release notes: add OSISM 11.0.2

docs/release-notes/osism-11.md

@@ -28,9 +28,67 @@ independently of it.
 
 | Release | Release Date     |
 |:--------|:-----------------|
+| 11.0.2  | 20. October 2026 |
 | 11.0.1  | 11. October 2026 |
 | 11.0.0  | 8. October 2026  |
 
+## 11.0.2
+
+### DNS resolution on hosts with an outdated systemd
+
+* On 11 October 2026 the DNS root zone switched to a new key signing key (KSK-2024, key tag 38696). systemd-resolved versions that only carry the old key (KSK-2017) in their built-in trust anchor fail every lookup with `missing-key` as long as DNSSEC validation is enabled. The `osism.commons.resolvconf` role enables validation by default (`resolvconf_dnssec: allow-downgrade`), unlike the Ubuntu default. `allow-downgrade` does not help here: it falls back only when the upstream server offers no DNSSEC at all, not when validation fails.
+* **Action required:** install the fixed systemd packages on all hosts. They are 255.4-1ubuntu8.18 for Ubuntu 24.04 and 249.11-0ubuntu3.23 for Ubuntu 22.04, published in the security archives on 14 October 2026. Hosts that have them installed are not affected.
+* This matters most for new hosts. The bootstrap configures resolvconf before it upgrades packages, so a host installed with an older systemd loses name resolution during the bootstrap and cannot fetch the fix itself. Examples are offline installations from the node image ISOs, or hosts installed from a package mirror that does not yet carry the fixed packages. Install the fixed packages on such hosts before the bootstrap.
+* Only if the fixed packages cannot be installed, set `resolvconf_dnssec: false` in `environments/configuration.yml` as a workaround, and remove it again once they are. A host that has already lost name resolution recovers after either of the two, followed by `osism apply resolvconf`.
+
+### Horizon now asks for a Keystone domain at login
+
+`horizon_keystone_multidomain` is now set to `"yes"` by default. Horizon's login form gets a required Domain field (pre-filled from the browser's `login_domain` cookie after a first login), and identity administration (the Users, Groups, Roles and Credentials panels) now needs a domain-scoped admin token; the Domains panel gains a "Set Domain Context" action and a domain filter. This lets users of a non-default Keystone domain, such as an LDAP-backed domain or one run by a domain manager, log in with a password. OSISM already keeps Horizon sessions in the database, which domain-scoped tokens require. To keep the previous single-domain login, set:
+
+```yaml title="environments/kolla/configuration.yml"
+horizon_keystone_multidomain: "no"
+```
+
+### Cinder now clusters Ceph-backed cinder-volume for active/active HA
+
+When `cinder-volume` runs on more than one host, `cinder_backend_ceph` is enabled, and no other Cinder backend is enabled, `cinder_cluster_name` is now derived automatically. Previously it stayed empty, so kolla-ansible ran one independent `cinder-volume` service per host: a volume belonged to whichever host created it, and while that host's service was down the volume could not be extended, snapshotted, attached or deleted. With clustering, every `cinder-volume` instance joins the same cluster and these operations continue if one host is down.
+
+Existing volumes are adopted into the cluster the next time `cinder-volume` starts with a cluster name set, on `osism apply cinder` or `osism apply -a upgrade cinder`; each host adopts only its own volumes. A backend configured only through an overlay is invisible to this check. If such a backend does not support active/active, opt out:
+
+```yaml title="environments/kolla/configuration.yml"
+cinder_cluster_name: ""
+```
+
+### Ceph monitoring and defaults
+
+* **Ceph mgr metrics are scraped automatically.** When OSISM deploys Ceph (the `ceph-mgr` group is non-empty) and Prometheus is enabled, Prometheus now scrapes the Ceph mgr's Prometheus module on every mgr host. If you already added a `prometheus.yml.d` overlay for this, remove it, or every Ceph metric series is scraped twice under two job names.
+* **Gnocchi now points at OSISM's own Ceph pool.** `ceph_gnocchi_pool_name` is derived from the pool OSISM actually creates for Gnocchi (`metrics`) when it deploys Ceph, instead of upstream's `gnocchi`, a pool OSISM never creates and whose key Gnocchi could not access. If your configuration repository already sets `ceph_gnocchi_pool_name: "metrics"` by hand, nothing changes and the override can be dropped. External Ceph clusters are unaffected and keep the upstream default.
+
+### Manager now trusts the host's CA bundle automatically
+
+The manager's Ansible containers (osism-ansible and the other `ansible_services`) and `osismclient` already mount the host's CA bundle, so they trust a private CA installed via `certificates_ca`. Until now, Python's `requests` library ignored that mount and used its own bundled CAs, so a site with a private CA and internal TLS had to add `REQUESTS_CA_BUNDLE` to `manager_environment_extra` by hand. A new `manager_requests_ca_bundle` variable, defaulting to the mounted bundle path, is now rendered automatically. An existing `REQUESTS_CA_BUNDLE` set via `manager_environment_extra` still wins. To opt out:
+
+```yaml title="environments/manager/configuration.yml"
+manager_requests_ca_bundle: ""
+```
+
+### osism CLI
+
+`osism openstack stress` no longer duplicates and restricts the options of the underlying `openstack-simple-stress` tool; it now passes arguments through unchanged, so options the wrapper did not know about (`--profile`, `--burnin`, `--burnin-duration`, `--no-network`, and future ones) work automatically. The wrapper also no longer forces `--interval 10`; the tool's own default of 2 seconds now applies, avoiding request failures caused by HAProxy closing idle keep-alive connections at the 10 second mark. Options the `osism` CLI consumes itself (`--debug`, `-h`/`--help`, `-v`, `-q`, `--version`, `--log-file`) must now follow a `--` separator, for example `osism openstack stress -- --help`.
+
+### OpenStack services (2026.1)
+
+* **Octavia:** the rendered `octavia.conf` no longer sets `bind_ip` in the `[health_manager]` section for every Octavia service, only for `octavia-health-manager`, the one service that reads it. Inventories where `octavia-api` runs on a host without the `o-hm0` interface used to fail configuration with `Interface 'o-hm0' not present on host`; a custom inventory placement added as a workaround for this is no longer needed. The change takes effect the next time Octavia is deployed, upgraded or reconfigured; services other than the health manager restart once.
+* **MariaDB:** upstream's post-deploy check for unhealthy containers, which previously never matched anything, now works correctly. That surfaced a race on fresh deployments, where a node joining after bootstrap runs its healthcheck before the monitor user that check needs has been created, so it was reported unhealthy. MariaDB's healthcheck `start_period` is now 120 seconds, long enough to cover this on most deployments, though an unusually slow bootstrap can still trip it. The next `osism apply mariadb` or reconfigure restarts the Galera nodes one at a time to pick this up.
+* **CloudKitty:** two new HAProxy timeout variables are available, `haproxy_cloudkitty_api_client_timeout` and `haproxy_cloudkitty_api_server_timeout`, both defaulting to one minute. They matter if you run CloudKitty, since its v1 API has no pagination and large requests can need longer than the default timeout.
+
+### Notable changes
+
+* NetBox's initial admin user and token are created reliably again on managers using ansible-core 2.19 (the current seed image). Before this fix, the user/token setup could silently render as a string instead of a mapping, so the operator user, its token, and the groups and permissions created after it were skipped, and `osism manage netbox` then failed with `403 Invalid token`. Contributed by Timon Schnell ([@kingspeedy95](https://github.com/kingspeedy95)).
+* Homer, the manager's dashboard application, now runs the version the release actually pins (v26.4.2) instead of its role's own older default (v25.11.1); the release's pin had never been wired through before, so every manager ran an outdated Homer regardless of release. No breaking or configuration changes are flagged between these versions upstream.
+* Nexus has been removed from OSISM: its role, playbook, inventory group and defaults are gone, and `osism apply nexus` no longer exists.
+* The `loopback0` fallback for `console_interface`, `hosts_interface`, `management_interface` and `k3s_interface` is quoted correctly again. Leaving `internal_interface` unset used to fail with an undefined-variable error instead of falling back to `loopback0`.
+
 ## 11.0.1
 
 OSISM 11.0.1 supersedes 11.0.0. OSISM 11.0.0 fails to deploy because of the image