openstack/kolla-ansible — Week of 2026-09-19

Container runtime. The kolla_container module gained group_add support, letting service containers join supplementary groups at launch. Alongside it, kolla_toolbox now drops unset values from module_args before invoking Ansible, and gained a retry on its ansible --version probe to weather transient toolbox startup races.

Config surface. Keystoneauth options are now registered for the [glance] config group, and Grafana switched away from the deprecated grafana-server invocation. Two changes tightened validation of enable_letsencrypt to a proper boolean.

Stability and fixes. A recurring theme was making prechecks tolerate vault-encrypted values in the Prometheus role — the fix landed on master and was backported across three stable branches. Service deployments now correctly remove stale systemd unit symlinks, ProxySQL was fixed to fall back to the backup writer node for reads, and Ironic's tftp_server is now kept in sync with ironic_tftp_listen_address. Duplicate log lines from Grafana and OpenSearch appearing in both syslog and docker logs were also silenced.

Docs. Leftover references to the Linux bridge driver were removed on master and one stable branch.