Synchronise master with upstream

ansible/fail2ban.yml

@@ -12,6 +12,3 @@
     - role: robertdebock.fail2ban
       become: true
       when: fail2ban_enabled | bool
-  vars:
-    # TODO (L-Chams): Remove fail2ban_sender override when PR https://github.com/robertdebock/ansible-role-fail2ban/pull/18 is merged.
-    fail2ban_sender: root@{{ ansible_facts.fqdn }}

ansible/inventory/group_vars/all/ipa

@@ -110,6 +110,10 @@ ipa_build_dib_upper_constraints_file: ""
 ###############################################################################
 # Ironic Python Agent (IPA) images configuration.
 
+# OS version of upstream Ironic deployment image files. Valid options are
+# "centos9" and "centos10". Default is "centos10".
+ipa_images_upstream_os: "centos10"
+
 # Suffix of upstream Ironic deployment image files. Default is based on
 # {{ openstack_branch }}.
 ipa_images_upstream_url_suffix: "-{{ openstack_branch | replace('/', '-') }}"
@@ -118,7 +122,7 @@ ipa_images_upstream_url_suffix: "-{{ openstack_branch | replace('/', '-') }}"
 ipa_images_kernel_name: "ipa.kernel"
 
 # URL of Ironic deployment kernel image to download.
-ipa_kernel_upstream_url: "https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos9{{ ipa_images_upstream_url_suffix }}.kernel"
+ipa_kernel_upstream_url: "https://tarballs.opendev.org/openstack/ironic-python-agent/dib/files/ipa-{{ ipa_images_upstream_os }}{{ ipa_images_upstream_url_suffix }}.kernel"
 
 # URL of checksum of Ironic deployment kernel image.
 ipa_kernel_checksum_url: "{{ ipa_kernel_upstream_url }}.{{ ipa_kernel_checksum_algorithm }}"
@@ -130,7 +134,7 @@ ipa_kernel_checksum_algorithm: "sha256"
 ipa_images_ramdisk_name: "ipa.initramfs"
 
 # URL of Ironic deployment ramdisk image to download.
-ipa_ramdisk_upstream_url: "https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos9{{ ipa_images_upstream_url_suffix }}.initramfs"
+ipa_ramdisk_upstream_url: "https://tarballs.opendev.org/openstack/ironic-python-agent/dib/files/ipa-{{ ipa_images_upstream_os }}{{ ipa_images_upstream_url_suffix }}.initramfs"
 
 # URL of checksum of Ironic deployment ramdisk image.
 ipa_ramdisk_checksum_url: "{{ ipa_ramdisk_upstream_url }}.{{ ipa_ramdisk_checksum_algorithm }}"

ansible/inventory/group_vars/all/ironic

@@ -100,6 +100,11 @@ kolla_ironic_inspection_network: "{{ kolla_ironic_provisioning_network if inspec
 # Name of the Neutron network to use for provisioning.
 kolla_ironic_provisioning_network: 'provision-net'
 
+# Address of the Ironic Python Agent (IPA) NTP server. The default value maps
+# to the IP address of each controller on the internal API, which should be
+# running chronyd.
+kolla_ironic_ntp_server: "{% raw %}{{ hostvars[inventory_hostname].ansible_facts[api_interface | replace('-', '_')]['ipv4']['address'] }}{% endraw %}"
+
 # List of default kernel parameters to append for baremetal PXE boot.
 kolla_ironic_pxe_append_params_default: "{{ kolla_ironic_kernel_append_params_default }}"
 
@@ -116,6 +121,7 @@ kolla_ironic_kernel_append_params_default:
   - vga=normal
   - console=tty0
   - console=ttyS0,115200n8
+  - ipa-ntp-server={% if kolla_ironic_ntp_server is not none and kolla_ironic_ntp_server | length > 0 %}{{ kolla_ironic_ntp_server }}{% endif %}
 
 # List of additional kernel parameters to append for baremetal boot.
 kolla_ironic_kernel_append_params_extra: []

ansible/inventory/group_vars/all/openstack

@@ -2,10 +2,10 @@
 ###############################################################################
 # OpenStack release configuration.
 
-# Name of the current OpenStack release. Default is "master".
-openstack_release: "master"
+# Name of the current OpenStack release. Default is "2026.2".
+openstack_release: "2026.2"
 
-# Name of the current OpenStack branch. Default is "master".
+# Name of the current OpenStack branch. Default is "stable/2026.2".
 openstack_branch: >-
   {% if openstack_release != 'master' %}stable/{% endif %}{{ openstack_release | lower }}
 

ansible/inventory/group_vars/all/seed

@@ -143,15 +143,9 @@ seed_users: "{{ users_default }}"
 #
 seed_containers: {}
 
-# (Deprecated) Whether to attempt a basic authentication login to a registry when
-# deploying seed containers.
-# TODO(mattcrees): remove seed_deploy_containers_registry_attempt_login in the
-# Hibiscus cycle.
-seed_deploy_containers_registry_attempt_login: "{{ kolla_docker_registry_username is truthy and kolla_docker_registry_password is truthy }}"
-
 # Whether to attempt a basic authentication login to a registry when
 # deploying seed containers.
-seed_manage_containers_registry_attempt_login: "{{ seed_deploy_containers_registry_attempt_login }}"
+seed_manage_containers_registry_attempt_login: "{{ kolla_docker_registry_username is truthy and kolla_docker_registry_password is truthy }}"
 
 ###############################################################################
 # Seed node firewalld configuration.

ansible/manage-containers.yml

@@ -2,10 +2,6 @@
 - name: "Ensure defined container images are {{ kayobe_action | default('deploy') }}ed"
   hosts: "{{ manage_containers_target_hosts | default('seed') }}"
   tags:
-    # Kept for backward compatibility.
-    # TODO(mattcrees): Will be removed in the Hibiscus release.
-    - seed-deploy-containers
-    - seed-manage-containers
     - manage-containers
   tasks:
     - import_role:

ansible/roles/kolla-ansible/templates/kolla/globals.yml

@@ -292,7 +292,7 @@ enable_{{ feature_flag }}: {{ hostvars[inventory_hostname]['kolla_enable_' ~ fea
 ####################
 # Osprofiler options
 ####################
-# valid values: ["elasticsearch", "redis"]
+# valid values: ["elasticsearch", "valkey"]
 #osprofiler_backend: "elasticsearch"
 
 ##################
@@ -308,8 +308,8 @@ enable_{{ feature_flag }}: {{ hostvars[inventory_hostname]['kolla_enable_' ~ fea
 # Valid options are [ file, ceph ]
 #gnocchi_backend_storage: "{% raw %}{{ 'ceph' if enable_ceph|bool else 'file' }}{% endraw %}"
 
-# Valid options are [redis, '']
-#gnocchi_incoming_storage: "{% raw %}{{ 'redis' if enable_redis | bool else '' }}{% endraw %}"
+# Valid options are [valkey, '']
+#gnocchi_incoming_storage: "{% raw %}{{ 'valkey' if enable_valkey | bool else '' }}{% endraw %}"
 
 ################################
 # Cinder - Block Storage Options
@@ -318,8 +318,8 @@ enable_{{ feature_flag }}: {{ hostvars[inventory_hostname]['kolla_enable_' ~ fea
 #cinder_backend_ceph: "{% raw %}{{ enable_ceph }}{% endraw %}"
 #cinder_backend_vmwarevc_vmdk: "no"
 #cinder_volume_group: "cinder-volumes"
-# Valid options are [ '', redis, etcd ]
-#cinder_coordination_backend: "{% raw %}{{ 'redis' if enable_redis|bool else 'etcd' if enable_etcd|bool else '' }}{% endraw %}"
+# Valid options are [ '', valkey, etcd ]
+#cinder_coordination_backend: "{% raw %}{{ 'valkey' if enable_valkey|bool else 'etcd' if enable_etcd|bool else '' }}{% endraw %}"
 
 # Valid options are [ nfs, ceph, s3 ]
 #cinder_backup_driver: "ceph"
@@ -344,8 +344,8 @@ enable_{{ feature_flag }}: {{ hostvars[inventory_hostname]['kolla_enable_' ~ fea
 # Valid options are [ bind9 ]
 #designate_backend: "bind9"
 #designate_ns_record: "sample.openstack.org"
-# Valid options are [ '', redis, etcd ]
-#designate_coordination_backend: "{% raw %}{{ 'redis' if enable_redis|bool else 'etcd' if enable_etcd|bool else '' }}{% endraw %}"
+# Valid options are [ '', valkey ]
+#designate_coordination_backend: "{% raw %}{{ 'valkey' if enable_valkey|bool else '' }}{% endraw %}"
 
 ########################
 # Nova - Compute Options
@@ -399,6 +399,9 @@ ironic_dnsmasq_dhcp_ranges:
 {% if kolla_inspector_dns_servers %}
     dns_servers: "{{ kolla_inspector_dns_servers | join(',') }}"
 {% endif %}
+{% if kolla_ironic_ntp_server is defined and kolla_ironic_ntp_server is not none and kolla_ironic_ntp_server | length > 0 %}
+    ntp_server: "{{ kolla_ironic_ntp_server }}"
+{% endif %}
 {% endif %}
 {% if kolla_inspector_extra_kernel_options %}
 ironic_kernel_cmdline_extras:

ansible/roles/kolla-ansible/templates/overcloud-components.j2

@@ -137,10 +137,6 @@ deployment
 [skyline:children]
 control
 
-# TODO(vurmil): Remove after G/2026.1 release as Redis migration is no longer required
-[redis:children]
-control
-
 [valkey:children]
 control
 

ansible/roles/kolla-ansible/vars/main.yml

@@ -96,6 +96,7 @@ kolla_feature_flags:
   - cinder_backend_pure_nvme_tcp
   - cinder_backend_pure_roce
   - cinder_backend_quobyte
+  - cinder_backend_vast
   - cinder_backup
   - cinder_horizon_policy_file
   - cloudkitty
@@ -157,6 +158,7 @@ kolla_feature_flags:
   - manila_backend_generic
   - manila_backend_glusterfs_nfs
   - manila_backend_hnas
+  - manila_backend_vast
   - mariabackup
   - mariadb
   - masakari

ansible/roles/manage-containers/defaults/main.yml

@@ -2,10 +2,7 @@
 # Action to perform: One of: "deploy", "destroy".
 manage_containers_action: "deploy"
 
-#TODO(mattcrees): remove deploy_containers_defaults in Hibiscus cycle
-manage_containers_defaults: "{{ deploy_containers_defaults }}"
-
-deploy_containers_defaults:
+manage_containers_defaults:
   comparisons:
     image: strict
     env: strict
@@ -18,8 +15,7 @@ deploy_containers_defaults:
 
 manage_custom_containers: []
 
-#TODO(mattcrees): remove deploy_containers_docker_api_timeout in Hibiscus cycle.
-manage_containers_docker_api_timeout: "{{ deploy_containers_docker_api_timeout | default(120) }}"
+manage_containers_docker_api_timeout: 120
 
 manage_containers_registry:
 manage_containers_registry_username:

ansible/roles/manage-containers/tasks/deploy-container.yml

@@ -14,18 +14,18 @@
   kayobe_container:
     capabilities: "{{ container_config.capabilities | default(omit) }}"
     command: "{{ container_config.command | default(omit) }}"
-    comparisons: "{{ container_config.comparisons | default(deploy_containers_defaults.comparisons) }}"
-    detach: "{{ container_config.detach | default(deploy_containers_defaults.detach) }}"
+    comparisons: "{{ container_config.comparisons | default(manage_containers_defaults.comparisons) }}"
+    detach: "{{ container_config.detach | default(manage_containers_defaults.detach) }}"
     env: "{{ container_config.env | default(omit) }}"
     name: "{{ container_name }}"
-    network_mode: "{{ container_config.network_mode | default(deploy_containers_defaults.network_mode) }}"
+    network_mode: "{{ container_config.network_mode | default(manage_containers_defaults.network_mode) }}"
     image: "{{ container_config.image }}:{{ container_config.tag | default('latest') }}"
-    init: "{{ container_config.init | default(deploy_containers_defaults.init) }}"
+    init: "{{ container_config.init | default(manage_containers_defaults.init) }}"
     ipc_mode: "{{ container_config.ipc_mode | default(omit) }}"
     pid_mode: "{{ container_config.pid_mode | default(omit) }}"
     ports: "{{ container_config.ports | default(omit) }}"
     privileged: "{{ container_config.privileged | default(omit) }}"
-    restart_policy: "{{ container_config.restart_policy | default(deploy_containers_defaults.restart_policy) }}"
+    restart_policy: "{{ container_config.restart_policy | default(manage_containers_defaults.restart_policy) }}"
     shm_size: "{{ container_config.shm_size | default(omit) }}"
     sysctls: "{{ container_config.sysctls | default(omit) }}"
     timeout: "{{ manage_containers_docker_api_timeout }}"

dev/tenks-deploy-config-overcloud.yml

@@ -40,3 +40,9 @@ wait_for_placement: false
 # Nested virtualisation is not working well in CI currently. Force the use of
 # QEMU.
 libvirt_vm_engine: "qemu"
+
+# NOTE(priteau): Disable libvirt_vm_trust_guest_rx_filters, which when enabled
+# triggers the following errors when booting baremetal instances with Tenks on
+# Libvirt 9: Cannot set interface flags on 'macvtap1': Value too large for
+# defined data type
+libvirt_vm_trust_guest_rx_filters: false

doc/source/configuration/reference/ironic-python-agent.rst

@@ -261,6 +261,9 @@ The following options configure the source of Ironic Python Agent images for
 inspection and deployment.  Consult the :ironic-python-agent-doc:`Ironic Python
 Agent documentation <>` for full details.
 
+``ipa_images_upstream_os``
+    OS version of upstream Ironic deployment image files. Valid options are
+    ``centos9`` and ``centos10``. Default is ``centos10``.
 ``ipa_images_upstream_url_suffix``
     Suffix of upstream Ironic deployment image files. Default is based on
     ``{{ openstack_branch }}``.
@@ -269,8 +272,8 @@ Agent documentation <>` for full details.
     ``ipa.kernel``.
 ``ipa_kernel_upstream_url``
     URL of Ironic deployment kernel image to download. Default is
-    ``https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos9{{
-    ipa_images_upstream_url_suffix }}.kernel``.
+    ``https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-{{
+    ipa_images_upstream_os }}{{ ipa_images_upstream_url_suffix }}.kernel``.
 ``ipa_kernel_checksum_url``
     URL of checksum of Ironic deployment kernel image. Default is ``{{
     ipa_kernel_upstream_url }}.{{ ipa_kernel_checksum_algorithm }}``.
@@ -282,8 +285,8 @@ Agent documentation <>` for full details.
     ``ipa.initramfs``.
 ``ipa_ramdisk_upstream_url``
     URL of Ironic deployment ramdisk image to download. Default is
-    ``https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos9{{
-    ipa_images_upstream_url_suffix }}.initramfs``.
+    ``https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-{{
+    ipa_images_upstream_os }}{{ ipa_images_upstream_url_suffix }}.initramfs``.
 ``ipa_ramdisk_checksum_url``
     URL of checksum of Ironic deployment ramdisk image. Default is ``{{
     ipa_ramdisk_upstream_url }}.{{ ipa_ramdisk_checksum_algorithm }}``.

etc/kayobe/hostname.yml

@@ -7,3 +7,7 @@
 
 # Custom hostname to set. Default is "{{ inventory_hostname }}".
 #kayobe_custom_hostname:
+
+###############################################################################
+# Dummy variable to allow Ansible to accept this file.
+workaround_ansible_issue_8743: yes

etc/kayobe/ipa.yml

@@ -88,6 +88,10 @@
 ###############################################################################
 # Ironic Python Agent (IPA) images configuration.
 
+# OS version of upstream Ironic deployment image files. Valid options are
+# "centos9" and "centos10". Default is "centos10".
+#ipa_images_upstream_os:
+
 # Suffix of upstream Ironic deployment image files. Default is based on
 # {{ openstack_branch }}.
 #ipa_images_upstream_url_suffix:

etc/kayobe/ironic.yml

@@ -100,6 +100,11 @@
 # Name of the Neutron network to use for provisioning.
 #kolla_ironic_provisioning_network:
 
+# Address of the Ironic Python Agent (IPA) NTP server. The default value maps
+# to the IP address of each controller on the internal API, which should be
+# running chronyd.
+#kolla_ironic_ntp_server:
+
 # List of default kernel parameters to append for baremetal PXE boot.
 #kolla_ironic_pxe_append_params_default:
 

etc/kayobe/kolla.yml

@@ -308,6 +308,7 @@
 #kolla_enable_cinder_backend_pure_nvme_tcp:
 #kolla_enable_cinder_backend_pure_roce:
 #kolla_enable_cinder_backend_quobyte:
+#kolla_enable_cinder_backend_vast:
 #kolla_enable_cinder_backup:
 #kolla_enable_cinder_horizon_policy_file:
 #kolla_enable_cloudkitty:
@@ -369,6 +370,7 @@
 #kolla_enable_manila_backend_generic:
 #kolla_enable_manila_backend_glusterfs_nfs:
 #kolla_enable_manila_backend_hnas:
+#kolla_enable_manila_backend_vast:
 #kolla_enable_mariabackup:
 #kolla_enable_mariadb:
 #kolla_enable_masakari:

etc/kayobe/openstack.yml

@@ -2,10 +2,10 @@
 ###############################################################################
 # OpenStack release configuration.
 
-# Name of the current OpenStack release. Default is "master".
+# Name of the current OpenStack release. Default is "2026.2".
 #openstack_release:
 
-# Name of the current OpenStack branch. Default is "master".
+# Name of the current OpenStack branch. Default is "stable/2026.2".
 #openstack_branch:
 
 ###############################################################################

playbooks/kayobe-seed-base/bifrost-overrides.yml.j2

@@ -1,7 +1,10 @@
 ---
-# Don't build an IPA deployment image.
+# Don't build an IPA deployment image, instead download upstream images.
 create_ipa_image: false
-download_ipa: false
+download_ipa: true
 
-# Don't build a disk image. It takes time and can be unreliable.
-create_image_via_dib: false
+# Use a CirrOS image
+use_cirros: true
+custom_deploy_image_upstream_url: https://download.cirros-cloud.net/0.5.3/cirros-0.5.3-x86_64-disk.img
+custom_deploy_image_checksum_url: https://download.cirros-cloud.net/0.5.3/MD5SUMS
+custom_deploy_image_checksum_algorithm: md5

playbooks/kayobe-seed-base/run.yml

@@ -10,6 +10,36 @@
         cmd: "{{ kayobe_src_dir }}/dev/seed-deploy.sh &> {{ logs_dir }}/ansible/seed-deploy"
         executable: /bin/bash
 
+    - name: Ensure test Tenks cluster is deployed
+      shell:
+        # Pass absolute source directory, since otherwise the `chdir` will
+        # cause this to fail.
+        cmd: dev/tenks-deploy-overcloud.sh '{{ tenks_src_dir }}' &> {{ logs_dir }}/ansible/tenks-deploy-overcloud
+        chdir: "{{ kayobe_src_dir }}"
+        executable: /bin/bash
+
+    - name: Perform overcloud inventory discovery
+      shell:
+        cmd: (source dev/environment-setup.sh && kayobe overcloud inventory discover) &> {{ logs_dir }}/ansible/overcloud-inventory-discover
+        chdir: "{{ kayobe_src_dir }}"
+        executable: /bin/bash
+
+    - name: Perform overcloud hardware inspection
+      shell:
+        cmd: (source dev/environment-setup.sh && kayobe overcloud hardware inspect) &> {{ logs_dir }}/ansible/overcloud-hardware-inspect
+        chdir: "{{ kayobe_src_dir }}"
+        executable: /bin/bash
+
+    - name: Perform overcloud provisioning
+      shell:
+        cmd: (source dev/environment-setup.sh && kayobe overcloud provision) &> {{ logs_dir }}/ansible/overcloud-provision
+        chdir: "{{ kayobe_src_dir }}"
+        executable: /bin/bash
+
+    - name: Test network connectivity to the overcloud host
+      shell:
+        cmd: ping -c1 -W1 192.168.33.3 &> {{ logs_dir }}/ansible/overcloud-test
+
     - block:
         # NOTE(mgoddard): The stack user cannot read the kolla source code, which
         # lives in the zuul user's home directory. Copy it to a readable location.

releasenotes/notes/add-default-config-for-the-ipa-ntp-server-b2ab9345e4bf524d.yaml

@@ -0,0 +1,9 @@
+---
+features:
+  - |
+    Adds default configuration to Kolla Ansible for the ``ipa-ntp-server``
+    kernel command line argument used by IPA during provisioning and cleaning.
+    Ensures correct system time during certificate creation, preventing issues
+    where Ironic fails to communicate with the Ironic Python Agent due to
+    invalid certificate timestamps. The default NTP server can be overridden by
+    changing ``kolla_ironic_ntp_server``.

releasenotes/notes/handle-304-in-image-download-8ceafad810dae83e.yaml

@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Fixes an error when downloading already downloaded VM images caused by HTTP
+    304 Not Modified.
+    `LP#2170208 <https://bugs.launchpad.net/kayobe/+bug/2170208>`__