Merge remote-tracking branch 'upstream/stable/2026.1' into 2026.1-merge-upstream

Author: Alex-Welsh

.gitreview

@@ -2,4 +2,4 @@
 host=review.opendev.org
 port=29418
 project=openstack/kayobe-config.git
-defaultbranch=stable/2025.1
+defaultbranch=stable/2026.1

etc/kayobe/ansible-control.yml

@@ -0,0 +1,161 @@
+---
+###############################################################################
+# Ansible control host configuration.
+
+# User with which to access the Ansible control host via SSH during bootstrap,
+# in order to setup the Kayobe user account. Default is {{ os_distribution }}.
+#ansible_control_bootstrap_user:
+
+###############################################################################
+# Ansible control host network interface configuration.
+
+# List of networks to which Ansible control host are attached.
+#ansible_control_network_interfaces:
+
+# List of default networks to which Ansible control host are attached.
+#ansible_control_default_network_interfaces:
+
+# List of extra networks to which Ansible control host are attached.
+#ansible_control_extra_network_interfaces:
+
+###############################################################################
+# Ansible control host software RAID configuration.
+
+# List of software RAID arrays. See mrlesmithjr.mdadm role for format.
+#ansible_control_mdadm_arrays:
+
+###############################################################################
+# Ansible control host encryption configuration.
+
+# List of block devices to encrypt. See stackhpc.luks role for format.
+#ansible_control_luks_devices:
+
+###############################################################################
+# Ansible control host LVM configuration.
+
+# List of Ansible control host volume groups. See mrlesmithjr.manage_lvm role
+# for format.
+#ansible_control_lvm_groups:
+
+# Default list of Ansible control host volume groups. See
+# mrlesmithjr.manage_lvm role for format.
+#ansible_control_lvm_groups_default:
+
+# Additional list of Ansible control host volume groups. See
+# mrlesmithjr.manage_lvm role for format.
+#ansible_control_lvm_groups_extra:
+
+# Whether a 'data' LVM volume group should exist on the Ansible control host.
+# By default this contains a 'docker-volumes' logical volume for Docker volume
+# storage. Default is false.
+#ansible_control_lvm_group_data_enabled:
+
+# Ansible control host LVM volume group for data. See mrlesmithjr.manage_lvm
+# role for format.
+#ansible_control_lvm_group_data:
+
+# List of disks for use by Ansible control host LVM data volume group. Default
+# to an invalid value to require configuration.
+#ansible_control_lvm_group_data_disks:
+
+# List of LVM logical volumes for the data volume group.
+#ansible_control_lvm_group_data_lvs:
+
+# Docker volumes LVM backing volume.
+#ansible_control_lvm_group_data_lv_docker_volumes:
+
+# Size of docker volumes LVM backing volume.
+#ansible_control_lvm_group_data_lv_docker_volumes_size:
+
+# Filesystem for docker volumes LVM backing volume. ext4 allows for shrinking.
+#ansible_control_lvm_group_data_lv_docker_volumes_fs:
+
+###############################################################################
+# Ansible control host sysctl configuration.
+
+# Dict of sysctl parameters to set.
+#ansible_control_sysctl_parameters:
+
+###############################################################################
+# Ansible control host tuned configuration.
+
+# Builtin tuned profile to use. Format is same as that used by giovtorres.tuned
+# role. Default is throughput-performance.
+#ansible_control_tuned_active_builtin_profile:
+
+###############################################################################
+# Ansible control host user configuration.
+
+# List of users to create. This should be in a format accepted by the
+# singleplatform-eng.users role.
+#ansible_control_users:
+
+###############################################################################
+# Ansible control host additional containers configuration
+
+# Dict of containers to deploy.
+# Example:
+# seed_containers:
+#   squid:
+#     image: "docker.io/stackhpc/squid"
+#     pre: "{{ kayobe_env_config_path }}/containers/squid/pre.yml"
+#     post: "{{ kayobe_env_config_path }}/containers/squid/post.yml"
+#     tag: "3.5.20-1"
+#
+#ansible_control_containers:
+
+# Whether to attempt a basic authentication login to a registry when
+# deploying containers.
+#ansible_control_manage_containers_registry_attempt_login:
+
+###############################################################################
+# Ansible control host firewalld configuration.
+
+# Whether to install and enable firewalld.
+#ansible_control_firewalld_enabled:
+
+# A list of zones to create. Each item is a dict containing a 'zone' item.
+#ansible_control_firewalld_zones:
+
+# A firewalld zone to set as the default. Default is unset, in which case the
+# default zone will not be changed.
+#ansible_control_firewalld_default_zone:
+
+# A list of firewall rules to apply. Each item is a dict containing arguments
+# to pass to the firewalld module. Arguments are omitted if not provided, with
+# the following exceptions:
+# - offline: true
+# - permanent: true
+# - state: enabled
+#ansible_control_firewalld_rules:
+
+###############################################################################
+# Ansible control host fail2ban configuration.
+
+# Whether to install and enable fail2ban.
+#ansible_control_fail2ban_enabled:
+
+# List of fail2ban jails for the Ansible control host.
+#ansible_control_fail2ban_jail_configuration:
+
+# List of default fail2ban jails for the Ansible control host.
+#ansible_control_fail2ban_jail_configuration_default:
+
+# List of extra fail2ban jails for the Ansible control host.
+#ansible_control_fail2ban_jail_configuration_extra:
+
+###############################################################################
+# Ansible control host swap configuration.
+
+# List of swap devices. Each item is a dict containing a 'device' item.
+#ansible_control_swap:
+
+###############################################################################
+# Ansible control host container engine configuration.
+
+# Whether a container engine should be configured. Default is false.
+#ansible_control_container_engine_enabled:
+
+###############################################################################
+# Dummy variable to allow Ansible to accept this file.
+workaround_ansible_issue_8743: yes

etc/kayobe/bifrost.yml

@@ -4,6 +4,9 @@
 ###############################################################################
 # Bifrost installation.
 
+# Whether to install Bifrost. Default is true.
+#kolla_enable_bifrost:
+
 # URL of Bifrost source code repository.
 #kolla_bifrost_source_url:
 
@@ -87,18 +90,27 @@
 # Ironic Inspector configuration.
 
 # List of of inspector processing plugins.
-#kolla_bifrost_inspector_processing_hooks:
+#kolla_bifrost_inspector_hooks:
 
 # Which MAC addresses to add as ports during introspection. One of 'all',
 # 'active' or 'pxe'.
 #kolla_bifrost_inspector_port_addition:
 
+# Which ports to keep after introspection. One of 'all', 'present', or 'added'.
+# Default follows Bifrost's default of 'present'.
+#kolla_bifrost_inspector_keep_ports:
+
 # List of extra kernel parameters for the inspector default PXE configuration.
 # Default is {{ inspector_extra_kernel_options }}, defined in inspector.yml.
 # When customising this variable, the default extra kernel parameters should be
 # kept to retain full node inspection capabilities.
 #kolla_bifrost_inspector_extra_kernel_options:
 
+# Node driver to use for auto-discovered nodes. Default is
+# {{ inspector_discovery_enroll_node_driver }}, defined in inspector.yml. Set
+# to 'redfish' for modern BMC implementations.
+#kolla_bifrost_inspector_default_node_driver:
+
 # List of introspection rules for Bifrost's Ironic Inspector service.
 #kolla_bifrost_inspector_rules:
 
@@ -124,9 +136,6 @@
 # Ironic inspector deployment ramdisk location.
 #kolla_bifrost_inspector_deploy_ramdisk:
 
-# Ironic inspector legacy deployment kernel location.
-#kolla_bifrost_inspector_legacy_deploy_kernel:
-
 # Timeout of hardware inspection on overcloud nodes, in seconds. Default is
 # {{ inspector_inspection_timeout }}.
 #kolla_bifrost_inspection_timeout:

etc/kayobe/compute.yml

@@ -159,6 +159,21 @@
 # - state: enabled
 #compute_firewalld_rules:
 
+###############################################################################
+# Compute node fail2ban configuration.
+
+# Whether to install and enable fail2ban.
+#compute_fail2ban_enabled:
+
+# List of fail2ban jails for the compute node.
+#compute_fail2ban_jail_configuration:
+
+# List of default fail2ban jails for the compute node.
+#compute_fail2ban_jail_configuration_default:
+
+# List of extra fail2ban jails for the compute node.
+#compute_fail2ban_jail_configuration_extra:
+
 ###############################################################################
 # Compute node host libvirt configuration.
 
@@ -215,9 +230,8 @@
 ###############################################################################
 # Compute node swap configuration.
 
-# List of swap devices. Each item is a dict containing a 'device' item. Default
-# is an empty list.
-# compute_swap:
+# List of swap devices. Each item is a dict containing a 'device' item.
+#compute_swap:
 
 ###############################################################################
 # Dummy variable to allow Ansible to accept this file.

etc/kayobe/controllers.yml

@@ -106,8 +106,7 @@
 
 # Whether a 'data' LVM volume group should exist on controller hosts. By
 # default this contains a 'docker-volumes' logical volume for Docker volume
-# storage.
-# Default is false.
+# storage. Default is false.
 #controller_lvm_group_data_enabled:
 
 # Controller LVM volume group for data. See mrlesmithjr.manage_lvm role for
@@ -118,18 +117,33 @@
 # invalid value to require configuration.
 #controller_lvm_group_data_disks:
 
+# List of LVM logical volumes for the data volume group when using docker.
+#controller_lvm_group_data_docker_lvs:
+
+# List of LVM logical volumes for the data volume group when using podman.
+#controller_lvm_group_data_podman_lvs:
+
 # List of LVM logical volumes for the data volume group.
 #controller_lvm_group_data_lvs:
 
 # Docker volumes LVM backing volume.
 #controller_lvm_group_data_lv_docker_volumes:
 
+# Podman volumes LVM backing volume.
+#controller_lvm_group_data_lv_podman_volumes:
+
 # Size of docker volumes LVM backing volume.
 #controller_lvm_group_data_lv_docker_volumes_size:
 
 # Filesystem for docker volumes LVM backing volume. ext4 allows for shrinking.
 #controller_lvm_group_data_lv_docker_volumes_fs:
 
+# Size of podman volumes LVM backing volume.
+#controller_lvm_group_data_lv_podman_volumes_size:
+
+# Filesystem for podman volumes LVM backing volume. ext4 allows for shrinking.
+#controller_lvm_group_data_lv_podman_volumes_fs:
+
 ###############################################################################
 # Controller node sysctl configuration.
 
@@ -150,6 +164,24 @@
 # singleplatform-eng.users role.
 #controller_users:
 
+###############################################################################
+# Controller node additional containers configuration
+
+# Dict of containers to deploy.
+# Example:
+# controller_containers:
+#   squid:
+#     image: "stackhpc/squid:3.5.20-1"
+#     pre: "{{ kayobe_env_config_path }}/containers/squid/pre.yml"
+#     post: "{{ kayobe_env_config_path }}/containers/squid/post.yml"
+#
+#controller_containers:
+
+
+# Whether to attempt a basic authentication login to a registry when
+# deploying controller containers
+#controller_manage_containers_registry_attempt_login:
+
 ###############################################################################
 # Controller node firewalld configuration.
 
@@ -171,12 +203,26 @@
 # - state: enabled
 #controller_firewalld_rules:
 
+###############################################################################
+# Controller node fail2ban configuration.
+
+# Whether to install and enable fail2ban.
+#controller_fail2ban_enabled:
+
+# List of fail2ban jails for the controller node.
+#controller_fail2ban_jail_configuration:
+
+# List of default fail2ban jails for the controller node.
+#controller_fail2ban_jail_configuration_default:
+
+# List of extra fail2ban jails for the controller node.
+#controller_fail2ban_jail_configuration_extra:
+
 ###############################################################################
 # Controller node swap configuration.
 
-# List of swap devices. Each item is a dict containing a 'device' item. Default
-# is an empty list.
-# controller_swap:
+# List of swap devices. Each item is a dict containing a 'device' item.
+#controller_swap:
 
 ###############################################################################
 # Dummy variable to allow Ansible to accept this file.

etc/kayobe/dnf.yml

@@ -297,6 +297,13 @@ dnf_install_doca: "{{ 'mlnx' in group_names }}"
 # Whether to enable the Rocky Linux security repository.
 dnf_enable_rocky_security: false
 
+# Override the state of repositories. Expected to be used with repositories not
+# managed by dnf_custom_repos. For example:
+# dnf_repo_state_overrides:
+#   crb: enabled
+# Default value is {}.
+#dnf_repo_state_overrides:
+
 ###############################################################################
 # DNF Automatic configuration.