2026.1 aio upgrade - #2454
Merged
Merged
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Member
Author
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
etc/kayobe/kolla.yml (1)
210-218: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winFix the stale third-party repo vars in
etc/kayobe/kolla.yml:213-216
stackhpc_repo_rhel_10_mariadb_10_11_urlshould bestackhpc_repo_rhel_10_mariadb_11_4_url.stackhpc_repo_rhel_9_influxdb_urlis undefined here, so this entry needs to be removed or restored.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@etc/kayobe/kolla.yml` around lines 210 - 218, Update the repository entries in the Kolla repository configuration: replace stackhpc_repo_rhel_10_mariadb_10_11_url with stackhpc_repo_rhel_10_mariadb_11_4_url, and remove the influxdb.repo entry referencing undefined stackhpc_repo_rhel_9_influxdb_url unless its valid variable is restored.
🧹 Nitpick comments (2)
tools/multiarch-manifests.sh (1)
22-33: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueOptional: use a bash array for
arch_images(SC2086).Word-splitting on
$arch_imagesis intentional here, so quoting isn't the fix. An array makes the intent explicit and robust while satisfying Shellcheck.♻️ Array-based accumulation
- arch_images="" + arch_images=() for arch in amd64 aarch64; do arch_image="${base_image}-${arch}" # Check if the image exists in the registry if docker manifest inspect "$arch_image" > /dev/null 2>&1; then - arch_images="$arch_images $arch_image" + arch_images+=("$arch_image") fi done - if [ -n "$arch_images" ]; then - echo "Creating manifest for $base_image with images:$arch_images" | tee -a logs/manifest-creation.log - docker buildx imagetools create -t "$base_image" $arch_images | tee -a logs/manifest-creation.log + if [ "${`#arch_images`[@]}" -gt 0 ]; then + echo "Creating manifest for $base_image with images: ${arch_images[*]}" | tee -a logs/manifest-creation.log + docker buildx imagetools create -t "$base_image" "${arch_images[@]}" | tee -a logs/manifest-creation.log🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tools/multiarch-manifests.sh` around lines 22 - 33, Update the arch_images accumulation and consumption in the manifest creation loop to use a Bash array, appending each arch_image as an element and expanding the array explicitly when calling docker buildx imagetools create. Preserve the existing manifest existence checks, logging, and image ordering.Source: Linters/SAST tools
etc/kayobe/stackhpc.yml (1)
196-202: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueKolla / Kolla-Ansible sources build from moving branches.
stackhpc_kolla_source_version: 2026_1_backportsandstackhpc_kolla_ansible_source_version: stackhpc/2026.1are mutable refs, so image builds aren't reproducible until the FIXMEs are resolved (merge cherry-picks, revert to tag). Tracking these before release avoids drift between builds.Want me to open an issue to track resolving these two FIXMEs before release?
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@etc/kayobe/stackhpc.yml` around lines 196 - 202, Resolve the two FIXME entries for stackhpc_kolla_source_version and stackhpc_kolla_ansible_source_version by merging the required cherry-picks and switching both source versions from moving refs back to their intended immutable release tag. Keep the existing source repository settings unchanged and ensure both Kolla sources use reproducible versions before release.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/stackhpc-build-kayobe-image.yml:
- Line 27: Update the build-argument fallback for base_image to use
rockylinux/rockylinux:10, matching the default declared for inputs.base_image.
Alternatively, remove the duplicate fallback so the workflow consistently uses
the existing Rocky 10 default, including on push triggers.
In `@etc/kayobe/inventory/group_vars/cis-hardening/cis`:
- Around line 84-89: Remove the unsupported rhel10cis_auditd_max_log_file
setting from the CIS auditd configuration, keeping
rhel10cis_auditd_max_log_file_size as the sole key controlling max_log_file.
In `@etc/kayobe/kolla.yml`:
- Line 336: Ensure stackhpc_kolla_build_customizations remains defined as an
empty mapping, or update the lookup that indexes it to apply a default empty
mapping before merging. Preserve the existing template behavior while preventing
undefined-variable failures during rendering.
In `@etc/kayobe/pulp.yml`:
- Around line 566-568: Update the service image configuration represented by
stackhpc_pulp_images_kolla to retain influxdb, or disable kolla_enable_influxdb
in the ci-builder stackhpc-ci.yml configuration. Ensure the enabled InfluxDB
service has a corresponding synced and published image.
In `@etc/kayobe/trivy/allowed-vulnerabilities.yml`:
- Around line 16-33: Review all entries in the allowlists at
etc/kayobe/trivy/allowed-vulnerabilities.yml lines 16-33 and 34-70, retaining
each CVE only for image groups whose vulnerable package is confirmed present;
remove unjustified image-level exceptions, including the cited critical CVEs
where applicable. Add a tracked removal date or ticket to every remaining
exception.
---
Outside diff comments:
In `@etc/kayobe/kolla.yml`:
- Around line 210-218: Update the repository entries in the Kolla repository
configuration: replace stackhpc_repo_rhel_10_mariadb_10_11_url with
stackhpc_repo_rhel_10_mariadb_11_4_url, and remove the influxdb.repo entry
referencing undefined stackhpc_repo_rhel_9_influxdb_url unless its valid
variable is restored.
---
Nitpick comments:
In `@etc/kayobe/stackhpc.yml`:
- Around line 196-202: Resolve the two FIXME entries for
stackhpc_kolla_source_version and stackhpc_kolla_ansible_source_version by
merging the required cherry-picks and switching both source versions from moving
refs back to their intended immutable release tag. Keep the existing source
repository settings unchanged and ensure both Kolla sources use reproducible
versions before release.
In `@tools/multiarch-manifests.sh`:
- Around line 22-33: Update the arch_images accumulation and consumption in the
manifest creation loop to use a Bash array, appending each arch_image as an
element and expanding the array explicitly when calling docker buildx imagetools
create. Preserve the existing manifest existence checks, logging, and image
ordering.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 4ff99423-7ff7-4ec5-b000-e15c67ae4c2b
📒 Files selected for processing (23)
.automation.github/workflows/ipa-image-build.yml.github/workflows/overcloud-host-image-build.yml.github/workflows/overcloud-host-image-promote.yml.github/workflows/overcloud-host-image-upload.yml.github/workflows/stackhpc-all-in-one.yml.github/workflows/stackhpc-build-kayobe-image.yml.github/workflows/stackhpc-container-image-build.ymletc/kayobe/ansible/requirements.ymletc/kayobe/apt.ymletc/kayobe/environments/ci-builder/stackhpc-ci.ymletc/kayobe/inventory/group_vars/cis-hardening/cisetc/kayobe/kolla-image-tags.ymletc/kayobe/kolla.ymletc/kayobe/kolla/kolla-build.confetc/kayobe/kolla/repos.yamletc/kayobe/pulp-repo-versions.ymletc/kayobe/pulp.ymletc/kayobe/stackhpc.ymletc/kayobe/trivy/allowed-vulnerabilities.ymlrequirements.txttools/kolla-images.pytools/multiarch-manifests.sh
seunghun1ee
force-pushed
the
2026.1-aio-upgrade
branch
from
July 27, 2026 08:58
c64b2f4 to
a408a13
Compare
seunghun1ee
force-pushed
the
2026.1-aio-upgrade
branch
from
July 27, 2026 12:34
2f82592 to
9eccb8a
Compare
Bump experimental 2026.1 Kayobe Add workaround for LP#2160235 K-A bug LP#2160235 is causing service upgrade to fail. Working around by pulling container images in advance. See [1]. [1] https://bugs.launchpad.net/kolla-ansible/+bug/2160235 Update replacing variable name K-A patch [2] introduced a new variable ``docker_image_url`` to avoid repeating ``docker_image_name_prefix`` variable. Updating kolla-images.py accordingly. [2] https://review.opendev.org/c/openstack/kolla-ansible/+/951747 Remove conditional playbook path Using different playbook path was only needed between 2024.1 and 2025.1 release. Removing as it's now breaking the upgrade path from 2025.1 to 2026.1. Prevent auditd halting machine on disk full and updating CIS auditd variables. Unlike RHEL9 CIS, RHEL10 and Ubuntu24 variables for auditd are not dict formatted. Updated them to comply the pinned version of each CIS roles. Removed ``rhel10cis_auditd_max_log_file`` as it's no longer used by the collection. Revert "Omit AIO CI on 2026.1 branch" This reverts commit efe5cca.
Update information of kolla images to match 2026.1 K-A Removed rocky-9 from supported base distros. Added httpd image. Removed following images - mariadb-clustercheck - proxysql-3 (2026.1 K-A default proxysql is version 3.0.x) - influxdb - ironic-inspector - letsencrypt-webserver - rabbitmq-4-1 - redis - redis-sentinel Fix stashing step of AIO upgrade No need to restore kolla/globals.yml anymore. Bump stackhpc.pulp collection to 0.6.1 Build missing httpd and valkey container images Added new tag for Ubuntu Noble Valkey image as it was missed on first image build. Tag of 3 services ironic_http, keystone_httpd and letsencrypt_webserver got updated since they all use httpd container image.
Alex-Welsh
approved these changes
Jul 27, 2026
Alex-Welsh
approved these changes
Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Bug Fixes
Chores