[rally] Add Rally role

Add a new `rally` Ansible role that runs OpenStack Rally benchmarks
inside a podman container (quay.io/airshipit/xrally-openstack:3.0.0).
The role auto-discovers OpenStack credentials from the cluster's
KeystoneAPI resource and appends the deployment CA to the trust bundle
so SSL verification works without any manual configuration.

The role supports two execution modes:

* Single run (default): `cifmw_rally_runs: []` — uses the top-level
  `cifmw_rally_*` variables, artifacts stored in
  `cifmw_rally_artifacts_basedir/`.

* Multi-run: set `cifmw_rally_runs` to a list of dicts, each with a
  `name` key and optional `cifmw_rally_*` overrides. Artifacts for each
  run are namespaced under `cifmw_rally_artifacts_basedir/<name>/`.
  This is modelled after `cifmw_test_operator_stages` and replaces the
  former test_operator-based wiring (Rally is not a test-operator CRD).

A `hooks/playbooks/rally_run.yaml` entry point is provided so jobs can
invoke Rally via the ci-framework hooks system, e.g.:

  post_tests_90_rally_run:
    type: playbook
    source: rally_run.yaml

Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: lkuchlan <lkuchlan@redhat.com>

Author: lkuchlan

docs/dictionary/en-custom.txt

@@ -78,6 +78,7 @@ baseimg
 baseurl
 bashrc
 bd
+benchmarking
 bgp
 blockquote
 bmaas
@@ -328,6 +329,7 @@ kerberos
 keycloak
 keypair
 keyring
+keystoneapi
 keystoneauth
 keystoneauth1
 keytab

hooks/playbooks/rally_cinder_prerequisites.yaml

@@ -0,0 +1,56 @@
+---
+- name: Ensure Cinder Rally prerequisites exist
+  hosts: "{{ cifmw_target_hook_host | default('localhost') }}"
+  gather_facts: false
+  environment:
+    KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}"
+    PATH: "{{ cifmw_path }}"
+  tasks:
+    - name: Create m1.tiny flavor if missing
+      ansible.builtin.shell: |
+        set -xe -o pipefail
+        oc -n {{ namespace }} rsh openstackclient \
+            openstack flavor show m1.tiny &>/dev/null || \
+            oc -n {{ namespace }} rsh openstackclient \
+            openstack flavor create m1.tiny \
+              --ram 512 --disk 1 --vcpus 1 --public
+
+    - name: Create lvmdriver-1 volume type if missing
+      ansible.builtin.shell: |
+        set -xe -o pipefail
+        oc -n {{ namespace }} rsh openstackclient \
+            openstack volume type show lvmdriver-1 &>/dev/null || \
+            oc -n {{ namespace }} rsh openstackclient \
+            openstack volume type create lvmdriver-1 --public
+
+    - name: Check if cirros image already exists
+      ansible.builtin.shell: |
+        set -e -o pipefail
+        oc -n {{ namespace }} rsh openstackclient \
+            openstack image list -f value -c Name | grep -q '^cirros'
+      register: _cirros_image_exists
+      failed_when: false
+
+    - name: Download cirros image to hypervisor
+      when: _cirros_image_exists.rc != 0
+      ansible.builtin.get_url:
+        url: "https://github.com/cirros-dev/cirros/releases/download/0.6.2/cirros-0.6.2-x86_64-disk.img"
+        dest: "/tmp/cirros-0.6.2-x86_64-disk.img"
+        mode: "0644"
+
+    - name: Copy cirros image to openstackclient pod
+      when: _cirros_image_exists.rc != 0
+      ansible.builtin.command: >-
+        oc cp /tmp/cirros-0.6.2-x86_64-disk.img
+        {{ namespace }}/openstackclient:/home/cloud-admin/cirros-0.6.2-x86_64-disk.img
+
+    - name: Upload cirros image for Rally if missing
+      when: _cirros_image_exists.rc != 0
+      ansible.builtin.shell: |
+        set -xe -o pipefail
+        oc -n {{ namespace }} rsh openstackclient \
+            openstack image create cirros-0.6.2-x86_64-disk \
+              --disk-format qcow2 \
+              --container-format bare \
+              --file /home/cloud-admin/cirros-0.6.2-x86_64-disk.img \
+              --public

hooks/playbooks/rally_run.yaml

@@ -0,0 +1,11 @@
+---
+- name: Run Rally benchmarks
+  hosts: "{{ cifmw_target_hook_host | default('localhost') }}"
+  gather_facts: false
+  environment:
+    KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}"
+    PATH: "{{ cifmw_path }}"
+  tasks:
+    - name: Run rally role
+      ansible.builtin.include_role:
+        name: rally

roles/rally/OWNERS

@@ -0,0 +1,7 @@
+# See the OWNERS docs at https://www.kubernetes.dev/docs/guide/owners/
+
+approvers:
+  - ciops-team
+
+reviewers:
+  - ciops-team

roles/rally/README.md

@@ -0,0 +1,95 @@
+# rally
+Role to setup and run Rally benchmarking tests against an OpenStack deployment.
+
+Rally is run inside the `quay.io/airshipit/xrally-openstack` container via podman.
+OpenStack credentials are discovered automatically from the Kubernetes KeystoneAPI resource,
+or can be supplied directly via `cifmw_rally_os_*` variables.
+
+## Prerequisites
+- `oc` CLI available and pointing to the target OpenStack cluster (used for credential and CA discovery).
+- `cifmw_openstack_namespace` must be set to the OpenStack namespace (typically `openstack`).
+
+### Manila prerequisites
+
+If running Manila benchmarks, the `dhss_true` share type must exist before Rally runs.
+Use `manila_create_default_resources.yml` with `share_type_name` and `extra_specs` overrides:
+
+```yaml
+pre_tests_80_manila_share_type:
+  type: playbook
+  source: manila_create_default_resources.yml
+  extra_vars:
+    share_type_name: dhss_true
+    extra_specs: {}
+```
+
+## Privilege escalation
+become - Required to install podman and fix artifact directory ownership after the container run.
+
+## Parameters
+
+* `cifmw_rally_artifacts_basedir`: (String) Directory where all Rally artifacts are stored.
+  Default: `{{ cifmw_basedir }}/tests/rally`
+* `cifmw_rally_registry`: (String) Container registry. Default: `quay.io`
+* `cifmw_rally_namespace`: (String) Registry namespace. Default: `airshipit`
+* `cifmw_rally_container`: (String) Container image name. Default: `xrally-openstack`
+* `cifmw_rally_image`: (String) Full image reference. Composed from registry/namespace/container.
+* `cifmw_rally_image_tag`: (String) Container image tag. Default: `3.0.0`
+* `cifmw_rally_dry_run`: (Boolean) Skip actual container execution. Default: `false`
+* `cifmw_rally_remove_container`: (Boolean) Remove container after run. Default: `true`
+* `cifmw_rally_fail_on_task_failure`: (Boolean) Fail the play if Rally exits non-zero. Default: `true`
+* `cifmw_rally_deployment_name`: (String) Rally deployment name. Default: `cifmw`
+* `cifmw_rally_concurrency`: (Integer) Concurrency passed to the Rally task via `--task-args`. Default: `1`
+* `cifmw_rally_task_file`: (String) Absolute path to a custom Rally task YAML on the host.
+  Mutually exclusive with `cifmw_rally_openstack_tests`. Default: `""`
+* `cifmw_rally_task_extra_args`: (String) Extra arguments passed verbatim to `rally task start`. Default: `""`
+* `cifmw_rally_dns_servers`: (List) DNS servers used inside the Rally container. Default: `["192.168.122.10"]`
+* `cifmw_rally_os_auth_url`: (String) OpenStack auth URL. Auto-discovered from KeystoneAPI if unset.
+* `cifmw_rally_os_username`: (String) OpenStack username. Default: `admin`
+* `cifmw_rally_os_password`: (String) OpenStack password. Auto-discovered from Kubernetes secret if unset.
+* `cifmw_rally_os_project_name`: (String) OpenStack project. Default: `admin`
+* `cifmw_rally_os_user_domain_name`: (String) User domain. Default: `Default`
+* `cifmw_rally_os_project_domain_name`: (String) Project domain. Default: `Default`
+* `cifmw_rally_os_region_name`: (String) OpenStack region. Default: `regionOne`
+* `cifmw_rally_runs`: (List) List of run definitions for sequential multi-run mode.
+  When empty (default), the role runs once using the top-level `cifmw_rally_*` variables.
+  When non-empty, the role loops over the list; each entry may override any `cifmw_rally_*`
+  variable for that run and **must** include a `name` key used to namespace artifacts.
+  Default: `[]`
+
+## Standalone usage (single run)
+
+```yaml
+- hosts: hypervisor
+  roles:
+    - role: rally
+      vars:
+        cifmw_rally_openstack_tests: "cinder"
+        cifmw_rally_concurrency: 2
+        cifmw_rally_fail_on_task_failure: false
+```
+
+## Usage via hook (multiple runs)
+
+Add a `post_tests_*` hook in your job vars and define `cifmw_rally_runs`:
+
+```yaml
+post_tests_90_rally_run:
+  type: playbook
+  source: rally_run.yaml
+cifmw_rally_runs:
+  - name: cinder
+    cifmw_rally_openstack_tests: "cinder"
+    cifmw_rally_concurrency: 1
+  - name: nova
+    cifmw_rally_openstack_tests: "nova"
+    cifmw_rally_concurrency: 2
+    cifmw_rally_fail_on_task_failure: false
+```
+
+Each run stores its artifacts under `cifmw_rally_artifacts_basedir/<name>/`.
+
+## Custom task files
+
+To use a custom Rally task file, set `cifmw_rally_task_file` to the absolute path of the
+YAML on the hypervisor host (pre-stage it via an earlier hook if needed).

roles/rally/defaults/main.yml

@@ -0,0 +1,36 @@
+---
+# Copyright Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+
+# All variables intended for modification should be placed in this file.
+# All variables within this role should have a prefix of "cifmw_rally"
+cifmw_rally_artifacts_basedir: "{{ cifmw_basedir }}/tests/rally"
+cifmw_rally_registry: "quay.io"
+cifmw_rally_namespace: "airshipit"
+cifmw_rally_container: "xrally-openstack"
+cifmw_rally_image: "{{ cifmw_rally_registry }}/{{ cifmw_rally_namespace }}/{{ cifmw_rally_container }}"
+cifmw_rally_image_tag: "3.0.0"
+cifmw_rally_dry_run: false
+cifmw_rally_remove_container: true
+cifmw_rally_fail_on_task_failure: true
+cifmw_rally_deployment_name: "cifmw"
+cifmw_rally_concurrency: 1
+cifmw_rally_task_file: ""
+cifmw_rally_openstack_tests: ""
+cifmw_rally_task_extra_args: ""
+cifmw_rally_dns_servers:
+  - "192.168.122.10"
+cifmw_rally_runs: []

roles/rally/meta/main.yml

@@ -0,0 +1,29 @@
+---
+# Copyright Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+
+galaxy_info:
+  author: CI Framework
+  description: CI Framework Role -- rally
+  company: Red Hat
+  license: Apache-2.0
+  min_ansible_version: "2.14"
+  namespace: cifmw
+  galaxy_tags:
+    - cifmw
+    - rally
+
+dependencies: []

roles/rally/molecule/default/converge.yml

@@ -0,0 +1,24 @@
+---
+# Copyright Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+
+- name: Converge
+  hosts: all
+  vars:
+    cifmw_rally_dry_run: true
+    cifmw_rally_openstack_tests: "cinder"
+  roles:
+    - role: "rally"

roles/rally/molecule/default/molecule.yml

@@ -0,0 +1,9 @@
+---
+# Mainly used to override the defaults set in .config/molecule/
+# By default, it uses the "config_podman.yml" - in CI, it will use
+# "config_local.yml".
+log: true
+
+provisioner:
+  name: ansible
+  log: true

roles/rally/molecule/default/prepare.yml

@@ -0,0 +1,28 @@
+---
+# Copyright Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+
+- name: Prepare
+  hosts: all
+  vars:
+    cifmw_basedir: "{{ ansible_user_dir }}/ci-framework-data"
+    cifmw_install_yamls_tasks_out: "{{ ansible_user_dir }}/zuul-jobs/roles/install_yamls_makes/tasks"
+    cifmw_install_yamls_defaults:
+      NAMESPACE: openstack
+  roles:
+    - role: test_deps
+    - role: ci_setup
+    - role: install_yamls