Synchronise 2025.1 with upstream

ansible/inventory/all-in-one

@@ -130,7 +130,6 @@ control
 
 [cyborg:children]
 control
-compute
 
 [tacker:children]
 control

ansible/inventory/multinode

@@ -145,7 +145,6 @@ control
 
 [cyborg:children]
 control
-compute
 
 [gnocchi:children]
 control

ansible/roles/nova-cell/tasks/version-check.yml

@@ -40,32 +40,25 @@
         name:
           - "{{ service.container_name }}"
       register: container_facts_per_host
-      run_once: true
-      delegate_to: "{{ item }}"
-      loop: "{{ groups[service.group] }}"
-      loop_control:
-        label: "{{ item }}"
+      when: inventory_hostname in groups[service.group]
 
     - name: Get current Libvirt version
+      any_errors_fatal: true
       become: true
       command: "{{ kolla_container_engine }} exec {{ service.container_name }} libvirtd --version"
       register: libvirt_version_current_results
       changed_when: false
-      run_once: true
-      delegate_to: "{{ item.item }}"
-      loop: "{{ container_facts_per_host.results }}"
-      loop_control:
-        label: "{{ item.item }}"
       when:
-        - item.containers[service.container_name] is defined
-        - item.containers[service.container_name].State.Running
+        - container_facts_per_host is not skipped
+        - container_facts_per_host.containers[service.container_name] is defined
         - (hostvars[groups[service.group] | first].service_image_info.images | default([]) | length) > 0
-        - item.containers[service.container_name].Image
+        - container_facts_per_host.containers[service.container_name].Image
           != hostvars[groups[service.group] | first].service_image_info.images[0].Id
 
     - name: Check that the new Libvirt version is >= current
+      any_errors_fatal: true
       vars:
-        current_version: "{{ item.stdout | regex_search('[0-9]+\\.[0-9]+\\.[0-9]+') }}"
+        current_version: "{{ libvirt_version_current_results.stdout | regex_search('[0-9]+\\.[0-9]+\\.[0-9]+') }}"
         new_version: "{{ hostvars[groups[service.group] | first].libvirt_new_version }}"
       assert:
         that: "{{ new_version is version(current_version, '>=', strict=true) }}"
@@ -75,11 +68,7 @@
           that you want to do this, please skip the tag `nova-libvirt-version-check`.
         success_msg: >
           Libvirt version check successful: target {{ new_version }} >= current {{ current_version }}.
-      run_once: true
-      loop: "{{ libvirt_version_current_results.results }}"
-      loop_control:
-        label: "{{ item.item }}"
-      when: item.stdout is defined
+      when: libvirt_version_current_results is not skipped
 
   tags: nova-libvirt-version-check
   when: enable_nova_libvirt_container | bool and (groups[service.group] | length) > 0

ansible/roles/ovn-db/defaults/main.yml

@@ -33,7 +33,7 @@ ovn_db_services:
     group: ovn-sb-db-relay
     enabled: "{{ enable_ovn_sb_db_relay | bool }}"
     environment:
-      RELAY_ID: "{{ ovn_sb_db_relay_group_id | default('1') }}"
+      RELAY_ID: "{{ item | default(ovn_sb_db_relay_group_id | default('1')) | string }}"
     image: "{{ ovn_sb_db_relay_image_full }}"
     iterate: true
     iterate_var: "{{ ovn_sb_db_relay_count | int }}"

ansible/roles/ovn-db/templates/ovn-sb-db-relay.json.j2

@@ -4,7 +4,7 @@
         {
             "source": "{{ container_config_directory }}/ovsdb-relay.json",
             "dest": "/etc/ovn/ovsdb-relay.json",
-            "owner": "openvswitch",
+            "owner": "root",
             "perm": "0600"
         }
     ],

ansible/roles/prometheus/templates/prometheus-cadvisor.json.j2

@@ -1,5 +1,5 @@
 {
-    "command": "/opt/cadvisor --port={{ prometheus_cadvisor_port }} --log_dir=/var/log/kolla/prometheus{% if prometheus_cadvisor_cmdline_extras %} {{ prometheus_cadvisor_cmdline_extras }}{% endif %}",
+    "command": "/opt/cadvisor --port={{ prometheus_cadvisor_port }} --log_dir=/var/log/kolla/prometheus --listen_ip {{ 'api' | kolla_address(inventory_hostname) }}{% if prometheus_cadvisor_cmdline_extras %} {{ prometheus_cadvisor_cmdline_extras }}{% endif %}",
     "config_files": [
 {% if kolla_copy_ca_into_containers | bool %}
         {

ansible/roles/service-check-containers/tasks/iterated.yml

@@ -2,11 +2,11 @@
 - name: "{{ kolla_role_name | default(project_name) }} | Check containers with iteration"
   become: true
   vars:
-    service: "{{ outer_item.value }}"
+    service: "{{ lookup('vars', (kolla_role_name | default(project_name)) + '_services')[service_name] }}"
   kolla_container:
     action: "compare_container"
     common_options: "{{ docker_common_options }}"
-    name: "{{ service.container_name }}"
+    name: "{{ service.container_name }}_{{ item }}"
     image: "{{ service.image | default(omit) }}"
     volumes: "{{ service.volumes | default(omit) }}"
     dimensions: "{{ service.dimensions | default(omit) }}"
@@ -22,8 +22,7 @@
     labels: "{{ service.labels | default(omit) }}"
     command: "{{ service.command | default(omit) }}"
     cgroupns_mode: "{{ service.cgroupns_mode | default(omit) }}"
-  loop:
-    - "{{ range(1,(service.iterate_var | int) + 1) | list }}"
+  loop: "{{ range(1, (iterate_count | int) + 1) | list }}"
   register: container_check
 
 # NOTE(yoctozepto): Must be a separate task because one cannot see the whole

ansible/roles/service-check-containers/tasks/main.yml

@@ -42,9 +42,10 @@
 
 - name: Include tasks
   vars:
-    service: "{{ outer_item.value }}"
+    service_name: "{{ outer_item.key }}"
+    iterate_count: "{{ outer_item.value.iterate_var | int }}"
   include_tasks: iterated.yml
   loop: "{{ lookup('vars', (kolla_role_name | default(project_name)) + '_services') | select_services_enabled_and_mapped_to_host | dict2items }}"
   loop_control:
     loop_var: outer_item
-  when: (service.iterate | default(False)) | bool
+  when: (outer_item.value.iterate | default(False)) | bool

ansible/roles/skyline/templates/nginx.conf.j2

@@ -38,6 +38,12 @@ http {
     ssl_certificate {{ skyline_ssl_certfile }};
     ssl_certificate_key {{ skyline_ssl_keyfile }};
     {% endif %}
+
+    {% if internal_protocol == 'https' %}
+    proxy_ssl_protocols TLSv1.2 TLSv1.3;
+    proxy_ssl_server_name on;
+    {% endif %}
+
     ##
     # Logging Settings
     ##

releasenotes/notes/fix-cyborg-api-conductor-placement-f0cdf7274d31ffc0.yaml

@@ -0,0 +1,7 @@
+---
+fixes:
+  - |
+    Fixes a placement problem for cyborg api and conductor services,
+    that would be also be scheduled on compute nodes, rather than
+    being exclusively on control plane.
+    `LP#2087552 <https://bugs.launchpad.net/kolla-ansible/+bug/2087552>`__

releasenotes/notes/skyline-tls-upstream-nginx-c93b39fb69b8d438.yaml

@@ -0,0 +1,7 @@
+---
+fixes:
+  - |
+    Fixed TLS errors in Skyline's nginx configuration when upstream
+    endpoints use HTTPS.
+    `LP#2091935 <https://bugs.launchpad.net/bugs/2091935>`__
+    `LP#1951437 <https://bugs.launchpad.net/bugs/1951437>`__