Merge pull request #894 from stackhpc/upstream/master-2026-06-29

Synchronise master with upstream

Author: Alex-Welsh

ansible/group_vars/all/keystone.yml

@@ -16,7 +16,7 @@ keystone_admin_project: "admin"
 
 # Whether or not to apply changes to service user passwords when services are
 # reconfigured
-update_keystone_service_user_passwords: true
+update_keystone_service_user_passwords: false
 
 default_project_domain_name: "Default"
 default_project_domain_id: "default"
@@ -68,13 +68,21 @@ keystone_default_user_role: "member"
 # The configuration of attribute mappings is a list of objects, where each
 # object must have a 'name' (that mapps to the 'attribute_mapping' to the IdP
 # object in the IdPs set), and the 'file' with a full qualified path to a mapping file.
+#
+# The "schema_version" attribute is optional. Here we just demonstrate a few examples of
+# configuration; before using them, one must check the supported version by Keystone. If
+# one wants to use the default of Keystone, she/he can omit the "schema_version" option.
+#
 # keystone_identity_mappings:
 #   - name: "mappingId1"
 #     file: "/full/qualified/path/to/mapping/json/file/to/mappingId1"
+#     schema_version: "1.0"
 #   - name: "mappingId2"
 #     file: "/full/qualified/path/to/mapping/json/file/to/mappingId2"
+#     schema_version: "2.0"
 #   - name: "mappingId3"
 #     file: "/full/qualified/path/to/mapping/json/file/to/mappingId3"
+#     schema_version: "3.0"
 keystone_identity_providers: []
 keystone_identity_mappings: []
 keystone_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else keystone_public_listen_port }}"

ansible/module_utils/kolla_podman_worker.py

@@ -539,8 +539,12 @@ def compare_config(self):
         if rc == 0:
             return False
         elif rc == 1:
-            self._config_diff = (raw_output.decode('utf-8') if
-                                 isinstance(raw_output, bytes) else raw_output)
+            try:
+                self._config_diff = (raw_output.decode('utf-8') if
+                                     isinstance(raw_output, bytes) else
+                                     raw_output)
+            except UnicodeDecodeError:
+                self._config_diff = 'container changed during config check'
             return True
         else:
             raise Exception('Failed to compare container configuration: '

ansible/roles/barbican/defaults/main.yml

@@ -109,7 +109,7 @@ barbican_api_healthcheck_test:
   - >-
     healthcheck_curl {{
     'https' if barbican_enable_tls_backend | bool else 'http' }}://{{
-    api_interface_address | put_address_in_context('url') }}:{{ barbican_api_listen_port }}/healthcheck"
+    api_interface_address | put_address_in_context('url') }}:{{ barbican_api_listen_port }}/healthcheck
 barbican_api_healthcheck_timeout: "{{ default_container_healthcheck_timeout }}"
 barbican_api_healthcheck:
   interval: "{{ barbican_api_healthcheck_interval }}"

ansible/roles/ironic/defaults/main.yml

@@ -34,7 +34,6 @@ ironic_services:
     group: ironic-conductor
     enabled: true
     image: "{{ ironic_conductor_image_full }}"
-    privileged: true
     volumes: "{{ ironic_conductor_default_volumes + ironic_conductor_extra_volumes + lookup('vars', 'run_default_volumes_' + kolla_container_engine) }}"
     dimensions: "{{ ironic_conductor_dimensions }}"
     healthcheck: "{{ ironic_conductor_healthcheck }}"

ansible/roles/keystone/tasks/register_identity_providers.yml

@@ -61,6 +61,7 @@
       ca_cert: "{{ openstack_cacert if openstack_cacert != '' else omit }}"
       name: "{{ item.name }}"
       rules: "{{ '{{ keystone_identity_mapping_rules | from_json }}' }}"
+      schema_version: "{{ item.schema_version | default(omit) }}"
       state: present
     module_extra_vars:
       keystone_identity_mapping_rules: "{{ lookup('ansible.builtin.file', item.file) }}"

ansible/roles/nova-cell/defaults/main.yml

@@ -639,6 +639,17 @@ libvirt_sasl_authname: "nova"
 libvirt_sasl_mech_list:
   - "{{ 'SCRAM-SHA-256' if libvirt_tls | bool else 'DIGEST-MD5' }}"
 
+# Connection processing limits for libvirtd. nova-compute is effectively the
+# only privileged client of libvirtd under Kolla, so libvirt's stock per-client
+# request cap (max_client_requests=5) is the binding constraint rather than a
+# safety net: concurrent instance builds plus the resource-tracker periodic
+# routinely exceed five in-flight RPCs, which starves keepalive responses until
+# libvirtd drops the connection. Raise the per-client cap, and the worker pool
+# along with it so that lifting the per-client limit does not starve other
+# connections (live migration, health checks, periodics).
+libvirt_max_client_requests: 20
+libvirt_max_workers: 50
+
 ####################
 # Kolla
 ####################

ansible/roles/nova-cell/templates/libvirtd.conf.j2

@@ -25,3 +25,13 @@ listen_addr = "{{ migration_interface_address }}"
 # Enable read-only access to libvirt socket
 auth_unix_ro = "none"
 {% endif %}
+
+# Connection processing limits. libvirt's defaults (max_workers=20,
+# max_client_requests=5) assume a multi-tenant host with many mutually
+# distrustful clients. Under Kolla, nova-compute is effectively the sole
+# privileged client, so the per-client cap of 5 becomes the binding
+# constraint: concurrent builds plus the resource-tracker periodic exceed
+# five in-flight RPCs and starve keepalive responses, causing libvirtd to
+# drop the connection after keepalive_interval (5s) x keepalive_count (5).
+max_workers = {{ libvirt_max_workers }}
+max_client_requests = {{ libvirt_max_client_requests }}

doc/source/admin/password-rotation.rst

@@ -38,6 +38,13 @@ The majority of the secrets can be applied by simply reconfiguring services
 with ``kolla-ansible reconfigure``. Below is a list of secrets that can be
 applied this way.
 
+.. note::
+
+   Rotating ``*_keystone_password`` secrets requires
+   ``update_keystone_service_user_passwords`` to be set to ``true`` in
+   ``globals.yml`` before running ``kolla-ansible reconfigure``, as the default
+   is ``false``. This setting may be reverted to ``false`` after the reconfigure
+   completes.
 
 * ``*_keystone_password``
 * ``*_database_password`` (excluding ``nova_database_password``)

doc/source/reference/compute/libvirt-guide.rst

@@ -198,3 +198,26 @@ Since the Yoga release, the ``kolla-ansible certificates`` command generates
 certificates for libvirt TLS. A single key and certificate is used for all
 hosts, with a Subject Alternative Name (SAN) entry for each compute host
 hostname.
+
+Libvirt Connection Limits
+=========================
+
+By default ``libvirt`` is configured by upstream packages with reasonable
+defaults for an environment where many users are starting and stopping virtual
+machines. This isn't true for Kolla Hypervisor nodes, where a single
+``nova-compute`` container manages all of the virtual machine instances on the
+machine.
+
+Kolla-Ansible therefore tunes the following values in ``libvirtd.conf``:
+
+* libvirt_max_client_requests: raised to 20 compared to the usual default of
+  5.
+* libvirt_max_workers: raised to 50 compared to the usual default of 20.
+
+Both of these values may be overridden in ``globals.yml``.
+
+This means that ``nova-compute`` can therefore perform 20 operations via
+libvirt simultaneously instead of the usual default of 5. These values should
+be safe, but if you see libvirt error messages saying ``Client hit max requests
+limit``, you may want to consider an additional increase -- especially if you
+have particularly large hypervisors.

doc/source/reference/shared-services/keystone-guide.rst

@@ -87,6 +87,7 @@ below:
     keystone_identity_mappings:
       - name: "mappingId1"
         file: "/full/qualified/path/to/mapping/json/file/to/mappingId1"
+        schema_version: "2.0"
 
 In some cases it's necessary to add JWKS (JSON Web Key Set) uri.
 It is required for auth-openidc endpoint - which is