[ideaship]

The README called these files "defaults only" and named the
operator's inventory, host_vars and extra-vars as the only layer
overriding them. That is no longer the whole picture: the runner
images (kolla-ansible, ceph-ansible, osism-ansible,
osism-kubernetes) also deliver release-specific values into the
inventory, as group_vars/all/100-versions-.yml. Those files
sort after every file in this repo, so they override it too.
osism-ansible now delivers the image tags of OSISM's own services
this way (https://github.com/osism/container-image-osism-ansible),
so a maintainer default here can no longer be assumed to be the
value that actually deploys.

Document the resulting precedence: maintainer defaults here, beaten
by the transported release values, beaten in turn by the operator.
Spell out where the operator's override reliably wins: the
documented environments//images.yml (and the other
environments//.yml extra-vars files), and inventory
group_vars/ or host_vars, which sit outside group_vars/all
and so win regardless of file name. A file the operator drops
directly into group_vars/all is not reliable the same way: it beats
the release only if its name sorts after
100-versions-osism-kubernetes.yml, the last runner file (a name
starting with a letter does); a numeric prefix such as 050-.yml
loses to the release, the same as this repo's own files. A flat
group_vars/all.yml is moved to group_vars/all/999-all.yml and wins.

State the rule that follows: a tag set in this repo loses to a
transported release value, so a version value here is either an
explicit exception for a key the release does not transport, or a
fallback for a track on which no runner transports it, as
ceph_image_version is for the latest track. List the stated
role-managed exceptions: kepler, httpd and httpd_data, homer and
nexus, and the zuul CI stack.

List what each runner's versions.yml carries, including the Ceph pins
that osism-ansible delivers in numbered releases (ceph_image_version
and cephclient_version, selected by ceph_version). Note that the
osism/release drift detector reads ceph-ansible and osism-kubernetes
only for their playbooks, so a value that only their versions.yml
transports is outside its coverage. Correct the 002-images-ceph.yml
entry: ceph_image_version is no longer only supplied externally, since
it defaults to ceph_version here and release pins override it.

Documentation only; no deployed value changes.

Part of:

• Release pins for services deployed by osism-ansible have no effect issues#1457

🤖 Generated with Claude Code