* Switch from python-ironic-inspector-client to openstacksdk in
  ironic-inspector-rules. This allows us to use clouds.yaml to provide
  credentials.
* Enable authentication in Bifrost. Passwords are auto-generated by
  Bifrost, and stored files in /root/.config/bifrost/. This change
  depends on a Kolla Ansible patch that ensures that these credentials
  are persisted between recreations of the bifrost container.
* Copy clouds.yaml and (if present) a CA certificate from the Bifrost
  container to the seed host, under the Kayobe Ansible user (stack).
  This allows us to use the credentials to register introspection rules.
* This patch is needed by a Kolla Ansible patch that enables TLS in
  Bifrost, since we need the CA certificate on the host to register
  introspection rules when TLS is enabled.

Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/851837
Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/851838

Story: 2010206
Task: 45930

Change-Id: I757f1bb72afb01a4f1689bed292f5b71b9048fa0

Adds support for installing additional build host dependencies when
building IPA and overcloud host images via
'ipa_build_dib_host_packages_extra' and
'overcloud_dib_host_packages_extra'.

Support for installing additional host packages was added in
stackhpc.os-images v1.15.0 [1].

[1] https://github.com/stackhpc/ansible-role-os-images/pull/63

Change-Id: I1a05d448031cb415cec4cd601a030abdb8a5eba5

Co-Authored-By: Bartosz Bezak <bartosz@stackhpc.com>

Change-Id: I06a3e9922cf95979f3bca120cd82633046270fa3

Enables the installation and configuration of firewalld on Ubuntu
systems.

Change-Id: I4a97a2aeed277be672e15e5c7727b810e11d3c42
Story: 2010160
Task: 45818

Follow up after I111df79f08eb76a735f33c6edf03b5a302fb6cc3 in kolla-ansible

Change-Id: I7e10b851016253bf85625e9daa89416c738242e8

The 8.5 image has moved to the Rocky Linux Vault.

Change-Id: I86c92a1b0b8cf5e4dc534e04709e38bd90f7660e

Change-Id: Ib182558e31da9d79a14f383c6a1d60fa66f1dc75

This is required to be able to install tenks. Otherwise, we try to
install Jinja2 3.1.2 which requires Python 3.7 or newer.

Change-Id: Ie497b191b6de8bc818dc4a2a12f7129a02d0fd00

Change-Id: Iec0b9cd24eda4fc0fc38003dea66c50ece7425b6

The disable-selinux role has been renamed to selinux and now supports
setting desired state.

Previously Kayobe was defaulting to disabling and rebooted the host - to
avoid audit logs filling up. This change allows operators to define
desired SELinux state and defaults to permissive - to adhere to those
site policies that require SELinux to be at least in permissive state.

Change-Id: I42933b0b7d55c69c9f6992e331fafb2e6c42d4d1

Change-Id: Ibf4b928222713bedb7e856307f5ad91e60953795

IPA itself is still compatible with Python 3.6, but ipa-builder uses
master upper-constraints which have dropped support for 3.6 and are
pulling importlib-metadata===4.11.4, which requires 3.7.

    ERROR: Cannot install ironic-python-agent==8.6.1.dev13 because these package versions have conflicting dependencies.

    The conflict is caused by:
        ironic-python-agent 8.6.1.dev13 depends on importlib_metadata>=1.7.0
        The user requested (constraint) importlib-metadata===4.11.4

Change-Id: I0cc48d0d5ed17400badb081e9117c9351677bb38

The support was added in this commit, but the docs were not updated:
c6263dbf

Change-Id: Icfc5cbc80af1199ad00f78292c6228273af701aa

Change-Id: I2823016294e7df63f63be9ab26535b3962a71ebe

Story: 2010069
Task: 45540
Change-Id: I0658c0059867468d6032cb1bfa3d05ae0d01c422

The 'overcloud container image build' command didn't build all the
hacluster images when hacluster is enabled.

TrivialFix

Change-Id: I9150e32579421e46782518948188e1363918fb39
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>

Requirements upper constraints bumped python-novaclient to version
18.0.0 [1], which requires Python 3.8 [2]. This results in failures when
installing python-openstackclient on CentOS and Rocky with Python 3.6.

    ERROR: Cannot install python-openstackclient==5.8.0 because these package versions have conflicting dependencies.

    The conflict is caused by:
        python-openstackclient 5.8.0 depends on python-novaclient>=17.0.0
        The user requested (constraint) python-novaclient===18.0.0

Work around this issue by using yoga upper constraints until we upgrade
to CentOS Stream 9 and Rocky Linux 9.

This also fixes another issue seen on Ubuntu where image uploads to
Glance through Ansible fail with a 400 Bad Request error. This is caused
by the bump of openstacksdk to version 0.99.0 and will be fixed by a new
release of ansible-collections-openstack.

[1] https://review.opendev.org/c/openstack/requirements/+/842808
[2] https://review.opendev.org/c/openstack/python-novaclient/+/838944

Change-Id: I40c6b898963c2218d41d37bd73d40ce8dcf22b87

Per [1].

[1] http://lists.zuul-ci.org/pipermail/zuul-discuss/2022-May/001801.html

Change-Id: I9cab915803bab882a12841cd40ccc6af2a78dae2

Change-Id: I7c87a6c45f036bedae24ac14a5ca245f0b69300c

Previously we were not applying an MTU defined in Kayobe networks.yml to
the provisioning and cleaning networks in Neutron. This could lead to
issues when nodes communicate with the Ironic and Inspector APIs.

Change-Id: Id9418e4e88c52056412daa22462aa611bfcc59ae

Using cp will leave removed files in kayobe-config.

Change-Id: Id8febf9f29e3cd230b9e516ab59e0fe9935cf375

This new version fixes the evaluation of check_mode, which is causing
`kayobe overcloud bios raid configure` to fail.

Change-Id: I9c6e261dbac067ca3f9218e6ea81813ddc2f6520

This is old and deprecated configuration settings for Swift not needed
anymore because kolla-ansible correctly configure glance-api.conf and
glance-swift.conf since Idddbf2ce741e0486d60e1de88c77a7f0332a5a2b when
kolla_enable_swift variable set to true. This change can be backported
through all releases till the Train.

Change-Id: I5273edc8265f115519f499e85fe12f8d22306c4b
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>

The no_proxy list should only contain domains, hostnames, IP addresses
and networks, but docker_registry is often in the form ip_address:port.

Use urlsplit to extract the hostname from the docker_registry variable
after prepending http:// to turn it into a valid URL.

Also add missing infra-vms to hosts in proxy.yml.

Change-Id: I6424fc405894514a63fb2b641637bbb9d5c070c0