From 43556261e6118d99f7fa68b44981776926fa826d Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 28 Aug 2026 04:37:07 +0000 Subject: [PATCH 1/3] Bump DevStack to latest master and follow ML2 option rename Update DEVSTACK_COMMIT for both the controller and the compute images from a05d26eb to 9b0a0086, the current tip of openstack/devstack master. This pulls in the latest nova/neutron along with the rest of the components DevStack installs from source. DevStack now writes project_network_types into ml2_conf.ini instead of tenant_network_types ("Start using project_network_types for neutron ML2", 03db96dc), following the neutron option rename where tenant_network_types became a deprecated alias. The controller post-config still set the deprecated key, so oslo.config would have preferred DevStack's own project_network_types=geneve over our tenant_network_types=vxlan, leaving project networks on a type the openvswitch agent does not tunnel. Set Q_ML2_TENANT_NETWORK_TYPE=vxlan in localrc so DevStack itself picks vxlan (its default is geneve, meant for ML2/OVN) and rename the post-config key to match. Verified with DevStack's own meta-config parser that the rendered ml2_conf.ini keeps project_network_types=vxlan, mechanism_drivers=openvswitch,l2population and tunnel_types=vxlan,gre. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_013WvtSA1Jc1Fhuj65ZDwbkw --- compute/Dockerfile | 2 +- controller/Dockerfile | 2 +- controller/local.conf | 6 +++++- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/compute/Dockerfile b/compute/Dockerfile index 17fa129..1a0dca4 100644 --- a/compute/Dockerfile +++ b/compute/Dockerfile @@ -2,7 +2,7 @@ FROM ubuntu:24.04 EXPOSE 80 5000 8773 8774 8775 8776 9292 ENV DEBIAN_FRONTEND=noninteractive -ENV DEVSTACK_COMMIT=a05d26ebc4ca81ccf1810c9c203143db552c28cb +ENV DEVSTACK_COMMIT=9b0a00865c2537338f72ed5b9b44a0d6bff16eb4 ENV OS_REGION_NAME=RegionOne ENV OS_PROJECT_DOMAIN_ID=default diff --git a/controller/Dockerfile b/controller/Dockerfile index 1594cf5..8db7dfc 100644 --- a/controller/Dockerfile +++ b/controller/Dockerfile @@ -2,7 +2,7 @@ FROM ubuntu:24.04 EXPOSE 80 5000 8773 8774 8775 8776 9292 ENV DEBIAN_FRONTEND=noninteractive -ENV DEVSTACK_COMMIT=a05d26ebc4ca81ccf1810c9c203143db552c28cb +ENV DEVSTACK_COMMIT=9b0a00865c2537338f72ed5b9b44a0d6bff16eb4 ENV OS_REGION_NAME=RegionOne ENV OS_PROJECT_DOMAIN_ID=default diff --git a/controller/local.conf b/controller/local.conf index b8a11b7..4352cd3 100644 --- a/controller/local.conf +++ b/controller/local.conf @@ -54,6 +54,10 @@ disable_service file_tracker # Use openvswitch as the ml2 plugin driver Q_AGENT=openvswitch +# Allocate project networks as VXLAN. DevStack defaults this to geneve, +# which the openvswitch agent does not tunnel, so it must be set here. +Q_ML2_TENANT_NETWORK_TYPE=vxlan + # Enable Neutron services neutron-server, neutron-openvswitch-agent, # neutron-dhcp-agent, neutron-l3-agent and neutron-metadata-agent enable_service q-svc @@ -77,7 +81,7 @@ verbose = True [[post-config|/$Q_PLUGIN_CONF_FILE]] [ml2] type_drivers=flat,gre,vlan,vxlan -tenant_network_types=vxlan +project_network_types=vxlan mechanism_drivers=openvswitch,l2population [agent] From a89c85a9b64ee14f49f6c31572e213ef69cf4f08 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 28 Aug 2026 04:40:38 +0000 Subject: [PATCH 2/3] Ignore hadolint DL3064 for the DevStack demo credentials The lint job pulls hadolint/hadolint:latest, and a hadolint release picked up DL3064, "Potentially sensitive data should not be used in the `ARG` or `ENV` commands". It fires on `ENV OS_USERNAME=admin` and `ENV OS_PASSWORD=password` in both Dockerfiles, and hadolint exits 1 on warnings, so the lint job has been failing on main since 2026-07-31. Those two variables are the DevStack demo credentials, matching ADMIN_PASSWORD=password in local.conf. They are what makes the `docker compose exec controller openstack ...` usage in the README work out of the box on a development-only image, so ignore the rule the same way DL3008 already is rather than drop the variables. Reproduced with hadolint 2.15.1: both Dockerfiles report the same two DL3064 warnings and exit 1 beforehand, and exit 0 with DL3064 ignored. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_013WvtSA1Jc1Fhuj65ZDwbkw --- .github/workflows/action.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/action.yaml b/.github/workflows/action.yaml index a21746b..8e37789 100644 --- a/.github/workflows/action.yaml +++ b/.github/workflows/action.yaml @@ -11,9 +11,9 @@ jobs: steps: - uses: actions/checkout@v2 - name: hadolint for controller - run: docker run -e "HADOLINT_IGNORE=DL3008" --rm -i hadolint/hadolint < controller/Dockerfile + run: docker run -e "HADOLINT_IGNORE=DL3008,DL3064" --rm -i hadolint/hadolint < controller/Dockerfile - name: hadolint for compute - run: docker run -e "HADOLINT_IGNORE=DL3008" --rm -i hadolint/hadolint < compute/Dockerfile + run: docker run -e "HADOLINT_IGNORE=DL3008,DL3064" --rm -i hadolint/hadolint < compute/Dockerfile test: runs-on: ubuntu-24.04 steps: From 5c941f73359b785cabe7b214d31d3d9c075caf71 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 28 Aug 2026 06:44:37 +0000 Subject: [PATCH 3/3] Pin the lint image to hadolint v2.15.1 The lint job pulled hadolint/hadolint:latest, so a new hadolint release changed what CI enforces without any change here. That is how DL3064 turned the nightly red for 18 consecutive nights before anyone noticed. Pinning also makes CI match what the DL3064 ignore in the previous commit was verified against, which was hadolint 2.15.1. v2.15.1 currently resolves to the same image as latest, so this is a no-op for the checks that run today, and future hadolint releases become a deliberate bump rather than a surprise. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_013WvtSA1Jc1Fhuj65ZDwbkw --- .github/workflows/action.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/action.yaml b/.github/workflows/action.yaml index 8e37789..63e151e 100644 --- a/.github/workflows/action.yaml +++ b/.github/workflows/action.yaml @@ -11,9 +11,9 @@ jobs: steps: - uses: actions/checkout@v2 - name: hadolint for controller - run: docker run -e "HADOLINT_IGNORE=DL3008,DL3064" --rm -i hadolint/hadolint < controller/Dockerfile + run: docker run -e "HADOLINT_IGNORE=DL3008,DL3064" --rm -i hadolint/hadolint:v2.15.1 < controller/Dockerfile - name: hadolint for compute - run: docker run -e "HADOLINT_IGNORE=DL3008,DL3064" --rm -i hadolint/hadolint < compute/Dockerfile + run: docker run -e "HADOLINT_IGNORE=DL3008,DL3064" --rm -i hadolint/hadolint:v2.15.1 < compute/Dockerfile test: runs-on: ubuntu-24.04 steps: