Merge pull request #890 from stackhpc/upstream/2026.1-2026-06-22

Synchronise 2026.1 with upstream

Author: priteau

ansible/group_vars/all/ovn.yml

@@ -8,7 +8,7 @@ ovn_sb_db_port: "6642"
 ovn_sb_db_relay_count: "{{ ((groups['ovn-controller'] | length) / ovn_sb_db_relay_compute_per_relay | int) | round(0, 'ceil') | int }}"
 ovn_sb_db_relay_compute_per_relay: "50"
 ovn_sb_db_relay_port_prefix: "1664"
-ovn_sb_db_relay_port: "{{ ovn_sb_db_relay_port_prefix ~ ovn_sb_db_relay_client_group_id }}"
+ovn_sb_db_relay_port: "{{ (ovn_sb_db_relay_port_prefix | int) * 10 + (ovn_sb_db_relay_client_group_id | int) }}"
 ovn_sb_db_relay_client_group_id: "{{ range(1, ovn_sb_db_relay_count | int + 1) | random(seed=inventory_hostname) }}"
 ovn_nb_connection:
   "{% for host in groups['ovn-nb-db'] %}\

ansible/roles/ironic/templates/ironic-conductor.json.j2

@@ -36,5 +36,12 @@
             "owner": "ironic:ironic",
             "recurse": true
         }{% endif %}
+    ],
+    "directories": [
+        {
+            "path": "/var/lib/ironic/tmp",
+            "owner": "ironic:ironic",
+            "perm": "0700"
+        }
     ]
 }

ansible/roles/ironic/templates/ironic.conf.j2

@@ -4,6 +4,8 @@ auth_strategy = noauth
 {% endif %}
 debug = {{ ironic_logging_debug }}
 
+tempdir = /var/lib/ironic/tmp
+
 log_file = /var/log/kolla/ironic/{{ service_name }}.log
 
 transport_url = {{ rpc_transport_url }}

ansible/roles/ovn-db/tasks/bootstrap-db.yml

@@ -85,8 +85,7 @@
 
 - name: Wait for ovn-sb-db-relay
   vars:
-    ovn_sb_db_relay_group_id: "{{ item }}"
-    ovn_sb_db_relay_port: "{{ ovn_sb_db_relay_port_prefix ~ ovn_sb_db_relay_group_id }}"
+    ovn_sb_db_relay_port: "{{ (ovn_sb_db_relay_port_prefix | int) * 10 + (item | int) }}"
   ansible.builtin.wait_for:
     host: "{{ api_interface_address }}"
     port: "{{ ovn_sb_db_relay_port }}"

ansible/roles/ovn-db/tasks/config-relay.yml

@@ -24,6 +24,7 @@
   vars:
     # NOTE(mnasiadka): Used in the ovn_sb_relay_command template in defaults/main.yml
     ovn_sb_db_relay_group_id: "{{ item }}"
+    ovn_sb_db_relay_port: "{{ (ovn_sb_db_relay_port_prefix | int) * 10 + (item | int) }}"
   ansible.builtin.template:
     src: "ovsdb-relay.json.j2"
     dest: "{{ node_config_directory }}/ovn-sb-db-relay-{{ item }}/ovsdb-relay.json"

ansible/roles/ovn-db/templates/ovsdb-relay.json.j2

@@ -1,7 +1,7 @@
 
 {
     "remotes": {
-        "ptcp:{{ ovn_sb_db_relay_port_prefix ~ ovn_sb_db_relay_group_id }}:{{ api_interface_address | put_address_in_context('url') }}": {
+        "ptcp:{{ ovn_sb_db_relay_port }}:{{ api_interface_address | put_address_in_context('url') }}": {
             "inactivity-probe": {{ ovn_sb_db_relay_passive_inactivity_probe }}
         }
     },

doc/source/reference/storage/external-ceph-guide.rst

@@ -537,6 +537,15 @@ This prevents cross-project and public object access. This can be resolved by
 setting ``ceph_rgw_swift_account_in_url`` to ``true``. This should match the
 ``rgw_swift_account_in_url`` configuration option in Ceph RadosGW.
 
+.. warning::
+
+   When using an external Ceph RadosGW for object storage endpoints
+   (when ``enable_ceph_rgw: true``), operators are advised to set
+   ``update_keystone_service_user_passwords: false`` in``globals.yml``.
+   Leaving this option enabled causes the service user password to be reset
+   on every reconfigure, which invalidates existing tokens and can cause
+   unforeseen outages for object storage consumers.
+
 Load balancing
 ==============
 

releasenotes/notes/fix-bug-2156758-e536b254fdd3fd32.yaml

@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    Fixes the Ironic temp directory causing invalid cross device links when
+    deploying baremetal images using the virtualmedia boot interface.

tests/templates/globals-default.j2

@@ -196,7 +196,7 @@ libvirt_tls: "yes"
 neutron_plugin_agent: "ovn"
 neutron_ovn_distributed_fip: "yes"
 neutron_enable_ovn_agent: "yes"
-ovn_sb_db_relay_count: "3"
+ovn_sb_db_relay_count: "11"
 {%     if not is_upgrade %}
 enable_neutron_vpnaas: "yes"
 {%     endif %}