Merge "Build Rocky based IPA images"

.ansible-lint

@@ -0,0 +1,37 @@
+---
+# NOTE(priteau): Rule file imported from kolla-ansible
+strict: true
+use_default_rules: true
+skip_list:
+  # [E301] Commands should not change things if nothing needs doing
+  # TODO(mnasiadka): Fix tasks that fail this check in a later iteration
+  - no-changed-when
+  # [E503] Tasks that run when changed should likely be handlers
+  - no-handler
+  # [unnamed-task] All tasks should be named
+  # FIXME(mgoddard): Add names to all tasks
+  - unnamed-task
+  # Package installs should not use latest
+  - package-latest
+  # NOTE(frickler): Agreed at Zed PTG not to use FQCN for builtin actions for now, due to
+  # conflicts with open patches and backports.
+  - fqcn-builtins
+  # Allow Jinja templating inside task and play names
+  - name[template]
+  # FQCNs again, now for module actions
+  - fqcn[action]
+  # role name check matching ^*$
+  - role-name
+  # Allow long lines
+  - yaml[line-length]
+  # TODO(frickler): Discuss these in detail, skipping for now to unblock things
+  - command-instead-of-module
+  - command-instead-of-shell
+  - deprecated-local-action
+  - key-order[task]
+  - name[play]
+  - risky-file-permissions
+  - risky-shell-pipe
+  - run-once[task]
+  - var-naming[no-reserved]
+  - var-naming[no-role-prefix]

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @stackhpc/kayobe

.github/workflows/tag-and-release.yml

@@ -0,0 +1,12 @@
+---
+name: Tag & Release
+'on':
+  push:
+    branches:
+      - stackhpc/master
+permissions:
+  actions: read
+  contents: write
+jobs:
+  tag-and-release:
+    uses: stackhpc/.github/.github/workflows/tag-and-release.yml@main

.github/workflows/tox.yml

@@ -0,0 +1,7 @@
+---
+name: Tox Continuous Integration
+'on':
+  pull_request:
+jobs:
+  tox:
+    uses: stackhpc/.github/.github/workflows/tox.yml@main

.gitignore

@@ -58,6 +58,7 @@ ansible/*.retry
 ansible/roles/*/tests/*.retry
 
 # Ansible Galaxy roles & collections
+.ansible
 ansible/roles/*\.*/
 ansible/collections/
 

ansible/action_plugins/template_content.py

@@ -0,0 +1,19 @@
+# Copyright (c) 2025 StackHPC Ltd.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+__metaclass__ = type
+
+import kayobe.plugins.action.template_content
+
+ActionModule = kayobe.plugins.action.template_content.ActionModule

ansible/apt.yml

@@ -1,6 +1,6 @@
 ---
 - name: Ensure APT is configured
-  hosts: seed-hypervisor:seed:overcloud:infra-vms
+  hosts: seed-hypervisor:seed:overcloud:infra-vms:ansible-control
   max_fail_percentage: >-
     {{ apt_max_fail_percentage |
        default(host_configure_max_fail_percentage) |
@@ -11,7 +11,7 @@
   tags:
     - apt
   tasks:
-    - name: include apt role
+    - name: Include apt role
       include_role:
         name: apt
       when: ansible_facts.os_family == 'Debian'

ansible/baremetal-compute-introspection-data-save.yml

@@ -8,11 +8,11 @@
     - name: Set up openstack cli virtualenv
       pip:
         virtualenv: "{{ venv }}"
-        virtualenv_command: python3 -m venv
         name:
           - python-openstackclient
-          - python-ironic-inspector-client
+          - python-ironicclient
         state: latest
+        virtualenv_command: python3.{{ ansible_facts.python.version.minor }} -m venv
         extra_args: "{% if pip_upper_constraints_file %}-c {{ pip_upper_constraints_file }}{% endif %}"
 
 - name: Ensure the baremetal compute nodes' hardware introspection data is saved
@@ -31,7 +31,7 @@
   tasks:
     - name: Query baremetal compute nodes' hardware introspection data
       command: >
-        {{ venv }}/bin/openstack baremetal introspection data save {{ inventory_hostname }}
+        {{ venv }}/bin/openstack baremetal node inventory save {{ inventory_hostname }}
       register: save_result
       changed_when: False
       # Ignore errors, log a message later.
@@ -44,14 +44,14 @@
         ansible_host: "{{ hostvars[controller_host].ansible_host | default(controller_host) }}"
 
     - name: Ensure introspection data output directory exists
-      local_action:
-        module: file
+      delegate_to: localhost
+      file:
         path: "{{ output_dir }}"
         state: directory
 
     - name: Ensure introspection data is saved locally
-      local_action:
-        module: copy
+      delegate_to: localhost
+      copy:
         content: "{{ introspection_data_map[output_format | lower] }}"
         dest: "{{ output_dir }}/{{ inventory_hostname }}.{{ output_format | lower }}"
       when: save_result.rc == 0

ansible/baremetal-compute-register.yml

@@ -39,42 +39,42 @@
         fail_msg: One or more Ironic variables are undefined.
 
     - block:
-      - name: Show baremetal node
-        ansible.builtin.command:
-          cmd: "{{ venv }}/bin/openstack baremetal node show {{ inventory_hostname }}"
-        register: node_show
-        failed_when:
-          - '"HTTP 404" not in node_show.stderr'
-          - node_show.rc != 0
-        changed_when: false
+        - name: Show baremetal node
+          ansible.builtin.command:
+            cmd: "{{ venv }}/bin/openstack baremetal node show {{ inventory_hostname }}"
+          register: node_show
+          failed_when:
+            - '"HTTP 404" not in node_show.stderr'
+            - node_show.rc != 0
+          changed_when: false
 
-      # NOTE: The openstack.cloud.baremetal_node module cannot be used in this
-      # script due to requiring a MAC address pre-defined, instead, this should
-      # be discovered by inpsection following this script.
-      #
-      # NOTE: IPMI address must be passed with Redfish address to ensure existing
-      # Ironic nodes match with new nodes during inspection.
-      - name: Create baremetal nodes
-        ansible.builtin.shell:
-          cmd: |
-            {{ venv }}/bin/openstack baremetal node create \
-            --name {{ inventory_hostname }} \
-            --driver {{ ironic_driver }} \
-            {% for key, value in ironic_driver_info.items() %}
-            --driver-info {{ key }}={{ value }} \
-            {% endfor %}
-            {% for key, value in ironic_properties.items() %}
-            --property {{ key }}={{ value }} \
-            {% endfor %}
-            --resource-class {{ ironic_resource_class }}
-        when:
-          - node_show.rc != 0
+        # NOTE: The openstack.cloud.baremetal_node module cannot be used in this
+        # script due to requiring a MAC address pre-defined, instead, this should
+        # be discovered by inpsection following this script.
+        #
+        # NOTE: IPMI address must be passed with Redfish address to ensure existing
+        # Ironic nodes match with new nodes during inspection.
+        - name: Create baremetal nodes
+          ansible.builtin.shell:
+            cmd: |
+              {{ venv }}/bin/openstack baremetal node create \
+              --name {{ inventory_hostname }} \
+              --driver {{ ironic_driver }} \
+              {% for key, value in ironic_driver_info.items() %}
+              --driver-info {{ key }}={{ value }} \
+              {% endfor %}
+              {% for key, value in ironic_properties.items() %}
+              --property {{ key }}={{ value }} \
+              {% endfor %}
+              --resource-class {{ ironic_resource_class }}
+          when:
+            - node_show.rc != 0
 
-      - name: Manage baremetal nodes
-        ansible.builtin.command:
-          cmd: "{{ venv }}/bin/openstack baremetal node manage {{ inventory_hostname }} --wait"
-        when:
-          - node_show.rc != 0
+        - name: Manage baremetal nodes
+          ansible.builtin.command:
+            cmd: "{{ venv }}/bin/openstack baremetal node manage {{ inventory_hostname }} --wait"
+          when:
+            - node_show.rc != 0
       delegate_to: "{{ controller_host }}"
       vars:
         # NOTE: Without this, the controller's ansible_host variable will not

ansible/baremetal-compute-rename.yml

@@ -5,7 +5,7 @@
 
 - name: Rename baremetal compute nodes
   hosts: controllers[0]
-  gather_facts: False
+  gather_facts: True
   vars:
     venv: "{{ virtualenv_path }}/openstack-cli"
   pre_tasks:
@@ -16,6 +16,7 @@
           - python-openstackclient
           - python-ironicclient
         state: latest
+        virtualenv_command: "python3.{{ ansible_facts.python.version.minor }} -m venv"
         extra_args: "{% if pip_upper_constraints_file %}-c {{ pip_upper_constraints_file }}{% endif %}"
 
 - name: Rename baremetal compute nodes
@@ -53,16 +54,16 @@
 
     - name: Rename baremetal compute nodes
       command: >
-        {{ venv }}/bin/openstack baremetal node set --name "{{ inventory_hostname }}" "{{ node['UUID'] }}"
+        {{ venv }}/bin/openstack baremetal node set --name "{{ inventory_hostname }}" "{{ node['uuid'] }}"
       delegate_to: "{{ controller_host }}"
       environment: "{{ openstack_auth_env }}"
       vars:
         # NOTE: Without this, the controller's ansible_host variable will not
         # be respected when using delegate_to.
         ansible_host: "{{ hostvars[controller_host].ansible_host | default(controller_host) }}"
         ipmi_address: "{{ hostvars[inventory_hostname].ipmi_address }}"
-        matching_nodes: "{{ (nodes.stdout | from_json) | selectattr('Driver Info.ipmi_address', 'defined') | selectattr('Driver Info.ipmi_address', 'equalto', ipmi_address) | list }}"
+        matching_nodes: "{{ (nodes.stdout | from_json) | selectattr('driver_info.ipmi_address', 'defined') | selectattr('driver_info.ipmi_address', 'equalto', ipmi_address) | list }}"
         node: "{{ matching_nodes | first }}"
       when:
         - matching_nodes | length > 0
-        - node['Name'] != inventory_hostname
+        - node['name'] != inventory_hostname