vcswatch reports that
this package seems to have new commits in its VCS but has
not yet updated debian/changelog. You should consider updating
the Debian changelog and uploading this new version into the archive.
Here are the relevant commit logs:
commit e58b08956b8b7d31aba81d96ec9a17b441376720
Author: Thomas Goirand <zigo@debian.org>
Date: Sun Nov 15 12:42:17 2026 +0100
Set the agent side bgp/chassis_router_vrf_id on OVN computes
The ovn-bgp agent extension enslaves the provider bridge into the
chassis router VRF device that ovn-controller maintains
(ovnvrf<id>), and it looks the VRF up with the
bgp/chassis_router_vrf_id setting. Without the setting the agent
falls back to the upstream default of 10, while the ovn-bgp service
plugin stamps ovnvrf42 on the peering LRPs and oci::frr peers inside
ovnvrf42: the enslavement silently skipped forever, br-ex stayed out
of the VRF and the fabric sessions were dead.
commit 7a29f809f043c80b56f0edb9c4058e1aa44ad1b9
Author: Thomas Goirand <zigo@debian.org>
Date: Sun Nov 15 12:07:52 2026 +0100
Add the BGP facing VLAN NICs as ports of br-ex
The fabric sessions of the chassis router VRF (FRR peers unnumbered
over br-ex itself, and ovn-controller exchanges the chassis router's
routes through it) only deliver traffic when the BGP facing VLAN NICs
are bridged into the provider bridge. The NIC names come from the
ENC's bgp_iface_list, which is deployment topology knowledge. The VRF
device itself is created by ovn-controller's route exchange
(dynamic-routing-maintain-vrf), and Neutron's ovn-bgp agent extension
owns the enslavement of br-ex to that VRF.
commit 8159a8742e8f06e2e337575ce1426ed5267e4288
Author: Thomas Goirand <zigo@debian.org>
Date: Sun Nov 15 00:49:20 2026 +0100
Enable the vif-reattach OVN agent extension on the computes
It re-converges the OVS plugging state of the VM ports (re-attaches
the missing taps and restores the lost external_ids) after an OVS
database restore or a wiped bridge. The --delete-bridges removal of
OVS_CTL_OPTS (0256f61b) makes the wiped-bridge case reachable, and the
extension takes care of the recovery.
commit 779b5847969300d45f8b1ef03ca4f78732a3f223
Author: Thomas Goirand <zigo@debian.org>
Date: Sun Nov 15 00:49:09 2026 +0100
Set ovn-cms-options=enable-chassis-as-gw on OVN computes
neutron only populates the HA chassis groups of the routers with
gateway capable chassis, without it the groups stay empty and northd
renders no NAT flows for the overlay-gatewayed routers (floating IPs
die at the gateway).
commit f7df59d86f129e0e6cd140e2fb07c96d613349fd
Author: Thomas Goirand <zigo@debian.org>
Date: Fri Nov 13 18:51:39 2026 +0100
Auto-rack on the q35 switch interface names
ikvswitch now runs its switch VMs with the q35 machine type and pinned
PCI addresses, so the leaf switches name their server ports enp0s6,
enp0s7, ... instead of ens6, ens7, ... LLDP reporting still works, but
the switchportnames map of auto-racking.json only knew the ensN names,
so machines could not be located automatically anymore. Add the enp0sN
entries mirroring the ensN ones (port N starts at U N-3), keeping the
ensN and swpN entries for the other fabric types.
commit 46c3d811bb6c7bf74d04162beea9c812116c6957
Author: Thomas Goirand <zigo@debian.org>
Date: Fri Nov 13 15:09:38 2026 +0100
README.md: More server type in the HCL
commit c942db29ed5f84ddf8675c10edc3e4df0dd31826
Author: Thomas Goirand <zigo@debian.org>
Date: Fri Nov 13 13:23:39 2026 +0100
Auto-login root on the pxe-server-node consoles
Pass --tty-autologin yes and --add-serial-getty ttyS0 when building
the OCI VM image, as the live VMs of the PoC already do: the VNC and
SOL consoles of the pxe-server-node then drop into a root shell
instead of asking for the password. The image must be rebuilt by
running oci-poc-setup again for this to apply.
commit 8ee5fab454bf20adf9bd1dd76c84f16ebb323d13
Author: Thomas Goirand <zigo@debian.org>
Date: Thu Nov 12 21:20:39 2026 +0100
Fix dead idempotency guard in Octavia router setup
The interfaces_info check looked for a hardcoded subnet UUID that
can never exist, so SUBNET_PORT_ID stayed empty on every run and
"openstack router add subnet int-octavia1-router1
int-octavia1-subnet1" was retried unconditionally, failing the
whole script on re-runs under set -e. Match on the subnet ID
captured just above instead, passed to jq with --arg the same way
oci-poc-provision-network-cl3 does.
commit cccc11c739b8281a4c31ea1f33098460ee5d985a
Author: Thomas Goirand <zigo@debian.org>
Date: Thu Nov 12 15:57:06 2026 +0100
Make the PoC compatible with ikvswitch 1.0.8
The ikvswitch 1.0.8 fabric stops originating the VLAN subnets of
the OVN clusters (the covering /24 would shadow the /32 host routes
announced by the compute hosting each floating IP), extends the
VLAN pools to 8 subnets (192.168.113.0/24 on VLAN 11 through
192.168.120.0/24 on VLAN 18), and rehomes the IPMI bridge inside
the /19 at 192.168.109.1. Adapt the PoC:
- Derive every 192.168.<x> prefix of oci-poc.conf from the new
HOST_VIRTUAL_SUBNET_START_PREFIX variable, matching ikvswitch.conf,
so that the whole address plan follows a single knob.
- Pass the redistribute knob from oci-poc-ci itself: the switch
rebuild runs ikvswitch-setup with --map-redistribute-vlan-subnets
using the new MAP_REDISTRIBUTE_VLAN_SUBNETS variable of
oci-poc.conf (cl3's OVS-mode block, 117,118,119,120), falling back
to ikvswitch's "all" default for older confs.
- Re-home the IPMI sites of the scripts to ${IPMI_BIND_IP_START}.
- Point every machine IPMI at ${IPMI_BIND_IP_START}.1: the default,
swift, and billing variants still pointed their BMCs at
192.168.100.1, the host's address on the PXE network.
- Thread USE_OVN to every PoC script, including
oci-poc-provision-network-cl3.
- Wire cl3's networks end to end, mirroring cl1's OVS-mode shapes:
the ext-provider1 transport (192.168.118.0/24 on VLAN 16, dual
stack), the shared ext-net1 overlay on 192.168.126.0/24 (a VXLAN
overlay needs no VLAN, so its /24 sits outside the pools' octets,
leaving pool 7 as headroom), the Octavia transport
(192.168.120.0/24 on VLAN 18, OVS-mode only, freeing .120 by
moving cl1's Octavia management to .127), and the Octavia
management network with its HA router.
- Host cl3's BGP speakers on its 3 controllers (the OVS-mode
cluster's network nodes): neutron_install_dragent is now a
controller-role variable, the provisioning creates both speakers
peering with the leaf loopbacks and adds them to all 3 dragents,
and the fabric accepts the controllers as speaker peers.
- In the OVN mode, skip the Octavia transport entirely and gateway
int-octavia1-router1 on ext-provider1 instead.
- Depend on ikvswitch (>= 1.0.8~).
- Document the network map of the whole /19 in the README, together
with the --map-redistribute-vlan-subnets value the PoC uses and
the [--ovn] flag of oci-poc-ci. Correct the map rows:
192.168.102.0/24 is the unused legacy VMNET (the VMs only have two
NICs, the overlays are tunneled over the management network),
192.168.119.0/24 is just unused, 192.168.114.0/24 and
192.168.115.0/24 describe both modes (114 = the VLAN-mounted
transport in the OVS mode / the flat underlay carrying the HA
routers' external gateways in the OVN mode, 115 = the VLAN mount /
the geneve ext-floating1); the 192.168.200.0/24 note is about the
demo and internal tenant overlays only, unrelated to the IPMI
bridge.
- Update the repository's ikvswitch and oci skill notes (the
.opencode knowledge base) to the same reality: the fabric's
speaker peers and tests, the cl3 networks and BGP speakers, the
PoC VM NICs, the knob invocation, and the Salsa CI -> osbpo
delivery flow.
commit 5f8c89b5477cd880918c79b3876d188a8ee60100
Author: Thomas Goirand <zigo@debian.org>
Date: Fri Nov 6 14:50:10 2026 +0100
Add OVN support
Wire ML2/OVN as an alternative to the Open vSwitch agent, selected
by the neutron_use_ovn cluster variable, together with
BGP-2-the-host for the VM networks:
- neutron_use_ovn toggle wired through the ENC and the cluster
variables
- controllers: ovn-central with the ovsdb raft cluster, raft
bootstrap on the first master, ovsdb servers started before
northd's wait chain, and the NB/SB endpoints built from the
ENC's master IP list
- computes: OVN chassis wiring with ovn-controller, geneve
encapsulation, provider bridges recorded in the OVS
external_ids, and vswitch::ovs declared for both roles
- unified OVN agent (neutron-ovn-agent) running the ovn-bgp and
metadata agent extensions, replacing the deprecated standalone
neutron-ovn-metadata-agent
- BGP-2-the-host: oci::frr manages the node FRR configuration,
unnumbered eBGP peering over the VLAN-10 subinterfaces toward
the leaf switches, and ENC emission of the VLAN-suffixed
interface list and bgp_ip
- router plugin switched to ovn-router, metering dropped from OVN
clusters, and the OVN deployment documented in the README
- tempest configuration gated on the OVN mode
- PoC tooling: --ovn option to deploy cl1 with ML2/OVN, and the
ovn-bgp skill documenting the stack
commit eb7b3e9489db600f048038a67b92db47101ca732
Author: Thomas Goirand <zigo@debian.org>
Date: Wed Nov 11 15:12:02 2026 +0100
Use GP_NET_SHARED_IPV6=fd00:1:2:2:: in the PoC, as this is RFC's.
commit 0256f61b9878de6068e6e06e8d6d56d719c6b906
Author: Thomas Goirand <zigo@debian.org>
Date: Tue Nov 10 20:11:46 2026 +0100
Drop --delete-bridges from OVS_CTL_OPTS defaults
/etc/default/openvswitch-switch carried OVS_CTL_OPTS="--delete-bridges"
on both compute and network nodes, making ovs-ctl wipe the OVS bridges
whenever openvswitch-switch restarts. The intent was cleaning a stale
OVS config on reprovisioned machines, but with OpenVSwitch >= 4.0.0 the
upgrade-time service restart deleted br-ex (and br-int with it),
orphaning all VM taps, killing the FRR VRF session and tearing down a
working cluster on every OVS upgrade.
Keep the file managed by Puppet, but with an empty OVS_CTL_OPTS, so
already deployed nodes converge to the safe value on the next run.
commit 7915af77dacac9318bf74f7c95c1775e555d22b4
Author: Thomas Goirand <zigo@debian.org>
Date: Sun Nov 8 22:06:48 2026 +0100
Run mistral db sync on the first master only
puppet-mistral's main class defaults sync_db to true, so the
mistral-db-populate exec ran on every controller, racing concurrent
schema migrations against the shared galera. Pass the ENC's
do_db_sync flag, like every other service class; the existing
wait-for-mistral-db execs (DESCRIBE workbooks_v2) still gate the
other controllers' service starts on the first master's sync.
commit 5a8b150807941fd97886bb1c153cf958a65f6049
Author: Thomas Goirand <zigo@debian.org>
Date: Sun Nov 8 19:43:16 2026 +0100
Manage rabbitmq users on the first master only
Rabbitmq users and vhosts are cluster-wide state in a replicated
rabbitmq cluster: when the first master creates them, the other
members' puppet runs race against that state and rabbitmqctl add_user
fails with error 70 ("User already exists"), aborting the whole run
(observed on cl1-controller-2 during the --ovn PoC CI: Rabbitmq_user
[monitoring] and [glance] failing this way).
Gate the vhost, users and user permissions on $is_first_master; the
rabbitmq server, the cluster auto-join and the rescue credentials
script remain managed on every node. messaging.pp already had the
same gating via $is_first_rabbit.
commit 15d080a474a17220027e4f12ce01aa332324c687
Author: Thomas Goirand <zigo@debian.org>
Date: Sun Nov 8 16:06:20 2026 +0100
Order placement registration before nova services
nova-conductor and nova-scheduler exit fatally at startup while the
placement service is missing from the keystone catalog. On first
bootstrap, the registration done by placement::keystone::auth on the
first master races the nova service phase: the units crash-loop and
puppet's own Service evaluation fails, breaking the whole first
puppet run. Gate the nova service phase on that registration, on the
first master and during the initial cluster setup only.
commit 745bc1f5e938f3c83787ddb1936d4f8e2efa519d
Author: Thomas Goirand <zigo@debian.org>
Date: Sat Nov 7 22:18:13 2026 +0100
poc: BMC-reset stuck VMs instead of restarting the CI
The PoC CI kills every VM, the OCI server included, whenever a
single guest VM gets stuck while booting: the 120 seconds wait for
all VMs to register in OCI times out, and oci-poc-ci then restarts
a full cycle.
Instead, a new oci-poc-recover-stuck-vms helper enumerates the VMs
that have not registered themselves with the OCI server: the
expected serials are generated from NUMBER_OF_GUESTS in
/etc/oci-poc/oci-poc.conf, starting at C1 and counting in hex, and
they are compared with the serials known to the OCI server. Each
missing serial is then power cycled through its BMC, reading its
port and the BMC credentials from the generated ipmi_sim
configuration files.
The wait loop in oci-poc-vms runs the helper when its 120 seconds
wait times out: if less than OCI_POC_MAX_STUCK_VMS (default 5) VMs
are missing, they get rebooted and the wait resumes for up to 2
recovery rounds. With more missing VMs, the helper exits non-zero
and the CI keeps its old behavior of restarting everything.
oci-poc-recover-stuck-vms --dry-run just lists the missing serials
without touching any VM.
commit b80ce61c70d1b5556267b00b7b1b9a0e67c02ff9
Author: Thomas Goirand <zigo@debian.org>
Date: Wed Nov 4 13:53:07 2026 +0100
rabbitmq: use disc nodes instead of ram
All RabbitMQ nodes of a cluster (the controllers, and the dedicated
messaging nodes when the messaging role is used) are now disk nodes:
the generated rabbitmq.conf carries {cluster_nodes, {[...], disc}}
instead of ram, so queues and metadata survive the loss of any node.
commit c9adf537e666ddfd9be1d9dcfef1cc03edf44ab3
Author: Thomas Goirand <zigo@debian.org>
Date: Tue Nov 3 16:22:07 2026 +0100
Fix adding Ceph nodes in multi-AZ ceph deployment
We used to have "cl1-cephNosd-X" but the slave_actions.php was
adding them as cl1-cephosdN-X. This commit fixes this.
commit 42ec1cfaf8c0805708624903b066506504c3fb49
Author: Thomas Goirand <zigo@debian.org>
Date: Tue Nov 3 10:39:36 2026 +0100
Standardize list separators on comma
Comma is now the only documented separator for every ocicli option
taking a list of values (GPU names, vendor/product IDs and VFIO IDs,
--time-server-host, --neutron-dnsmasq-dns-servers, --amp-secgroup-list,
--amp-boot-network-list, --api-maint-whitelist,
--glance-api-proxy-exceptions, --cpu-model-extra-flags).
The API validates on both "," and the legacy separators (";" and, for
the GPU values, "+" and spaces) but always stores a comma separated
list. db_sync.php rewrites legacy separators found in existing rows,
and the ENC emits canonical comma separated lists (GPU values become
proper YAML arrays), so puppet always sees the right format.
ocicli no longer converts "," to "+" for the GPU options (that hack
was storing space separated values, as PHP decodes "+" in query
strings as a space). Puppet consumers split on [;,] so they keep
working against rows written by older APIs. The display side drops
the comma mangling of cluster-show (amp lists) and machine-show (CPU
model name) and quotes comma containing values so csvlook renders
them correctly. The PoC scripts switch to comma as well.
commit 062819af41ad8cbc925045279226f503782ee403
Author: Thomas Goirand <zigo@debian.org>
Date: Tue Nov 3 09:14:45 2026 +0100
ocicli: add --skip-xfs-format to machine-install-os
Add a --skip-xfs-format option to machine-install-os (and to the
machine-display-install-cmd dry-run), so that reinstalling a Swift
store node doesn't erase the data on its storage drives: OCI then
builds the bodi command without the --xfsformat block device list.
commit f069c4884c9d368ffbf0a2652885ffa2b276a1f7
Author: Thomas Goirand <zigo@debian.org>
Date: Mon Nov 2 09:38:26 2026 +0100
agent: report its package version to the OCI server
The agent now sends an "agent_version" attribute in the machine
object it reports, read with dpkg-query from the
openstack-cluster-installer-common package. report.php normalizes
any non-version value to "0": absence (older agents) and garbage
compare below every real version.
report.php accepts it on both the INSERT path (first report of a
machine) and the UPDATE path. Values are stored in the new
machines.agent_version varchar(32) NOT NULL DEFAULT '0' column,
which db_sync adds to existing deployments.
"ocicli machine-list -v" (and -a) now shows the agent version
alongside the BIOS and IPMI firmware versions.
commit cc6cc2a9046f58e8baafcc7e298d407034068fe0
Author: Thomas Goirand <zigo@debian.org>
Date: Sun Nov 1 18:17:11 2026 +0100
ocicli: route action verbs around the csvlook renderer
ocicli re-runs every non -csv invocation through
"ocicli -csv <cmd> | csvlook" unless the command is listed in its
pre-dispatch passthrough block. Action verbs missing from that list
had their free-text output parsed as CSV: a header line followed by
any line holding a comma made agate die with
"ValueError: Row 0 has 2 values, but Table only has 1 columns."
and exit non-zero, while the pipe also masked API errors, letting a
failed action exit 0 (csvlook's own status).
oci-poc-install-cluster-bgp hits this on machine-add: the hardware
profile guess matches no profile for the PoC VMs, the reply data
carries "Could not guess a unique hardware profile, machine-set not
applied." (one comma), csvlook crashes and set -e aborts the CI
after the machine was already enrolled.
Add the remaining action verbs to the passthrough block (machine-add,
machine-set, machine-remove, compute-decomission, machine-destroy
kept out as it prints a table, plus 36 more: cluster-set,
network-*, role-*, location-*, machine-reboot-on-*, machine-to-dns,
...). Tabular verbs (all *-list, machine-show, machine-blk,
machine-ram, filebeat-output-host-list, ...) keep the csvlook
rendering, as does the --column filter.
commit bd996e718760a8212787e4c067981816d66c7bb5
Author: Thomas Goirand <zigo@debian.org>
Date: Sun Nov 1 17:24:24 2026 +0100
poc: switch the PoC VMs to q35, virtio and UEFI
Rework the firmware and device model of the PoC VMs (new
/etc/oci-poc/oci-poc.conf directives default to the new behavior):
- q35 machine type with pinned PCI slots (USE_Q35), replacing the
legacy i440fx "pc" machine and dropping its floppy controller
- virtio-net NICs for all the VMs, including the IPMI one
(USE_VIRTIO_NET), forced to 1 Gbit/s full duplex, as virtio-net
leaves lshw's link speed empty, which broke the "1g*" speed
aliases; the agent falls back to the sysfs current speed when
lshw reports no capacity
- virtio-scsi with 4 queues and SSD rotation rate for the disks
- UEFI firmware (USE_UEFI): rack 2 boots plain OVMF, rack 3 boots
OVMF with secure boot, rack 1 and the OCI VM keep legacy BIOS;
fresh NVRAM on every start
- UEFI netboot fixes: grub-efi-amd64-signed installed in the
template, DHCP left to the ikvswitch leaf switches (the OCI
VM's own dhcpd NAKed the rack 1 leases), and the Secure Boot
NVRAM template used for the rack 2 VMs, whose plain template
never PXE-boots on q35
- iPXE identity: when the dhcp_ip match misses (each boot phase
can lease a different IP), ipxe.php chains back on the NIC MAC
and resolves the machine through the ifnames table
- persistent UEFI BootOrder management with oci-uefi-boot-order,
used by the machine reboot API actions and the oci-install
pre-reboot hook
- runtime disk images created as qcow2 overlays on the templates
(USE_QCOW2_OVERLAYS), flattened by oci-poc-save
- guest NIC names derived from USE_Q35 (enp0s4 onward on q35
instead of ens4), and cl3's VIP interface discovered at start
instead of hardcoding ens5, riding the trunk NIC
commit 6e26b89875c03d62899579d49ffd1bfed2bce6c3
Author: Thomas Goirand <zigo@debian.org>
Date: Fri Oct 30 13:45:18 2026 +0100
ocicli: fix --gpu-produc-id typo in --gpu-product-id
The machine-set option was misspelled --gpu-produc-id everywhere:
usage message, man page, bash completion and README example. Rename
it to --gpu-product-id, matching the gpu_product_id API and db
column. The old --gpu-produc-id spelling is still accepted for
backward compatibility.
commit 9cd32fc7600827d93c7324a58af1fea216dd52e1
Author: Thomas Goirand <zigo@debian.org>
Date: Fri Oct 30 10:46:15 2026 +0100
api: check machine_set block devices exist
The machine_set action now validates --dest-blk and --raid-dev0..3
values against the machine's block device inventory, instead of only
checking the name format:
- raid_dev0..3 must match an existing blockdevices.name or
blockdevices.realdev row for that machine. The bare NVMe controller
form (nvme0) is refused: only the full namespace device (nvme0n1)
can be stored, as expected by the install and ENC flows.
- dest_blk also accepts the NVMe controller form, matching the
existing name / name+"n1" duality used by the installer, plus the
"none" reset value.
On mismatch, the API returns an error listing the block devices
registered for the machine.
ocicli normalizes device names on the client side (previous commit),
so interactive users see the correction before the API is called.
commit a0e6dab4893b0f2c79322bdfc982f57aa951b684
Author: Thomas Goirand <zigo@debian.org>
Date: Fri Oct 30 10:40:27 2026 +0100
ocicli: auto-correct nvme device name forms
--raid-dev0..3 and --dest-blk now normalize the device name on the
client side before calling the API:
- a leading /dev/ prefix is stripped (both options)
- a bare NVMe controller name (nvme0) given to --raid-devN is
expanded into the full namespace name (nvme0n1)
- an NVMe namespace name (nvme0n1) given to --dest-blk is
shortened into the controller name (nvme0)
- partition suffixes (sda1, nvme0n1p1) are stripped
When a value gets corrected, ocicli prints a notice on stderr, for
example "selected nvme0n1 instead of nvme0 (for --raid-dev0)", so
that the user is informed about the wrong usage. Already valid
names, and the "none" value for --dest-blk, are left untouched.
A missing option value now errors out with "No parameter for
--raid-devN" / "No parameter for --dest-blk" before calling the
API, like the other client side validations in machine-set.
Documented in ocicli(1) and in the usage() examples.
commit d348aa96dc55a26f6479cc3cee8cbe8dd04c86ea
Author: Thomas Goirand <zigo@debian.org>
Date: Fri Oct 30 10:13:20 2026 +0100
machine-add: apply hardware-profile machine-set
The "machine-set" entries of hardware-profiles.json were only applied
when running "ocicli machine-megacli-apply", or by the hands-off
scheduler when megacli_auto_apply is on: neither "machine-add" nor
"machine-install-os" applied them.
Move that logic to a new hardware_profile_apply_machine_set() function,
call it after enrolling a machine through "ocicli machine-add" and
"machine-auto-add" (best effort: enrollment never fails because of it),
and carry the outcome in the data of the API reply, which ocicli now
displays. The web GUI path is untouched.
Also guard the auto-racking lookup with isset(): the old inline block
could hit count(NULL) under PHP 8 when auto_racking_guess_location()
returned success without data.
commit 45910903fba5eff983cfe08b0e323ad7ff401ed3
Author: Thomas Goirand <zigo@debian.org>
Date: Thu Oct 29 17:27:08 2026 +0100
Add fail2ban option for bad keystone authentication
Add a new keystone_fail2ban cluster variable (off by default, with
bantime, findtime and maxretry knobs) which installs fail2ban on the
controllers and watches haproxy's JSON access log for failed
authentications against the keystone token endpoint (POST with a 401
or 403 status, including the haproxy-level admin token ACL deny).
The haproxy log is watched rather than keystone's own log, as the
latter only sees a third of the requests per master and carries
haproxy's source address instead of the client's IP. Bans are
enforced by the nftables-multiport action, whose bans live in a
dedicated nftables table that the puppet managed iptables rules
(purged on every run on API masters) can never remove. Cluster
networks are excluded from bans via ignoreip, reusing the API
rate-limit whitelist.
commit b5e28b3aa422a8321083aa7379a0bbf139c04529
Author: Thomas Goirand <zigo@debian.org>
Date: Thu Oct 29 15:55:46 2026 +0100
Only run db-purge crons on the first controller
The cron jobs for purging deleted rows from the database
(nova::cron::archive_deleted_rows, heat::cron::purge_deleted,
cinder::cron::db_purge and manila::cron::db_purge) were running on
every controller of a cluster. There is no point in having each of
them run the same job, and the purge commands are racy when executed
concurrently on the same database.
This patch makes sure that the db purge cron jobs are setup only on
the first controller of a cluster (ie: if $is_first_master), and
that other controllers purge the crontab file of the corresponding
service user. This way, the cron file is removed by puppet if the
first controller moves to another host in the cluster.
commit ef9ec5678f39e7f0c553421c54472c4c2d52e362
Author: Thomas Goirand <zigo@debian.org>
Date: Wed Oct 28 15:48:41 2026 +0100
Report HDD and memory DIMM hardware inventory
Have the agent report the disk and memory inventory of the
machines, store and display it on the server side, and equip the
PoC VMs with matching SMBIOS records:
- the agent reports each HDD's model and serial number, as
discovered through lsblk, stored in the new blockdevices.model
and blockdevices.serial columns and displayed by
"ocicli machine-blk"
- the agent reports each populated memory DIMM (slot locator,
size in MB, vendor, part number, serial number) from the
dmidecode type 17 records, stored in the new memorydimms
table and displayed by the new "ocicli machine-ram" command,
which was also missing from ocicli's usage message
- report.php validates the new fields, refreshes the stored
inventory on any change, accepts an empty block-device
firmware version, and machine-destroy now purges the
memorydimms and blkdev_ctrl entries as well
- the PoC VMs carry SMBIOS type 17 (memory device) records with
a manufacturer, part number and the same monotonic serial
number as the type 1 and 3 records, so the DIMM reporting
works in the PoC, including on the 32 GB controller VMs
(supported from QEMU 5.2 through 11.1)
- the new tables and columns are auto-created by db_sync.php on
upgrade
commit c094781e3cf4c84687efd383b87205ffe376cb9b
Author: Thomas Goirand <zigo@debian.org>
Date: Wed Oct 21 23:48:33 2026 +0200
Do glance TLS with uwsgi in Gazpacho too
Now that glance-api is switched to uwsgi in the Gazpacho packaging,
the service terminates TLS itself: stop doing the haproxy frontend
and backend re-encryption when deploying Gazpacho, and point
balancermembers at port 9292 like for Hibiscus and above.
commit 0b6350f3f5e4d4b40f16d99f0309929d151e5649
Author: Thomas Goirand <zigo@debian.org>
Date: Wed Oct 21 18:25:45 2026 +0200
Set compute/flavor_disk_size to 3 in tempest.pp
Tempest gained a [compute] flavor_disk_size option (Debian patch
forwarded upstream as
https://review.opendev.org/c/openstack/tempest/+/1009995) letting
the tests configure the disk size of the flavors they create. The
upstream default of 1 GB is too small for the Debian cloud image's
min_disk, so set it to 3 GB.
The option only exists since Hibiscus, and older tempest versions
refuse to start when tempest.conf contains unknown options, so the
entry is gated by the negation of the usual all-releases-before-
Hibiscus chain: future releases inherit the setting.
commit bd36b15c9faffef112bad668395fb008baaf8812
Author: Thomas Goirand <zigo@debian.org>
Date: Fri Oct 16 14:06:13 2026 +0200
ocicli cluster-set cl1 --dns-empty-zones-enable no
![[bug history graph]](https://qa.debian.org/data/bts/graphs/o/openstack-cluster-installer.png){kind=link}