check-kolla-inventory: gate CI on inventory drift#602
Merged
Conversation
The check previously printed kolla-ansible inventory groups that are missing locally and always exited 0, so it could only ever be run by hand and never enforced anything. The neutron (62b6274) and ironic- dnsmasq incidents -- where a group present upstream but absent from this inventory aborts Ansible with "'dict object' has no attribute '<group>'" -- show this drift must be caught in CI, not discovered in production. Rework the script into functions and have it exit non-zero when drift is found, printing each missing group followed by guidance on how to resolve it (add to inventory, or to the IGNORE list). A failed upstream fetch exits 2 so transient network errors are distinguishable from real drift. Pin the compared release to the kolla-ansible stable branch OSISM deploys (KOLLA_BRANCH = stable/2025.2) instead of master. Master lists groups for unreleased services that cannot affect any deployed release, which would flag spurious drift; the stable branch flags exactly the groups that exist in what OSISM ships. The constant must be bumped whenever OSISM moves to a new OpenStack release. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Roger Luethi <luethi@osism.tech>
The single IGNORE list conflated two unrelated reasons for skipping an upstream group and had accumulated stale entries. Split it in two and document each: * IGNORE_ROLE_GROUPS -- kolla-ansible's physical host-role groups (control, compute, network, storage, monitoring, deployment, baremetal). Services map onto these; OSISM populates them from the operator's environment inventory, not from 50-/51-kolla. Matched by exact name so a role-group prefix can no longer accidentally shadow an unrelated service group. * IGNORE_NOT_DEPLOYED -- services OSISM deliberately does not deploy (collectd, cyborg, tacker, telegraf). Matched by prefix so newly added sub-groups stay covered. Drop entries that no longer suppress anything against the tracked release (stable/2025.2): blazar and masakari are now shipped in the inventory, so ignoring them was redundant; freezer, murano, sahara, solum, venus and vitrage no longer exist in kolla-ansible. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Roger Luethi <luethi@osism.tech>
Add stale_ignores(), which fails (exit 3) when an IGNORE entry no longer suppresses any upstream group that is absent from the inventory. An entry goes stale in two ways: the service is now shipped locally (so ignoring it is redundant), or kolla-ansible removed it from the tracked release. This matters beyond tidiness. IGNORE_NOT_DEPLOYED matches by prefix, so a stale entry such as a fully shipped "blazar" would silently swallow any new blazar-* group kolla-ansible adds later -- precisely the drift this check exists to catch. Failing on stale entries keeps the lists honest and is what flagged that blazar and masakari had become redundant once their groups were added to the inventory. The guard runs before the missing-group check, so the lists are validated even on a run that would otherwise report no drift. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Roger Luethi <luethi@osism.tech>
Add a check-kolla tox environment that runs src/check-kolla-inventory.py and a generics-tox-check-kolla Zuul job that invokes it, wired into the check and periodic-daily pipelines. The job is voting, so drift between this inventory and the tracked kolla-ansible release now blocks the merge instead of being found at deploy time. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Roger Luethi <luethi@osism.tech>
ideaship
force-pushed
the
check-kolla-gating
branch
from
5c2b94d to
d96150f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Turn
src/check-kolla-inventory.pyinto a gating CI check that fails whenthis repo's Ansible inventory drifts from the kolla-ansible release OSISM
deploys. This is the class of bug behind the neutron 2025.2 groups and
ironic-dnsmasq: a group present upstream but absent here makes Ansible abortwith
'dict object' has no attribute '<group>'.Commits
check-kolla-inventory: gate CI on missing groups— exit non-zero on driftwith remediation guidance; pin
KOLLA_BRANCH = stable/2025.2(the deployedrelease) instead of
master, so it flags real drift rather thannot-yet-released groups.
check-kolla-inventory: clean up the IGNORE list— split intoIGNORE_ROLE_GROUPS(host-role groups, exact match) andIGNORE_NOT_DEPLOYED(services OSISM does not deploy, prefix match); drop 8stale entries.
check-kolla-inventory: guard against stale IGNORE— fail when an IGNOREentry no longer suppresses any real upstream group (now shipped, or removed
from the tracked release), so a stale prefix can't silently hide future
drift.
zuul: run check-kolla-inventory as a gating job—check-kollatox env +voting
generics-tox-check-kollajob in thecheckandperiodic-dailypipelines.
This branch is based on
main, which does not yet contain theironic-dnsmasqinventory group. The newgenerics-tox-check-kollajob willtherefore fail on
ironic-dnsmasquntil that fix merges and this branch isrebased. Merge order: the fix first, then this PR.
Maintenance
KOLLA_BRANCHmust be bumped when OSISM moves to a new OpenStack series;documented as a prerequisite in the developer-guide release checklist
(osism.github.io,
rewrite-releases-guide).🤖 Generated with Claude Code