openstack/kolla-ansible — Week of 2026-10-31

Neutron OVN consolidation. The metadata path on the OVN side was reshaped: neutron-ovn-metadata-agent was removed outright, with the metadata extension now running inside ovn-agent and wrapper script support added alongside it. Together these account for roughly 200 lines of churn across the Neutron role.

Octavia and container runtime. The octavia-certificates play was rewritten to stop leaking secrets through Ansible output, a ~250-line reshuffle of how CA material is generated and handed off. On the container side, kolla_container gained systempaths_unconfined support, exposing the Docker/Podman knob to deployments that need it. A missing OS_CACERT in octavia-openrc.sh was also fixed and backported across four stable branches.

Fixes. The LetsEncrypt deployment directory setup was corrected, Prometheus data directory permissions were tightened, and MariaDB's healthcheck start_period was bumped to 120s to tolerate slower startups. A new Keystoneauth option group was registered for [glance] to unblock configuration that depends on it.

CI. Debian Trixie jobs were flipped back to voting via a revert of the earlier non-voting marker (1012701).