openstack/kolla-ansible — Week of 2026-10-03

TLS fix. The one functional change this week ensured the CA bundle is included for database TLS when MariaDB backups run, landing on master with a matching backport so operators using TLS-protected databases no longer hit trust failures during backup jobs.

Tooling and CI. The bulk of activity cleaned up the gate: tempest now installs into its own venv, the requirements checkout was separated from installation, the bcrypt pin was dropped in two steps, a leftover ironic-inspector group was removed, and an old Ansible fallback in the kolla_toolbox test was deleted. A previous "prefer ipv4 over ipv6 and disable docker mirror" change was reverted after proving unnecessary.

Maintenance. Overdue deprecated cleanup code was finally removed, trimming ~73 lines of carry.