starlingx/openstack-armada-app
Code Issues Proposed changes

Sync master and f/epoxy branches

Browse Source 
This change ensures that the master branch is in sync with the f/epoxy
branch after the f/epoxy->master merge performed at [1].

[1]https://review.opendev.org/c/starlingx/openstack-armada-app/+/975838

Test Plan:
[PASS] Build openstack packages and tarball

Story: 2011516
Task: 53785

Change-Id: I328117c12286fe47551a1c3e51a066f57e58be73
Signed-off-by: Alex Figueiredo <alex.fernandesfigueiredo@windriver.com>
This commit is contained in:
Alex Figueiredo
2026-02-06 14:24:34 +00:00
committed by Alex Fernandes Figueirêdo
parent 8532437bef
commit 8488875c81
8 changed files with 2 additions and 875 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stx-openstack-helm-fluxcd/stx-openstack-helm-fluxcd/manifests/glance/glance-static-overrides.yaml
+2
View File
@@ -31,6 +31,8 @@ images:
glance_db_sync: docker.io/starlingx/stx-glance:master-debian-stable-latest
db_drop: docker.io/starlingx/stx-heat:master-debian-stable-latest
ks_user: docker.io/starlingx/stx-openstackclients:master-debian-stable-latest
ks_service: docker.io/starlingx/stx-heat:master-debian-stable-latest
ks_endpoints: docker.io/starlingx/stx-heat:master-debian-stable-latest
rabbit_init: docker.io/rabbitmq:3.13-management
glance_api: docker.io/starlingx/stx-glance:master-debian-stable-latest
# Bootstrap image requires curl
upstream/helm-charts/openstack-helm/debian/deb_folder/patches/0025-Add-volume-storage-class-priorities.patch
-57
View File
@@ -1,57 +0,0 @@
From cdad5b37e60f36d9b88e0e2ec79c666fffbcfae8 Mon Sep 17 00:00:00 2001
From: jchialun <johnny.chialung@windriver.com>
Date: Wed, 19 Nov 2025 14:56:26 -0500
Subject: [PATCH 1/1] Add volume storage class priorities
Added volume_storage_class_priority list to values.yaml file to enable
external applications to update the value. This list represents the
priority order for creation of the Kubernetes PVCs StorageClasses for
MariaDB and RabbitMQ. The highest available storage class will be
selected as the k8s volume storageClass
Signed-off-by: Johnny Chia <johnny.chialung@windriver.com>
---
mariadb/values.yaml | 8 ++++++++
rabbitmq/values.yaml | 7 +++++++
2 files changed, 15 insertions(+)
diff --git a/mariadb/values.yaml b/mariadb/values.yaml
index 9eb81231..66740a2c 100644
--- a/mariadb/values.yaml
+++ b/mariadb/values.yaml
@@ -740,6 +740,14 @@ network_policy:
# Set helm3_hook: false in case helm2 is used.
helm3_hook: true
+storage_conf:
+ volume_storage_class_priority:
+ - "ceph"
+ - "netapp-nfs"
+ - "netapp-iscsi"
+ - "netapp-fc"
+
+
manifests:
certificates: false
configmap_bin: true
diff --git a/rabbitmq/values.yaml b/rabbitmq/values.yaml
index fbb98414..99b2833c 100644
--- a/rabbitmq/values.yaml
+++ b/rabbitmq/values.yaml
@@ -441,6 +441,13 @@ io_thread_pool:
enabled: false
size: 64
+storage_conf:
+ volume_storage_class_priority:
+ - "ceph"
+ - "netapp-nfs"
+ - "netapp-iscsi"
+ - "netapp-fc"
+
manifests:
certificates: false
configmap_bin: true
--
2.43.0
upstream/helm-charts/openstack-helm/debian/deb_folder/patches/0029-Add-DEX-integration.patch
-177
View File
@@ -1,177 +0,0 @@
From e252d383d9973c33192b5e4b969b5f777947df63 Mon Sep 17 00:00:00 2001
From: Daniel Caires <DanielMarques.Caires@windriver.com>
Date: Thu, 23 Oct 2025 10:07:47 -0300
Subject: [PATCH] Add DEX integration
Dex is an Opensource identity provider that acts as identity
broker, that allows applications to use a single OpenID
Connect (OIDC) integration to authenticate users against
various existing identity providers. It is delivered to Starlingx
through the oidc-auth-apps application.
This patch integrates DEX to StarligX Openstack using a
federated SSO provider and creating the necessary openstack
resources to allow STX-O to use DEX as an identity provider.
Change-Id: I8540dce2dd0f1d1100872cec0ddf3a9e6df9ae81
Signed-off-by: Daniel Caires <DanielMarques.Caires@windriver.com>
[ Add DEX http requests configurations ]
Signed-off-by: cbohlhal <Caique.BohlhalterdeSouza@windriver.com>
---
keystone/templates/bin/_bootstrap.sh.tpl | 4 +++
keystone/templates/configmap-bin.yaml | 12 ++++++
keystone/templates/job-bootstrap.yaml | 8 ++++-
keystone/values.yaml | 81 +++++++++++++++++++++++++++++++
4 files changed, 104 insertions(+), 1 deletion(-)
diff --git a/keystone/templates/bin/_bootstrap.sh.tpl b/keystone/templates/bin/_bootstrap.sh.tpl
index c325824d8..7b268548c 100644
--- a/keystone/templates/bin/_bootstrap.sh.tpl
+++ b/keystone/templates/bin/_bootstrap.sh.tpl
@@ -17,3 +17,7 @@ limitations under the License.
set -ex
{{ .Values.bootstrap.script | default "echo 'Not Enabled'" }}
+
+if [ -f /tmp/dex-bootstrap.sh ]; then
+ bash /tmp/dex-bootstrap.sh
+fi
diff --git a/keystone/templates/configmap-bin.yaml b/keystone/templates/configmap-bin.yaml
index 45512d3ec..d55ed5672 100644
--- a/keystone/templates/configmap-bin.yaml
+++ b/keystone/templates/configmap-bin.yaml
@@ -55,4 +55,16 @@ data:
{{ tuple "bin/_domain-manage.py.tpl" . | include "helm-toolkit.utils.template" | indent 4 }}
rabbit-init.sh: |
{{- include "helm-toolkit.scripts.rabbit_init" . | indent 4 }}
+{{- if .Values.conf.federation.dex_idp.enabled}}
+ dex_mapping.json: |
+{{- if .Values.conf.federation.dex_idp.claim_groups }}
+{{ tpl .Values.conf.federation.dex_idp.groups_mapping . | indent 4 }}
+{{- else }}
+{{ tpl .Values.conf.federation.dex_idp.default_mapping . | indent 4 }}
+{{- end }}
+{{- if .Values.conf.federation.dex_idp.bootstrap.enabled }}
+ dex-bootstrap.sh: |
+{{ tpl .Values.conf.federation.dex_idp.bootstrap.script . | indent 4 }}
+{{- end }}
+{{- end }}
{{- end }}
diff --git a/keystone/templates/job-bootstrap.yaml b/keystone/templates/job-bootstrap.yaml
index 37ce4a481..cae003b9b 100644
--- a/keystone/templates/job-bootstrap.yaml
+++ b/keystone/templates/job-bootstrap.yaml
@@ -17,8 +17,14 @@ helm.sh/hook: post-install,post-upgrade
helm.sh/hook-weight: "5"
{{- end }}
+{{- $podVolMounts := list }}
+{{- if and (.Values.conf.federation.dex_idp.bootstrap.enabled) (.Values.conf.federation.dex_idp.enabled) }}
+{{- $podVolMounts = append $podVolMounts (dict "name" "bootstrap-sh" "mountPath" "/tmp/dex_mapping.json" "subPath" "dex_mapping.json" "readOnly" true) }}
+{{- $podVolMounts = append $podVolMounts (dict "name" "bootstrap-sh" "mountPath" "/tmp/dex-bootstrap.sh" "subPath" "dex-bootstrap.sh" "readOnly" true) }}
+{{- end }}
+
{{- if and .Values.manifests.job_bootstrap .Values.bootstrap.enabled }}
-{{- $bootstrapJob := dict "envAll" . "serviceName" "keystone" "keystoneUser" .Values.bootstrap.ks_user "logConfigFile" .Values.conf.keystone.DEFAULT.log_config_append "jobAnnotations" (include "metadata.annotations.job.bootstrap" . | fromYaml) -}}
+{{- $bootstrapJob := dict "envAll" . "serviceName" "keystone" "keystoneUser" .Values.bootstrap.ks_user "logConfigFile" .Values.conf.keystone.DEFAULT.log_config_append "jobAnnotations" (include "metadata.annotations.job.bootstrap" . | fromYaml) "podVolMounts" $podVolMounts -}}
{{- if and ( or .Values.manifests.certificates .Values.tls.identity) .Values.secrets.tls.identity.api.public -}}
{{- $_ := set $bootstrapJob "tlsSecret" .Values.secrets.tls.identity.api.public -}}
{{- end -}}
diff --git a/keystone/values.yaml b/keystone/values.yaml
index 7e262d5f9..d1a4bea83 100644
--- a/keystone/values.yaml
+++ b/keystone/values.yaml
@@ -565,6 +565,91 @@ conf:
# NOTE(vdrok): The following two options have effect only for SQL backend
lockout_failure_attempts: 5
lockout_duration: 1800
+ federation:
+ wsgi:
+ OIDCClaimPrefix: "OIDC-"
+ OIDCRemoteUserClaim: "email"
+ OIDCScope: "openid profile email"
+ OIDCClientID: "stx-oidc-client-app"
+ OIDCResponseType: "code"
+ OIDCSSLValidateServer: "Off"
+ OIDCPassClaimsAs: "both"
+ OIDCOAuthSSLValidateServer: "Off"
+ OIDCEnableMemcached: true
+ # Delimiter for multi-valued claims (Keystone expects semicolon for groups)
+ OIDCClaimDelimiter: ";"
+ dex_conf:
+ verify: False
+ retries: 1
+ timeout: 5
+ probe_endpoint: "/healthz"
+ dex_idp:
+ # Enable DEX integration
+ enabled: false
+ provider_name: "dex"
+ provider_remote_id: "https://0.0.0.0:30556/dex" # This IP is the one used in the DEX configuration
+ protocol_name: "openid"
+ group_name: "federated_users"
+ project_name: "federation"
+ mapping_name: "dex_mapping"
+ # Horizon WebSSO configuration
+ websso_label: "Login with DEX SSO"
+ websso_initial_choice: "credentials"
+ # Enable group-based authentication (groups from OIDC provider)
+ claim_groups: false
+ # Groups to create when claim_groups is enabled (project defaults to <name>_project, role defaults to member)
+ groups: []
+ # groups:
+ # - name: developers
+ # project: dev_project
+ # role: admin
+ # - name: operators
+ # Mapping for claim_groups: false
+ default_mapping: |
+ [{
+ "local": [{
+ "user": {"name": "{0}"},
+ "group": {"name": "{{ .Values.conf.federation.dex_idp.group_name }}", "domain": {"name": "Default"}}
+ }],
+ "remote": [{"type": "OIDC-email"}]
+ }]
+ # Mapping for claim_groups: true
+ # Maps OIDC groups directly to Keystone groups (groups must exist in Keystone)
+ groups_mapping: |
+ [{
+ "local": [
+ {"user": {"name": "{0}"}},
+ {"groups": "{1}", "domain": {"name": "Default"}}
+ ],
+ "remote": [
+ {"type": "OIDC-email"},
+ {"type": "OIDC-groups"}
+ ]
+ }]
+ # Add DEX extra bootstrap commands to keystone bootstrap
+ bootstrap:
+ enabled: true
+ script: |
+ openstack role create member 2>/dev/null || true
+ openstack role create admin 2>/dev/null || true
+ {{- if .Values.conf.federation.dex_idp.claim_groups }}
+ {{- range .Values.conf.federation.dex_idp.groups }}
+ {{- $groupName := .name }}
+ {{- $projectName := .project | default (printf "%s_project" .name) }}
+ {{- $roleName := .role | default "member" }}
+ openstack group create {{ $groupName }} 2>/dev/null || true
+ openstack project create {{ $projectName }} 2>/dev/null || true
+ openstack role add --group {{ $groupName }} --project {{ $projectName }} {{ $roleName }} 2>/dev/null || true
+ {{- end }}
+ {{- else }}
+ openstack group create {{ .Values.conf.federation.dex_idp.group_name }} 2>/dev/null || true
+ openstack project create {{ .Values.conf.federation.dex_idp.project_name }} 2>/dev/null || true
+ openstack role add --group {{ .Values.conf.federation.dex_idp.group_name }} --project {{ .Values.conf.federation.dex_idp.project_name }} member 2>/dev/null || true
+ {{- end }}
+ openstack identity provider create {{ .Values.conf.federation.dex_idp.provider_name }} --remote-id {{ .Values.conf.federation.dex_idp.provider_remote_id }} 2>/dev/null || true
+ openstack mapping create --rules /tmp/dex_mapping.json {{ .Values.conf.federation.dex_idp.mapping_name }} 2>/dev/null || \
+ openstack mapping set --rules /tmp/dex_mapping.json {{ .Values.conf.federation.dex_idp.mapping_name }}
+ openstack federation protocol create {{ .Values.conf.federation.dex_idp.protocol_name }} --identity-provider {{ .Values.conf.federation.dex_idp.provider_name }} --mapping {{ .Values.conf.federation.dex_idp.mapping_name }} 2>/dev/null || true
# NOTE(lamt) We can leverage multiple domains with different
# configurations as outlined in
# https://docs.openstack.org/keystone/pike/admin/identity-domain-specific-config.html.
--
2.34.1
upstream/helm-charts/openstack-helm/debian/deb_folder/patches/0030-Add-Netapp-backend-support-to-Cinder.patch
-237
View File
@@ -1,237 +0,0 @@
From f4a89b354d90078cb82539bde4fd95759622c6cf Mon Sep 17 00:00:00 2001
From: Joao Fracarolli <joao.vicentinifracarolli@windriver.com>
Date: Wed, 26 Nov 2025 11:36:33 -0300
Subject: [PATCH] Add Netapp backend support to Cinder
This patch modifies Cinder's helm chart and shell templates
to add support for NetApp backends. This includes:
- Add logic to check if a given backend is enabled when
creating it's specific resources and mounts
- Add new utils templates to improve the templates readability
and to help implementing the conditional rendering
Change-Id: Id10aa9f85cabd622b62b1dc851fa50cb863987bd
Signed-off-by: Joao Fracarolli <joao.vicentinifracarolli@windriver.com>
[Mount cinder volumes to support NetApp iSCSI]
This change updates the patch by mounting a new volume
required by cinder/ssh_utils.py to enable the creation and updating of
the /var/lib/cinder/ssh_known_hosts file [3] during iSCSI session
initializations.
[1]https://review.opendev.org/c/openstack/openstack-helm/+/704429
[2]https://review.opendev.org/c/starlingx/openstack-armada-app/+/968753
[3]https://opendev.org/openstack/cinder/src/commit/b87d45b3c87ad836d94c7bcbde1dbaeff5f1caae/cinder/ssh_utils.py#L82
Signed-off-by: Alex Figueiredo <alex.fernandesfigueiredo@windriver.com>
[Removes Cinder state path mounts]
Cinder state path can be mounted dynamically by overriding the
`pod.mounts.cinder_volume` and `pod.mounts.cinder_backup` when required
per cinder storage backend.
Signed-off-by: Alex Figueiredo <alex.fernandesfigueiredo@windriver.com>
---
cinder/templates/bin/_storage-init.sh.tpl | 5 ++++
cinder/templates/deployment-volume.yaml | 4 ++-
cinder/templates/job-storage-init.yaml | 18 +++++++----
cinder/templates/utils/_has_ceph_backend.tpl | 4 ++-
.../templates/utils/_has_netapp_backend.tpl | 25 ++++++++++++++++
.../templates/utils/_is_backend_enabled.tpl | 30 +++++++++++++++++++
6 files changed, 78 insertions(+), 8 deletions(-)
create mode 100644 cinder/templates/utils/_has_netapp_backend.tpl
create mode 100644 cinder/templates/utils/_is_backend_enabled.tpl
diff --git a/cinder/templates/bin/_storage-init.sh.tpl b/cinder/templates/bin/_storage-init.sh.tpl
index 53b0b071c..a04cc0856 100644
--- a/cinder/templates/bin/_storage-init.sh.tpl
+++ b/cinder/templates/bin/_storage-init.sh.tpl
@@ -14,6 +14,11 @@ See the License for the specific language governing permissions and
limitations under the License.
*/}}
+set -x
+if [ "x$STORAGE_BACKEND" == "xcinder.volume.drivers.netapp.common.NetAppDriver" ]; then
+ echo "INFO: no action required to use ${STORAGE_BACKEND}"
+fi
+
set -x
if [ "x$STORAGE_BACKEND" == "xcinder.volume.drivers.rbd.RBDDriver" ]; then
SECRET=$(mktemp --suffix .yaml)
diff --git a/cinder/templates/deployment-volume.yaml b/cinder/templates/deployment-volume.yaml
index e82128501..20803b5a6 100644
--- a/cinder/templates/deployment-volume.yaml
+++ b/cinder/templates/deployment-volume.yaml
@@ -74,6 +74,7 @@ spec:
{{ tuple $envAll "volume" $mounts_cinder_volume_init | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
{{- range $name := rest (splitList "," (include "cinder.utils.ceph_backend_list" $envAll)) }}
{{- $backend := index $envAll.Values.conf.backends $name }}
+ {{- if eq "true" (tuple $envAll $name | include "cinder.utils.is_backend_enabled") -}}
{{- if eq $internal_ceph_backend $name }}
- name: ceph-keyring-placement-{{ $name | lower }}
{{ tuple $envAll "cinder_volume" | include "helm-toolkit.snippets.image" | indent 10 }}
@@ -107,6 +108,7 @@ spec:
readOnly: true
{{- end }}
{{- end }}
+ {{- end }}
{{- end }}
{{- if eq ( split "://" .Values.conf.cinder.coordination.backend_url )._0 "file" }}
- name: ceph-coordination-volume-perms
@@ -188,7 +190,7 @@ spec:
mountPath: /etc/cinder/conf/backends.conf
subPath: backends.conf
readOnly: true
- {{- if hasKey .Values.conf "nfs_shares" }}
+ {{- if and (eq "true" (include "cinder.utils.has_netapp_backend" $envAll)) (hasKey .Values.conf "nfs_shares") }}
- name: cinder-etc
mountPath: /etc/cinder/nfs.shares
subPath: nfs.shares
diff --git a/cinder/templates/job-storage-init.yaml b/cinder/templates/job-storage-init.yaml
index 6a63ce4a0..b1dca36bf 100755
--- a/cinder/templates/job-storage-init.yaml
+++ b/cinder/templates/job-storage-init.yaml
@@ -103,8 +103,7 @@ spec:
{{ end }}
containers:
{{- range $name, $backend := .Values.conf.backends }}
- {{- if (eq "true" ( dict "backend" $backend | include "cinder.utils.is_ceph_backend" )) }}
- {{- if eq $internal_ceph_backend $name }}
+ {{- if eq "true" (tuple $envAll $name | include "cinder.utils.is_backend_enabled") }}
- name: cinder-storage-init-{{ $name | lower }}
{{ tuple $envAll "cinder_storage_init" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ tuple $envAll $envAll.Values.pod.resources.jobs.storage_init | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
@@ -115,6 +114,8 @@ spec:
fieldPath: metadata.namespace
- name: STORAGE_BACKEND
value: {{ $backend.volume_driver | quote }}
+ {{- if (eq "true" ( dict "backend" $backend | include "cinder.utils.is_ceph_backend" )) }}
+ {{- if eq $internal_ceph_backend $name }}
- name: RBD_POOL_NAME
value: {{ $backend.rbd_pool | quote }}
- name: RBD_POOL_APP_NAME
@@ -129,6 +130,8 @@ spec:
value: {{ (index $envAll.Values.conf.ceph.pools $backend.rbd_pool).chunk_size | quote }}
- name: RBD_POOL_SECRET
value: {{ $envAll.Values.secrets.rbd.volume | quote }}
+ {{- end }}
+ {{- end }}
command:
- /tmp/storage-init.sh
volumeMounts:
@@ -138,21 +141,24 @@ spec:
mountPath: /tmp/storage-init.sh
subPath: storage-init.sh
readOnly: true
+ {{- if (eq "true" ( dict "backend" $backend | include "cinder.utils.is_ceph_backend" )) }}
+ {{- if eq $internal_ceph_backend $name }}
- name: etcceph
mountPath: /etc/ceph
- name: ceph-etc
mountPath: /etc/ceph/ceph.conf
subPath: ceph.conf
readOnly: true
- {{- if empty $envAll.Values.conf.ceph.admin_keyring }}
+ {{- if empty $envAll.Values.conf.ceph.admin_keyring }}
- name: ceph-keyring
mountPath: /tmp/client-keyring
subPath: key
readOnly: true
- {{- end }}
- {{- end }}
+ {{- end }}
+ {{- end }}
+ {{- end }}
+ {{- end }}
{{- end }}
- {{- end }}
volumes:
- name: pod-tmp
emptyDir: {}
diff --git a/cinder/templates/utils/_has_ceph_backend.tpl b/cinder/templates/utils/_has_ceph_backend.tpl
index bf975bb37..4e4f21e97 100644
--- a/cinder/templates/utils/_has_ceph_backend.tpl
+++ b/cinder/templates/utils/_has_ceph_backend.tpl
@@ -16,7 +16,9 @@ limitations under the License.
{{- $has_ceph := false -}}
{{- range $_, $backend := .Values.conf.backends -}}
{{- if kindIs "map" $backend -}}
- {{- $has_ceph = or $has_ceph (eq $backend.volume_driver "cinder.volume.drivers.rbd.RBDDriver") -}}
+ {{- if eq "true" (tuple $ $backend.volume_backend_name | include "cinder.utils.is_backend_enabled") -}}
+ {{- $has_ceph = or $has_ceph (eq $backend.volume_driver "cinder.volume.drivers.rbd.RBDDriver") -}}
+ {{- end -}}
{{- end -}}
{{- end -}}
{{- $has_ceph -}}
diff --git a/cinder/templates/utils/_has_netapp_backend.tpl b/cinder/templates/utils/_has_netapp_backend.tpl
new file mode 100644
index 000000000..f791b804c
--- /dev/null
+++ b/cinder/templates/utils/_has_netapp_backend.tpl
@@ -0,0 +1,25 @@
+{{/*
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{- define "cinder.utils.has_netapp_backend" -}}
+ {{- $has_netapp := false -}}
+ {{- range $_, $backend := .Values.conf.backends -}}
+ {{- if kindIs "map" $backend -}}
+ {{- if eq "true" (tuple $ $backend.volume_backend_name | include "cinder.utils.is_backend_enabled") -}}
+ {{- $has_netapp = or $has_netapp (eq $backend.volume_driver "cinder.volume.drivers.netapp.common.NetAppDriver") -}}
+ {{- end -}}
+ {{- end -}}
+ {{- end -}}
+ {{- $has_netapp -}}
+{{- end -}}
diff --git a/cinder/templates/utils/_is_backend_enabled.tpl b/cinder/templates/utils/_is_backend_enabled.tpl
new file mode 100644
index 000000000..514187f6f
--- /dev/null
+++ b/cinder/templates/utils/_is_backend_enabled.tpl
@@ -0,0 +1,30 @@
+{{/*
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{- /*
+ Returns true if a given backend is enabled by checking the
+ Values.conf.cinder.DEFAULT.enabled_backends configuration
+
+ Usage:
+ $is_enabled := (tuple $ctx $backend | include "cinder.utils.is_backend_enabled")
+*/ -}}
+
+{{- define "cinder.utils.is_backend_enabled" -}}
+ {{- $args := . -}}
+ {{- $ctx := index $args 0 -}}
+ {{- $backend := index $args 1 -}}
+ {{- $enabled_backends := $ctx.Values.conf.cinder.DEFAULT.enabled_backends -}}
+ {{- $backend_list := splitList "," $enabled_backends -}}
+ {{- printf "%v" (has $backend $backend_list) -}}
+{{- end -}}
\ No newline at end of file
--
2.34.1
upstream/helm-charts/openstack-helm/debian/deb_folder/patches/0031-Update-glance-store-config.patch
-285
View File
@@ -1,285 +0,0 @@
From fbb58d9c25aa112164a3deeeb18a869b9e67832c Mon Sep 17 00:00:00 2001
From: vrochalo <vinicius.rochalobo@windriver.com>
Date: Tue, 25 Nov 2025 11:14:27 -0300
Subject: [PATCH] Update glance store config
This patch syncs the Glance backend configuration with
the updated model from OpenStack-Helm. The upstream
version referenced by Armada still included deprecated
backend fields, which were removed or updated in later
commits (884fdc05c94b, ff1582dd3a92, c4c80371f9a3).
Their relevant changes were consolidated into this single
patch, keeping only what is needed to update the backend
configuration and enable the newer backend workflow
(including NetApp integration).
Signed-off-by: vrochalo <Vinicius.RochaLobo@windriver.com>
---
glance/Chart.yaml | 2 +-
glance/templates/configmap-etc.yaml | 30 ++++++++++++--------------
glance/templates/deployment-api.yaml | 17 +++++++++------
glance/templates/job-storage-init.yaml | 19 +++++-----------
glance/templates/pvc-images.yaml | 2 +-
glance/values.yaml | 27 +++++++++++++++++++++++
glance/values_overrides/tls.yaml | 1 +
releasenotes/notes/glance.yaml | 4 ++++
8 files changed, 64 insertions(+), 38 deletions(-)
diff --git a/glance/Chart.yaml b/glance/Chart.yaml
index c5adfefa..549138c8 100644
--- a/glance/Chart.yaml
+++ b/glance/Chart.yaml
@@ -14,7 +14,7 @@ apiVersion: v1
appVersion: v1.0.0
description: OpenStack-Helm Glance
name: glance
-version: 0.4.23
+version: 0.5.0
home: https://docs.openstack.org/glance/latest/
icon: https://www.openstack.org/themes/openstack/images/project-mascots/Glance/OpenStack_Project_Glance_vertical.png
sources:
diff --git a/glance/templates/configmap-etc.yaml b/glance/templates/configmap-etc.yaml
index 210560b0..70dfd040 100644
--- a/glance/templates/configmap-etc.yaml
+++ b/glance/templates/configmap-etc.yaml
@@ -68,27 +68,25 @@ limitations under the License.
{{- $_ := tuple "image" "public" "api" . | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup" | set .Values.conf.glance.DEFAULT "public_endpoint" -}}
{{- end -}}
-{{- if empty .Values.conf.glance.glance_store.stores -}}
+{{- if empty .Values.conf.glance.DEFAULT.enabled_backends -}}
{{- if eq .Values.storage "rbd" }}
-{{- $_ := "file, http, rbd" | set .Values.conf.glance.glance_store "stores" -}}
-{{- end -}}
-{{- if eq .Values.storage "pvc" }}
-{{- $_ := "file, http" | set .Values.conf.glance.glance_store "stores" -}}
-{{- end -}}
-{{ if or (eq .Values.storage "radosgw") (eq .Values.storage "swift") }}
-{{- $_ := "file, http, swift" | set .Values.conf.glance.glance_store "stores" -}}
+{{- $_ := "file:file,http:http,rbd:rbd" | set .Values.conf.glance.DEFAULT "enabled_backends" -}}
+{{- else if or (eq .Values.storage "radosgw") (eq .Values.storage "swift") }}
+{{- $_ := "file:file,http:http,swift:swift" | set .Values.conf.glance.DEFAULT "enabled_backends" -}}
+{{- else -}}
+{{/* pvc, local (hostPath) or other/ephemeral (emptyDir) */}}
+{{- $_ := "file:file,http:http" | set .Values.conf.glance.DEFAULT "enabled_backends" -}}
{{- end -}}
{{- end -}}
-{{- if empty .Values.conf.glance.glance_store.default_store -}}
+{{- if empty .Values.conf.glance.glance_store.default_backend -}}
{{- if eq .Values.storage "rbd" }}
-{{- $_ := "rbd" | set .Values.conf.glance.glance_store "default_store" -}}
-{{- end -}}
-{{- if eq .Values.storage "pvc" }}
-{{- $_ := "file" | set .Values.conf.glance.glance_store "default_store" -}}
-{{- end -}}
-{{ if or (eq .Values.storage "radosgw") (eq .Values.storage "swift") }}
-{{- $_ := "swift" | set .Values.conf.glance.glance_store "default_store" -}}
+{{- $_ := "rbd" | set .Values.conf.glance.glance_store "default_backend" -}}
+{{- else if or (eq .Values.storage "radosgw") (eq .Values.storage "swift") }}
+{{- $_ := "swift" | set .Values.conf.glance.glance_store "default_backend" -}}
+{{- else -}}
+{{/* pvc, local (hostPath) or other/ephemeral (emptyDir) */}}
+{{- $_ := "file" | set .Values.conf.glance.glance_store "default_backend" -}}
{{- end -}}
{{- end -}}
diff --git a/glance/templates/deployment-api.yaml b/glance/templates/deployment-api.yaml
index 3ba5f17a..4cb910a6 100644
--- a/glance/templates/deployment-api.yaml
+++ b/glance/templates/deployment-api.yaml
@@ -89,19 +89,19 @@ spec:
- chown
- -R
- "glance:"
- - {{ .Values.conf.glance.glance_store.filesystem_store_datadir }}
+ - {{ .Values.conf.glance.file.filesystem_store_datadir }}
volumeMounts:
- name: pod-tmp
mountPath: /tmp
- name: glance-images
- mountPath: {{ .Values.conf.glance.glance_store.filesystem_store_datadir }}
+ mountPath: {{ .Values.conf.glance.file.filesystem_store_datadir }}
{{ if eq .Values.storage "rbd" }}
- name: ceph-keyring-placement
{{ tuple $envAll "glance_api" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ dict "envAll" $envAll "application" "glance" "container" "ceph_keyring_placement" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env:
- name: RBD_STORE_USER
- value: {{ .Values.conf.glance.glance_store.rbd_store_user | quote }}
+ value: {{ .Values.conf.glance.rbd.rbd_store_user | quote }}
command:
- /tmp/ceph-keyring.sh
volumeMounts:
@@ -209,11 +209,11 @@ spec:
{{- end }}
{{- end }}
- name: glance-etc
- mountPath: {{ .Values.conf.glance.glance_store.swift_store_config_file }}
+ mountPath: {{ .Values.conf.glance.swift.swift_store_config_file }}
subPath: swift-store.conf
readOnly: true
- name: glance-images
- mountPath: {{ .Values.conf.glance.glance_store.filesystem_store_datadir }}
+ mountPath: {{ .Values.conf.glance.file.filesystem_store_datadir }}
{{- if eq .Values.storage "cinder" }}
- name: host-rootfs
mountPath: /mnt/host-rootfs
@@ -287,7 +287,12 @@ spec:
- name: glance-images
persistentVolumeClaim:
claimName: glance-images
-{{ else }}
+{{ else if eq .Values.storage "local" }}
+ - name: glance-images
+ hostPath:
+ path: {{ .Values.conf.glance.file.filesystem_store_datadir }}
+ type: DirectoryOrCreate
+{{- else }}
- name: glance-images
emptyDir: {}
{{- end }}
diff --git a/glance/templates/job-storage-init.yaml b/glance/templates/job-storage-init.yaml
index 22cd4109..5e6a210a 100644
--- a/glance/templates/job-storage-init.yaml
+++ b/glance/templates/job-storage-init.yaml
@@ -114,17 +114,17 @@ spec:
value: {{ .Values.storage | quote }}
{{- if eq .Values.storage "rbd" }}
- name: RBD_POOL_NAME
- value: {{ .Values.conf.glance.glance_store.rbd_store_pool | quote }}
+ value: {{ .Values.conf.glance.rbd.rbd_store_pool | quote }}
- name: RBD_POOL_APP_NAME
value: {{ .Values.conf.software.rbd.rbd_store_pool_app_name | quote }}
- name: RBD_POOL_USER
- value: {{ .Values.conf.glance.glance_store.rbd_store_user | quote }}
+ value: {{ .Values.conf.glance.rbd.rbd_store_user | quote }}
- name: RBD_POOL_REPLICATION
- value: {{ .Values.conf.glance.glance_store.rbd_store_replication | quote }}
+ value: {{ .Values.conf.glance.rbd.rbd_store_replication | quote }}
- name: RBD_POOL_CRUSH_RULE
- value: {{ .Values.conf.glance.glance_store.rbd_store_crush_rule | quote }}
+ value: {{ .Values.conf.glance.rbd.rbd_store_crush_rule | quote }}
- name: RBD_POOL_CHUNK_SIZE
- value: {{ .Values.conf.glance.glance_store.chunk_size | quote }}
+ value: {{ .Values.conf.glance.rbd.chunk_size | quote }}
- name: RBD_POOL_SECRET
value: {{ .Values.secrets.rbd | quote }}
{{ end }}
@@ -166,10 +166,6 @@ spec:
readOnly: true
{{ end }}
{{ end }}
- {{- if eq .Values.storage "pvc" }}
- - name: glance-images
- mountPath: {{ .Values.conf.glance.glance_store.filesystem_store_datadir }}
- {{ end }}
{{- dict "enabled" .Values.manifests.certificates "name" .Values.secrets.tls.image.api.public | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
volumes:
- name: pod-tmp
@@ -191,10 +187,5 @@ spec:
secretName: {{ .Values.ceph_client.user_secret_name }}
{{ end }}
{{ end }}
- {{- if eq .Values.storage "pvc" }}
- - name: glance-images
- persistentVolumeClaim:
- claimName: glance-images
- {{ end }}
{{- dict "enabled" .Values.manifests.certificates "name" .Values.secrets.tls.image.api.public | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
{{- end }}
diff --git a/glance/templates/pvc-images.yaml b/glance/templates/pvc-images.yaml
index 21ea9613..9451a959 100644
--- a/glance/templates/pvc-images.yaml
+++ b/glance/templates/pvc-images.yaml
@@ -25,7 +25,7 @@ metadata:
helm.sh/resource-policy: keep
{{- end }}
spec:
- accessModes: [ "ReadWriteOnce" ]
+ accessModes: {{ .Values.volume.accessModes }}
resources:
requests:
storage: {{ .Values.volume.size }}
diff --git a/glance/values.yaml b/glance/values.yaml
index c902bcab..bad40e5c 100644
--- a/glance/values.yaml
+++ b/glance/values.yaml
@@ -263,6 +263,10 @@ conf:
memcache_security_strategy: ENCRYPT
service_type: image
glance_store:
+ # Since 2024.1 this section must contain the only key 'default_backend'.
+ # Other keys should be defined in the corresponding per-backend sections.
+ # This is for backward compatibility.
+ filesystem_store_datadir: /var/lib/glance/images
cinder_catalog_info: volumev3::internalURL
chunk_size: 8
rbd_store_replication: 3
@@ -270,7 +274,28 @@ conf:
rbd_store_pool: glance.images
rbd_store_user: glance
rbd_store_ceph_conf: /etc/ceph/ceph.conf
+ default_swift_reference: ref1
+ swift_store_container: glance
+ swift_store_create_container_on_put: true
+ swift_store_config_file: /etc/glance/swift-store.conf
+ swift_store_endpoint_type: internalURL
+ file:
filesystem_store_datadir: /var/lib/glance/images
+ # These two sections os_glance_tasks_store and os_glance_staging_store
+ # are mandatory. Glance will be unable to delete images from if these
+ # two are not properly configured.
+ os_glance_tasks_store:
+ filesystem_store_datadir: /var/lib/glance/tmp/os_glance_tasks_store
+ os_glance_staging_store:
+ filesystem_store_datadir: /var/lib/glance/tmp/os_glance_staging_store
+ rbd:
+ rbd_store_chunk_size: 8
+ rbd_store_replication: 3
+ rbd_store_crush_rule: replicated_rule
+ rbd_store_pool: glance.images
+ rbd_store_user: glance
+ rbd_store_ceph_conf: /etc/ceph/ceph.conf
+ swift:
default_swift_reference: ref1
swift_store_container: glance
swift_store_create_container_on_put: true
@@ -427,6 +452,8 @@ network:
volume:
class_name: general
size: 2Gi
+ accessModes:
+ - ReadWriteOnce
dependencies:
dynamic:
diff --git a/glance/values_overrides/tls.yaml b/glance/values_overrides/tls.yaml
index d1aa35ad..86cba608 100644
--- a/glance/values_overrides/tls.yaml
+++ b/glance/values_overrides/tls.yaml
@@ -7,6 +7,7 @@ conf:
keystone_authtoken:
cafile: /etc/glance/certs/ca.crt
glance_store:
+ # This option has been removed in 2024.1
https_ca_certificates_file: /etc/glance/certs/ca.crt
swift_store_cacert: /etc/glance/certs/ca.crt
oslo_messaging_rabbit:
diff --git a/releasenotes/notes/glance.yaml b/releasenotes/notes/glance.yaml
index 3456e15c..f3438339 100644
--- a/releasenotes/notes/glance.yaml
+++ b/releasenotes/notes/glance.yaml
@@ -57,4 +57,8 @@ glance:
- 0.4.21 Use uWSGI
- 0.4.22 Enable custom annotations for Openstack secrets
- 0.4.23 Update images used by default
+ - 0.4.24 Do not attach backend pvc to storage init pod
+ - 0.4.25 Allow customisation of pvc storage accessMode so we can run multiple api pods
+ - 0.4.26 Use quay.io/airshipit/kubernetes-entrypoint:latest-ubuntu_focal by default
+ - 0.5.0 Remove deprecated config options `stores` and `default_store`
...
--
2.34.1
upstream/helm-charts/openstack-helm/debian/deb_folder/patches/0032-Add-backend-checks-to-skip-Ceph-init-for-NetApp-stor.patch
-33
View File
@@ -1,33 +0,0 @@
From dc2d4dae1df45be1d0a6f27b1bd3edf72ae355e2 Mon Sep 17 00:00:00 2001
From: Thiago Miranda <tmarques@windriver.com>
Date: Mon, 22 Dec 2025 18:38:00 -0300
Subject: [PATCH] Add backend checks to skip Ceph init for NetApp storage
Introduce conditional logic to skip Ceph initialization when using
NetApp backends (file, cinder, or pvc).
The script now prints an informational message and only runs the Ceph
bootstrap when the backend is rbd.
Signed-off-by: Thiago Miranda <tmarques@windriver.com>
---
glance/templates/bin/_storage-init.sh.tpl | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/glance/templates/bin/_storage-init.sh.tpl b/glance/templates/bin/_storage-init.sh.tpl
index f780ff9e8..53ba9f155 100644
--- a/glance/templates/bin/_storage-init.sh.tpl
+++ b/glance/templates/bin/_storage-init.sh.tpl
@@ -30,8 +30,8 @@ if [[ "$SCHEME" == "https" && -f /etc/ssl/certs/openstack-helm.crt ]]; then
fi
set -ex
-if [ "x$STORAGE_BACKEND" == "xpvc" ]; then
- echo "No action required."
+if [ "x$STORAGE_BACKEND" == "xfile" ] || [ "x$STORAGE_BACKEND" == "xpvc" ]; then
+ echo "INFO: No action required to use $STORAGE_BACKEND backend."
elif [ "x$STORAGE_BACKEND" == "xswift" ]; then
: ${OS_INTERFACE:="internal"}
OS_TOKEN="$(openstack token issue -f value -c id)"
--
2.34.1
upstream/helm-charts/openstack-helm/debian/deb_folder/patches/0033-Remove-cinder-default-rbd1-backend.patch
-48
View File
@@ -1,48 +0,0 @@
From b49593ed630ee69413429f1626d6793673df0aba Mon Sep 17 00:00:00 2001
From: vrochalo <vinicius.rochalobo@windriver.com>
Date: Tue, 6 Jan 2026 04:23:29 -0300
Subject: [PATCH] Remove cinder default rbd1 backend
This patch removes dummy backend configuration from
Cinder that is not used and comes from values.yaml of
OpenStack-Helm. It should be removed because it is a
dummy/example config and even on Ceph deployments it
is not really used.
Signed-off-by: vrochalo <Vinicius.RochaLobo@windriver.com>
---
cinder/values.yaml | 18 +-----------------
1 file changed, 1 insertion(+), 17 deletions(-)
diff --git a/cinder/values.yaml b/cinder/values.yaml
index 46c5fce38..2fb2064a8 100644
--- a/cinder/values.yaml
+++ b/cinder/values.yaml
@@ -928,23 +928,7 @@ conf:
apply-to: all
pattern: '^(?!(amq\.|reply_)).*'
- backends:
- # Those options will be written to backends.conf as-is.
- rbd1:
- volume_driver: cinder.volume.drivers.rbd.RBDDriver
- volume_backend_name: rbd1
- rbd_pool: cinder.volumes
- rbd_ceph_conf: "/etc/ceph/ceph.conf"
- rbd_flatten_volume_from_snapshot: false
- report_discard_supported: true
- rbd_max_clone_depth: 5
- rbd_store_chunk_size: 4
- rados_connect_timeout: -1
- rbd_user: cinder
- rbd_secret_uuid: 457eb676-33da-42ec-9a8c-9293d545c337
- image_volume_cache_enabled: true
- image_volume_cache_max_size_gb: 200
- image_volume_cache_max_count: 50
+ backends: null
rally_tests:
run_tempest: false
clean_up: |
--
2.34.1
upstream/openstack/python-openstackclient/debian/patches/0005-Volume-backup-support-with-Openstack-plugin.patch
-38
View File
@@ -1,38 +0,0 @@
From bc1af8fc831eeaf32c51197e3603c89b08caf97e Mon Sep 17 00:00:00 2001
From: jchialun <johnny.chialung@windriver.com>
Date: Fri, 10 Oct 2025 12:18:54 -0500
Subject: [PATCH 1/1] Volume backup support with Openstack plugging and SDK
Add openstack plugin support to communicate with STX-O and Openstack
vanilla by adding a default value to the location parameter. It is
required to keep compatibility with vanilla versions.
Signed-off-by: Johnny Chia <johnny.chialung@windriver.com>
---
openstackclient/volume/v2/volume_backup.py | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/openstackclient/volume/v2/volume_backup.py b/openstackclient/volume/v2/volume_backup.py
index decb5beb..bf8646ea 100644
--- a/openstackclient/volume/v2/volume_backup.py
+++ b/openstackclient/volume/v2/volume_backup.py
@@ -158,9 +158,13 @@ class CreateVolumeBackup(command.ShowOne):
kwargs['metadata'] = parsed_args.properties
- if not parsed_args.location and parsed_args.properties:
- parsed_args.location = parsed_args.properties.get("location", None)
- elif sdk_utils.supports_microversion(volume_client, '3.43'):
+ if not parsed_args.location:
+ if parsed_args.properties:
+ parsed_args.location = parsed_args.properties.get("location", "ceph")
+ else:
+ parsed_args.location = "ceph"
+
+ if sdk_utils.supports_microversion(volume_client, '3.43'):
if kwargs.get('metadata', None):
kwargs['metadata']['location'] = parsed_args.location
else:
--
2.43.0