From 4e38899d8584c0295b20358fb9011f2cea72f0c2 Mon Sep 17 00:00:00 2001 From: Roger Luethi Date: Sat, 10 Oct 2026 08:38:09 +0200 Subject: [PATCH 1/3] Take the httpd consumers' tags from httpd Three kolla-ansible containers run the httpd image, but none takes its tag from httpd's own version: - keystone_httpd_tag (httpd from 2025.2) followed keystone_tag. - ironic_http_tag (httpd from 2026.1) is not in this catalogue, so the kolla-ansible role default "{{ ironic_tag }}" applied. - letsencrypt_webserver_tag followed kolla_letsencrypt_webserver_version, which no longer resolves from 2026.1 on, because kolla replaced the letsencrypt-webserver image with httpd and the SBOM has no key for it. The tag fell back to the series. On the latest track every kolla image carries the series tag, so this went unnoticed. On a release, images carry per-image versions, and OSISM 11.0.0 requests httpd:29.0.3.20261008 (keystone), httpd:35.1.1.20261008 (ironic) and httpd:2026.1 (Let's Encrypt), none of which exists; the build pushed httpd:2.4.58.20261008. ironic-http runs in every deployment with ironic enabled. Point all three at kolla_httpd_version, which container-image-kolla- ansible now renders from the SBOM's httpd key, falling back as before to kolla_image_version (letsencrypt_tag for the webserver). Add ironic_http_image and ironic_http_tag to the catalogue so the role default is overridden. letsencrypt_webserver_tag keeps kolla_letsencrypt_webserver_version up to 2025.2, gated on the same release list as letsencrypt_webserver_image. Every new reference has a default(), so this can land before or after the container-images-kolla and container-image-kolla-ansible changes that provide kolla_httpd_version. Until a kolla-ansible image carrying it is released, the tags fall back as described, which is no worse than today. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Roger Luethi --- all/002-images-kolla.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/all/002-images-kolla.yml b/all/002-images-kolla.yml index 5a92f22..c9a19b3 100644 --- a/all/002-images-kolla.yml +++ b/all/002-images-kolla.yml @@ -131,7 +131,7 @@ keystone_fernet_tag: "{{ keystone_tag }}" keystone_ssh_image: "{{ docker_image_url }}keystone-ssh" keystone_ssh_tag: "{{ keystone_tag }}" keystone_httpd_image: "{{ docker_image_url }}httpd" -keystone_httpd_tag: "{{ keystone_tag }}" +keystone_httpd_tag: "{{ kolla_httpd_version|default(kolla_image_version) }}" ############################## # role: mariadb @@ -549,6 +549,8 @@ ironic_pxe_image: "{{ docker_image_url }}ironic-pxe" ironic_pxe_tag: "{{ ironic_tag }}" ironic_pxe_filter_image: "{{ docker_image_url }}ironic-pxe-filter" ironic_pxe_filter_tag: "{{ ironic_tag }}" +ironic_http_image: "{{ docker_image_url }}httpd" +ironic_http_tag: "{{ kolla_httpd_version|default(kolla_image_version) }}" ironic_inspector_image: "{{ docker_image_url }}ironic-inspector" ironic_inspector_tag: "{{ kolla_ironic_inspector_version|default(kolla_image_version) }}" ironic_dnsmasq_image: "{{ docker_image_url }}dnsmasq" @@ -606,7 +608,7 @@ skyline_console_image: "{{ docker_image_url }}skyline-console" letsencrypt_tag: "{{ kolla_letsencrypt_version|default(kolla_image_version) }}" letsencrypt_lego_tag: "{{ kolla_letsencrypt_lego_version|default(letsencrypt_tag) }}" letsencrypt_lego_image: "{{ docker_image_url }}letsencrypt-lego" -letsencrypt_webserver_tag: "{{ kolla_letsencrypt_webserver_version|default(letsencrypt_tag) }}" +letsencrypt_webserver_tag: "{{ kolla_letsencrypt_webserver_version|default(letsencrypt_tag) if openstack_version in ['2024.1', '2024.2', '2025.1', '2025.2'] else kolla_httpd_version|default(letsencrypt_tag) }}" letsencrypt_webserver_image: "{{ docker_image_url }}{{ 'letsencrypt-webserver' if openstack_version in ['2024.1', '2024.2', '2025.1', '2025.2'] else 'httpd' }}" ############################## From b2572d340075836ff724b9355f75665cbfd84c1e Mon Sep 17 00:00:00 2001 From: Roger Luethi Date: Sat, 10 Oct 2026 08:54:57 +0200 Subject: [PATCH 2/3] Map the tags of the two 2026.1 exporters kolla 2026.1 adds prometheus-valkey-exporter and prometheus-openstack-network-exporter, both enabled by default. The catalogue has no entries for them, so kolla-ansible's role defaults apply and both use prometheus_tag. On the latest track that is the series tag, which exists. On OSISM 11.0.0 both request 3.5.5.20261008, Prometheus's own version, which does not exist for either image; the build pushed 1.82.0.20261008 and 0.2.0.20261008. Every deployment with Prometheus fails at the monitoring stage. Add image and tag entries for both, mapped like the other exporters: kolla_prometheus__version from container-image-kolla-ansible, falling back to prometheus_tag. Until a kolla-ansible image providing the variables is released, the fallback keeps today's behaviour. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Roger Luethi --- all/002-images-kolla.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/all/002-images-kolla.yml b/all/002-images-kolla.yml index c9a19b3..9cda3b7 100644 --- a/all/002-images-kolla.yml +++ b/all/002-images-kolla.yml @@ -290,6 +290,10 @@ prometheus_blackbox_exporter_image: "{{ docker_image_url }}prometheus-blackbox-e prometheus_blackbox_exporter_tag: "{{ kolla_prometheus_blackbox_exporter_version|default(prometheus_tag) }}" prometheus_libvirt_exporter_image: "{{ docker_image_url }}prometheus-libvirt-exporter" prometheus_libvirt_exporter_tag: "{{ kolla_prometheus_libvirt_exporter_version|default(prometheus_tag) }}" +prometheus_openstack_network_exporter_image: "{{ docker_image_url }}prometheus-openstack-network-exporter" +prometheus_openstack_network_exporter_tag: "{{ kolla_prometheus_openstack_network_exporter_version|default(prometheus_tag) }}" +prometheus_valkey_exporter_image: "{{ docker_image_url }}prometheus-valkey-exporter" +prometheus_valkey_exporter_tag: "{{ kolla_prometheus_valkey_exporter_version|default(prometheus_tag) }}" ############################## # role: designate From df56d0e65bc7a3356805a115d49fadf1c051b9e8 Mon Sep 17 00:00:00 2001 From: Roger Luethi Date: Sat, 10 Oct 2026 08:55:55 +0200 Subject: [PATCH 3/3] Give hacluster-corosync its own tag variable hacluster_corosync_tag followed hacluster_tag, like the pacemaker and pacemaker-remote tags. On a release that cannot be right for all three: the OSISM 11.0.0 build pushed hacluster-corosync:3.1.7.20261008 but hacluster-pacemaker(-remote):2.1.6.20261008. (All three currently fall back to the series, 2026.1, because kolla_hacluster_version is never defined; container-image-kolla-ansible fixes that separately.) Take hacluster_corosync_tag from kolla_hacluster_corosync_version, rendered by container-image-kolla-ansible from the SBOM's hacluster_corosync key, falling back to hacluster_tag. The pacemaker tags keep hacluster_tag, which will carry the pacemaker version. Until a kolla-ansible image providing the variable is released, the fallback keeps today's behaviour. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Roger Luethi --- all/002-images-kolla.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/all/002-images-kolla.yml b/all/002-images-kolla.yml index 9cda3b7..8b578b5 100644 --- a/all/002-images-kolla.yml +++ b/all/002-images-kolla.yml @@ -176,7 +176,7 @@ cinder_api_tag: "{{ cinder_tag }}" hacluster_tag: "{{ kolla_hacluster_version|default(kolla_image_version) }}" hacluster_corosync_image: "{{ docker_image_url }}hacluster-corosync" -hacluster_corosync_tag: "{{ hacluster_tag }}" +hacluster_corosync_tag: "{{ kolla_hacluster_corosync_version|default(hacluster_tag) }}" hacluster_pacemaker_image: "{{ docker_image_url }}hacluster-pacemaker" hacluster_pacemaker_tag: "{{ hacluster_tag }}" hacluster_pacemaker_remote_image: "{{ docker_image_url }}hacluster-pacemaker-remote"