From eb28325c16f197db5cb1ff86245998d306f42b5c Mon Sep 17 00:00:00 2001 From: Grzegorz Koper Date: Thu, 3 Sep 2026 22:41:19 +0200 Subject: [PATCH 1/2] Fix nmstate zone sync for cloud-init profiles Cloud-init may create a NetworkManager profile whose ID differs from the interface name. Resolve the active profile before synchronising its firewalld zone. Closes-Bug: #2165006 Generated-By: Qwen3.8-27B-UD-Q4_K_XL(initial review Opus5) Change-Id: I2e1985a76b7d532f15b38f257db05fb386b5dc8d Signed-off-by: Grzegorz Koper (cherry picked from commit c77e490253ba658838e8760098c7f8a948967d0b) --- ansible/roles/network-nmstate/tasks/main.yml | 91 ++++++++++++++----- ...e-cloud-init-profile-3ea31ce33527ad63.yaml | 8 ++ 2 files changed, 74 insertions(+), 25 deletions(-) create mode 100644 releasenotes/notes/fix-nmstate-cloud-init-profile-3ea31ce33527ad63.yaml diff --git a/ansible/roles/network-nmstate/tasks/main.yml b/ansible/roles/network-nmstate/tasks/main.yml index 4bff2ed9d..fdb326676 100644 --- a/ansible/roles/network-nmstate/tasks/main.yml +++ b/ansible/roles/network-nmstate/tasks/main.yml @@ -132,31 +132,72 @@ # TODO(gkoper): replace temporary nmcli profile zone sync with native # zone handling in the nmstate filter/module path. - - name: Gather NetworkManager connection firewalld zones for nmstate interfaces - command: - argv: - - nmcli - - -g - - connection.zone - - connection - - show - - "{{ item.interface }}" - changed_when: false - loop: "{{ network_nmstate_zone_items }}" - register: network_nmstate_nm_zone_result - - - name: Ensure NetworkManager connection firewalld zones are set for nmstate interfaces - command: - argv: - - nmcli - - connection - - modify - - "{{ item.item.interface }}" - - connection.zone - - "{{ item.item.zone }}" - loop: "{{ network_nmstate_nm_zone_result.results }}" - when: - - (item.stdout | default('') | trim) != item.item.zone + - name: Sync NetworkManager connection firewalld zones for nmstate interfaces + block: + # Cloud-init can create a profile whose ID is prefixed with + # "cloud-init", while its active device is still the nmstate interface. + # `nmcli connection show` accepts a profile UUID, so get the active + # profile UUID from the device before reading or updating its zone. + - name: Gather NetworkManager connection profiles for nmstate interfaces + command: + argv: + - nmcli + - -g + - GENERAL.CON-UUID + - device + - show + - "{{ zone_item.interface }}" + changed_when: false + loop: "{{ network_nmstate_zone_items }}" + loop_control: + loop_var: zone_item + label: "{{ zone_item.interface }}" + register: network_nmstate_nm_connection_result + + - name: Validate NetworkManager connections for nmstate interfaces + ansible.builtin.assert: + that: + - (connection_item.stdout | trim) not in ['', '--'] + fail_msg: >- + No active NetworkManager connection found for nmstate interface + {{ connection_item.zone_item.interface }} + loop: "{{ network_nmstate_nm_connection_result.results }}" + loop_control: + loop_var: connection_item + label: "{{ connection_item.zone_item.interface }}" + + - name: Gather NetworkManager connection firewalld zones for nmstate interfaces + command: + argv: + - nmcli + - -g + - connection.zone + - connection + - show + - "{{ connection_item.stdout | trim }}" + changed_when: false + loop: "{{ network_nmstate_nm_connection_result.results }}" + loop_control: + loop_var: connection_item + label: "{{ connection_item.zone_item.interface }}" + register: network_nmstate_nm_zone_result + + - name: Ensure NetworkManager connection firewalld zones are set for nmstate interfaces + command: + argv: + - nmcli + - connection + - modify + - "{{ zone_result.connection_item.stdout | trim }}" + - connection.zone + - "{{ zone_result.connection_item.zone_item.zone }}" + loop: "{{ network_nmstate_nm_zone_result.results }}" + loop_control: + loop_var: zone_result + label: "{{ zone_result.connection_item.zone_item.interface }}" + when: + - (zone_result.stdout | default('') | trim) != zone_result.connection_item.zone_item.zone + when: not ansible_check_mode # Keep permanent firewalld configuration in sync first. Runtime state is # refreshed separately below from permanent config. diff --git a/releasenotes/notes/fix-nmstate-cloud-init-profile-3ea31ce33527ad63.yaml b/releasenotes/notes/fix-nmstate-cloud-init-profile-3ea31ce33527ad63.yaml new file mode 100644 index 000000000..7ec31646a --- /dev/null +++ b/releasenotes/notes/fix-nmstate-cloud-init-profile-3ea31ce33527ad63.yaml @@ -0,0 +1,8 @@ +--- +fixes: + - | + Fixes the nmstate network engine when cloud-init creates a + NetworkManager connection whose profile ID differs from the interface + name (`LP#2165006 `__). + Firewalld zone synchronisation now resolves the active profile from the + interface before reading or updating its connection zone. From bd9d872e9226a9d39d735bfd95dd486e391a51df Mon Sep 17 00:00:00 2001 From: Pierre Riteau Date: Wed, 9 Sep 2026 10:46:12 +0200 Subject: [PATCH 2/2] CI: Download cirros images instead of using cache Old cirros images have been removed from the image cache [1]. Download images while we fix compatibility with new cirros images. [1] https://review.opendev.org/c/opendev/zuul-providers/+/1000965 Change-Id: Icabdca7babf71ace60c1db3bbbb3c0016d6df312 Signed-off-by: Pierre Riteau (cherry picked from commit 9ff5475ae2c16ab2833830f73002a89026ef23c2) --- playbooks/kayobe-infra-vm-base/overrides.yml.j2 | 2 +- playbooks/kayobe-seed-vm-base/overrides.yml.j2 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/playbooks/kayobe-infra-vm-base/overrides.yml.j2 b/playbooks/kayobe-infra-vm-base/overrides.yml.j2 index c6d5cc075..2df774af1 100644 --- a/playbooks/kayobe-infra-vm-base/overrides.yml.j2 +++ b/playbooks/kayobe-infra-vm-base/overrides.yml.j2 @@ -34,7 +34,7 @@ infra_vm_memory_mb: "{{ 1 * 1024 }}" {% if infra_vm_use_cirros | default(true) %} # Use cirros rather than distribution cloud image for the VM. infra_vm_bootstrap_user: cirros -infra_vm_root_image: /opt/cache/files/cirros-0.5.3-x86_64-disk.img +infra_vm_root_image: https://download.cirros-cloud.net/0.5.3/cirros-0.5.3-x86_64-disk.img # Cirros doesn't load cdom drivers by default. vm_configdrive_device: disk diff --git a/playbooks/kayobe-seed-vm-base/overrides.yml.j2 b/playbooks/kayobe-seed-vm-base/overrides.yml.j2 index 83be19105..137370220 100644 --- a/playbooks/kayobe-seed-vm-base/overrides.yml.j2 +++ b/playbooks/kayobe-seed-vm-base/overrides.yml.j2 @@ -37,7 +37,7 @@ seed_vm_memory_mb: "{{ 1 * 1024 }}" {% if seed_vm_use_cirros | default(true) %} # Use cirros rather than distribution cloud image for the VM. seed_bootstrap_user: cirros -seed_vm_root_image: /opt/cache/files/cirros-0.5.3-x86_64-disk.img +seed_vm_root_image: https://download.cirros-cloud.net/0.5.3/cirros-0.5.3-x86_64-disk.img # Cirros doesn't load cdom drivers by default. seed_vm_configdrive_device: disk