Update AIO workflow for 2026.1

Bump experimental 2026.1 Kayobe

Add workaround for LP#2160235

K-A bug LP#2160235 is causing service upgrade to fail.
Working around by pulling container images in advance.
See [1].

[1] https://bugs.launchpad.net/kolla-ansible/+bug/2160235

Update replacing variable name

K-A patch [1] introduced a new variable ``docker_image_url`` to avoid
repeating ``docker_image_name_prefix`` variable.

Updating kolla-images.py accordingly.

[1] https://review.opendev.org/c/openstack/kolla-ansible/+/951747

Remove conditional playbook path

Using different playbook path was only needed between 2024.1 and 2025.1
release.
Removing as it's now breaking the upgrade path from 2025.1 to 2026.1.

Prevent auditd halting machine on disk full

and updating CIS auditd variables.
Unlike RHEL9 CIS, RHEL10 and Ubuntu24 variables for auditd are not dict
formatted.
Updated them to comply the pinned version of each CIS roles.

Removed ``rhel10cis_auditd_max_log_file`` as it's no longer used by the
collection.

Revert "Omit AIO CI on 2026.1 branch"

This reverts commit efe5cca.

Author: seunghun1ee

.github/workflows/stackhpc-all-in-one.yml

@@ -285,7 +285,7 @@ jobs:
             -v $(pwd):/stack/kayobe-automation-env/src/kayobe-config \
             -e KAYOBE_ENVIRONMENT -e KAYOBE_VAULT_PASSWORD -e KAYOBE_AUTOMATION_SSH_PRIVATE_KEY \
             ${{ steps.kayobe_image.outputs.kayobe_image }} \
-            /stack/kayobe-automation-env/src/kayobe-config/.automation/pipeline/playbook-run.sh etc/kayobe/ansible${{ inputs.upgrade && '/' || '/fixes/' }}fix-hostname.yml
+            /stack/kayobe-automation-env/src/kayobe-config/.automation/pipeline/playbook-run.sh etc/kayobe/ansible/fixes/fix-hostname.yml
         env:
           KAYOBE_AUTOMATION_SSH_PRIVATE_KEY: ${{ steps.ssh_key.outputs.ssh_key }}
 
@@ -296,7 +296,7 @@ jobs:
             -v $(pwd):/stack/kayobe-automation-env/src/kayobe-config \
             -e KAYOBE_ENVIRONMENT -e KAYOBE_VAULT_PASSWORD -e KAYOBE_AUTOMATION_SSH_PRIVATE_KEY \
             ${{ steps.kayobe_image.outputs.kayobe_image }} \
-            /stack/kayobe-automation-env/src/kayobe-config/.automation/pipeline/playbook-run.sh etc/kayobe/ansible${{ inputs.upgrade && '/' || '/maintenance/' }}reboot.yml -e reboot_with_bootstrap_user=true
+            /stack/kayobe-automation-env/src/kayobe-config/.automation/pipeline/playbook-run.sh etc/kayobe/ansible/maintenance/reboot.yml -e reboot_with_bootstrap_user=true
         env:
           KAYOBE_AUTOMATION_SSH_PRIVATE_KEY: ${{ steps.ssh_key.outputs.ssh_key }}
 
@@ -306,7 +306,7 @@ jobs:
             -v $(pwd):/stack/kayobe-automation-env/src/kayobe-config \
             -e KAYOBE_ENVIRONMENT -e KAYOBE_VAULT_PASSWORD -e KAYOBE_AUTOMATION_SSH_PRIVATE_KEY \
             ${{ steps.kayobe_image.outputs.kayobe_image }} \
-            /stack/kayobe-automation-env/src/kayobe-config/.automation/pipeline/playbook-run.sh '$KAYOBE_CONFIG_PATH/ansible${{ inputs.upgrade && '/' || '/tools/' }}growroot.yml'
+            /stack/kayobe-automation-env/src/kayobe-config/.automation/pipeline/playbook-run.sh '$KAYOBE_CONFIG_PATH/ansible/tools/growroot.yml'
         env:
           KAYOBE_AUTOMATION_SSH_PRIVATE_KEY: ${{ steps.ssh_key.outputs.ssh_key }}
 
@@ -356,7 +356,7 @@ jobs:
             -v $(pwd):/stack/kayobe-automation-env/src/kayobe-config \
             -e KAYOBE_ENVIRONMENT -e KAYOBE_VAULT_PASSWORD -e KAYOBE_AUTOMATION_SSH_PRIVATE_KEY \
             ${{ steps.kayobe_image.outputs.kayobe_image }} \
-            /stack/kayobe-automation-env/src/kayobe-config/.automation/pipeline/playbook-run.sh etc/kayobe/ansible${{ inputs.upgrade && '/' || '/tools/' }}configure-aio-resources.yml
+            /stack/kayobe-automation-env/src/kayobe-config/.automation/pipeline/playbook-run.sh etc/kayobe/ansible/tools/configure-aio-resources.yml
         env:
           KAYOBE_AUTOMATION_SSH_PRIVATE_KEY: ${{ steps.ssh_key.outputs.ssh_key }}
 
@@ -437,6 +437,20 @@ jobs:
           KAYOBE_AUTOMATION_SSH_PRIVATE_KEY: ${{ steps.ssh_key.outputs.ssh_key }}
         if: inputs.upgrade
 
+      # NOTE(seunghun1ee): LP#2160235 causes service-check-containers role to fail on upgrade
+      # This role runs on every role of services, so we need to workaround by pulling images
+      # before running service upgrade
+      - name: Pull overcloud container images
+        run: |
+          docker run -t --rm \
+            -v $(pwd):/stack/kayobe-automation-env/src/kayobe-config \
+            -e KAYOBE_ENVIRONMENT -e KAYOBE_VAULT_PASSWORD -e KAYOBE_AUTOMATION_SSH_PRIVATE_KEY \
+            $KAYOBE_IMAGE \
+            /stack/kayobe-automation-env/src/kayobe-config/.automation/pipeline/overcloud-container-image-pull.sh
+        env:
+          KAYOBE_AUTOMATION_SSH_PRIVATE_KEY: ${{ steps.ssh_key.outputs.ssh_key }}
+        if: inputs.upgrade
+
       - name: Service upgrade
         run: |
           docker run -t --rm \

.github/workflows/stackhpc-pull-request.yml

@@ -158,153 +158,153 @@ jobs:
     secrets: inherit
     if: ${{ ! failure() && ! cancelled() && github.repository == 'stackhpc/stackhpc-kayobe-config' }}
 
-  # all-in-one-ubuntu-noble-ovn:
-  #   name: aio (Ubuntu Noble OVN)
-  #   permissions: {}
-  #   needs:
-  #     - check-changes
-  #     - build-kayobe-image
-  #   uses: ./.github/workflows/stackhpc-all-in-one.yml
-  #   with:
-  #     kayobe_image: ${{ needs.build-kayobe-image.outputs.kayobe_image }}
-  #     os_distribution: ubuntu
-  #     os_release: noble
-  #     ssh_username: ubuntu
-  #     neutron_plugin: ovn
-  #     OS_CLOUD: openstack
-  #     if: ${{ needs.check-changes.outputs.aio == 'true' }}
-  #   secrets: inherit
-  #   if: ${{ ! failure() && ! cancelled() && github.repository == 'stackhpc/stackhpc-kayobe-config' }}
+  all-in-one-ubuntu-noble-ovn:
+    name: aio (Ubuntu Noble OVN)
+    permissions: {}
+    needs:
+      - check-changes
+      - build-kayobe-image
+    uses: ./.github/workflows/stackhpc-all-in-one.yml
+    with:
+      kayobe_image: ${{ needs.build-kayobe-image.outputs.kayobe_image }}
+      os_distribution: ubuntu
+      os_release: noble
+      ssh_username: ubuntu
+      neutron_plugin: ovn
+      OS_CLOUD: openstack
+      if: ${{ needs.check-changes.outputs.aio == 'true' }}
+    secrets: inherit
+    if: ${{ ! failure() && ! cancelled() && github.repository == 'stackhpc/stackhpc-kayobe-config' }}
 
-  # all-in-one-rocky-10-ovs:
-  #   name: aio (Rocky 10 OVS)
-  #   permissions: {}
-  #   needs:
-  #     - check-changes
-  #     - build-kayobe-image
-  #   uses: ./.github/workflows/stackhpc-all-in-one.yml
-  #   with:
-  #     kayobe_image: ${{ needs.build-kayobe-image.outputs.kayobe_image }}
-  #     os_distribution: rocky
-  #     os_release: "10"
-  #     ssh_username: cloud-user
-  #     neutron_plugin: ovs
-  #     OS_CLOUD: openstack
-  #     if: ${{ needs.check-changes.outputs.aio == 'true' }}
-  #   secrets: inherit
-  #   if: ${{ ! failure() && ! cancelled() && github.repository == 'stackhpc/stackhpc-kayobe-config' }}
+  all-in-one-rocky-10-ovs:
+    name: aio (Rocky 10 OVS)
+    permissions: {}
+    needs:
+      - check-changes
+      - build-kayobe-image
+    uses: ./.github/workflows/stackhpc-all-in-one.yml
+    with:
+      kayobe_image: ${{ needs.build-kayobe-image.outputs.kayobe_image }}
+      os_distribution: rocky
+      os_release: "10"
+      ssh_username: cloud-user
+      neutron_plugin: ovs
+      OS_CLOUD: openstack
+      if: ${{ needs.check-changes.outputs.aio == 'true' }}
+    secrets: inherit
+    if: ${{ ! failure() && ! cancelled() && github.repository == 'stackhpc/stackhpc-kayobe-config' }}
 
-  # all-in-one-rocky-10-aarch64-ovs:
-  #   name: aio (Rocky 10 aarch64 OVS)
-  #   permissions: {}
-  #   needs:
-  #     - check-changes
-  #     - build-kayobe-image
-  #   uses: ./.github/workflows/stackhpc-all-in-one.yml
-  #   with:
-  #     kayobe_image: ${{ needs.build-kayobe-image.outputs.kayobe_image }}
-  #     architecture: aarch64
-  #     os_distribution: rocky
-  #     os_release: "10"
-  #     ssh_username: cloud-user
-  #     neutron_plugin: ovs
-  #     OS_CLOUD: openstack
-  #     if: ${{ needs.check-changes.outputs.aio == 'true' }}
-  #   secrets: inherit
-  #   if: ${{ ! failure() && ! cancelled() && github.repository == 'stackhpc/stackhpc-kayobe-config' }}
+  all-in-one-rocky-10-aarch64-ovs:
+    name: aio (Rocky 10 aarch64 OVS)
+    permissions: {}
+    needs:
+      - check-changes
+      - build-kayobe-image
+    uses: ./.github/workflows/stackhpc-all-in-one.yml
+    with:
+      kayobe_image: ${{ needs.build-kayobe-image.outputs.kayobe_image }}
+      architecture: aarch64
+      os_distribution: rocky
+      os_release: "10"
+      ssh_username: cloud-user
+      neutron_plugin: ovs
+      OS_CLOUD: openstack
+      if: ${{ needs.check-changes.outputs.aio == 'true' }}
+    secrets: inherit
+    if: ${{ ! failure() && ! cancelled() && github.repository == 'stackhpc/stackhpc-kayobe-config' }}
 
-  # all-in-one-rocky-10-ovn:
-  #   name: aio (Rocky 10 OVN)
-  #   permissions: {}
-  #   needs:
-  #     - check-changes
-  #     - build-kayobe-image
-  #   uses: ./.github/workflows/stackhpc-all-in-one.yml
-  #   with:
-  #     kayobe_image: ${{ needs.build-kayobe-image.outputs.kayobe_image }}
-  #     os_distribution: rocky
-  #     os_release: "10"
-  #     ssh_username: cloud-user
-  #     neutron_plugin: ovn
-  #     OS_CLOUD: openstack
-  #     if: ${{ needs.check-changes.outputs.aio == 'true' }}
-  #   secrets: inherit
-  #   if: ${{ ! failure() && ! cancelled() && github.repository == 'stackhpc/stackhpc-kayobe-config' }}
+  all-in-one-rocky-10-ovn:
+    name: aio (Rocky 10 OVN)
+    permissions: {}
+    needs:
+      - check-changes
+      - build-kayobe-image
+    uses: ./.github/workflows/stackhpc-all-in-one.yml
+    with:
+      kayobe_image: ${{ needs.build-kayobe-image.outputs.kayobe_image }}
+      os_distribution: rocky
+      os_release: "10"
+      ssh_username: cloud-user
+      neutron_plugin: ovn
+      OS_CLOUD: openstack
+      if: ${{ needs.check-changes.outputs.aio == 'true' }}
+    secrets: inherit
+    if: ${{ ! failure() && ! cancelled() && github.repository == 'stackhpc/stackhpc-kayobe-config' }}
 
-  # all-in-one-rocky-10-aarch64-ovn:
-  #   name: aio (Rocky 10 aarch64 OVN)
-  #   permissions: {}
-  #   needs:
-  #     - check-changes
-  #     - build-kayobe-image
-  #   uses: ./.github/workflows/stackhpc-all-in-one.yml
-  #   with:
-  #     kayobe_image: ${{ needs.build-kayobe-image.outputs.kayobe_image }}
-  #     architecture: aarch64
-  #     os_distribution: rocky
-  #     os_release: "10"
-  #     ssh_username: cloud-user
-  #     neutron_plugin: ovn
-  #     OS_CLOUD: openstack
-  #     if: ${{ needs.check-changes.outputs.aio == 'true' }}
-  #   secrets: inherit
-  #   if: ${{ ! failure() && ! cancelled() && github.repository == 'stackhpc/stackhpc-kayobe-config' }}
+  all-in-one-rocky-10-aarch64-ovn:
+    name: aio (Rocky 10 aarch64 OVN)
+    permissions: {}
+    needs:
+      - check-changes
+      - build-kayobe-image
+    uses: ./.github/workflows/stackhpc-all-in-one.yml
+    with:
+      kayobe_image: ${{ needs.build-kayobe-image.outputs.kayobe_image }}
+      architecture: aarch64
+      os_distribution: rocky
+      os_release: "10"
+      ssh_username: cloud-user
+      neutron_plugin: ovn
+      OS_CLOUD: openstack
+      if: ${{ needs.check-changes.outputs.aio == 'true' }}
+    secrets: inherit
+    if: ${{ ! failure() && ! cancelled() && github.repository == 'stackhpc/stackhpc-kayobe-config' }}
 
-  # # Test three upgrade scenarios: Ubuntu Noble OVN, Rocky 10 OVN, and Rocky 10 OVS.
+  # Test three upgrade scenarios: Ubuntu Noble OVN, Rocky 10 OVN, and Rocky 10 OVS.
 
-  # all-in-one-upgrade-ubuntu-noble-ovn:
-  #   name: aio upgrade (Ubuntu Noble OVN)
-  #   permissions: {}
-  #   needs:
-  #     - check-changes
-  #     - build-kayobe-image
-  #   uses: ./.github/workflows/stackhpc-all-in-one.yml
-  #   with:
-  #     kayobe_image: ${{ needs.build-kayobe-image.outputs.kayobe_image }}
-  #     os_distribution: ubuntu
-  #     os_release: noble
-  #     ssh_username: ubuntu
-  #     neutron_plugin: ovn
-  #     OS_CLOUD: openstack
-  #     if: ${{ needs.check-changes.outputs.aio == 'true' }}
-  #     upgrade: true
-  #   secrets: inherit
-  #   if: ${{ ! failure() && ! cancelled() && github.repository == 'stackhpc/stackhpc-kayobe-config' }}
+  all-in-one-upgrade-ubuntu-noble-ovn:
+    name: aio upgrade (Ubuntu Noble OVN)
+    permissions: {}
+    needs:
+      - check-changes
+      - build-kayobe-image
+    uses: ./.github/workflows/stackhpc-all-in-one.yml
+    with:
+      kayobe_image: ${{ needs.build-kayobe-image.outputs.kayobe_image }}
+      os_distribution: ubuntu
+      os_release: noble
+      ssh_username: ubuntu
+      neutron_plugin: ovn
+      OS_CLOUD: openstack
+      if: ${{ needs.check-changes.outputs.aio == 'true' }}
+      upgrade: true
+    secrets: inherit
+    if: ${{ ! failure() && ! cancelled() && github.repository == 'stackhpc/stackhpc-kayobe-config' }}
 
-  # all-in-one-upgrade-rocky-10-ovn:
-  #   name: aio upgrade (Rocky 10 OVN)
-  #   permissions: {}
-  #   needs:
-  #     - check-changes
-  #     - build-kayobe-image
-  #   uses: ./.github/workflows/stackhpc-all-in-one.yml
-  #   with:
-  #     kayobe_image: ${{ needs.build-kayobe-image.outputs.kayobe_image }}
-  #     os_distribution: rocky
-  #     os_release: "10"
-  #     ssh_username: cloud-user
-  #     neutron_plugin: ovn
-  #     OS_CLOUD: openstack
-  #     if: ${{ needs.check-changes.outputs.aio == 'true' }}
-  #     upgrade: true
-  #   secrets: inherit
-  #   if: ${{ ! failure() && ! cancelled() && github.repository == 'stackhpc/stackhpc-kayobe-config' }}
+  all-in-one-upgrade-rocky-10-ovn:
+    name: aio upgrade (Rocky 10 OVN)
+    permissions: {}
+    needs:
+      - check-changes
+      - build-kayobe-image
+    uses: ./.github/workflows/stackhpc-all-in-one.yml
+    with:
+      kayobe_image: ${{ needs.build-kayobe-image.outputs.kayobe_image }}
+      os_distribution: rocky
+      os_release: "10"
+      ssh_username: cloud-user
+      neutron_plugin: ovn
+      OS_CLOUD: openstack
+      if: ${{ needs.check-changes.outputs.aio == 'true' }}
+      upgrade: true
+    secrets: inherit
+    if: ${{ ! failure() && ! cancelled() && github.repository == 'stackhpc/stackhpc-kayobe-config' }}
 
-  # all-in-one-upgrade-rocky-10-ovs:
-  #   name: aio upgrade (Rocky 10 OVS)
-  #   permissions: {}
-  #   needs:
-  #     - check-changes
-  #     - build-kayobe-image
-  #   uses: ./.github/workflows/stackhpc-all-in-one.yml
-  #   with:
-  #     kayobe_image: ${{ needs.build-kayobe-image.outputs.kayobe_image }}
-  #     os_distribution: rocky
-  #     os_release: "10"
-  #     ssh_username: cloud-user
-  #     neutron_plugin: ovs
-  #     OS_CLOUD: openstack
-  #     if: ${{ needs.check-changes.outputs.aio == 'true' }}
-  #     upgrade: true
-  #   secrets: inherit
-  #   if: ${{ ! failure() && ! cancelled() && github.repository == 'stackhpc/stackhpc-kayobe-config' }}
+  all-in-one-upgrade-rocky-10-ovs:
+    name: aio upgrade (Rocky 10 OVS)
+    permissions: {}
+    needs:
+      - check-changes
+      - build-kayobe-image
+    uses: ./.github/workflows/stackhpc-all-in-one.yml
+    with:
+      kayobe_image: ${{ needs.build-kayobe-image.outputs.kayobe_image }}
+      os_distribution: rocky
+      os_release: "10"
+      ssh_username: cloud-user
+      neutron_plugin: ovs
+      OS_CLOUD: openstack
+      if: ${{ needs.check-changes.outputs.aio == 'true' }}
+      upgrade: true
+    secrets: inherit
+    if: ${{ ! failure() && ! cancelled() && github.repository == 'stackhpc/stackhpc-kayobe-config' }}

etc/kayobe/inventory/group_vars/cis-hardening/cis

@@ -81,12 +81,11 @@ rhel9cis_rule_5_6_1_1: false
 # Rocky 10 CIS Hardening Configuration
 
 # Configure log rotation to prevent audit logs from filling the disk
-rhel10cis_auditd_action_mail_acct: root
 rhel10cis_auditd_admin_space_left_action: syslog
 rhel10cis_auditd_max_log_file_action: rotate
 rhel10cis_auditd_max_log_file_size: 1024
-rhel10cis_auditd_max_log_file: 10
 rhel10cis_auditd_space_left_action: syslog
+rhel10cis_auditd_disk_full_action: syslog
 
 # Set an authselect profile name (required)
 rhel10cis_authselect_custom_profile_name: "stack"
@@ -236,11 +235,10 @@ ubtu24cis_no_world_write_adjust: false
 ubtu24cis_suid_sgid_adjust: false
 
 # Configure log rotation to prevent audit logs from filling the disk
-ubtu24cis_auditd:
-  action_mail_acct: root
-  space_left_action: syslog
-  admin_space_left_action: syslog
-  max_log_file_action: rotate
+ubtu24cis_auditd_space_left_action: syslog
+ubtu24cis_auditd_admin_space_left_action: syslog
+ubtu24cis_auditd_max_log_file_action: rotate
+ubtu24cis_auditd_disk_full_action: syslog
 
 # Max size of audit logs (MB)
 ubtu24cis_max_log_file_size: 1024

requirements.txt

@@ -1,4 +1,4 @@
-kayobe@git+https://github.com/stackhpc/kayobe@stackhpc/20.0.0.5
+kayobe@git+https://github.com/stackhpc/kayobe@7862ee3f5a859970a2b810a0388019950e9d48b0
 ansible-modules-hashivault>=5.3.0
 pulp-glue==0.33.*
 pulp-glue-deb==0.3.*

tools/kolla-images.py

@@ -315,7 +315,7 @@ def check_image_map(kolla_ansible_path: str):
     image_map = yaml.safe_load(image_map_str)
     image_var_re = re.compile(r"^([a-z0-9_]+)_image$")
     image_map = {
-        image_var_re.match(image_var).group(1): image.split("/")[-1].replace('{{ docker_image_name_prefix }}', '')
+        image_var_re.match(image_var).group(1): image.split("/")[-1].replace('{{ docker_image_url }}', '')
         for image_var, image in image_map.items()
     }
     # Filter out unsupported images.