Release 2025.2.2 rc

base-helm-configs/barbican/barbican-helm-overrides.yaml

@@ -33,7 +33,7 @@ conf:
       connection_recycle_time: 600
       connection_trace: true
       idle_timeout: 3600
-      mysql_sql_mode: ""
+      mysql_sql_mode: {}
       use_db_reconnect: true
       pool_timeout: 60
       max_retries: -1

base-helm-configs/ceilometer/ceilometer-helm-overrides.yaml

@@ -44,7 +44,7 @@ conf:
       connection_recycle_time: 600
       connection_trace: true
       idle_timeout: 3600
-      mysql_sql_mode: ""
+      mysql_sql_mode: {}
       use_db_reconnect: true
       pool_timeout: 60
       max_retries: -1

base-helm-configs/cinder/cinder-helm-overrides.yaml

@@ -93,7 +93,7 @@ conf:
       connection_recycle_time: 600
       connection_trace: true
       idle_timeout: 3600
-      mysql_sql_mode: ""
+      mysql_sql_mode: {}
       use_db_reconnect: true
       pool_timeout: 60
       max_retries: -1

base-helm-configs/designate/designate-helm-overrides.yaml

@@ -465,7 +465,7 @@ conf:
       connection_recycle_time: 600
       connection_trace: true
       idle_timeout: 3600
-      mysql_sql_mode: ""
+      mysql_sql_mode: {}
       use_db_reconnect: true
       pool_timeout: 60
       max_retries: -1

base-helm-configs/glance/glance-helm-overrides.yaml

@@ -91,7 +91,7 @@ conf:
       connection_recycle_time: 600
       connection_trace: true
       idle_timeout: 3600
-      mysql_sql_mode: ""
+      mysql_sql_mode: {}
       use_db_reconnect: true
       pool_timeout: 60
       max_retries: -1
@@ -116,6 +116,13 @@ conf:
   glance_api_uwsgi:
     uwsgi:
       processes: 4
+  policy:
+    "admin_required": "role:admin or role:glance_admin"
+    "default": "role:admin or role:glance_admin"
+    "context_is_admin": "role:admin or role:glance_admin"
+    "publicize_image": "role:glance_admin"
+    "is_owner": "tenant:%(owner)s"
+    "download_image": "rule:is_owner or rule:context_is_admin"
   logging:
     logger_root:
       level: INFO

base-helm-configs/heat/heat-helm-overrides.yaml

@@ -31,7 +31,7 @@ conf:
       connection_recycle_time: 600
       connection_trace: true
       idle_timeout: 3600
-      mysql_sql_mode: ""
+      mysql_sql_mode: {}
       use_db_reconnect: true
       pool_timeout: 60
       max_retries: -1

base-helm-configs/keystone/keystone-helm-overrides.yaml

@@ -42,7 +42,7 @@ conf:
       connection_recycle_time: 600
       connection_trace: true
       idle_timeout: 3600
-      mysql_sql_mode: ""
+      mysql_sql_mode: {}
       use_db_reconnect: true
       pool_timeout: 60
       max_retries: -1

base-helm-configs/magnum/magnum-helm-overrides.yaml

@@ -32,7 +32,7 @@ conf:
       connection_recycle_time: 600
       connection_trace: true
       idle_timeout: 3600
-      mysql_sql_mode: ""
+      mysql_sql_mode: {}
       use_db_reconnect: true
       pool_timeout: 60
       max_retries: -1

base-helm-configs/neutron/neutron-helm-overrides.yaml

@@ -100,7 +100,7 @@ conf:
       connection_recycle_time: 600
       connection_trace: true
       idle_timeout: 3600
-      mysql_sql_mode: ""
+      mysql_sql_mode: {}
       use_db_reconnect: true
       pool_timeout: 60
       max_retries: -1

base-helm-configs/nova/nova-helm-overrides.yaml

@@ -111,7 +111,7 @@ conf:
       connection_recycle_time: 600
       connection_trace: true
       idle_timeout: 3600
-      mysql_sql_mode: ""
+      mysql_sql_mode: {}
       use_db_reconnect: true
       pool_timeout: 60
       max_retries: -1
@@ -120,7 +120,7 @@ conf:
       connection_recycle_time: 600
       connection_trace: true
       idle_timeout: 3600
-      mysql_sql_mode: ""
+      mysql_sql_mode: {}
       use_db_reconnect: true
       pool_timeout: 60
       max_retries: -1
@@ -133,7 +133,7 @@ conf:
       connection_recycle_time: 600
       connection_trace: true
       idle_timeout: 3600
-      mysql_sql_mode: ""
+      mysql_sql_mode: {}
       use_db_reconnect: true
       pool_timeout: 60
       max_retries: -1

base-helm-configs/octavia/octavia-helm-overrides.yaml

@@ -1,23 +1,23 @@
 ---
 images:
   tags:
-    bootstrap: 'quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy'
-    db_drop: 'quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy'
-    db_init: 'quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy'
-    dep_check: 'quay.io/rackspace/rackerlabs-kubernetes-entrypoint:latest-ubuntu_jammy'
-    image_repo_sync: 'quay.io/rackspace/rackerlabs-docker:17.07.0'
-    ks_endpoints: 'quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy'
-    ks_service: 'quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy'
-    ks_user: 'quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy'
-    octavia_api: 'quay.io/rackspace/rackerlabs-octavia-ovn:2024.1-ubuntu_jammy-1737651745'
-    octavia_db_sync: 'quay.io/rackspace/rackerlabs-octavia-ovn:2024.1-ubuntu_jammy-1737651745'
-    octavia_health_manager: 'quay.io/rackspace/rackerlabs-octavia-ovn:2024.1-ubuntu_jammy-1737651745'
-    octavia_health_manager_init: 'quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy'
-    octavia_housekeeping: 'quay.io/rackspace/rackerlabs-octavia-ovn:2024.1-ubuntu_jammy-1737651745'
-    octavia_worker: 'quay.io/rackspace/rackerlabs-octavia-ovn:2024.1-ubuntu_jammy-1737651745'
-    openvswitch_vswitchd: 'docker.io/kolla/centos-source-openvswitch-vswitchd:rocky'
-    rabbit_init: 'quay.io/rackspace/rackerlabs-rabbitmq:3.13-management'
-    test: 'quay.io/rackspace/rackerlabs-xrally-openstack:2.0.0'
+    bootstrap: "quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy"
+    db_drop: "quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy"
+    db_init: "quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy"
+    dep_check: "quay.io/rackspace/rackerlabs-kubernetes-entrypoint:latest-ubuntu_jammy"
+    image_repo_sync: "quay.io/rackspace/rackerlabs-docker:17.07.0"
+    ks_endpoints: "quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy"
+    ks_service: "quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy"
+    ks_user: "quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy"
+    octavia_api: "quay.io/rackspace/rackerlabs-octavia-ovn:2024.1-ubuntu_jammy-1737651745"
+    octavia_db_sync: "quay.io/rackspace/rackerlabs-octavia-ovn:2024.1-ubuntu_jammy-1737651745"
+    octavia_health_manager: "quay.io/rackspace/rackerlabs-octavia-ovn:2024.1-ubuntu_jammy-1737651745"
+    octavia_health_manager_init: "quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy"
+    octavia_housekeeping: "quay.io/rackspace/rackerlabs-octavia-ovn:2024.1-ubuntu_jammy-1737651745"
+    octavia_worker: "quay.io/rackspace/rackerlabs-octavia-ovn:2024.1-ubuntu_jammy-1737651745"
+    openvswitch_vswitchd: "docker.io/kolla/centos-source-openvswitch-vswitchd:rocky"
+    rabbit_init: "quay.io/rackspace/rackerlabs-rabbitmq:3.13-management"
+    test: "quay.io/rackspace/rackerlabs-xrally-openstack:2.0.0"
 
 dependencies:
   static:
@@ -69,7 +69,7 @@ conf:
       connection_recycle_time: 600
       connection_trace: true
       idle_timeout: 3600
-      mysql_sql_mode: ""
+      mysql_sql_mode: {}
       use_db_reconnect: true
       pool_timeout: 60
       max_retries: -1
@@ -90,7 +90,7 @@ conf:
       endpoint_type: internalURL
       valid_interfaces: internal
     nova:
-      enable_anti_affinity: 'True'
+      enable_anti_affinity: "True"
       endpoint_type: internalURL
     oslo_concurrency:
       lock_path: /tmp/octavia
@@ -106,15 +106,15 @@ conf:
       # https://opendev.org/openstack/oslo.messaging/commit/36fb5bceabe08a982ebd52e4a8f005cd26fdf6b8
       heartbeat_rate: 3
       heartbeat_timeout_threshold: 60
-       # NOTE (deprecation warning) heartbeat_in_pthread will be deprecated in 2024.2
+      # NOTE (deprecation warning) heartbeat_in_pthread will be deprecated in 2024.2
       heartbeat_in_pthread: True
       # Setting lower kombu_reconnect_delay should resolve issue with HA failing when one node is down
       # https://lists.openstack.org/pipermail/openstack-discuss/2023-April/033314.html
       # https://review.opendev.org/c/openstack/oslo.messaging/+/866617
       kombu_reconnect_delay: 0.5
     ovn:
-      ovn_nb_connection: 'tcp:127.0.0.1:6641'
-      ovn_sb_connection: 'tcp:127.0.0.1:6642'
+      ovn_nb_connection: "tcp:127.0.0.1:6641"
+      ovn_sb_connection: "tcp:127.0.0.1:6642"
     service_auth:
       insecure: true
   octavia_api_uwsgi:

base-helm-configs/placement/placement-helm-overrides.yaml

@@ -54,7 +54,7 @@ conf:
       connection_recycle_time: 600
       connection_trace: true
       idle_timeout: 3600
-      mysql_sql_mode: ""
+      mysql_sql_mode: {}
       use_db_reconnect: true
       pool_timeout: 60
       max_retries: -1

base-kustomize/kube-ovn/base/kube-ovn-nodeSelector-patch.yaml

@@ -0,0 +1,5 @@
+- op: replace
+  path: "/spec/template/spec/nodeSelector"
+  value:
+    "kubernetes.io/os": "linux"
+    "kube-ovn/role": "master"

base-kustomize/kube-ovn/base/kustomization.yaml

@@ -0,0 +1,12 @@
+sortOptions:
+  order: fifo
+
+resources:
+  - all.yaml
+
+patches:
+  - path: kube-ovn-nodeSelector-patch.yaml
+    target:
+      kind: Deployment
+      name: kube-ovn-controller
+      namespace: kube-system

bin/install-glance.sh

@@ -24,7 +24,6 @@ HELM_CMD+=" --set endpoints.oslo_db.auth.admin.password=\"\$(kubectl --namespace
 HELM_CMD+=" --set endpoints.oslo_db.auth.glance.password=\"\$(kubectl --namespace openstack get secret glance-db-password -o jsonpath='{.data.password}' | base64 -d)\""
 HELM_CMD+=" --set endpoints.oslo_cache.auth.memcache_secret_key=\"\$(kubectl --namespace openstack get secret os-memcached -o jsonpath='{.data.memcache_secret_key}' | base64 -d)\""
 HELM_CMD+=" --set conf.glance.keystone_authtoken.memcache_secret_key=\"\$(kubectl --namespace openstack get secret os-memcached -o jsonpath='{.data.memcache_secret_key}' | base64 -d)\""
-HELM_CMD+=" --set conf.glance.database.slave_connection=\"mysql+pymysql://glance:\$(kubectl --namespace openstack get secret glance-db-password -o jsonpath='{.data.password}' | base64 -d)@mariadb-cluster-secondary.openstack.svc.cluster.local:3306/glance\""
 HELM_CMD+=" --set endpoints.oslo_messaging.auth.admin.password=\"\$(kubectl --namespace openstack get secret rabbitmq-default-user -o jsonpath='{.data.password}' | base64 -d)\""
 HELM_CMD+=" --set endpoints.oslo_messaging.auth.glance.password=\"\$(kubectl --namespace openstack get secret glance-rabbitmq-password -o jsonpath='{.data.password}' | base64 -d)\""
 

bin/install-heat.sh

@@ -26,7 +26,6 @@ HELM_CMD+=" --set endpoints.oslo_db.auth.admin.password=\"\$(kubectl --namespace
 HELM_CMD+=" --set endpoints.oslo_db.auth.heat.password=\"\$(kubectl --namespace openstack get secret heat-db-password -o jsonpath='{.data.password}' | base64 -d)\""
 HELM_CMD+=" --set endpoints.oslo_cache.auth.memcache_secret_key=\"\$(kubectl --namespace openstack get secret os-memcached -o jsonpath='{.data.memcache_secret_key}' | base64 -d)\""
 HELM_CMD+=" --set conf.heat.keystone_authtoken.memcache_secret_key=\"\$(kubectl --namespace openstack get secret os-memcached -o jsonpath='{.data.memcache_secret_key}' | base64 -d)\""
-HELM_CMD+=" --set conf.heat.database.slave_connection=\"mysql+pymysql://heat:\$(kubectl --namespace openstack get secret heat-db-password -o jsonpath='{.data.password}' | base64 -d)@mariadb-cluster-secondary.openstack.svc.cluster.local:3306/heat\""
 HELM_CMD+=" --set endpoints.oslo_messaging.auth.admin.password=\"\$(kubectl --namespace openstack get secret rabbitmq-default-user -o jsonpath='{.data.password}' | base64 -d)\""
 HELM_CMD+=" --set endpoints.oslo_messaging.auth.heat.password=\"\$(kubectl --namespace openstack get secret heat-rabbitmq-password -o jsonpath='{.data.password}' | base64 -d)\""
 

bin/install-keystone.sh

@@ -25,7 +25,6 @@ HELM_CMD+=" --set endpoints.identity.auth.admin.password=\"\$(kubectl --namespac
 HELM_CMD+=" --set endpoints.oslo_db.auth.admin.password=\"\$(kubectl --namespace openstack get secret mariadb -o jsonpath='{.data.root-password}' | base64 -d)\""
 HELM_CMD+=" --set endpoints.oslo_cache.auth.memcache_secret_key=\"\$(kubectl --namespace openstack get secret os-memcached -o jsonpath='{.data.memcache_secret_key}' | base64 -d)\""
 HELM_CMD+=" --set endpoints.oslo_db.auth.keystone.password=\"\$(kubectl --namespace openstack get secret keystone-db-password -o jsonpath='{.data.password}' | base64 -d)\""
-HELM_CMD+=" --set conf.keystone.database.slave_connection=\"mysql+pymysql://keystone:\$(kubectl --namespace openstack get secret keystone-db-password -o jsonpath='{.data.password}' | base64 -d)@mariadb-cluster-secondary.openstack.svc.cluster.local:3306/keystone\""
 HELM_CMD+=" --set endpoints.oslo_messaging.auth.admin.password=\"\$(kubectl --namespace openstack get secret rabbitmq-default-user -o jsonpath='{.data.password}' | base64 -d)\""
 HELM_CMD+=" --set endpoints.oslo_messaging.auth.keystone.password=\"\$(kubectl --namespace openstack get secret keystone-rabbitmq-password -o jsonpath='{.data.password}' | base64 -d)\""
 

bin/install-kube-ovn.sh

@@ -37,6 +37,8 @@ for dir in "$GLOBAL_OVERRIDES_DIR" "$SERVICE_CONFIG_DIR"; do
     fi
 done
 
+HELM_CMD+=" --post-renderer /etc/genestack/kustomize/kustomize.sh"
+HELM_CMD+=" --post-renderer-args kube-ovn/overlay"
 
 HELM_CMD+=" $@"
 

bin/install-neutron.sh

@@ -33,7 +33,6 @@ HELM_CMD+=" --set endpoints.oslo_db.auth.admin.password=\"\$(kubectl --namespace
 HELM_CMD+=" --set endpoints.oslo_db.auth.neutron.password=\"\$(kubectl --namespace openstack get secret neutron-db-password -o jsonpath='{.data.password}' | base64 -d)\""
 HELM_CMD+=" --set endpoints.oslo_cache.auth.memcache_secret_key=\"\$(kubectl --namespace openstack get secret os-memcached -o jsonpath='{.data.memcache_secret_key}' | base64 -d)\""
 HELM_CMD+=" --set conf.neutron.keystone_authtoken.memcache_secret_key=\"\$(kubectl --namespace openstack get secret os-memcached -o jsonpath='{.data.memcache_secret_key}' | base64 -d)\""
-HELM_CMD+=" --set conf.neutron.database.slave_connection=\"mysql+pymysql://neutron:\$(kubectl --namespace openstack get secret neutron-db-password -o jsonpath='{.data.password}' | base64 -d)@mariadb-cluster-secondary.openstack.svc.cluster.local:3306/neutron\""
 HELM_CMD+=" --set endpoints.oslo_messaging.auth.admin.password=\"\$(kubectl --namespace openstack get secret rabbitmq-default-user -o jsonpath='{.data.password}' | base64 -d)\""
 HELM_CMD+=" --set endpoints.oslo_messaging.auth.neutron.password=\"\$(kubectl --namespace openstack get secret neutron-rabbitmq-password -o jsonpath='{.data.password}' | base64 -d)\""
 HELM_CMD+=" --set conf.neutron.ovn.ovn_nb_connection=\"tcp:\$(kubectl --namespace kube-system get service ovn-nb -o jsonpath='{.spec.clusterIP}:{.spec.ports[0].port}')\""

bin/install-nova.sh

@@ -36,9 +36,6 @@ HELM_CMD+=" --set endpoints.oslo_db_cell0.auth.admin.password=\"\$(kubectl --nam
 HELM_CMD+=" --set endpoints.oslo_db_cell0.auth.nova.password=\"\$(kubectl --namespace openstack get secret nova-db-password -o jsonpath='{.data.password}' | base64 -d)\""
 HELM_CMD+=" --set endpoints.oslo_cache.auth.memcache_secret_key=\"\$(kubectl --namespace openstack get secret os-memcached -o jsonpath='{.data.memcache_secret_key}' | base64 -d)\""
 HELM_CMD+=" --set conf.nova.keystone_authtoken.memcache_secret_key=\"\$(kubectl --namespace openstack get secret os-memcached -o jsonpath='{.data.memcache_secret_key}' | base64 -d)\""
-HELM_CMD+=" --set conf.nova.database.slave_connection=\"mysql+pymysql://nova:\$(kubectl --namespace openstack get secret nova-db-password -o jsonpath='{.data.password}' | base64 -d)@mariadb-cluster-secondary.openstack.svc.cluster.local:3306/nova\""
-HELM_CMD+=" --set conf.nova.api_database.slave_connection=\"mysql+pymysql://nova:\$(kubectl --namespace openstack get secret nova-db-password -o jsonpath='{.data.password}' | base64 -d)@mariadb-cluster-secondary.openstack.svc.cluster.local:3306/nova_api\""
-HELM_CMD+=" --set conf.nova.cell0_database.slave_connection=\"mysql+pymysql://nova:\$(kubectl --namespace openstack get secret nova-db-password -o jsonpath='{.data.password}' | base64 -d)@mariadb-cluster-secondary.openstack.svc.cluster.local:3306/nova_cell0\""
 HELM_CMD+=" --set endpoints.oslo_messaging.auth.admin.password=\"\$(kubectl --namespace openstack get secret rabbitmq-default-user -o jsonpath='{.data.password}' | base64 -d)\""
 HELM_CMD+=" --set endpoints.oslo_messaging.auth.nova.password=\"\$(kubectl --namespace openstack get secret nova-rabbitmq-password -o jsonpath='{.data.password}' | base64 -d)\""
 HELM_CMD+=" --set network.ssh.public_key=\"\$(kubectl -n openstack get secret nova-ssh-keypair -o jsonpath='{.data.public_key}' | base64 -d)\"\$'\n'"

bin/install-octavia.sh

@@ -29,7 +29,6 @@ HELM_CMD+=" --set endpoints.oslo_messaging.auth.admin.password=\"\$(kubectl --na
 HELM_CMD+=" --set endpoints.oslo_messaging.auth.octavia.password=\"\$(kubectl --namespace openstack get secret octavia-rabbitmq-password -o jsonpath='{.data.password}' | base64 -d)\""
 HELM_CMD+=" --set endpoints.oslo_cache.auth.memcache_secret_key=\"\$(kubectl --namespace openstack get secret os-memcached -o jsonpath='{.data.memcache_secret_key}' | base64 -d)\""
 HELM_CMD+=" --set conf.octavia.keystone_authtoken.memcache_secret_key=\"\$(kubectl --namespace openstack get secret os-memcached -o jsonpath='{.data.memcache_secret_key}' | base64 -d)\""
-HELM_CMD+=" --set conf.octavia.database.slave_connection=\"mysql+pymysql://octavia:\$(kubectl --namespace openstack get secret octavia-db-password -o jsonpath='{.data.password}' | base64 -d)@mariadb-cluster-secondary.openstack.svc.cluster.local:3306/octavia\""
 HELM_CMD+=" --set conf.octavia.certificates.ca_private_key_passphrase=\"\$(kubectl --namespace openstack get secret octavia-certificates -o jsonpath='{.data.password}' | base64 -d)\""
 HELM_CMD+=" --set conf.octavia.ovn.ovn_nb_connection=\"tcp:\$(kubectl --namespace kube-system get service ovn-nb -o jsonpath='{.spec.clusterIP}:{.spec.ports[0].port}')\""
 HELM_CMD+=" --set conf.octavia.ovn.ovn_sb_connection=\"tcp:\$(kubectl --namespace kube-system get service ovn-sb -o jsonpath='{.spec.clusterIP}:{.spec.ports[0].port}')\""

bin/install-placement.sh

@@ -28,7 +28,6 @@ HELM_CMD+=" --set endpoints.oslo_db.auth.placement.password=\"\$(kubectl --names
 HELM_CMD+=" --set endpoints.oslo_cache.auth.memcache_secret_key=\"\$(kubectl --namespace openstack get secret os-memcached -o jsonpath='{.data.memcache_secret_key}' | base64 -d)\""
 HELM_CMD+=" --set endpoints.oslo_db.auth.nova_api.password=\"\$(kubectl --namespace openstack get secret nova-db-password -o jsonpath='{.data.password}' | base64 -d)\""
 HELM_CMD+=" --set conf.placement.keystone_authtoken.memcache_secret_key=\"\$(kubectl --namespace openstack get secret os-memcached -o jsonpath='{.data.memcache_secret_key}' | base64 -d)\""
-HELM_CMD+=" --set conf.placement.placement_database.slave_connection=\"mysql+pymysql://placement:\$(kubectl --namespace openstack get secret placement-db-password -o jsonpath='{.data.password}' | base64 -d)@mariadb-cluster-secondary.openstack.svc.cluster.local:3306/placement\""
 
 HELM_CMD+=" --post-renderer /etc/genestack/kustomize/kustomize.sh"
 HELM_CMD+=" --post-renderer-args placement/overlay"

bootstrap.sh

@@ -32,7 +32,7 @@ apt update
 DEBIAN_FRONTEND=noninteractive \
   apt-get -o "Dpkg::Options::=--force-confdef" \
           -o "Dpkg::Options::=--force-confold" \
-          -qy install make git python3-pip python3-venv jq make > ~/genestack-base-package-install.log 2>&1
+          -qy install git python3-pip python3-venv python3-dev jq build-essential > ~/genestack-base-package-install.log 2>&1
 
 if [ $? -gt 1 ]; then
   error "Check for ansible errors at ~/genestack-base-package-install.log"