[2026.1] Synchronise config with kayobe

This is the result of following this step in the release doc:

https://docs.openstack.org/kayobe/latest/contributor/releases.html#synchronise-kayobe-config

Synchronised with kayobe @ 5def63f7d0c354ffb2f9ab01fbab03cfc19a8490.

Change-Id: Ia942d944def7c99f7af15686ee459479e0ba680d
Signed-off-by: Will Szumski <will@stackhpc.com>

Author: jovial

etc/kayobe/ansible-control.yml

@@ -90,6 +90,24 @@
 # singleplatform-eng.users role.
 #ansible_control_users:
 
+###############################################################################
+# Ansible control host additional containers configuration
+
+# Dict of containers to deploy.
+# Example:
+# seed_containers:
+#   squid:
+#     image: "docker.io/stackhpc/squid"
+#     pre: "{{ kayobe_env_config_path }}/containers/squid/pre.yml"
+#     post: "{{ kayobe_env_config_path }}/containers/squid/post.yml"
+#     tag: "3.5.20-1"
+#
+#ansible_control_containers:
+
+# Whether to attempt a basic authentication login to a registry when
+# deploying containers.
+#ansible_control_manage_containers_registry_attempt_login:
+
 ###############################################################################
 # Ansible control host firewalld configuration.
 
@@ -111,6 +129,21 @@
 # - state: enabled
 #ansible_control_firewalld_rules:
 
+###############################################################################
+# Ansible control host fail2ban configuration.
+
+# Whether to install and enable fail2ban.
+#ansible_control_fail2ban_enabled:
+
+# List of fail2ban jails for the Ansible control host.
+#ansible_control_fail2ban_jail_configuration:
+
+# List of default fail2ban jails for the Ansible control host.
+#ansible_control_fail2ban_jail_configuration_default:
+
+# List of extra fail2ban jails for the Ansible control host.
+#ansible_control_fail2ban_jail_configuration_extra:
+
 ###############################################################################
 # Ansible control host swap configuration.
 

etc/kayobe/bifrost.yml

@@ -106,6 +106,11 @@
 # kept to retain full node inspection capabilities.
 #kolla_bifrost_inspector_extra_kernel_options:
 
+# Node driver to use for auto-discovered nodes. Default is
+# {{ inspector_discovery_enroll_node_driver }}, defined in inspector.yml. Set
+# to 'redfish' for modern BMC implementations.
+#kolla_bifrost_inspector_default_node_driver:
+
 # List of introspection rules for Bifrost's Ironic Inspector service.
 #kolla_bifrost_inspector_rules:
 

etc/kayobe/compute.yml

@@ -159,6 +159,21 @@
 # - state: enabled
 #compute_firewalld_rules:
 
+###############################################################################
+# Compute node fail2ban configuration.
+
+# Whether to install and enable fail2ban.
+#compute_fail2ban_enabled:
+
+# List of fail2ban jails for the compute node.
+#compute_fail2ban_jail_configuration:
+
+# List of default fail2ban jails for the compute node.
+#compute_fail2ban_jail_configuration_default:
+
+# List of extra fail2ban jails for the compute node.
+#compute_fail2ban_jail_configuration_extra:
+
 ###############################################################################
 # Compute node host libvirt configuration.
 

etc/kayobe/controllers.yml

@@ -164,6 +164,24 @@
 # singleplatform-eng.users role.
 #controller_users:
 
+###############################################################################
+# Controller node additional containers configuration
+
+# Dict of containers to deploy.
+# Example:
+# controller_containers:
+#   squid:
+#     image: "stackhpc/squid:3.5.20-1"
+#     pre: "{{ kayobe_env_config_path }}/containers/squid/pre.yml"
+#     post: "{{ kayobe_env_config_path }}/containers/squid/post.yml"
+#
+#controller_containers:
+
+
+# Whether to attempt a basic authentication login to a registry when
+# deploying controller containers
+#controller_manage_containers_registry_attempt_login:
+
 ###############################################################################
 # Controller node firewalld configuration.
 
@@ -185,6 +203,21 @@
 # - state: enabled
 #controller_firewalld_rules:
 
+###############################################################################
+# Controller node fail2ban configuration.
+
+# Whether to install and enable fail2ban.
+#controller_fail2ban_enabled:
+
+# List of fail2ban jails for the controller node.
+#controller_fail2ban_jail_configuration:
+
+# List of default fail2ban jails for the controller node.
+#controller_fail2ban_jail_configuration_default:
+
+# List of extra fail2ban jails for the controller node.
+#controller_fail2ban_jail_configuration_extra:
+
 ###############################################################################
 # Controller node swap configuration.
 

etc/kayobe/dnf.yml

@@ -47,6 +47,13 @@
 # systems only. Default value is 'false'.
 #dnf_install_epel:
 
+# Override the state of repositories. Expected to be used with repositories not
+# managed by dnf_custom_repos. For example:
+# dnf_repo_state_overrides:
+#   crb: enabled
+# Default value is {}.
+#dnf_repo_state_overrides:
+
 ###############################################################################
 # DNF Automatic configuration.
 

etc/kayobe/globals.yml

@@ -48,6 +48,14 @@
 # is "rocky".
 #os_distribution:
 
+# Mapping from OS distribution name to OS family. Supported keys are
+# "centos", "rocky", and "ubuntu".
+#os_family_map:
+
+# OS family. Valid options are "RedHat" and "Debian". Default depends on
+# os_distribution.
+#os_family:
+
 # OS release. Valid options are "10-stream" when os_distribution is "centos",
 # "10" when os_distribution is "rocky", or "noble" when os_distribution is
 # "ubuntu".
@@ -56,6 +64,10 @@
 ###############################################################################
 # Ansible configuration.
 
+# String used as the header comment in files managed by Kayobe. Default is
+# "Ansible managed".
+#kayobe_managed:
+
 # Filter to apply to the setup module when gathering facts. Default is to not
 # specify a filter.
 #kayobe_ansible_setup_filter:
@@ -73,6 +85,13 @@
 # user would not normally have permission to create. Default is true.
 #kayobe_control_host_become:
 
+###############################################################################
+# Networking configuration.
+
+# Network configuration engine. Valid options are "default" and "nmstate".
+# Default is "default".
+#network_engine: default
+
 ###############################################################################
 # Dummy variable to allow Ansible to accept this file.
 workaround_ansible_issue_8743: yes

etc/kayobe/infra-vms.yml

@@ -167,6 +167,23 @@
 # singleplatform-eng.users role.
 #infra_vm_users:
 
+###############################################################################
+# Infrastructure VM node additional containers configuration
+
+# Dict of containers to deploy.
+# Example:
+# infra_vm_containers:
+#   squid:
+#     image: "stackhpc/squid:3.5.20-1"
+#     pre: "{{ kayobe_env_config_path }}/containers/squid/pre.yml"
+#     post: "{{ kayobe_env_config_path }}/containers/squid/post.yml"
+#
+#infra_vm_containers:
+
+# Whether to attempt a basic authentication login to a registry when
+# deploying controller containers
+#infra_vm_manage_containers_registry_attempt_login:
+
 ###############################################################################
 # Infrastructure VM node firewalld configuration.
 
@@ -188,6 +205,21 @@
 # - state: enabled
 #infra_vm_firewalld_rules:
 
+###############################################################################
+# Infrastructure VM node fail2ban configuration.
+
+# Whether to install and enable fail2ban.
+#infra_vm_fail2ban_enabled:
+
+# List of fail2ban jails for the infrastructure VM node.
+#infra_vm_fail2ban_jail_configuration:
+
+# List of default fail2ban jails for the infrastructure VM node.
+#infra_vm_fail2ban_jail_configuration_default:
+
+# List of extra fail2ban jails for the infrastructure VM node.
+#infra_vm_fail2ban_jail_configuration_extra:
+
 ###############################################################################
 # Infrastructure VM node swap configuration.
 

etc/kayobe/inspector.yml

@@ -66,7 +66,7 @@
 ###############################################################################
 # Ironic inspector introspection rules configuration.
 
-# Ironic inspector option to enable IPMI rules. Set to 'True' by default.
+# Ironic inspector option to enable IPMI rules. Default is true.
 #inspector_rules_ipmi_enabled:
 
 # Ironic inspector IPMI username to set.
@@ -86,7 +86,7 @@
 # Ironic inspector uses IPMI by default enroll the baremetal nodes, however it
 # is possible to use Redfish instead. To do that enable Redfish and make sure
 # all of the necessary variables below have been properly set.
-# Enable inspector Redfish rules. Set to 'False' by default.
+# Enable inspector Redfish rules. Default is false.
 #inspector_rules_redfish_enabled:
 
 # Ironic inspector Redfish username to set.
@@ -95,9 +95,12 @@
 # Ironic inspector Redfish password to set.
 #inspector_redfish_password:
 
-# Redfish CA setting. Set to 'True' by default
+# Redfish CA setting. Default is true.
 #inspector_rule_var_redfish_verify_ca:
 
+# Log Ironic inspector rules marked sensitive. Default is true.
+#ironic_inspector_sensitive_rule_no_log:
+
 # Ironic inspector rule to set IPMI credentials.
 #inspector_rule_ipmi_credentials:
 

etc/kayobe/inventory/groups

@@ -80,6 +80,7 @@ monitoring
 storage
 compute
 ansible-control
+infra-vms
 
 [docker-registry:children]
 # Hosts in this group will have a Docker Registry deployed. This group should

etc/kayobe/ipa.yml

@@ -7,6 +7,14 @@
 # Whether to build IPA images from source.
 #ipa_build_images:
 
+# Override the OS distribution used to build IPA images. Default is the host
+# distribution.
+#ipa_build_distro:
+
+# Override the OS release used to build IPA images. Default is the host
+# release.
+#ipa_build_release:
+
 # URL of IPA source repository.
 #ipa_build_source_url:
 
@@ -23,10 +31,11 @@
 #ipa_build_dib_host_packages_extra:
 
 # List of default Diskimage Builder (DIB) elements to use when building IPA
-# images. Default is ["centos", "dynamic-login", "enable-serial-console",
-# "ironic-python-agent-ramdisk"] when os_distribution is "rocky", and
-# ["ubuntu", "dynamic-login", "enable-serial-console",
-# "ironic-python-agent-ramdisk"] otherwise.
+# images. Default is ["rocky-container", "dynamic-login",
+# "enable-serial-console", "ironic-python-agent-ramdisk", "baremetal"] when
+# ipa_build_distro is "rocky", and [ipa_build_distro, "dynamic-login",
+# "enable-serial-console", "ironic-python-agent-ramdisk", "baremetal"]
+# otherwise.
 #ipa_build_dib_elements_default:
 
 # List of additional Diskimage Builder (DIB) elements to use when building IPA
@@ -64,7 +73,8 @@
 # ipa_build_dib_git_elements_default and ipa_build_dib_git_elements_extra.
 #ipa_build_dib_git_elements:
 
-# List of DIB packages to install. Default is empty list.
+# List of DIB packages to install. Default is ["python3-yaml"] when
+# when ipa_build_distro is "rocky", otherwise [].
 #ipa_build_dib_packages:
 
 # Upper constraints file for installing packages in the virtual environment