1125,7 @@ barbican_library_path: "/usr/lib/libCryptoki2_64.so"
 gnocchi_backend_storage: "file"
 
 # Valid options are [valkey, redis, '']
-gnocchi_incoming_storage: "{{ 'valkey' if enable_valkey | bool else 'redis' if enable_redis | bool else '' }}"
+gnocchi_incoming_storage: "{{ 'valkey' if enable_valkey | bool else '' }}"
 gnocchi_metric_datadir_volume: "gnocchi"
 
 #################################
@@ -1156,12 +1134,10 @@ gnocchi_metric_datadir_volume: "gnocchi"
 cinder_backend_ceph: "no"
 cinder_backend_huawei: "no"
 cinder_backend_huawei_xml_files: []
-cinder_backend_vmwarevc_vmdk: "no"
-cinder_backend_vmware_vstorage_object: "no"
 cinder_volume_group: "cinder-volumes"
 cinder_target_helper: "{{ 'lioadm' if ansible_facts.os_family == 'RedHat' else 'tgtadm' }}"
 # Valid options are [ '', valkey, redis, etcd ]
-cinder_coordination_backend: "{{ 'valkey' if enable_valkey | bool else 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}"
+cinder_coordination_backend: "{{ 'valkey' if enable_valkey | bool else 'etcd' if enable_etcd | bool else '' }}"
 
 # Valid options are [ nfs, ceph, s3 ]
 cinder_backup_driver: "ceph"
@@ -1188,7 +1164,7 @@ designate_ns_record:
 designate_backend_external: "no"
 designate_backend_external_bind9_nameservers: ""
 # Valid options are [ '', valkey, redis ]
-designate_coordination_backend: "{{ 'valkey' if enable_valkey | bool else 'redis' if enable_redis | bool else '' }}"
+designate_coordination_backend: "{{ 'valkey' if enable_valkey | bool else '' }}"
 
 designate_enable_notifications_sink: "no"
 designate_notifications_topic_name: "notifications_designate"
@@ -1197,7 +1173,7 @@ designate_notifications_topic_name: "notifications_designate"
 # Neutron options
 #######################
 neutron_bgp_router_id: "1.1.1.1"
-neutron_bridge_name: "{{ 'br-dvs' if neutron_plugin_agent == 'vmware_dvs' else 'br_dpdk' if enable_ovs_dpdk | bool else 'br-ex' }}"
+neutron_bridge_name: "{{ 'br_dpdk' if enable_ovs_dpdk | bool else 'br-ex' }}"
 neutron_physical_networks: "{% for bridge in neutron_bridge_name.split(',') %}physnet{{ loop.index }}{% if not loop.last %},{% endif %}{% endfor %}"
 # Comma-separated type of enabled ml2 type drivers
 neutron_type_drivers: "flat,vlan,vxlan{% if neutron_plugin_agent == 'ovn' %},geneve{% endif %}"
@@ -1212,9 +1188,6 @@ computes_need_external_bridge: "{{ (enable_neutron_dvr | bool and neutron_comput
 # Default DNS resolvers for virtual networks
 neutron_dnsmasq_dns_servers: "1.1.1.1,8.8.8.8,8.8.4.4"
 
-# Set legacy iptables to allow kernels not supporting iptables-nft
-neutron_legacy_iptables: "no"
-
 # Enable distributed floating ip for OVN deployments
 neutron_ovn_distributed_fip: "no"
 
@@ -1298,14 +1271,6 @@ ceph_gnocchi_user: "gnocchi"
 ceph_manila_user: "manila"
 ceph_nova_user: "{{ ceph_cinder_user }}"
 
-#####################
-# VMware support
-######################
-vmware_vcenter_host_ip: "127.0.0.1"
-vmware_vcenter_host_username: "username"
-vmware_vcenter_cluster_name: "cluster-1"
-vmware_vcenter_insecure: "True"
-
 #############################################
 # MariaDB component-specific database details
 #############################################
@@ -1368,9 +1333,9 @@ influxdb_internal_endpoint: "{{ kolla_internal_fqdn | kolla_url(internal_protoco
 # Internal Image options
 #########################
 kolla_base_distro_version_default_map: {
-  "centos": "stream9",
+  "centos": "stream10",
   "debian": "bookworm",
-  "rocky": "9",
+  "rocky": "10",
   "ubuntu": "noble",
 }
 
@@ -1395,7 +1360,7 @@ s3_secret_key:
 telegraf_enable_docker_input: "no"
 
 # Valid options are [ '', valkey, redis, etcd ]
-ironic_coordination_backend: "{{ 'valkey' if enable_valkey | bool else 'redis' if enable_redis | bool else 'etcd' if enable_etcd | bool else '' }}"
+ironic_coordination_backend: "{{ 'valkey' if enable_valkey | bool else 'etcd' if enable_etcd | bool else '' }}"
 
 ##########
 # Octavia

all/010-2024.1.yml

@@ -0,0 +1,22 @@
+---
+# Self-retiring backward-compat layer for release 2024.1 (parent spec D8).
+#
+# A verbatim copy of upstream kolla-ansible's group_vars/all keys that upstream
+# dropped by 2025.2 but that release 2024.1 still defines. OSISM supports 2024.1,
+# so these keys must stay in the enforced union. This file loads between 001
+# (the 2025.2 verbatim mirror) and 099 (OSISM opinions), extending the mirror
+# for the older release without polluting it. No OSISM edits belong here.
+#
+# Remove this file when 2024.1 leaves the supported release range.
+# Source: openstack/kolla-ansible ansible/group_vars/all.yml @ 2024.1-eom
+distro_python_version_map: {
+  "centos": "3.9",
+  "debian": "3.11",
+  "rocky": "3.9",
+  "ubuntu": "3.10"
+}
+enable_cinder_backend_hnas_nfs: "no"
+prometheus_msteams_port: "9095"
+prometheus_msteams_webhook_url:
+swift_internal_endpoint: "{{ swift_internal_base_endpoint }}/v1/AUTH_%(tenant_id)s"
+swift_public_endpoint: "{{ swift_external_fqdn | kolla_url(public_protocol, swift_proxy_server_port, '/v1/AUTH_%(tenant_id)s') }}"

all/010-2024.2.yml

@@ -0,0 +1,32 @@
+---
+# Self-retiring backward-compat layer for release 2024.2 (parent spec D8).
+#
+# A verbatim copy of upstream kolla-ansible's group_vars/all keys that upstream
+# dropped by 2025.2 but that release 2024.2 still defines. OSISM supports 2024.2,
+# so these keys must stay in the enforced union. This file loads between 001
+# (the 2025.2 verbatim mirror) and 099 (OSISM opinions), extending the mirror
+# for the older release without polluting it. No OSISM edits belong here.
+#
+# Remove this file when 2024.2 leaves the supported release range.
+# Source: openstack/kolla-ansible ansible/group_vars/all.yml @ 2024.2-eol
+default_container_dimensions_el9: "{{ default_docker_dimensions_el9 if kolla_container_engine == 'docker' else default_podman_dimensions_el9 }}"
+default_docker_dimensions_el9:
+  ulimits:
+    nofile:
+      soft: 1048576
+      hard: 1048576
+default_podman_dimensions_el9:
+  ulimits:
+    RLIMIT_NOFILE:
+      soft: 1048576
+      hard: 1048576
+    RLIMIT_NPROC:
+      soft: 1048576
+      hard: 1048576
+enable_swift_recon: "no"
+enable_swift_s3api: "no"
+swift_account_server_port: "6001"
+swift_container_server_port: "6002"
+swift_object_server_port: "6000"
+swift_proxy_server_listen_port: "{{ swift_proxy_server_port }}"
+swift_rsync_port: "10873"