stackhpc · Alex-Welsh · Jul 13, 2026 · Jun 18, 2026 · Jun 26, 2026 · Jun 29, 2026
@@ -152,15 +152,17 @@ Getting Involved
 
 Need a feature? Find a bug? Let us know! Contributions are much
 appreciated and should follow the standard `Gerrit
-workflow <https://docs.openstack.org/infra/manual/developers.html>`__.
+workflow <https://docs.openstack.org/contributors/common/setup-gerrit.html>`__.
 
--  We communicate using the #openstack-kolla irc channel.
+-  We communicate using the #openstack-kolla IRC channel on OFTC.
 -  File bugs, blueprints, track releases, etc on
    `Launchpad <https://launchpad.net/kolla>`__.
 -  Attend weekly
    `meetings
    <https://docs.openstack.org/kolla/latest/contributor/meeting.html>`__.
 -  Contribute `code <https://opendev.org/openstack/kolla>`__.
+-  Please respect our `AI policy
+   <https://docs.openstack.org/kolla/latest/contributor/contributing.html#aipolicy>`__.
 
 Notices
 =======

@@ -679,6 +679,97 @@ Can I use the ``--template-override`` option for custom templates? Yes!
 Custom repos
 ------------
 
+repos.yaml
+^^^^^^^^^^
+
+Kolla uses ``kolla/template/repos.yaml`` to define repositories used during
+image builds. Each entry is keyed by a logical name and contains the
+information needed to configure the repository.
+
+Repositories marked with ``distro: True`` are default repos that require no
+additional configuration. For RPM-based distros they are enabled via
+``dnf config-manager --enable``; for Debian-based distros they are a no-op
+as the sources are already provided by the base image. Examples include
+``crb``, ``extras``, and the base repos ``baseos`` and ``appstream`` for
+CentOS and Rocky Linux, as well as ``debian``, ``debian-security``,
+``ubuntu``, ``ubuntu-security``.
+
+Repositories without ``distro: True`` are fully templated into a new
+repository file and must provide at least one of ``baseurl``, ``metalink``,
+or ``mirrorlist`` (RPM), or ``url`` (Debian/Ubuntu).
+
+To override repositories (e.g. to point base repos at a local mirror),
+provide a custom ``repos.yaml`` via the ``--repos-yaml`` option and supply
+entries without ``distro: True`` and with the desired URL.
+
+Example for Rocky Linux:
+
+.. code-block:: yaml
+
+   rocky:
+     baseos:
+       name: "baseos"
+       baseurl: "https://my-mirror.example.com/rocky/10/BaseOS/$basearch/os/"
+       gpgkey: "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-10"
+     appstream:
+       name: "appstream"
+       baseurl: "https://my-mirror.example.com/rocky/10/AppStream/$basearch/os/"
+       gpgkey: "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-10"
+     crb:
+       name: "crb"
+       baseurl: "https://my-mirror.example.com/rocky/10/CRB/$basearch/os/"
+       gpgkey: "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-10"
+
+Example for Debian:
+
+.. code-block:: yaml
+
+   debian:
+     debian:
+       component: "main"
+       gpg_key: "/usr/share/keyrings/debian-archive-keyring.gpg"
+       suite: "trixie trixie-updates trixie-backports"
+       url: "https://my-mirror.example.com/debian"
+     debian-security:
+       component: "main"
+       gpg_key: "/usr/share/keyrings/debian-archive-keyring.gpg"
+       suite: "trixie-security"
+       url: "https://my-mirror.example.com/debian-security"
+
+Example for Ubuntu:
+
+.. code-block:: yaml
+
+   ubuntu:
+     ubuntu:
+       component: "main universe"
+       gpg_key: "/usr/share/keyrings/ubuntu-archive-keyring.gpg"
+       suite: "noble noble-updates noble-backports"
+       url: "https://my-mirror.example.com/ubuntu/"
+     ubuntu-security:
+       component: "main universe"
+       gpg_key: "/usr/share/keyrings/ubuntu-archive-keyring.gpg"
+       suite: "noble-security"
+       url: "https://my-mirror.example.com/ubuntu/"
+
+.. code-block:: ini
+
+   repos_yaml = /path/to/custom-repos.yaml
+
+When overriding a base repo, any existing ``.repo`` file on the image
+containing that repository ID is automatically removed before the new one
+is created.
+
+Some distro repos share a single ``.repo`` file on disk (for example,
+``baseos``, ``appstream``, and ``crb`` all live in ``rocky.repo`` on Rocky
+Linux). These repos are annotated with a ``file_group`` field in
+``repos.yaml`` that names the shared file. If any repo in a ``file_group``
+is overridden, all other repos sharing that ``file_group`` must also be
+overridden — otherwise removing the shared file would silently disable them.
+Kolla validates this at build time and raises an error listing the missing
+overrides. For Rocky Linux this means overriding ``baseos`` or ``appstream``
+requires also overriding ``crb``.
+
 Red Hat
 ^^^^^^^
 

@@ -18,6 +18,47 @@ The source repository for this project can be found at:
 
    https://opendev.org/openstack/kolla
 
+.. _aicontent:
+
+AI-Generated Content
+~~~~~~~~~~~~~~~~~~~~
+
+In general, please do not submit AI generated content to the Kolla
+project, but some exceptions apply.
+
+The OpenInfra foundation has created a policy for AI Generated content
+at https://openinfra.org/legal/ai-policy which provides useful
+background to the Kolla project's policy, but the Kolla project policy
+differs somewhat.
+
+As a free software project, we are concerned with the copyright
+ownership of the project's source code.  Because most commercially
+available LLMs are not able to indicate whether their output may
+include training data incompatible with Kolla's licences, accepting
+substantial contributions generated by them increases the risk to the
+project.  And because LLM-generated output is not considered
+copyrightable in the United States and other regions, that further
+increases the risk to the project.
+
+In many cases, the code and documentation output from LLMs is not of
+sufficient quality for easy incorporation into Kolla.  A community of
+contributors and reviewers with deep understanding of the project is
+healthier in the long run.  Contributions generated by LLMs without
+that understanding creates more work for the maintainers.
+
+Nevertheless, if you use an LLM to create a very small patch (one that
+would likely not be subject to copyright protection even if generated
+by a human), that's fine, but you must annotate it with the
+`Assisted-By` or `Generated-By` labels.
+
+In short:
+
+* Please do not submit substantial AI-generated content (code or docs)
+* Very small/limited use may be okay if it's not copyrightable
+* Make sure you fully understand the code or docs you are changing
+* If you don't, engage with humans in the Kolla community
+* Any AI-Generated content must have `Assisted-By` or `Generated-By` labels
+
 .. _communication:
 
 Communication

@@ -110,8 +110,22 @@ For a list of currently unbuildable images please look into
 SPICE limitations
 =================
 
-The new OpenStack Compute console type ``spice-direct`` requires that
-SPICE support be compiled into the qemu running the instance. Sadly,
-Red Hat chose to remove SPICE support from qemu in RHEL9, and Rocky
-Linux has followed along. You therefore _must_ run the Debian or Ubuntu
-container images if you wish to use the ``spice-direct`` console type.
+The OpenStack Compute console type ``spice-direct`` requires that
+SPICE support be compiled into the qemu running the instance. Red Hat
+removed SPICE support from qemu in RHEL9 onwards, and Rocky Linux has
+followed suit, so the stock Rocky Linux container images do not support
+``spice-direct`` out of the box.
+
+As a solution, Kolla builds two copies of the ``nova-libvirt`` container
+regardless of container distribution. These containers are identical on
+other distributions, but for Rocky Linux the community-maintained
+`ligenix/enterprise-qemu-spice
+<https://copr.fedorainfracloud.org/coprs/ligenix/enterprise-qemu-spice/>`__
+COPR repository is installed as it provides a rebuilt ``qemu-kvm``
+with SPICE re-enabled for EPEL 9 and EPEL 10. Because this COPR is a
+third-party rebuild without a vendor support contract, it is recommended
+only for proof-of-concept deployments.
+
+Which container to use for ``nova-libvirt`` is then determined at
+``kolla-ansible deploy`` time based on the value of the ``enable_kerbside``
+flag.
@@ -246,7 +246,8 @@
                     'kolla-toolbox image'),
     cfg.StrOpt('openstack-release-codename',
                default=OPENSTACK_RELEASE_CODENAME,
-               help='OpenStack release codename for Debian OpenStack extrepo'),
+               help='OpenStack release codename for Debian OpenStack extrepo '
+                    'and Ubuntu Cloud Archive'),
     cfg.StrOpt('openstack-branch',
                help='Branch for source images (internal; with a dash; '
                     'please set openstack-release instead)'),

@@ -34,10 +34,8 @@ RUN cat /tmp/kolla_bashrc >> /etc/skel/.bashrc \
 ENV PS1="$(tput bold)($(printenv KOLLA_SERVICE_NAME))$(tput sgr0)[$(id -un)@$(hostname -s) $(pwd)]$ "
 
 {% if base_package_type == 'rpm' %}
-# For RPM Variants, enable the correct repositories - this should all be done
-# in the base image so repos are consistent throughout the system.  This also
-# enables to provide repo overrides at a later date in a simple fashion if we
-# desire such functionality.  I think we will :)
+
+{{ macros.enable_extra_repos(['baseos', 'appstream']) }}
 
 ENV KOLLA_RPM_OVS_VERSION=3.5 \
     KOLLA_RPM_OVN_VERSION=26.03
@@ -154,6 +152,7 @@ RUN {{ macros.install_packages(base_centos_yum_repo_packages | customizable("cen
 
 {# endif for base_package_type rpm #}
 {% elif base_package_type == 'deb' %}
+
 # This will prevent questions from being asked during the install
 ENV DEBIAN_FRONTEND noninteractive
 
@@ -195,9 +194,16 @@ COPY {{ base_distro }}.sources.arm64 /etc/apt/sources.list.d/{{ base_distro }}.s
 {% else %}
 COPY {{ base_distro }}.sources /etc/apt/sources.list.d/
 {% endif %}
+
 COPY sources.list /etc/apt/sources.list.d/kolla-custom.list
 {% endblock %}
 
+{% if base_distro == 'debian' %}
+{{ macros.enable_extra_repos(['debian', 'debian-security']) }}
+{% elif base_distro == 'ubuntu' %}
+{{ macros.enable_extra_repos(['ubuntu', 'ubuntu-security', 'ubuntu-cloud-archive']) }}
+{% endif %}
+
 {% block base_debian_after_sources_list %}{% endblock %}
 
 {# install Debian Openstack repos - they are not mirrored on CI #}

@@ -12,13 +12,6 @@ Suites: noble-security
 Components: main universe
 Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
 
-## Ubuntu Cloud Archive
-Types: deb
-URIs: http://ubuntu-cloud.archive.canonical.com/ubuntu
-Suites: noble-updates/gazpacho
-Components: main
-Signed-By: /usr/share/keyrings/ubuntu-cloud-keyring.gpg
-
 # NOTE(hrw): extra repositories are added into image when they are needed as
 # separate files in /etc/apt/sources.list.d/ directory. For that purpose they
 # are defined in kolla/template/repos.yaml file.
@@ -0,0 +1,120 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build_date }}"
+{% endblock %}
+
+{% block nova_libvirt_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='nova', groups='qemu') }}
+
+{% if base_package_type == 'rpm' %}
+
+    {% set nova_libvirt_extra_repos = ['ceph', 'crb', 'epel', 'openvswitch'] %}
+    {% if base_distro == 'rocky' %}
+        {#
+            The stock Rocky qemu-kvm has SPICE compiled out. To enable
+            Kerbside and the nova ``spice-direct`` console we therefore
+            layer the ligenix COPR in so that qemu-kvm and spice-server
+            are available with SPICE re-enabled. The repo definition
+            lives in kolla/template/repos.yaml so deployers can override
+            it like any other extra repo.
+        #}
+        {% set nova_libvirt_extra_repos = nova_libvirt_extra_repos + ['ligenix-qemu-spice'] %}
+    {% endif %}
+
+{{ macros.enable_extra_repos(nova_libvirt_extra_repos) }}
+
+    {% set nova_libvirt_packages = [
+        'ceph-common',
+        'cyrus-sasl-md5',
+        'cyrus-sasl-scram',
+        'libguestfs',
+        'libvirt-client',
+        'libvirt-daemon',
+        'libvirt-daemon-log',
+        'libvirt-daemon-config-nwfilter',
+        'libvirt-daemon-driver-nwfilter',
+        'libvirt-daemon-driver-nodedev',
+        'openvswitch${KOLLA_RPM_OVS_VERSION}',
+        'qemu-img',
+        'qemu-kvm',
+        'swtpm',
+    ] %}
+    {% if base_arch == 'x86_64' %}
+        {% set nova_libvirt_packages = nova_libvirt_packages + [
+            'edk2-ovmf'
+        ] %}
+    {% elif base_arch == 'aarch64' %}
+        {% set nova_libvirt_packages = nova_libvirt_packages + [
+            'edk2-aarch64'
+        ] %}
+    {% endif %}
+
+    {% if use_ligenix_qemu | default(false) and base_distro == 'rocky' %}
+        {% set nova_libvirt_packages = nova_libvirt_packages + [
+            'qemu-kvm-ui-spice',
+            'spice-server',
+        ] %}
+    {% endif %}
+
+{% elif base_package_type == 'deb' %}
+
+    {% set nova_libvirt_packages = [
+        'ceph-common',
+        'ebtables',
+        'libsasl2-modules-gssapi-mit',
+        'libvirt-clients',
+        'libvirt-daemon-system',
+        'mdevctl',
+        'openvswitch-switch',
+        'pm-utils',
+        'python3-cephfs',
+        'python3-rados',
+        'python3-rbd',
+        'qemu-block-extra',
+        'qemu-system',
+        'qemu-system-modules-spice',
+        'qemu-utils',
+        'sasl2-bin',
+        'swtpm',
+        'swtpm-tools',
+        'tpm2-tools',
+        'trousers'
+    ] %}
+
+    {% if base_arch == "aarch64" %}
+        {% set nova_libvirt_packages = nova_libvirt_packages + [
+            'qemu-efi-aarch64'
+        ] %}
+    {% elif base_arch == "x86_64" %}
+        {% set nova_libvirt_packages = nova_libvirt_packages + [
+            'ovmf',
+        ] %}
+    {% endif %}
+
+    {% if base_distro in ['debian'] %}
+        {% set nova_libvirt_packages = nova_libvirt_packages + [
+            'libvirt-daemon-log',
+            'usermode'
+        ] %}
+    {% endif %}
+{% endif %}
+
+{{ macros.install_packages(nova_libvirt_packages | customizable("packages")) }}
+
+{% if base_package_type == 'deb' %}
+
+RUN rm -f /etc/libvirt/qemu/networks/default.xml /etc/libvirt/qemu/networks/autostart/default.xml
+
+{% endif %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+COPY kolla_nova_libvirt_start.sh /usr/local/bin/kolla_nova_libvirt_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start && chmod 744 /usr/local/bin/kolla_nova_libvirt_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block nova_libvirt_footer %}{% endblock %}
+{% block footer %}{% endblock %}
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+if [[ ! -e "/var/log/kolla/libvirt/libvirtd.log" ]]; then
+    mkdir -p /var/log/kolla/libvirt
+    touch /var/log/kolla/libvirt/libvirtd.log
+    chmod 644 /var/log/kolla/libvirt/libvirtd.log
+fi
+if [[ $(stat -c %a /var/log/kolla/libvirt) != "755" ]]; then
+    chmod 755 /var/log/kolla/libvirt
+    chmod 644 /var/log/kolla/libvirt/libvirtd.log
+fi