From d3df3844c0cce768430e475d88bf394e840c2b1c Mon Sep 17 00:00:00 2001 From: Roger Luethi Date: Thu, 24 Sep 2026 19:40:56 +0200 Subject: [PATCH 1/8] kolla: drop two defaults nothing reads certificates_dir and keystone_token_provider are set in all/099-kolla.yml, but no supported kolla-ansible release reads either of them, and no OSISM repository ever did. certificates_dir was a role default of the upstream certificates role in Stein and Train only (added 9223deeec). Ussuri renamed it to kolla_certificates_dir (b475643c1). OSISM pointed it at /share/certificates in 2020 (container-image-kolla-ansible 087bf88), together with a carried Stein/Train patch; the value was carried into this repository with its initial commit and has been inert since OSISM stopped building Train. keystone_token_provider was read by the upstream keystone role until b3b9dff3c (Zed) replaced every use with a literal fernet, the only valid value since Rocky. OSISM's "fernet" therefore never differed from upstream's behaviour. The CHANGELOG entry for osism/defaults#142 that calls the parameter removed refers to the copy in the former upstream mirror file; this OSISM copy was left behind. Remove both. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Roger Luethi --- all/099-kolla.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/all/099-kolla.yml b/all/099-kolla.yml index e64ae67..4094a75 100644 --- a/all/099-kolla.yml +++ b/all/099-kolla.yml @@ -54,8 +54,6 @@ proxysql_version: 3 network_interface: loopback0 -certificates_dir: /share/certificates - kolla_base_distro: ubuntu kolla_install_type: source @@ -113,7 +111,6 @@ ironic_agent_files_directory: /share/ironic enable_ironic_prometheus_exporter: false # keystone -keystone_token_provider: "fernet" # NOTE: use authorization code in keystone instead of default upstream keystone_federation_oidc_response_type: "code" keystone_federation_oidc_forwarded_headers: "X-Forwarded-Proto" From 5aab454d41337c482b3fe2cf466c8d64a3399e80 Mon Sep 17 00:00:00 2001 From: Roger Luethi Date: Thu, 24 Sep 2026 19:41:04 +0200 Subject: [PATCH 2/8] infrastructure: drop dead helper and client vars Six keys in all/099-infrastructure.yml have had no reader since 2020. They came into this repository with its initial commit, carried over from osism/ansible-playbooks, which had taken them from the testbed and cookiecutter configuration in 2020. configure_adminer, configure_phpmyadmin, configure_rally and configure_sshconfig gated the per-service task includes of the osism/ansible-helper role. That role was split into collection roles and archived in August 2020 (ansible-helper 52a5074); the replacement adminer, phpmyadmin and sshconfig roles have no such switch, and rally was not carried over. The helper playbook has been a stub that fails with "Role has been split up" since ansible-playbooks 892ba8d. cephclient_cluster_fsid was never read in any public history; the cephclient role has no fsid setting. opentstackclient_groupname is misspelled and has been since it first appeared, so it never had an effect. The correct name, openstackclient_groupname, lost its only reader when openstackclient moved out of the helper role in May 2020 (ansible-helper 21c8901). Remove all six, and the helper section header that is left empty. cephclient_groupname stays: the ceph validate playbooks in ansible-playbooks read it. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Roger Luethi --- all/099-infrastructure.yml | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/all/099-infrastructure.yml b/all/099-infrastructure.yml index 35defc3..a74154f 100644 --- a/all/099-infrastructure.yml +++ b/all/099-infrastructure.yml @@ -1,16 +1,7 @@ --- -########################## -# helper - -configure_adminer: false -configure_phpmyadmin: true -configure_rally: false -configure_sshconfig: true - ########################## # cephclient -cephclient_cluster_fsid: "{{ ceph_cluster_fsid | default('') }}" cephclient_groupname: cephclient cephclient_keyring: "{{ lookup('file', '{{ configuration_directory }}/environments/infrastructure/files/ceph/ceph.client.admin.keyring', rstrip=false) | default('', true) }}" cephclient_keyring_name: client.admin @@ -19,7 +10,6 @@ cephclient_keyring_name: client.admin # openstackclient openstackclient_configuration_directory: "{{ configuration_directory }}/environments/openstack" -opentstackclient_groupname: openstackclient ########################## # substation From 79344d849277833834123a5c6fdb3393f06728ac Mon Sep 17 00:00:00 2001 From: Roger Luethi Date: Thu, 24 Sep 2026 19:41:13 +0200 Subject: [PATCH 3/8] ceph: drop defaults no ceph-ansible reads bootstrap_dirs_owner and bootstrap_dirs_group were read only by ceph-ansible's roles/ceph-docker-common/tasks/dirs_permissions.yml. ceph-ansible deleted that file in 2018 (6947f9c3e, in stable-4.0 and later) and dropped the variables from ceph-defaults in 2020 (c644ea904). OSISM set them in 2020 as part of running Ceph under UID 64045 (container-image-ceph-ansible 77282e1), when it still shipped stable-3.2. The ceph-ansible branches OSISM ships now, stable-7.0 to stable-9.0, do not mention them. ceph_uid stays. ceph_share_directory was moved here from the testbed and cookiecutter configuration in 2022 (#90), but no code has ever read it. Consumers of /share either hard-code the path or, for ceph-ansible, use fetch_directory, which is set separately in this file. osd_scenario selected the OSD layout in ceph-ansible until stable-4.0 made lvm the only scenario. stable-7.0 to stable-9.0 mention it only in docs/source/osds/scenarios.rst ("no need to configure osd_scenario anymore"), in a tests/ fixture, and in tox-update.ini, which passes it as --extra-vars to a test playbook. None of that reads this default. Remove all four. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Roger Luethi --- all/099-ceph.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/all/099-ceph.yml b/all/099-ceph.yml index fd457f3..6aa3b5f 100644 --- a/all/099-ceph.yml +++ b/all/099-ceph.yml @@ -2,7 +2,6 @@ ########################## # generic -ceph_share_directory: /share configure_firewall: false containerized_deployment: true dashboard_enabled: false @@ -40,14 +39,11 @@ ceph_min_compat_client_order: # NOTE(berendt): We use an adapted Ceph image in which always the UID 64045 is used ceph_uid: 64045 -bootstrap_dirs_owner: "64045" -bootstrap_dirs_group: "64045" ########################## # osd osd_objectstore: bluestore -osd_scenario: lvm ########################## # group names From d883a391d9be9983c69c6eee810afb666f1aa175 Mon Sep 17 00:00:00 2001 From: Roger Luethi Date: Thu, 24 Sep 2026 19:41:13 +0200 Subject: [PATCH 4/8] k3s: drop cilium_cli cilium_cli was added in #266 to stop k3s-ansible from installing the Cilium CLI, which the osism-kubernetes image already ships. It gated the CLI install tasks in roles/k3s_server_post/tasks/cilium.yml. osism/osism-kubernetes#241 (1063d6d, October 2025) removed those tasks, and the gate with them; the image build installs the CLI instead. Only osism-kubernetes releases between these two changes read the key, i.e. OSISM 9.2.0 to 9.4.0, and those releases pin their own defaults version. Nothing on main reads it, so remove it. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Roger Luethi --- all/099-k3s.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/all/099-k3s.yml b/all/099-k3s.yml index a09d671..e3ff68a 100644 --- a/all/099-k3s.yml +++ b/all/099-k3s.yml @@ -30,7 +30,6 @@ k3s_monitoring_controller_manage_port: "10257" # cilium cilium_mode: "native" -cilium_cli: false cilium_hubble: false cilium_hubble_ui_lb: true # Cilium BGP is opt-in: with cilium_bgp: true the MetalLB pool is not deployed From f2082aca8d2a7579eafac660f9c017ccfa01fe9a Mon Sep 17 00:00:00 2001 From: Roger Luethi Date: Thu, 24 Sep 2026 19:41:42 +0200 Subject: [PATCH 5/8] generic: drop four defaults nothing reads Four keys in all/099-generic.yml have no reader. All came into this repository with its initial commit, carried over from osism/ansible-playbooks. docker_configure_storage_driver switched --storage-driver on the dockerd command line in the old standalone ansible-docker role. That role moved to daemon.json in 2017 and dropped the switch; the osism.services docker role never had it and always writes docker_storage_driver into daemon.json. docker_storage_driver stays. grub_hidden_timeout belonged to the old debops.grub role. debops v1.0 (fd73f3ebdd, 2018) redesigned the role: the hidden timeout is now an entry in grub__original_configuration, and the variable is gone. OSISM has shipped the debops collection since 2020, so the value "false" has not reached GRUB since then. Removing it changes nothing; restoring the intent would need a grub__configuration entry. fluentd_host was the rsyslog role's variable until osism.services #113 (98231886, January 2021) renamed it rsyslog_fluentd_host and kept fluentd_host as an alias (fluentd_host: "{{ rsyslog_fluentd_host }}"). Nothing reads fluentd_host. rsyslog_fluentd_host, which the role's template reads, stays. sysdig_configure_repository was read by the osism.commons sysdig role, which was deleted in January 2024 (ff592b2), along with the generic sysdig play (ansible-playbooks 9821528). Remove all four, and the grub comment left empty. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Roger Luethi --- all/099-generic.yml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/all/099-generic.yml b/all/099-generic.yml index 66ff204..2cb8296 100644 --- a/all/099-generic.yml +++ b/all/099-generic.yml @@ -12,7 +12,6 @@ configuration_directory: /opt/configuration ########################## # docker -docker_configure_storage_driver: true docker_storage_driver: overlay2 docker_compose_install_type: package @@ -23,10 +22,6 @@ docker_compose_install_type: package apt__enabled: false -# grub - -grub_hidden_timeout: false - ########################## # timezone @@ -48,7 +43,6 @@ osism_strategy: linear ########################## # rsyslog -fluentd_host: "{{ rsyslog_fluentd_host }}" rsyslog_fluentd_host: "{{ internal_address }}" ########################## @@ -59,7 +53,6 @@ falco_configure_repository: true lynis_configure_repository: true netdata_configure_repository: true osquery_configure_repository: true -sysdig_configure_repository: true trivy_configure_repository: true zabbix_agent_configure_repository: true From 374bd30c25ecd7e059aaa1696ec37a32856303bb Mon Sep 17 00:00:00 2001 From: Roger Luethi Date: Thu, 24 Sep 2026 19:41:42 +0200 Subject: [PATCH 6/8] interfaces: drop bifrost_network_address_family all/099-interfaces.yml sets bifrost_network_address_family to "{{ network_address_family }}", in the block copied from kolla-ansible's defaults with this repository's initial commit. It is not an OSISM opinion: the value is identical to upstream's, which all/001-bifrost.yml now supplies from the mirror layer. Upstream has never read the variable either. It was added with IPv6 support for the control plane (kolla-ansible bc053c09c, 2019), but no role or template uses it, and the bifrost configuration kolla-ansible renders passes no address family. Removing the 099 copy therefore changes nothing; the 001 definition stays, as that layer mirrors upstream verbatim. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Roger Luethi --- all/099-interfaces.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/all/099-interfaces.yml b/all/099-interfaces.yml index c7d5c97..65390f6 100644 --- a/all/099-interfaces.yml +++ b/all/099-interfaces.yml @@ -19,7 +19,6 @@ tunnel_interface: "{{ network_interface }}" network_address_family: "ipv4" api_address_family: "{{ network_address_family }}" -bifrost_network_address_family: "{{ network_address_family }}" dns_address_family: "{{ network_address_family }}" migration_address_family: "{{ api_address_family }}" octavia_network_address_family: "{{ api_address_family }}" From 2e5b627c245cecd593b4a77423e493ed12e408a0 Mon Sep 17 00:00:00 2001 From: Roger Luethi Date: Fri, 9 Oct 2026 13:40:39 +0200 Subject: [PATCH 7/8] ceph: drop ceph_docker_tag all/002-images-ceph.yml sets ceph_docker_tag to "{{ ceph_image_version }}}", with a stray closing brace. Nothing has ever read it: not ceph-ansible on any branch or tag, not any OSISM repository. The cephadm plays and ceph-ansible read ceph_docker_image_tag, which is set on the line above and stays. The key was defined in container-image-ceph-ansible from its first public commit (604e7ae, 2019-11-05) and moved here with the rest of the image defaults (b9194e2, 2021-05-03). The typo went unnoticed because the value was never rendered. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Roger Luethi --- all/002-images-ceph.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/all/002-images-ceph.yml b/all/002-images-ceph.yml index bf1e6b5..3ef45a0 100644 --- a/all/002-images-ceph.yml +++ b/all/002-images-ceph.yml @@ -8,4 +8,3 @@ ceph_image_version: "{{ ceph_version }}" ceph_docker_image: osism/ceph-daemon ceph_docker_image_tag: "{{ ceph_image_version }}" -ceph_docker_tag: "{{ ceph_image_version }}}" From bb11b53ba9fb44d51a1b5bcfd02829d17b6e43d0 Mon Sep 17 00:00:00 2001 From: Roger Luethi Date: Fri, 9 Oct 2026 11:15:13 +0200 Subject: [PATCH 8/8] Fix the monitoring k3s label variable name osism-kubernetes collects node labels with lookup('community.general.merge_variables', '^k3s_add_labels__.+$') (playbooks/kubernetes-kubernetes-label-nodes.yml). Every group file names its variable k3s_add_labels__, except monitoring, which had k3s_add_labels_monitoring with one underscore. That name does not match the pattern, so monitoring nodes never received node-role.osism.tech/monitoring-plane=true. This has been the case since the labels were added in #229. Rename it to k3s_add_labels__monitoring. Monitoring nodes now get the label. Nothing selects on it yet (osism-kubernetes only uses the control-plane label), so no workload moves. Found by the defaults_orphan drift check (osism/release#2811). Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Roger Luethi --- monitoring/000-defaults.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/monitoring/000-defaults.yml b/monitoring/000-defaults.yml index b09e2d4..a3cc90f 100644 --- a/monitoring/000-defaults.yml +++ b/monitoring/000-defaults.yml @@ -1,3 +1,3 @@ --- -k3s_add_labels_monitoring: +k3s_add_labels__monitoring: - node-role.osism.tech/monitoring-plane=true