From df4d573eb55bb8f72c9059b1a353e5357eec8e6e Mon Sep 17 00:00:00 2001
From: Maximilian Stinsky <maximilian.stinsky-damke@wiit.cloud>
Date: Fri, 12 Sep 2025 10:24:42 +0200
Subject: [PATCH 01/20] neutron-metadata-agent: copy wrapper script for haproxy
 processes

In ml2/ovn setups, the neutron-metadata-agent spawns haproxy processes
to serve metadata requests. To run these haproxy instances inside their
own containers, the wrapper script must be available in the
metadata-agent container.
This is a follow up on I679ac66186d457ae53f89469fe22c5662089019a

Change-Id: Ia47af98ff723ebe8ea8461d05a2bc3b58af845f9
Signed-off-by: Maximilian Stinsky <maximilian.stinsky-damke@wiit.cloud>
---
 .../neutron-metadata-agent/Dockerfile.j2       |  2 ++
 .../neutron-metadata-agent/extend_start.sh     | 18 ++++++++++++++++++
 ...agent-wrapper-scripts-d6163080d169ea14.yaml |  7 +++++++
 3 files changed, 27 insertions(+)
 create mode 100644 docker/neutron/neutron-metadata-agent/extend_start.sh
 create mode 100644 releasenotes/notes/neutron-metadata-agent-wrapper-scripts-d6163080d169ea14.yaml

diff --git a/docker/neutron/neutron-metadata-agent/Dockerfile.j2 b/docker/neutron/neutron-metadata-agent/Dockerfile.j2
index 676ee1a850..91c3084051 100644
--- a/docker/neutron/neutron-metadata-agent/Dockerfile.j2
+++ b/docker/neutron/neutron-metadata-agent/Dockerfile.j2
@@ -14,6 +14,8 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 {{ macros.kolla_patch_sources() }}
 
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
 {% block neutron_metadata_agent_footer %}{% endblock %}
 {% block footer %}{% endblock %}
 
diff --git a/docker/neutron/neutron-metadata-agent/extend_start.sh b/docker/neutron/neutron-metadata-agent/extend_start.sh
new file mode 100644
index 0000000000..001898f68e
--- /dev/null
+++ b/docker/neutron/neutron-metadata-agent/extend_start.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/neutron" ]]; then
+    mkdir -p /var/log/kolla/neutron
+fi
+if [[ $(stat -c %a /var/log/kolla/neutron) != "755" ]]; then
+    chmod 755 /var/log/kolla/neutron
+fi
+
+if [[ "${KOLLA_NEUTRON_WRAPPERS:-false}" == "true" ]]; then
+    echo "Copying neutron agent wrappers to /usr/local/bin"
+    sudo -E /usr/local/lib/neutron-wrappers/copy-wrappers
+else
+    echo "Removing neutron agent wrappers from /usr/local/bin"
+    sudo -E /usr/local/lib/neutron-wrappers/delete-wrappers
+fi
+
+. /usr/local/bin/kolla_neutron_extend_start
diff --git a/releasenotes/notes/neutron-metadata-agent-wrapper-scripts-d6163080d169ea14.yaml b/releasenotes/notes/neutron-metadata-agent-wrapper-scripts-d6163080d169ea14.yaml
new file mode 100644
index 0000000000..8155aa5683
--- /dev/null
+++ b/releasenotes/notes/neutron-metadata-agent-wrapper-scripts-d6163080d169ea14.yaml
@@ -0,0 +1,7 @@
+---
+features:
+  - |
+    The neutron wrapper scripts, which were introduced in
+    I679ac66186d457ae53f89469fe22c5662089019a, are now included in the
+    ``neutron-metadata-agent`` container, making it possible to run
+    haproxy processes as separate containers.

From 4d87fecd163f5e692e6843fc4709c2b66aee0797 Mon Sep 17 00:00:00 2001
From: Michal Nasiadka <mnasiadka@gmail.com>
Date: Thu, 9 Oct 2025 13:52:36 +0200
Subject: [PATCH 02/20] repos: Deduplicate repos.yaml

Introduce rpm/deb entry in repos.yaml, create a structure

[base_package_type]:
  [base_distro]:
    [base_distro-$arch]

Allow any of these to be undefined, defaulting to empty dict

This allows to deduplicate entries between distros of the same
base_package_type (rpm/deb)

Sort repos.yaml

Change-Id: Ifc351d5d612e6c6cc82be282aed179c656ae252c
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
---
 kolla/template/methods.py |   5 +-
 kolla/template/repos.yaml | 238 ++++++++++++--------------------------
 2 files changed, 74 insertions(+), 169 deletions(-)

diff --git a/kolla/template/methods.py b/kolla/template/methods.py
index 53e0da95b2..42b7399bbc 100644
--- a/kolla/template/methods.py
+++ b/kolla/template/methods.py
@@ -126,8 +126,9 @@ def handle_repos(context, reponames, mode):
     commands = ''
 
     try:
-        repo_list = repo_data[base_distro] | \
-                    repo_data['%s-%s' % (base_distro, base_arch)]
+        repo_list = repo_data.get(base_package_type, dict()) | \
+                    repo_data.get(base_distro, dict()) | \
+                    repo_data.get('%s-%s' % (base_distro, base_arch), dict())
     except KeyError:
         # NOTE(hrw): Fallback to distro list
         repo_list = repo_data[base_distro]
diff --git a/kolla/template/repos.yaml b/kolla/template/repos.yaml
index c9ba633b89..59c3f5c748 100644
--- a/kolla/template/repos.yaml
+++ b/kolla/template/repos.yaml
@@ -1,107 +1,8 @@
 ---
-centos:
-  ceph:
-    gpgkey: "https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage"
-    metalink: "https://mirrors.centos.org/metalink?repo=centos-storage-sig-ceph-squid-9-stream&arch=$basearch"
-    name: "centos-ceph-squid"
-  crb:
-    distro: True
-    name: "crb"
-  docker-ce:
-    gpgkey: "https://download.docker.com/linux/centos/gpg"
-    baseurl: "https://download.docker.com/linux/centos/$releasever/$basearch/stable"
-    name: "docker-ce"
-  epel:
-    gpgkey: "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-$releasever"
-    metalink: "https://mirrors.fedoraproject.org/metalink?repo=epel-$releasever&arch=$basearch&infra=$infra&content=$contentdir"
-    name: "epel"
-  erlang:
-    baseurl: |
-      https://yum1.rabbitmq.com/erlang/el/9/$basearch
-      https://yum2.rabbitmq.com/erlang/el/9/$basearch
-    gpgkey: "https://github.com/rabbitmq/signing-keys/releases/download/3.0/cloudsmith.rabbitmq-erlang.E495BB49CC4BBE5B.key"
-    name: "rabbitmq_rabbitmq-erlang"
-  extras:
-    distro: True
-    name: "extras"
-  fluentd:
-    baseurl: "https://fluentd.cdn.cncf.io/lts/6/redhat/$releasever/$basearch"
-    gpgkey: "https://fluentd.cdn.cncf.io/GPG-KEY-fluent-package"
-    name: "fluent-package-lts"
-  grafana:
-    baseurl: "https://rpm.grafana.com"
-    gpgkey: "https://rpm.grafana.com/gpg.key"
-    name: "grafana"
-  hacluster:
-    name: "highavailability"
-    distro: true
-  influxdb:
-    baseurl: "https://repos.influxdata.com/rhel/9/$basearch/stable"
-    gpgkey: "https://repos.influxdata.com/influxdata-archive_compat.key"
-    name: "influxdb"
-  kolla_el10:
-    baseurl: "https://download.copr.fedorainfracloud.org/results/@openstack-kolla/el10-missing/epel-10-$basearch/"
-    gpgkey: "https://download.copr.fedorainfracloud.org/results/@openstack-kolla/el10-missing/pubkey.gpg"
-    name: "kolla_el10"
-  mariadb:
-    baseurl: "https://dlm.mariadb.com/repo/mariadb-server/10.11/yum/rhel/$releasever/$basearch"
-    gpgkey: "https://downloads.mariadb.com/MariaDB/RPM-GPG-KEY-MariaDB"
-    name: "mariadb"
-  opensearch:
-    baseurl: "https://artifacts.opensearch.org/releases/bundle/opensearch/3.x/yum"
-    gpgkey: "https://artifacts.opensearch.org/publickeys/opensearch-release.pgp"
-    repo_gpgcheck: 1
-    name: "opensearch32.x"
-  opensearch-dashboards:
-    baseurl: "https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/3.x/yum"
-    gpgkey: "https://artifacts.opensearch.org/publickeys/opensearch-release.pgp"
-    repo_gpgcheck: 1
-    name: "opensearch-dashboards-3.x"
-  openvswitch:
-    gpgkey: "https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-NFV"
-    metalink: "https://mirrors.centos.org/metalink?repo=centos-nfv-sig-openvswitch-2-$stream&arch=$basearch&protocol=https,http"
-    name: "centos-nfv-openvswitch"
-  opstools:
-    distro: True
-    name: "opstools"
-  proxysql:
-    baseurl: "https://repo.proxysql.com/ProxySQL/proxysql-3.0.x/almalinux/9"
-    gpgkey: "https://repo.proxysql.com/ProxySQL/proxysql-3.0.x/repo_pub_key"
-    name: "proxysql"
-  rabbitmq:
-    baseurl: |
-      https://yum1.rabbitmq.com/rabbitmq/el/9/noarch
-      https://yum2.rabbitmq.com/rabbitmq/el/9/noarch
-    gpgkey: |
-      https://github.com/rabbitmq/signing-keys/releases/download/3.0/cloudsmith.rabbitmq-server.9F4587F226208342.key
-      https://github.com/rabbitmq/signing-keys/releases/download/3.0/rabbitmq-release-signing-key.asc
-    name: "rabbitmq_rabbitmq-server"
-
-centos-aarch64:
-  erlang:
-    baseurl: "https://download.copr.fedorainfracloud.org/results/@openstack-kolla/rabbitmq-erlang-27/rhel-$releasever-aarch64/"
-    gpgkey: "https://download.copr.fedorainfracloud.org/results/@openstack-kolla/rabbitmq-erlang-27/pubkey.gpg"
-    name: "copr-rabbitmq-erlang"
-
 # NOTE(mnasiadka): For RabbitMQ Debuntu suite names is following:
 # https://www.rabbitmq.com/install-debian.html#apt-cloudsmith
 
-debian:
-  docker-ce:
-    url: "https://download.docker.com/linux/debian"
-    suite: "bookworm"
-    component: "stable"
-    gpg_key: "docker-ce.asc"
-  erlang:
-    url: "https://ppa.launchpadcontent.net/rabbitmq/rabbitmq-erlang/ubuntu"
-    suite: "jammy"
-    component: "main"
-    gpg_key: "erlang-ppa.gpg"
-  fluentd:
-    url: "https://fluentd.cdn.cncf.io/lts/6/debian/bookworm"
-    suite: "bookworm"
-    component: "contrib"
-    gpg_key: "fluentd.asc"
+deb:
   grafana:
     url: "https://apt.grafana.com"
     suite: "stable"
@@ -112,11 +13,6 @@ debian:
     suite: "jammy"
     component: "stable"
     gpg_key: "influxdb.asc"
-  mariadb:
-    url: "https://dlm.mariadb.com/repo/mariadb-server/10.11/repo/debian"
-    suite: "bookworm"
-    component: "main"
-    gpg_key: "mariadb.gpg"
   opensearch:
     url: "https://artifacts.opensearch.org/releases/bundle/opensearch/3.x/apt/"
     suite: "stable"
@@ -127,6 +23,28 @@ debian:
     suite: "stable"
     component: "main"
     gpg_key: "opensearch.asc"
+
+debian:
+  erlang:
+    url: "https://ppa.launchpadcontent.net/rabbitmq/rabbitmq-erlang/ubuntu"
+    suite: "jammy"
+    component: "main"
+    gpg_key: "erlang-ppa.gpg"
+  docker-ce:
+    url: "https://download.docker.com/linux/debian"
+    suite: "bookworm"
+    component: "stable"
+    gpg_key: "docker-ce.asc"
+  fluentd:
+    url: "https://fluentd.cdn.cncf.io/lts/6/debian/bookworm"
+    suite: "bookworm"
+    component: "contrib"
+    gpg_key: "fluentd.asc"
+  mariadb:
+    url: "https://dlm.mariadb.com/repo/mariadb-server/10.11/repo/debian"
+    suite: "bookworm"
+    component: "main"
+    gpg_key: "mariadb.gpg"
   proxysql:
     url: "https://repo.proxysql.com/ProxySQL/proxysql-3.0.x/bookworm/"
     suite: "./"
@@ -148,7 +66,49 @@ debian-aarch64:
     arch: "amd64"
     gpg_key: "rabbitmq.gpg"
 
-rocky:
+ubuntu:
+  erlang:
+    url: "https://ppa.launchpadcontent.net/rabbitmq/rabbitmq-erlang/ubuntu"
+    suite: "noble"
+    component: "main"
+    gpg_key: "erlang-ppa.gpg"
+  docker-ce:
+    url: "https://download.docker.com/linux/ubuntu"
+    suite: "noble"
+    component: "stable"
+    gpg_key: "docker-ce.asc"
+  fluentd:
+    url: "https://fluentd.cdn.cncf.io/lts/6/ubuntu/noble"
+    suite: "noble"
+    component: "contrib"
+    gpg_key: "fluentd.asc"
+  mariadb:
+    url: "https://dlm.mariadb.com/repo/mariadb-server/10.11/repo/ubuntu"
+    suite: "noble"
+    component: "main"
+    gpg_key: "mariadb.gpg"
+  proxysql:
+    url: "https://repo.proxysql.com/ProxySQL/proxysql-3.0.x/noble/"
+    suite: "./"
+    component: ""
+    gpg_key: "proxysql.asc"
+  rabbitmq:
+    url: "https://ppa1.rabbitmq.com/rabbitmq/rabbitmq-server/deb/ubuntu"
+    suite: "noble"
+    component: "main"
+    gpg_key: "rabbitmq.gpg"
+
+ubuntu-aarch64:
+  rabbitmq:
+    url: "https://ppa1.rabbitmq.com/rabbitmq/rabbitmq-server/deb/ubuntu"
+    suite: "noble"
+    component: "main"
+    # NOTE(mnasiadka): Since rabbitmq is really noarch and community mirror is not
+    # syncing binary-aarch64 - we're using amd64 here.
+    arch: "amd64"
+    gpg_key: "rabbitmq.gpg"
+
+rpm:
   ceph:
     gpgkey: "https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage"
     metalink: "https://mirrors.centos.org/metalink?repo=centos-storage-sig-ceph-squid-9-stream&arch=$basearch"
@@ -226,71 +186,15 @@ rocky:
       https://github.com/rabbitmq/signing-keys/releases/download/3.0/rabbitmq-release-signing-key.asc
     name: "rabbitmq_rabbitmq-server"
 
-rocky-aarch64:
+centos-aarch64:
   erlang:
     baseurl: "https://download.copr.fedorainfracloud.org/results/@openstack-kolla/rabbitmq-erlang-27/rhel-$releasever-aarch64/"
     gpgkey: "https://download.copr.fedorainfracloud.org/results/@openstack-kolla/rabbitmq-erlang-27/pubkey.gpg"
     name: "copr-rabbitmq-erlang"
 
-ubuntu:
-  docker-ce:
-    url: "https://download.docker.com/linux/ubuntu"
-    suite: "noble"
-    component: "stable"
-    gpg_key: "docker-ce.asc"
+rocky-aarch64:
   erlang:
-    url: "https://ppa.launchpadcontent.net/rabbitmq/rabbitmq-erlang/ubuntu"
-    suite: "noble"
-    component: "main"
-    gpg_key: "erlang-ppa.gpg"
-  fluentd:
-    url: "https://fluentd.cdn.cncf.io/lts/6/ubuntu/noble"
-    suite: "noble"
-    component: "contrib"
-    gpg_key: "fluentd.asc"
-  grafana:
-    url: "https://apt.grafana.com"
-    suite: "stable"
-    component: "main"
-    gpg_key: "grafana.asc"
-  influxdb:
-    url: "https://repos.influxdata.com/ubuntu"
-    # TODO(mnasiadka): Switch to noble when available
-    suite: "jammy"
-    component: "stable"
-    gpg_key: "influxdb.asc"
-  mariadb:
-    url: "https://dlm.mariadb.com/repo/mariadb-server/10.11/repo/ubuntu"
-    suite: "noble"
-    component: "main"
-    gpg_key: "mariadb.gpg"
-  opensearch:
-    url: "https://artifacts.opensearch.org/releases/bundle/opensearch/3.x/apt/"
-    suite: "stable"
-    component: "main"
-    gpg_key: "opensearch.asc"
-  opensearch-dashboards:
-    url: "https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/3.x/apt/"
-    suite: "stable"
-    component: "main"
-    gpg_key: "opensearch.asc"
-  proxysql:
-    url: "https://repo.proxysql.com/ProxySQL/proxysql-3.0.x/noble/"
-    suite: "./"
-    component: ""
-    gpg_key: "proxysql.asc"
-  rabbitmq:
-    url: "https://ppa1.rabbitmq.com/rabbitmq/rabbitmq-server/deb/ubuntu"
-    suite: "noble"
-    component: "main"
-    gpg_key: "rabbitmq.gpg"
+    baseurl: "https://download.copr.fedorainfracloud.org/results/@openstack-kolla/rabbitmq-erlang-27/rhel-$releasever-aarch64/"
+    gpgkey: "https://download.copr.fedorainfracloud.org/results/@openstack-kolla/rabbitmq-erlang-27/pubkey.gpg"
+    name: "copr-rabbitmq-erlang"
 
-ubuntu-aarch64:
-  rabbitmq:
-    url: "https://ppa1.rabbitmq.com/rabbitmq/rabbitmq-server/deb/debian"
-    suite: "noble"
-    component: "main"
-    # NOTE(mnasiadka): Since rabbitmq is really noarch and community mirror is not
-    # syncing binary-aarch64 - we're using amd64 here.
-    arch: "amd64"
-    gpg_key: "rabbitmq.gpg"

From cd75df6ce06b12c01af0eeb9578d2ca80af4f0cf Mon Sep 17 00:00:00 2001
From: Seunghun Lee <seunghun@stackhpc.com>
Date: Mon, 13 Oct 2025 15:17:27 +0100
Subject: [PATCH 03/20] Drop support for building MariaDB clustercheck

MariaDB clustercheck script has not been maintained and it will not work
with MariaDB 11.4 (the next LTS version).
This is because clustercheck.sh uses ``mysql*`` commands but from
MariaDB 11.4, those commands are not supported.

The health check of MariaDB server containers will be done by new script
which comes with change [1].

Without MariaDB clustercheck, MariaDB server becomes only container image in
the family, so mariadb-base and mariadb-server dockerfiles are merged.
To avoid breaking changes, the name 'mariadb-server' is retained.
Follow-up to rename references in Kolla and K-A from 'mariadb-server' to
'mariadb' would be nice.

[1] https://review.opendev.org/c/openstack/kolla/+/962657

Change-Id: I01278f76ee82b018a854b5862f3caaa8c78a9a30
Signed-off-by: Seunghun Lee <seunghun@stackhpc.com>
---
 .../mariadb-server/Dockerfile.j2              | 10 ++++-
 docker/{mariadb => }/mariadb-server/backup.sh |  0
 .../mariadb-server/backup_replica.sh          |  0
 .../mariadb-server/extend_start.sh            |  0
 .../mariadb-server/healthcheck_mariadb        |  0
 .../mariadb-server/mariadb_sudoers            |  0
 .../mariadb-server/security_reset.expect      |  0
 docker/mariadb/mariadb-base/Dockerfile.j2     | 44 -------------------
 .../mariadb-clustercheck/Dockerfile.j2        | 19 --------
 .../mariadb-clustercheck/extend_start.sh      | 11 -----
 .../mariadb-clustercheck/socat_wrapper.sh     | 19 --------
 kolla/common/sources.py                       |  2 +-
 ...mariadb-clustercheck-427a6cfb3f39c508.yaml |  5 +++
 zuul.d/scenarios/cephadm.yaml                 |  8 ++--
 zuul.d/scenarios/mariadb.yaml                 |  4 +-
 15 files changed, 21 insertions(+), 101 deletions(-)
 rename docker/{mariadb => }/mariadb-server/Dockerfile.j2 (89%)
 rename docker/{mariadb => }/mariadb-server/backup.sh (100%)
 rename docker/{mariadb => }/mariadb-server/backup_replica.sh (100%)
 rename docker/{mariadb => }/mariadb-server/extend_start.sh (100%)
 rename docker/{mariadb => }/mariadb-server/healthcheck_mariadb (100%)
 rename docker/{mariadb => }/mariadb-server/mariadb_sudoers (100%)
 rename docker/{mariadb => }/mariadb-server/security_reset.expect (100%)
 delete mode 100644 docker/mariadb/mariadb-base/Dockerfile.j2
 delete mode 100644 docker/mariadb/mariadb-clustercheck/Dockerfile.j2
 delete mode 100644 docker/mariadb/mariadb-clustercheck/extend_start.sh
 delete mode 100644 docker/mariadb/mariadb-clustercheck/socat_wrapper.sh
 create mode 100644 releasenotes/notes/remove-mariadb-clustercheck-427a6cfb3f39c508.yaml

diff --git a/docker/mariadb/mariadb-server/Dockerfile.j2 b/docker/mariadb-server/Dockerfile.j2
similarity index 89%
rename from docker/mariadb/mariadb-server/Dockerfile.j2
rename to docker/mariadb-server/Dockerfile.j2
index 15b9e48a4e..ddb045fbb6 100644
--- a/docker/mariadb/mariadb-server/Dockerfile.j2
+++ b/docker/mariadb-server/Dockerfile.j2
@@ -1,4 +1,4 @@
-FROM {{ namespace }}/{{ image_prefix }}mariadb-base:{{ tag }}
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
 {% block labels %}
 LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build_date }}"
 {% endblock %}
@@ -18,6 +18,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
     {% set mariadb_packages = [
         'expect',
+        'mariadb',
         'mariadb-backup',
         'mariadb-server',
         'mariadb-server-galera',
@@ -34,12 +35,19 @@ RUN ln -s /usr/lib64/galera-4 /usr/lib64/galera
     {% set mariadb_packages = [
         'expect',
         'mariadb-backup',
+        'mariadb-client',
         'mariadb-server'
     ] %}
 {% endif %}
 
 {{ macros.install_packages(mariadb_packages | customizable("packages")) }}
 
+{% block mariadb_healthcheck %}
+ENV MARIADB_VERSION=10.11
+ADD plugins-archive /
+RUN install -m 755 /plugins/mariadb-server-plugin-mariadb-docker-archive*/$MARIADB_VERSION/healthcheck.sh /usr/bin/healthcheck.sh
+{% endblock %}
+
 COPY mariadb_sudoers /etc/sudoers.d/kolla_mariadb_sudoers
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 COPY security_reset.expect /usr/local/bin/kolla_security_reset
diff --git a/docker/mariadb/mariadb-server/backup.sh b/docker/mariadb-server/backup.sh
similarity index 100%
rename from docker/mariadb/mariadb-server/backup.sh
rename to docker/mariadb-server/backup.sh
diff --git a/docker/mariadb/mariadb-server/backup_replica.sh b/docker/mariadb-server/backup_replica.sh
similarity index 100%
rename from docker/mariadb/mariadb-server/backup_replica.sh
rename to docker/mariadb-server/backup_replica.sh
diff --git a/docker/mariadb/mariadb-server/extend_start.sh b/docker/mariadb-server/extend_start.sh
similarity index 100%
rename from docker/mariadb/mariadb-server/extend_start.sh
rename to docker/mariadb-server/extend_start.sh
diff --git a/docker/mariadb/mariadb-server/healthcheck_mariadb b/docker/mariadb-server/healthcheck_mariadb
similarity index 100%
rename from docker/mariadb/mariadb-server/healthcheck_mariadb
rename to docker/mariadb-server/healthcheck_mariadb
diff --git a/docker/mariadb/mariadb-server/mariadb_sudoers b/docker/mariadb-server/mariadb_sudoers
similarity index 100%
rename from docker/mariadb/mariadb-server/mariadb_sudoers
rename to docker/mariadb-server/mariadb_sudoers
diff --git a/docker/mariadb/mariadb-server/security_reset.expect b/docker/mariadb-server/security_reset.expect
similarity index 100%
rename from docker/mariadb/mariadb-server/security_reset.expect
rename to docker/mariadb-server/security_reset.expect
diff --git a/docker/mariadb/mariadb-base/Dockerfile.j2 b/docker/mariadb/mariadb-base/Dockerfile.j2
deleted file mode 100644
index 51cdadb29f..0000000000
--- a/docker/mariadb/mariadb-base/Dockerfile.j2
+++ /dev/null
@@ -1,44 +0,0 @@
-FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
-{% block labels %}
-LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build_date }}"
-{% endblock %}
-
-{% block mariadb_base_header %}{% endblock %}
-
-{% import "macros.j2" as macros with context %}
-
-{{ macros.configure_user(name='mysql') }}
-
-{# NOTE(mnasiadka): Using AppStream packages on CS10 for now #}
-{% if base_package_type == 'rpm' %}
-    {% set mariadb_base_packages = [
-        'mariadb',
-    ] %}
-
-{% elif base_package_type == 'deb' %}
-{{ macros.enable_extra_repos(['mariadb']) }}
-    {% set mariadb_base_packages = [
-        'mariadb-client',
-    ] %}
-{% endif %}
-
-{{ macros.install_packages(mariadb_base_packages | customizable("packages")) }}
-
-{# NOTE(mnasiadka): Latest clustercheck version as of May 2023 is 10.9 #}
-{% block mariadb_clustercheck_version %}
-ARG mariadb_clustercheck_version=10.9
-ARG mariadb_clustercheck_url=https://src.fedoraproject.org/rpms/mariadb/raw/${mariadb_clustercheck_version}/f/clustercheck.sh
-{% endblock %}
-
-RUN curl -o /usr/bin/clustercheck ${mariadb_clustercheck_url} \
-    && chmod 755 /usr/bin/clustercheck
-
-{% block mariadb_healthcheck %}
-ENV MARIADB_VERSION=10.11
-ADD plugins-archive /
-RUN install -m 755 /plugins/mariadb-base-plugin-mariadb-docker-archive*/$MARIADB_VERSION/healthcheck.sh /usr/bin/healthcheck.sh
-{% endblock %}
-
-{{ macros.kolla_patch_sources() }}
-
-{% block mariadb_base_footer %}{% endblock %}
diff --git a/docker/mariadb/mariadb-clustercheck/Dockerfile.j2 b/docker/mariadb/mariadb-clustercheck/Dockerfile.j2
deleted file mode 100644
index 7aee4ef055..0000000000
--- a/docker/mariadb/mariadb-clustercheck/Dockerfile.j2
+++ /dev/null
@@ -1,19 +0,0 @@
-FROM {{ namespace }}/{{ image_prefix }}mariadb-base:{{ tag }}
-{% block labels %}
-LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build_date }}"
-{% endblock %}
-
-{% block mariadb_clustercheck_header %}{% endblock %}
-
-{% import "macros.j2" as macros with context %}
-
-COPY extend_start.sh /usr/local/bin/kolla_extend_start
-COPY socat_wrapper.sh /usr/local/bin/socat_wrapper
-
-RUN chmod 644 /usr/local/bin/kolla_extend_start && \
-    chmod 755 /usr/local/bin/socat_wrapper
-
-{{ macros.kolla_patch_sources() }}
-
-{% block mariadb_clustercheck_footer %}{% endblock %}
-{% block footer %}{% endblock %}
diff --git a/docker/mariadb/mariadb-clustercheck/extend_start.sh b/docker/mariadb/mariadb-clustercheck/extend_start.sh
deleted file mode 100644
index 7379abddc6..0000000000
--- a/docker/mariadb/mariadb-clustercheck/extend_start.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/bash
-
-: ${MARIADB_LOG_DIR:=/var/log/kolla/mariadb}
-
-# Create log directory, with appropriate permissions
-if [[ ! -d "${MARIADB_LOG_DIR}" ]]; then
-    mkdir -p ${MARIADB_LOG_DIR}
-fi
-if [[ $(stat -c %a ${MARIADB_LOG_DIR}) != "755" ]]; then
-    chmod 755 ${MARIADB_LOG_DIR}
-fi
diff --git a/docker/mariadb/mariadb-clustercheck/socat_wrapper.sh b/docker/mariadb/mariadb-clustercheck/socat_wrapper.sh
deleted file mode 100644
index bf562e3d5d..0000000000
--- a/docker/mariadb/mariadb-clustercheck/socat_wrapper.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-
-catch_term() {
-    kill -TERM "$child" 2>/dev/null
-    exit 0
-}
-
-catch_quit() {
-    kill -QUIT "$child" 2>/dev/null
-    exit 0
-}
-
-trap catch_term SIGTERM
-trap catch_quit SIGQUIT
-
-socat "$@" &
-
-child=$!
-wait "$child"
diff --git a/kolla/common/sources.py b/kolla/common/sources.py
index ea8df7c570..70ff33ea75 100644
--- a/kolla/common/sources.py
+++ b/kolla/common/sources.py
@@ -193,7 +193,7 @@
         'type': 'url',
         'location': ('$tarballs_base/openstack/manila/'
                      'manila-${openstack_branch}.tar.gz')},
-    'mariadb-base-plugin-mariadb-docker': {
+    'mariadb-server-plugin-mariadb-docker': {
         # NOTE(seunghun1ee): This repo is needed to get MariaDB healthcheck.sh
         'type': 'git',
         'reference': 'master',
diff --git a/releasenotes/notes/remove-mariadb-clustercheck-427a6cfb3f39c508.yaml b/releasenotes/notes/remove-mariadb-clustercheck-427a6cfb3f39c508.yaml
new file mode 100644
index 0000000000..2a6fcadba0
--- /dev/null
+++ b/releasenotes/notes/remove-mariadb-clustercheck-427a6cfb3f39c508.yaml
@@ -0,0 +1,5 @@
+---
+upgrade:
+  - |
+    Dropped support for building MariaDB clustercheck container image as it
+    will not be compatible with MariaDB 11.4 (the next LTS version).
diff --git a/zuul.d/scenarios/cephadm.yaml b/zuul.d/scenarios/cephadm.yaml
index 1a56c81ff9..93578439ae 100644
--- a/zuul.d/scenarios/cephadm.yaml
+++ b/zuul.d/scenarios/cephadm.yaml
@@ -6,10 +6,10 @@
     check:
       jobs:
         - kolla-ansible-debian-bookworm-cephadm:
-            files: ^docker\/(base|cinder|glance|mariadb|openstack-base|rabbitmq)\/.*
+            files: ^docker\/(base|cinder|glance|mariadb-server|openstack-base|rabbitmq)\/.*
         - kolla-ansible-debian-bookworm-cephadm-upgrade:
-            files: ^docker\/(base|cinder|glance|mariadb|openstack-base|rabbitmq)\/.*
+            files: ^docker\/(base|cinder|glance|mariadb-server|openstack-base|rabbitmq)\/.*
         - kolla-ansible-ubuntu-noble-cephadm:
-            files: ^docker\/(base|cinder|glance|mariadb|openstack-base|rabbitmq)\/.*
+            files: ^docker\/(base|cinder|glance|mariadb-server|openstack-base|rabbitmq)\/.*
         - kolla-ansible-ubuntu-noble-cephadm-upgrade:
-            files: ^docker\/(base|cinder|glance|mariadb|openstack-base|rabbitmq)\/.*
+            files: ^docker\/(base|cinder|glance|mariadb-server|openstack-base|rabbitmq)\/.*
diff --git a/zuul.d/scenarios/mariadb.yaml b/zuul.d/scenarios/mariadb.yaml
index 42b4535dfa..3627e11a4a 100644
--- a/zuul.d/scenarios/mariadb.yaml
+++ b/zuul.d/scenarios/mariadb.yaml
@@ -6,6 +6,6 @@
     check:
       jobs:
         - kolla-ansible-debian-bookworm-mariadb:
-            files: ^docker/(base|mariadb)/
+            files: ^docker/(base|mariadb-server)/
         - kolla-ansible-ubuntu-noble-mariadb:
-            files: ^docker/(base|mariadb)/
+            files: ^docker/(base|mariadb-server)/

From c24528917661a9dc6f0fb1379cc74c544c690a42 Mon Sep 17 00:00:00 2001
From: Michal Nasiadka <mnasiadka@gmail.com>
Date: Fri, 23 Aug 2024 08:37:13 +0200
Subject: [PATCH 04/20] mariadb: Bump to 11.4

11.4 is the next LTS release (see [1])

New variable ``VERIFY_DB_SERVER_CERT`` is added to mitigate the MariaDB
client variable ``ssl-verify-server-cert`` change from ``FALSE`` to
``TRUE``. [2]
This variable can be overidden by assigning ``TRUE`` to environment
variable with the same name.

[1]: https://mariadb.org/11-4-lts/
[2]: https://jira.mariadb.org/browse/MDEV-31857

Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/928487
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/958281

Change-Id: Ifb41c0c48c4743e70e95fa7e1d329e91362e966c
Signed-off-by: Seunghun Lee <seunghun@stackhpc.com>
---
 docker/mariadb-server/Dockerfile.j2                |  2 +-
 docker/mariadb-server/backup_replica.sh            |  3 ++-
 docker/mariadb-server/extend_start.sh              | 14 +++++++-------
 kolla/template/repos.yaml                          |  7 +++----
 .../notes/mariadb-11.4-b66b5baf9f5e6cd0.yaml       |  5 +++++
 5 files changed, 18 insertions(+), 13 deletions(-)
 create mode 100644 releasenotes/notes/mariadb-11.4-b66b5baf9f5e6cd0.yaml

diff --git a/docker/mariadb-server/Dockerfile.j2 b/docker/mariadb-server/Dockerfile.j2
index ddb045fbb6..8d17ff4ff9 100644
--- a/docker/mariadb-server/Dockerfile.j2
+++ b/docker/mariadb-server/Dockerfile.j2
@@ -43,7 +43,7 @@ RUN ln -s /usr/lib64/galera-4 /usr/lib64/galera
 {{ macros.install_packages(mariadb_packages | customizable("packages")) }}
 
 {% block mariadb_healthcheck %}
-ENV MARIADB_VERSION=10.11
+ENV MARIADB_VERSION=11.4
 ADD plugins-archive /
 RUN install -m 755 /plugins/mariadb-server-plugin-mariadb-docker-archive*/$MARIADB_VERSION/healthcheck.sh /usr/bin/healthcheck.sh
 {% endblock %}
diff --git a/docker/mariadb-server/backup_replica.sh b/docker/mariadb-server/backup_replica.sh
index ebdcbf6b0b..fe10bc61b1 100644
--- a/docker/mariadb-server/backup_replica.sh
+++ b/docker/mariadb-server/backup_replica.sh
@@ -8,6 +8,7 @@ DEFAULT_MY_CNF="/etc/mysql/my.cnf"
 REPLICA_MY_CNF="$(mktemp)"
 RETRY_INTERVAL=5  # Interval between retries (in seconds)
 MAX_RETRIES=12    # Max retries (12 retries * 5 seconds = 60 seconds)
+VERIFY_DB_SERVER_CERT="${VERIFY_DB_SERVER_CERT:=FALSE}"
 
 # Cleanup function to remove the REPLICA_MY_CNF file
 cleanup() {
@@ -74,7 +75,7 @@ retry_mysql_query() {
     local attempt=1
 
     while [ ${attempt} -le ${MAX_RETRIES} ]; do
-        result=$(mysql -h "${HOST}" -u "${USER}" -p"${PASS}" -s -N -e "${query}" 2>/dev/null || true)
+        result=$(mariadb --ssl-verify-server-cert="${VERIFY_DB_SERVER_CERT}" -h "${HOST}" -u "${USER}" -p"${PASS}" -s -N -e "${query}" 2>/dev/null || true)
         if [ -n "${result}" ]; then
             echo "${result}"
             return 0
diff --git a/docker/mariadb-server/extend_start.sh b/docker/mariadb-server/extend_start.sh
index 53a54557d6..f14c859492 100644
--- a/docker/mariadb-server/extend_start.sh
+++ b/docker/mariadb-server/extend_start.sh
@@ -3,7 +3,7 @@
 : ${MARIADB_LOG_DIR:=/var/log/kolla/mariadb}
 
 function bootstrap_db {
-    mysqld_safe --wsrep-new-cluster --skip-networking --wsrep-on=OFF --pid-file=/var/lib/mysql/mariadb.pid &
+    mariadbd-safe --wsrep-new-cluster --skip-networking --wsrep-on=OFF --pid-file=/var/lib/mysql/mariadb.pid &
     # Wait for the mariadb server to be "Ready" before starting the security reset with a max timeout
     # NOTE(huikang): the location of mysql's socket file varies depending on the OS distributions.
     # Querying the cluster status has to be executed after the existence of mysql.sock and mariadb.pid.
@@ -22,9 +22,9 @@ function bootstrap_db {
     sudo -E kolla_security_reset
 
     set +o xtrace
-    mysql -u root --password="${DB_ROOT_PASSWORD}" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY '${DB_ROOT_PASSWORD}' WITH GRANT OPTION;"
-    mysql -u root --password="${DB_ROOT_PASSWORD}" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '${DB_ROOT_PASSWORD}' WITH GRANT OPTION;"
-    mysqladmin -uroot -p"${DB_ROOT_PASSWORD}" shutdown
+    mariadb -u root --password="${DB_ROOT_PASSWORD}" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY '${DB_ROOT_PASSWORD}' WITH GRANT OPTION;"
+    mariadb -u root --password="${DB_ROOT_PASSWORD}" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '${DB_ROOT_PASSWORD}' WITH GRANT OPTION;"
+    mariadb-admin -uroot -p"${DB_ROOT_PASSWORD}" shutdown
     set -o xtrace
 }
 
@@ -38,21 +38,21 @@ fi
 
 # This catches all cases of the BOOTSTRAP variable being set, including empty
 if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
-    mysql_install_db 2>&1 | tee -a ${MARIADB_LOG_DIR}/mariadb-bootstrap.log
+    mariadb-install-db 2>&1 | tee -a ${MARIADB_LOG_DIR}/mariadb-bootstrap.log
     bootstrap_db 2>&1 | tee -a ${MARIADB_LOG_DIR}/mariadb-bootstrap.log
     exit 0
 fi
 
 # This catches all cases of the KOLLA_UPGRADE variable being set, including empty
 if [[ "${!KOLLA_UPGRADE[@]}" ]]; then
-    # The mysql_upgrade command treats any directories under /var/lib/mysql as
+    # The mariadb-upgrade command treats any directories under /var/lib/mysql as
     # databases. Somehow we can end up with a .pki directory, which causes the
     # command to fail with this error:
     # Incorrect database name '#mysql50#.pki' when selecting the database
     # There doesn't seem to be anything in the directory, so remove it.
     rm -rf /var/lib/mysql/.pki
 
-    mysql_upgrade --host=${DB_HOST} --port=${DB_PORT} --user=root --password="${DB_ROOT_PASSWORD}" 2>&1 | tee -a ${MARIADB_LOG_DIR}/mariadb-upgrade.log
+    mariadb-upgrade --host=${DB_HOST} --port=${DB_PORT} --user=root --password="${DB_ROOT_PASSWORD}" 2>&1 | tee -a ${MARIADB_LOG_DIR}/mariadb-upgrade.log
     exit 0
 fi
 
diff --git a/kolla/template/repos.yaml b/kolla/template/repos.yaml
index 59c3f5c748..6739c9bd1e 100644
--- a/kolla/template/repos.yaml
+++ b/kolla/template/repos.yaml
@@ -41,7 +41,7 @@ debian:
     component: "contrib"
     gpg_key: "fluentd.asc"
   mariadb:
-    url: "https://dlm.mariadb.com/repo/mariadb-server/10.11/repo/debian"
+    url: "https://dlm.mariadb.com/repo/mariadb-server/11.4/repo/debian"
     suite: "bookworm"
     component: "main"
     gpg_key: "mariadb.gpg"
@@ -83,7 +83,7 @@ ubuntu:
     component: "contrib"
     gpg_key: "fluentd.asc"
   mariadb:
-    url: "https://dlm.mariadb.com/repo/mariadb-server/10.11/repo/ubuntu"
+    url: "https://dlm.mariadb.com/repo/mariadb-server/11.4/repo/ubuntu"
     suite: "noble"
     component: "main"
     gpg_key: "mariadb.gpg"
@@ -153,7 +153,7 @@ rpm:
     gpgkey: "https://download.copr.fedorainfracloud.org/results/@openstack-kolla/el10-missing/pubkey.gpg"
     name: "kolla_el10"
   mariadb:
-    baseurl: "https://dlm.mariadb.com/repo/mariadb-server/10.11/yum/rhel/$releasever/$basearch"
+    baseurl: "https://dlm.mariadb.com/repo/mariadb-server/11.4/yum/rhel/$releasever/$basearch"
     gpgkey: "https://downloads.mariadb.com/MariaDB/RPM-GPG-KEY-MariaDB"
     name: "mariadb"
   opensearch:
@@ -197,4 +197,3 @@ rocky-aarch64:
     baseurl: "https://download.copr.fedorainfracloud.org/results/@openstack-kolla/rabbitmq-erlang-27/rhel-$releasever-aarch64/"
     gpgkey: "https://download.copr.fedorainfracloud.org/results/@openstack-kolla/rabbitmq-erlang-27/pubkey.gpg"
     name: "copr-rabbitmq-erlang"
-
diff --git a/releasenotes/notes/mariadb-11.4-b66b5baf9f5e6cd0.yaml b/releasenotes/notes/mariadb-11.4-b66b5baf9f5e6cd0.yaml
new file mode 100644
index 0000000000..17c0f9845f
--- /dev/null
+++ b/releasenotes/notes/mariadb-11.4-b66b5baf9f5e6cd0.yaml
@@ -0,0 +1,5 @@
+---
+features:
+  - |
+    ``MariaDB`` version has been updated to ``11.4 LTS``.
+    This version will be supported until 29th May 2029.

From 8f827e021bd1c3d070763a96bd19cc9d2516f91f Mon Sep 17 00:00:00 2001
From: Michal Nasiadka <mnasiadka@gmail.com>
Date: Fri, 11 Jul 2025 11:56:54 +0200
Subject: [PATCH 05/20] Add httpd image for OIDC/SAML frontend in uWSGI case

Change-Id: Ia85f253ecaeaef63c17e75dc4a223e030dbbc58d
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
---
 docker/httpd/Dockerfile.j2   | 45 ++++++++++++++++++++++++++++++++++++
 docker/httpd/extend_start.sh |  1 +
 2 files changed, 46 insertions(+)
 create mode 100644 docker/httpd/Dockerfile.j2
 create mode 100644 docker/httpd/extend_start.sh

diff --git a/docker/httpd/Dockerfile.j2 b/docker/httpd/Dockerfile.j2
new file mode 100644
index 0000000000..2b58e7b127
--- /dev/null
+++ b/docker/httpd/Dockerfile.j2
@@ -0,0 +1,45 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build_date }}"
+{% endblock %}
+
+{% block apache_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+{# NOTE(mnasiadka): mod_auth_mellon missing in CentOS 10 Stream - temporarily from Kolla COPR #}
+{{ macros.enable_extra_repos(['epel', 'kolla_el10']) }}
+    {% set apache_packages = [
+        'httpd',
+        'mod_ssl',
+        'mod_auth_mellon',
+        'mod_auth_openidc',
+        'mod_proxy_uwsgi'
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set apache_packages = [
+        'apache2',
+        'ca-certificates',
+        'libapache2-mod-auth-mellon',
+        'libapache2-mod-auth-openidc',
+        'libapache2-mod-proxy-uwsgi'
+    ] %}
+{% endif %}
+
+{{ macros.install_packages(apache_packages | customizable("packages")) }}
+
+{% if base_package_type == 'rpm' %}
+RUN sed -i -r 's,^(Listen 80),#\1,' /etc/httpd/conf/httpd.conf \
+    && sed -i -r 's,^(Listen 443),#\1,' /etc/httpd/conf.d/ssl.conf
+{% elif base_package_type == 'deb' %}
+RUN echo > /etc/apache2/ports.conf
+{% endif %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
+
+USER root
+
+{% block apache_footer %}{% endblock %}
+
diff --git a/docker/httpd/extend_start.sh b/docker/httpd/extend_start.sh
new file mode 100644
index 0000000000..d47af64b96
--- /dev/null
+++ b/docker/httpd/extend_start.sh
@@ -0,0 +1 @@
+. /usr/local/bin/kolla_httpd_setup

From 3e12a642c2f4cd0600a2f9aa97ab9e24af3b7912 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Thu, 25 Sep 2025 22:30:03 +0900
Subject: [PATCH 06/20] Remove container image of neutron-linuxbridge-agent

The agent was removed from neutron during 2025.1 cycle. The remaining
implementation to deploy it is being removed from kolla-anible now.

Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/962278
Change-Id: I2cf22b874fcb885752bf3800c8ad8fa7a5eacff7
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
---
 .../neutron-linuxbridge-agent/Dockerfile.j2   | 21 -------------------
 ...on-linuxbridge-agent-5c4596f148c143ed.yaml |  5 +++++
 2 files changed, 5 insertions(+), 21 deletions(-)
 delete mode 100644 docker/neutron/neutron-linuxbridge-agent/Dockerfile.j2
 create mode 100644 releasenotes/notes/drop-neutron-linuxbridge-agent-5c4596f148c143ed.yaml

diff --git a/docker/neutron/neutron-linuxbridge-agent/Dockerfile.j2 b/docker/neutron/neutron-linuxbridge-agent/Dockerfile.j2
deleted file mode 100644
index 471325548a..0000000000
--- a/docker/neutron/neutron-linuxbridge-agent/Dockerfile.j2
+++ /dev/null
@@ -1,21 +0,0 @@
-FROM {{ namespace }}/{{ image_prefix }}neutron-base:{{ tag }}
-{% block labels %}
-LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build_date }}"
-{% endblock %}
-
-{% block neutron_linuxbridge_agent_header %}{% endblock %}
-
-{% import "macros.j2" as macros with context %}
-
-{% set neutron_linuxbridge_agent_packages = [
-    'ebtables'
-] %}
-
-{{ macros.install_packages(neutron_linuxbridge_agent_packages | customizable("packages")) }}
-
-{{ macros.kolla_patch_sources() }}
-
-{% block neutron_linuxbridge_agent_footer %}{% endblock %}
-{% block footer %}{% endblock %}
-
-USER neutron
diff --git a/releasenotes/notes/drop-neutron-linuxbridge-agent-5c4596f148c143ed.yaml b/releasenotes/notes/drop-neutron-linuxbridge-agent-5c4596f148c143ed.yaml
new file mode 100644
index 0000000000..e4d951f539
--- /dev/null
+++ b/releasenotes/notes/drop-neutron-linuxbridge-agent-5c4596f148c143ed.yaml
@@ -0,0 +1,5 @@
+---
+upgrade:
+  - |
+    Support for building ``neutron-linuxbridge-agent`` container image has
+    been dropped following removal in Neutron.

From 9bc8d4d0816ac89614a703170601046e57f54c57 Mon Sep 17 00:00:00 2001
From: Michal Nasiadka <mnasiadka@gmail.com>
Date: Mon, 27 Oct 2025 09:44:35 +0100
Subject: [PATCH 07/20] horizon: pin pip to <25.3

Closes-Bug: #2129916

Change-Id: Ib1b40a65cb2667b53c72f00d16bfe280bcf24bfe
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
---
 docker/horizon/Dockerfile.j2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker/horizon/Dockerfile.j2 b/docker/horizon/Dockerfile.j2
index d73e5702d4..d28565aa01 100644
--- a/docker/horizon/Dockerfile.j2
+++ b/docker/horizon/Dockerfile.j2
@@ -51,7 +51,7 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 # know to which path symlink should point to.
 # NOTE(mnasiadka): pinning setuptools due to https://bugs.launchpad.net/horizon/+bug/2007574
 RUN ln -s horizon-source/* horizon \
-    && {{ macros.install_pip(['setuptools==67.2.*']) }} \
+    && {{ macros.install_pip(['setuptools==67.2.*','pip==25.2.*']) }} \
     && {{ macros.upper_constraints_remove("horizon") }} \
     && {{ macros.install_pip(horizon_pip_packages | customizable("pip_packages")) }} \
     && mkdir -p /etc/openstack-dashboard \

From 539342b730a21c1fb81f2e8a7c3c170c73afbc5e Mon Sep 17 00:00:00 2001
From: Michal Nasiadka <mnasiadka@gmail.com>
Date: Mon, 27 Oct 2025 09:14:16 +0100
Subject: [PATCH 08/20] Drop Venus images

It has been marked as inactive and venus dashboard plugin is breaking
Horizon Kolla builds.

Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/964860

Change-Id: I3a04487a75c04ba989fa70f2025db33308671dfb
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
---
 README.rst                                    |  1 -
 docker/horizon/extend_start.sh                |  9 ------
 docker/venus/venus-api/Dockerfile.j2          | 18 ------------
 docker/venus/venus-api/extend_start.sh        |  8 -----
 docker/venus/venus-base/Dockerfile.j2         | 29 -------------------
 docker/venus/venus-base/extend_start.sh       | 10 -------
 docker/venus/venus-manager/Dockerfile.j2      | 15 ----------
 kolla/common/sources.py                       |  8 -----
 kolla/common/users.py                         |  2 +-
 .../notes/drop-venus-435234b3bff7f209.yaml    |  5 ++++
 roles/kolla-build-config/defaults/main.yml    |  2 --
 11 files changed, 6 insertions(+), 101 deletions(-)
 delete mode 100644 docker/venus/venus-api/Dockerfile.j2
 delete mode 100644 docker/venus/venus-api/extend_start.sh
 delete mode 100644 docker/venus/venus-base/Dockerfile.j2
 delete mode 100644 docker/venus/venus-base/extend_start.sh
 delete mode 100644 docker/venus/venus-manager/Dockerfile.j2
 create mode 100644 releasenotes/notes/drop-venus-435234b3bff7f209.yaml

diff --git a/README.rst b/README.rst
index 71a4073b29..4af919296e 100644
--- a/README.rst
+++ b/README.rst
@@ -94,7 +94,6 @@ Kolla provides images to deploy the following OpenStack projects:
 - Skyline (`APIServer <https://docs.openstack.org/skyline-apiserver/latest/>`__ and `Console <https://docs.openstack.org/skyline-console/latest/>`__)
 - `Tacker <https://docs.openstack.org/tacker/latest/>`__
 - `Trove <https://docs.openstack.org/trove/latest/>`__
-- `Venus <https://docs.openstack.org/venus/latest/>`__
 - `Watcher <https://docs.openstack.org/watcher/latest/>`__
 - `Zun <https://docs.openstack.org/zun/latest/>`__
 
diff --git a/docker/horizon/extend_start.sh b/docker/horizon/extend_start.sh
index 41695a9d57..dae3ae2db8 100644
--- a/docker/horizon/extend_start.sh
+++ b/docker/horizon/extend_start.sh
@@ -172,14 +172,6 @@ function config_trove_dashboard {
     done
 }
 
-function config_venus_dashboard {
-    for file in ${SITE_PACKAGES}/venus_dashboard/enabled/_*[^__].py; do
-        config_dashboard "${ENABLE_VENUS:-no}" \
-            "${SITE_PACKAGES}/venus_dashboard/enabled/${file##*/}" \
-            "${SITE_PACKAGES}/openstack_dashboard/local/enabled/${file##*/}"
-    done
-}
-
 function config_watcher_dashboard {
     for file in ${SITE_PACKAGES}/watcher_dashboard/local/enabled/_*[^__].py; do
         config_dashboard "${ENABLE_WATCHER:-no}" \
@@ -236,7 +228,6 @@ config_neutron_vpnaas_dashboard
 config_octavia_dashboard
 config_tacker_dashboard
 config_trove_dashboard
-config_venus_dashboard
 config_watcher_dashboard
 config_zun_dashboard
 
diff --git a/docker/venus/venus-api/Dockerfile.j2 b/docker/venus/venus-api/Dockerfile.j2
deleted file mode 100644
index 35ac69dca2..0000000000
--- a/docker/venus/venus-api/Dockerfile.j2
+++ /dev/null
@@ -1,18 +0,0 @@
-FROM {{ namespace }}/{{ image_prefix }}venus-base:{{ tag }}
-{% block labels %}
-LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build_date }}"
-{% endblock %}
-
-{% block venus_api_header %}{% endblock %}
-
-{% import "macros.j2" as macros with context %}
-
-COPY extend_start.sh /usr/local/bin/kolla_venus_extend_start
-RUN chmod 644 /usr/local/bin/kolla_venus_extend_start
-
-{{ macros.kolla_patch_sources() }}
-
-{% block venus_api_footer %}{% endblock %}
-{% block footer %}{% endblock %}
-
-USER venus
diff --git a/docker/venus/venus-api/extend_start.sh b/docker/venus/venus-api/extend_start.sh
deleted file mode 100644
index bbe03bbbcc..0000000000
--- a/docker/venus/venus-api/extend_start.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/bin/bash
-
-# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
-# of the KOLLA_BOOTSTRAP variable being set, including empty.
-if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
-    venus_manager db sync
-    exit 0
-fi
diff --git a/docker/venus/venus-base/Dockerfile.j2 b/docker/venus/venus-base/Dockerfile.j2
deleted file mode 100644
index 729ae6bd4d..0000000000
--- a/docker/venus/venus-base/Dockerfile.j2
+++ /dev/null
@@ -1,29 +0,0 @@
-FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
-{% block labels %}
-LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build_date }}"
-{% endblock %}
-
-{% block venus_base_header %}{% endblock %}
-
-{% import "macros.j2" as macros with context %}
-
-{{ macros.configure_user(name='venus') }}
-
-ADD venus-base-archive /venus-base-source
-
-{% set venus_base_pip_packages = [
-    '/venus'
-] %}
-
-COPY extend_start.sh /usr/local/bin/kolla_extend_start
-
-RUN ln -s venus-base-source/* venus \
-    && {{ macros.install_pip(venus_base_pip_packages | customizable("pip_packages")) }} \
-    && mkdir -p /etc/venus \
-    && cp -r /venus/etc/venus/* /etc/venus/ \
-    && touch /usr/local/bin/kolla_venus_extend_start \
-    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_venus_extend_start
-
-{{ macros.kolla_patch_sources() }}
-
-{% block venus_base_footer %}{% endblock %}
diff --git a/docker/venus/venus-base/extend_start.sh b/docker/venus/venus-base/extend_start.sh
deleted file mode 100644
index fa7bbe54b0..0000000000
--- a/docker/venus/venus-base/extend_start.sh
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/bin/bash
-
-if [[ ! -d "/var/log/kolla/venus" ]]; then
-    mkdir -p /var/log/kolla/venus
-fi
-if [[ $(stat -c %a /var/log/kolla/venus) != "755" ]]; then
-    chmod 755 /var/log/kolla/venus
-fi
-
-. /usr/local/bin/kolla_venus_extend_start
diff --git a/docker/venus/venus-manager/Dockerfile.j2 b/docker/venus/venus-manager/Dockerfile.j2
deleted file mode 100644
index 35575adb64..0000000000
--- a/docker/venus/venus-manager/Dockerfile.j2
+++ /dev/null
@@ -1,15 +0,0 @@
-FROM {{ namespace }}/{{ image_prefix }}venus-base:{{ tag }}
-{% block labels %}
-LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build_date }}"
-{% endblock %}
-
-{% block venus_manager_header %}{% endblock %}
-
-{% import "macros.j2" as macros with context %}
-
-{{ macros.kolla_patch_sources() }}
-
-{% block venus_manager_footer %}{% endblock %}
-{% block footer %}{% endblock %}
-
-USER venus
diff --git a/kolla/common/sources.py b/kolla/common/sources.py
index 70ff33ea75..4073ae12ae 100644
--- a/kolla/common/sources.py
+++ b/kolla/common/sources.py
@@ -135,10 +135,6 @@
         'type': 'url',
         'location': ('$tarballs_base/openstack/trove-dashboard/'
                      'trove-dashboard-${openstack_branch}.tar.gz')},
-    'horizon-plugin-venus-dashboard': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/venus-dashboard/'
-                     'venus-dashboard-${openstack_branch}.tar.gz')},
     'horizon-plugin-watcher-dashboard': {
         'type': 'url',
         'location': ('$tarballs_base/openstack/watcher-dashboard/'
@@ -415,10 +411,6 @@
         'type': 'url',
         'location': ('$tarballs_base/openstack/trove/'
                      'trove-${openstack_branch}.tar.gz')},
-    'venus-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/venus/'
-                     'venus-${openstack_branch}.tar.gz')},
     'watcher-base': {
         'type': 'url',
         'location': ('$tarballs_base/openstack/watcher/'
diff --git a/kolla/common/users.py b/kolla/common/users.py
index 95aefa4b6e..b1edb2949c 100644
--- a/kolla/common/users.py
+++ b/kolla/common/users.py
@@ -326,7 +326,7 @@
         'uid': 42488,
         'gid': 42488,
     },
-    'venus-user': {
+    'venus-user': {  # unused user (venus dropped)
         'uid': 42489,
         'gid': 42489,
     },
diff --git a/releasenotes/notes/drop-venus-435234b3bff7f209.yaml b/releasenotes/notes/drop-venus-435234b3bff7f209.yaml
new file mode 100644
index 0000000000..879e494a0b
--- /dev/null
+++ b/releasenotes/notes/drop-venus-435234b3bff7f209.yaml
@@ -0,0 +1,5 @@
+---
+upgrade:
+  - |
+    Support for building ``Venus`` container images has been dropped,
+    following it's inactivity and producing breaking Horizon plugin builds.
diff --git a/roles/kolla-build-config/defaults/main.yml b/roles/kolla-build-config/defaults/main.yml
index e8c6f7841f..81313edaf5 100644
--- a/roles/kolla-build-config/defaults/main.yml
+++ b/roles/kolla-build-config/defaults/main.yml
@@ -58,7 +58,6 @@ kolla_build_sources:
     - tacker-base
     - mistral-base-plugin-tacker
   openstack/trove: trove-base
-  openstack/venus: venus-base
   openstack/watcher: watcher-base
   openstack/zun: zun-base
 
@@ -77,6 +76,5 @@ kolla_build_sources:
   openstack/octavia-dashboard: horizon-plugin-octavia-dashboard
   openstack/tacker-horizon: horizon-plugin-tacker-dashboard
   openstack/trove-dashboard: horizon-plugin-trove-dashboard
-  openstack/venus-dashboard: horizon-plugin-venus-dashboard
   openstack/watcher-dashboard: horizon-plugin-watcher-dashboard
   openstack/zun-ui: horizon-plugin-zun-ui

From 07872d34d08b4712712fad77734a622e2cee24d5 Mon Sep 17 00:00:00 2001
From: Michal Nasiadka <mnasiadka@gmail.com>
Date: Mon, 27 Oct 2025 10:39:51 +0100
Subject: [PATCH 09/20] horizon: unpin pip and setuptools

Since Venus is removed - that is not needed anymore

Change-Id: I444304139dfbe451b5449a181de1129f073b7535
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
---
 docker/horizon/Dockerfile.j2 | 1 -
 1 file changed, 1 deletion(-)

diff --git a/docker/horizon/Dockerfile.j2 b/docker/horizon/Dockerfile.j2
index d28565aa01..f2cb0b4336 100644
--- a/docker/horizon/Dockerfile.j2
+++ b/docker/horizon/Dockerfile.j2
@@ -51,7 +51,6 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 # know to which path symlink should point to.
 # NOTE(mnasiadka): pinning setuptools due to https://bugs.launchpad.net/horizon/+bug/2007574
 RUN ln -s horizon-source/* horizon \
-    && {{ macros.install_pip(['setuptools==67.2.*','pip==25.2.*']) }} \
     && {{ macros.upper_constraints_remove("horizon") }} \
     && {{ macros.install_pip(horizon_pip_packages | customizable("pip_packages")) }} \
     && mkdir -p /etc/openstack-dashboard \

From 3913b6229510788f019b90d0011cc1a372cd57e7 Mon Sep 17 00:00:00 2001
From: Michal Nasiadka <mnasiadka@gmail.com>
Date: Tue, 9 Sep 2025 21:08:10 +0200
Subject: [PATCH 10/20] Bump Ansible to 12 and ansible-core to 2.19

Change-Id: I37f4515587cb040296612e35d4c643f0c2bea6f6
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
---
 docker/bifrost/bifrost-base/Dockerfile.j2 | 2 +-
 docker/kolla-toolbox/Dockerfile.j2        | 2 +-
 test-requirements.txt                     | 4 +++-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/docker/bifrost/bifrost-base/Dockerfile.j2 b/docker/bifrost/bifrost-base/Dockerfile.j2
index dc62aaf2a4..e31a12b326 100644
--- a/docker/bifrost/bifrost-base/Dockerfile.j2
+++ b/docker/bifrost/bifrost-base/Dockerfile.j2
@@ -67,7 +67,7 @@ RUN apt-get --error-on=any update && \
 {%- else %}
 RUN echo " " && \
 {%- endif %}
-    bash -c '$VENV/bin/pip install "ansible>=11,<12" && \
+    bash -c '$VENV/bin/pip install "ansible>=12,<13" && \
     $VENV/bin/ansible-galaxy collection install -r /bifrost/ansible-collections-requirements.yml && \
     $VENV/bin/ansible-playbook -vvvv -i /bifrost/playbooks/inventory/target \
     /bifrost/playbooks/install.yaml \
diff --git a/docker/kolla-toolbox/Dockerfile.j2 b/docker/kolla-toolbox/Dockerfile.j2
index b53b45da28..9f97ed3866 100644
--- a/docker/kolla-toolbox/Dockerfile.j2
+++ b/docker/kolla-toolbox/Dockerfile.j2
@@ -96,7 +96,7 @@ RUN mkdir -p /requirements \
 ENV PATH {{ venv_path }}/bin:$PATH
 
 {% set kolla_toolbox_pip_packages = [
-        'ansible-core==2.18.*',
+        'ansible-core==2.19.*',
         'cmd2',
         'influxdb',
         'openstacksdk',
diff --git a/test-requirements.txt b/test-requirements.txt
index 30c980fb33..7e3178bd66 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -1,4 +1,6 @@
-ansible-core>=2.17,<2.19 # GPLv3
+# NOTE(mnasiadka): Keeping 2.17 to satisfy py310 job
+ansible-core>=2.17; python_version < '3.11' # GPLv3
+ansible-core>=2.18,<2.20; python_version >= '3.11' # GPLv3
 ansible-lint<26 # MIT
 bandit!=1.6.0,>=1.1.0 # Apache-2.0
 bashate>=0.5.1 # Apache-2.0

From af9dfb0dba11f0cb025a806792c3b7dcb71dc39c Mon Sep 17 00:00:00 2001
From: Michal Nasiadka <mnasiadka@gmail.com>
Date: Fri, 11 Oct 2024 14:13:58 +0200
Subject: [PATCH 11/20] Add Valkey

Change-Id: I02f3adf9825636e2b81c50543d6f95ea986019b6
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
---
 docker/valkey/valkey-base/Dockerfile.j2       | 17 ++++++++++
 docker/valkey/valkey-base/extend_start.sh     |  9 ++++++
 docker/valkey/valkey-sentinel/Dockerfile.j2   | 26 +++++++++++++++
 docker/valkey/valkey-sentinel/extend_start.sh | 32 +++++++++++++++++++
 docker/valkey/valkey-server/Dockerfile.j2     | 23 +++++++++++++
 kolla/common/users.py                         |  6 +++-
 6 files changed, 112 insertions(+), 1 deletion(-)
 create mode 100644 docker/valkey/valkey-base/Dockerfile.j2
 create mode 100644 docker/valkey/valkey-base/extend_start.sh
 create mode 100644 docker/valkey/valkey-sentinel/Dockerfile.j2
 create mode 100644 docker/valkey/valkey-sentinel/extend_start.sh
 create mode 100644 docker/valkey/valkey-server/Dockerfile.j2

diff --git a/docker/valkey/valkey-base/Dockerfile.j2 b/docker/valkey/valkey-base/Dockerfile.j2
new file mode 100644
index 0000000000..7d4e6da9a0
--- /dev/null
+++ b/docker/valkey/valkey-base/Dockerfile.j2
@@ -0,0 +1,17 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build_date }}"
+{% endblock %}
+
+{% block valkey_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='valkey', homedir='/run/valkey') }}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block valkey_base_footer %}{% endblock %}
diff --git a/docker/valkey/valkey-base/extend_start.sh b/docker/valkey/valkey-base/extend_start.sh
new file mode 100644
index 0000000000..3a3a321d4e
--- /dev/null
+++ b/docker/valkey/valkey-base/extend_start.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/valkey" ]]; then
+    mkdir -p /var/log/kolla/valkey
+fi
+
+if [[ $(stat -c %a /var/log/kolla/valkey) != "755" ]]; then
+    chmod 755 /var/log/kolla/valkey
+fi
diff --git a/docker/valkey/valkey-sentinel/Dockerfile.j2 b/docker/valkey/valkey-sentinel/Dockerfile.j2
new file mode 100644
index 0000000000..9cdfac282f
--- /dev/null
+++ b/docker/valkey/valkey-sentinel/Dockerfile.j2
@@ -0,0 +1,26 @@
+FROM {{ namespace }}/{{ image_prefix }}valkey-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build_date }}"
+{% endblock %}
+
+{% block valkey_sentinel_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+{{ macros.enable_extra_repos(['epel']) }}
+    {% set valkey_sentinel_packages = ['valkey'] %}
+{% elif base_package_type == 'deb' %}
+    {% set valkey_sentinel_packages = ['valkey-sentinel'] %}
+{% endif %}
+{{ macros.install_packages(valkey_sentinel_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block valkey_sentinel_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER valkey
diff --git a/docker/valkey/valkey-sentinel/extend_start.sh b/docker/valkey/valkey-sentinel/extend_start.sh
new file mode 100644
index 0000000000..e6af42ef6b
--- /dev/null
+++ b/docker/valkey/valkey-sentinel/extend_start.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/valkey" ]]; then
+    mkdir -p /var/log/kolla/valkey
+fi
+
+if [[ $(stat -c %a /var/log/kolla/valkey) != "755" ]]; then
+    chmod 755 /var/log/kolla/valkey
+fi
+
+# The CONFIG REWRITE command rewrites the valkey.conf
+# file the server was started with, applying the minimal
+# changes needed to make it reflect the configuration
+# currently used by the server, which may be different
+# compared to the original one because of the use of
+# the CONFIG SET command.
+#
+# https://valkey.io/commands/config-rewrite/
+#
+# Because of above behaviour it's needed to
+# hack kolla's CMD.
+#
+# Without this hack
+# /usr/local/bin/kolla_set_configs --check
+# is always reporting changed.
+#
+# Therefore valkey-sentinel is always restarted
+# even if configuration is not changed from
+# kolla-ansible side.
+if [ ! -z "${VALKEY_CONF}" ] && [ ! -z ${VALKEY_GEN_CONF} ]; then
+    cp ${VALKEY_CONF} ${VALKEY_GEN_CONF}
+fi
diff --git a/docker/valkey/valkey-server/Dockerfile.j2 b/docker/valkey/valkey-server/Dockerfile.j2
new file mode 100644
index 0000000000..046260d7bf
--- /dev/null
+++ b/docker/valkey/valkey-server/Dockerfile.j2
@@ -0,0 +1,23 @@
+FROM {{ namespace }}/{{ image_prefix }}valkey-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build_date }}"
+{% endblock %}
+
+{% block valkey_server_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+{{ macros.enable_extra_repos(['epel']) }}
+    {% set valkey_server_packages = ['valkey'] %}
+{% elif base_package_type == 'deb' %}
+    {% set valkey_server_packages = ['valkey'] %}
+{% endif %}
+{{ macros.install_packages(valkey_server_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block valkey_server_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER valkey
diff --git a/kolla/common/users.py b/kolla/common/users.py
index 95aefa4b6e..d7610282f8 100644
--- a/kolla/common/users.py
+++ b/kolla/common/users.py
@@ -345,5 +345,9 @@
     'hsmusers-user': {
         'uid': 42493,  # This is not used, but the group ID is required.
         'gid': 42493,
-    }
+    },
+    'valkey-user': {
+        'uid': 42494,
+        'gid': 42494,
+    },
 }

From 8c2c3c90f9f0ac28dfb37c29ae61f78d453821ba Mon Sep 17 00:00:00 2001
From: Michal Nasiadka <mnasiadka@gmail.com>
Date: Thu, 30 Oct 2025 16:39:36 +0100
Subject: [PATCH 12/20] CI: Fix missing variable in publish jobs

Change-Id: Ie76463977d2e9e4358bcd37b62cc8172813cf7b4
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
---
 zuul.d/debian.yaml | 2 +-
 zuul.d/rocky.yaml  | 2 +-
 zuul.d/ubuntu.yaml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/zuul.d/debian.yaml b/zuul.d/debian.yaml
index 66b0badacf..cf6c847b85 100644
--- a/zuul.d/debian.yaml
+++ b/zuul.d/debian.yaml
@@ -25,7 +25,7 @@
       kolla_namespace: openstack.kolla
     secrets:
       - kolla_quay_io_creds
-      - kolla_quay_io_api
+      - kolla_quay_io_api_oct_2025
 
 - job:
     name: kolla-publish-debian-bookworm-arm64-quay
diff --git a/zuul.d/rocky.yaml b/zuul.d/rocky.yaml
index f854cca6e2..1306998e9a 100644
--- a/zuul.d/rocky.yaml
+++ b/zuul.d/rocky.yaml
@@ -30,7 +30,7 @@
       kolla_namespace: openstack.kolla
     secrets:
       - kolla_quay_io_creds
-      - kolla_quay_io_api
+      - kolla_quay_io_api_oct_2025
 
 - project-template:
     name: kolla-build-rocky
diff --git a/zuul.d/ubuntu.yaml b/zuul.d/ubuntu.yaml
index 258b98f6c7..28a6ac3bbc 100644
--- a/zuul.d/ubuntu.yaml
+++ b/zuul.d/ubuntu.yaml
@@ -25,7 +25,7 @@
       kolla_namespace: openstack.kolla
     secrets:
       - kolla_quay_io_creds
-      - kolla_quay_io_api
+      - kolla_quay_io_api_oct_2025
 
 - job:
     name: kolla-build-ubuntu-noble-no-infra-wheels

From 40bcc4297802dd2f765d61496fb1ef814ff0b8c4 Mon Sep 17 00:00:00 2001
From: Michal Nasiadka <mnasiadka@gmail.com>
Date: Fri, 31 Oct 2025 10:30:58 +0100
Subject: [PATCH 13/20] CI: Fix publish secret for arm64

Change-Id: Ifd0b4d511aa5481ff9066c81289457383932079b
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
---
 zuul.d/debian.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zuul.d/debian.yaml b/zuul.d/debian.yaml
index cf6c847b85..847a0b4d17 100644
--- a/zuul.d/debian.yaml
+++ b/zuul.d/debian.yaml
@@ -37,7 +37,7 @@
       kolla_namespace: openstack.kolla
     secrets:
       - kolla_quay_io_creds
-      - kolla_quay_io_api
+      - kolla_quay_io_api_oct_2025
 
 - job:
     name: kolla-build-debian-bookworm-no-infra-wheels

From 5ad545cc725e1f072784fe4973ed6428963ea0fc Mon Sep 17 00:00:00 2001
From: Michal Nasiadka <mnasiadka@gmail.com>
Date: Fri, 31 Oct 2025 11:08:05 +0100
Subject: [PATCH 14/20] Bump versions of packages in sources.py

Change-Id: I395cfdf22cd87a43294dbae561a8872cb0b48e1b
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
---
 kolla/common/sources.py                        | 18 +++++++++---------
 .../update-packages-071d1863639fe3e3.yaml      |  5 +++--
 2 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/kolla/common/sources.py b/kolla/common/sources.py
index 4073ae12ae..d999335da7 100644
--- a/kolla/common/sources.py
+++ b/kolla/common/sources.py
@@ -54,11 +54,11 @@
     'etcd': {
         # NOTE(wszumski): Upgrade one minor version at a time:
         # https://etcd.io/docs/v3.6/upgrades/upgrade_3_6/
-        'version': '3.6.4',
+        'version': '3.6.5',
         'type': 'url',
         'sha256': {
-            'amd64': '4d5f3101daa534e45ccaf3eec8d21c19b7222db377bcfd5e5a9144155238c105',  # noqa: E501
-            'arm64': '323421fa279f4f3d7da4c7f2dfa17d9e49529cb2b4cdf40899a7416bccdde42d'},  # noqa: E501
+            'amd64': '66bad39ed920f6fc15fd74adcb8bfd38ba9a6412f8c7852d09eb11670e88cac3',  # noqa: E501
+            'arm64': '7010161787077b07de29b15b76825ceacbbcedcb77fe2e6832f509be102cab6b'},  # noqa: E501
         'location': ('https://github.com/etcd-io/etcd/'
                      'releases/download/v${version}'
                      '/etcd-v${version}-linux-${debian_arch}.tar.gz')},
@@ -165,11 +165,11 @@
         'location': ('$tarballs_base/openstack/kuryr-libnetwork/'
                      'kuryr-libnetwork-${openstack_branch}.tar.gz')},
     'letsencrypt-lego': {
-        'version': 'v4.25.2',
+        'version': 'v4.27.0',
         'type': 'url',
         'sha256': {
-            'amd64': '6022cf99bdc310ebba21c059fcbf1cb5939e17b2f95dade6bb6f878f9590a961',  # noqa: E501
-            'arm64': '3dc4bc343b265a66bb174d3dd03b769bc40c326d680b240b948d12e97ddd4bf8'},  # noqa: E501
+            'amd64': '898b58bbbca4282d706b4f204593cb94fc2ed13232777236c06dc20259bbcd02',  # noqa: E501
+            'arm64': '2973b412d37e5d652a91bda1a6bf7642491e316bc0f855a614e2c996249014dc'},  # noqa: E501
         'location': ('https://github.com/go-acme/lego/'
                      'releases/download/${version}/'
                      'lego_${version}_linux_${debian_arch}.tar.gz')},
@@ -178,11 +178,11 @@
         'location': ('$tarballs_base/openstack/magnum/'
                      'magnum-${openstack_branch}.tar.gz')},
     'magnum-conductor-plugin-helm': {
-        'version': 'v3.16.3',
+        'version': 'v3.19.0',
         'type': 'url',
         'sha256': {
-            'amd64': 'f5355c79190951eed23c5432a3b920e071f4c00a64f75e077de0dd4cb7b294ea',  # noqa: E501
-            'arm64': '5bd34ed774df6914b323ff84a0a156ea6ff2ba1eaf0113962fa773f3f9def798'},  # noqa: E501
+            'amd64': 'a7f81ce08007091b86d8bd696eb4d86b8d0f2e1b9f6c714be62f82f96a594496',  # noqa: E501
+            'arm64': '440cf7add0aee27ebc93fada965523c1dc2e0ab340d4348da2215737fc0d76ad'},  # noqa: E501
         'location': ('https://get.helm.sh/helm'
                      '-${version}-linux-${debian_arch}.tar.gz')},
     'manila-base': {
diff --git a/releasenotes/notes/update-packages-071d1863639fe3e3.yaml b/releasenotes/notes/update-packages-071d1863639fe3e3.yaml
index 8f30730d09..d8d48ad3f1 100644
--- a/releasenotes/notes/update-packages-071d1863639fe3e3.yaml
+++ b/releasenotes/notes/update-packages-071d1863639fe3e3.yaml
@@ -4,8 +4,9 @@ upgrade:
     Update monitoring and key infrastructure components to their latest versions.
     This upgrade includes several prometheus-related services, as well as Etcd and Lego.
 
-    * etcd: 3.5.16 -> 3.6.4
-    * letsencrypt-lego: 4.20.4 -> 4.25.2
+    * etcd: 3.5.16 -> 3.6.5
+    * helm: 3.16.3 -> 3.19.0
+    * letsencrypt-lego: 4.20.4 -> 4.27.0
     * prometheus-blackbox-exporter: 0.25.0 -> 0.27.0
     * prometheus-cadvisor: 0.49.2 -> 0.53.0
     * prometheus-elasticsearch-exporter: 1.8.0 -> 1.9.0

From 477f71b6ba8dd9472ecccd16ac9a5aa79d82eaf0 Mon Sep 17 00:00:00 2001
From: Bartosz Bezak <bartosz@stackhpc.com>
Date: Mon, 3 Nov 2025 11:43:59 +0100
Subject: [PATCH 15/20] debian: use valkey from bookworm-backports

To fix arm64 valkey build.
The virtual `valkey` resolves to `valkey-server` in bookworm-backports,
but our global -1000 pin blocks it. Amd64 worked only because extrepo
shipped it. Use valkey directly from the backports packages instead.

follow up to https://review.opendev.org/c/openstack/kolla/+/932174

Change-Id: I846e4f19696ca28758cb9c0400be96c01b079daa
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
---
 docker/valkey/valkey-sentinel/Dockerfile.j2 | 6 +++++-
 docker/valkey/valkey-server/Dockerfile.j2   | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/docker/valkey/valkey-sentinel/Dockerfile.j2 b/docker/valkey/valkey-sentinel/Dockerfile.j2
index 9cdfac282f..e3045d2fe9 100644
--- a/docker/valkey/valkey-sentinel/Dockerfile.j2
+++ b/docker/valkey/valkey-sentinel/Dockerfile.j2
@@ -11,7 +11,11 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {{ macros.enable_extra_repos(['epel']) }}
     {% set valkey_sentinel_packages = ['valkey'] %}
 {% elif base_package_type == 'deb' %}
-    {% set valkey_sentinel_packages = ['valkey-sentinel'] %}
+    {% if base_distro == 'debian' %}
+        {% set valkey_sentinel_packages = ['valkey-sentinel/bookworm-backports'] %}
+    {% else %}
+        {% set valkey_sentinel_packages = ['valkey-sentinel'] %}
+    {% endif %}
 {% endif %}
 {{ macros.install_packages(valkey_sentinel_packages | customizable("packages")) }}
 
diff --git a/docker/valkey/valkey-server/Dockerfile.j2 b/docker/valkey/valkey-server/Dockerfile.j2
index 046260d7bf..7b989f66b4 100644
--- a/docker/valkey/valkey-server/Dockerfile.j2
+++ b/docker/valkey/valkey-server/Dockerfile.j2
@@ -11,7 +11,11 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {{ macros.enable_extra_repos(['epel']) }}
     {% set valkey_server_packages = ['valkey'] %}
 {% elif base_package_type == 'deb' %}
-    {% set valkey_server_packages = ['valkey'] %}
+    {% if base_distro == 'debian' %}
+        {% set valkey_server_packages = ['valkey/bookworm-backports'] %}
+    {% else %}
+        {% set valkey_server_packages = ['valkey'] %}
+    {% endif %}
 {% endif %}
 {{ macros.install_packages(valkey_server_packages | customizable("packages")) }}
 

From 4ed9bcee5001bee32dfb795a09f8af1a8c7c13ad Mon Sep 17 00:00:00 2001
From: Bartosz Bezak <bartosz@stackhpc.com>
Date: Fri, 7 Nov 2025 10:55:45 +0100
Subject: [PATCH 16/20] Tidy up release notes for Flamingo release

Change-Id: I10f47d3454fd81a36aa7a724050869ef680e88b4
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
---
 .../deprecate-collectd-8ba94052bdc9424b.yaml  |  4 ----
 .../deprecate-telegraf-db2b0b9f30591552.yaml  |  2 +-
 .../notes/drop-venus-435234b3bff7f209.yaml    |  4 ++--
 .../flamingo-prelude-b72f2599ed9d25d5.yaml    | 24 +++++++++++++++++++
 .../fluentd-update-8db10e760b2dc4d5.yaml      |  2 +-
 .../notes/mariadb-11.4-b66b5baf9f5e6cd0.yaml  |  6 ++---
 .../opensearch-upgrade-9e263a65f015a376.yaml  |  2 +-
 .../notes/rabbitmq-41-d881d0b6bbf46446.yaml   |  2 +-
 ...metheus-ovn-exporter-c5f5005b4d1a4b12.yaml |  6 ++---
 .../notes/rocky-10-4111fa0160be14ab.yaml      | 12 +++++-----
 .../update-packages-071d1863639fe3e3.yaml     |  9 +++----
 11 files changed, 47 insertions(+), 26 deletions(-)
 delete mode 100644 releasenotes/notes/deprecate-collectd-8ba94052bdc9424b.yaml
 create mode 100644 releasenotes/notes/flamingo-prelude-b72f2599ed9d25d5.yaml

diff --git a/releasenotes/notes/deprecate-collectd-8ba94052bdc9424b.yaml b/releasenotes/notes/deprecate-collectd-8ba94052bdc9424b.yaml
deleted file mode 100644
index c41b720f96..0000000000
--- a/releasenotes/notes/deprecate-collectd-8ba94052bdc9424b.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
----
-deprecations:
-  - |
-    Deprecates support for building ``collectd`` images.
diff --git a/releasenotes/notes/deprecate-telegraf-db2b0b9f30591552.yaml b/releasenotes/notes/deprecate-telegraf-db2b0b9f30591552.yaml
index 7aa96baff9..0667f571d6 100644
--- a/releasenotes/notes/deprecate-telegraf-db2b0b9f30591552.yaml
+++ b/releasenotes/notes/deprecate-telegraf-db2b0b9f30591552.yaml
@@ -1,4 +1,4 @@
 ---
 deprecations:
   - |
-    Deprecates support for building ``telegraf`` images.
+    Deprecates support for building ``collectd`` and ``telegraf`` images.
diff --git a/releasenotes/notes/drop-venus-435234b3bff7f209.yaml b/releasenotes/notes/drop-venus-435234b3bff7f209.yaml
index 879e494a0b..b6d2218421 100644
--- a/releasenotes/notes/drop-venus-435234b3bff7f209.yaml
+++ b/releasenotes/notes/drop-venus-435234b3bff7f209.yaml
@@ -1,5 +1,5 @@
 ---
 upgrade:
   - |
-    Support for building ``Venus`` container images has been dropped,
-    following it's inactivity and producing breaking Horizon plugin builds.
+    Support for building ``Venus`` container images has been dropped due to the
+    project's inactivity and the Horizon plugin build failures it caused.
diff --git a/releasenotes/notes/flamingo-prelude-b72f2599ed9d25d5.yaml b/releasenotes/notes/flamingo-prelude-b72f2599ed9d25d5.yaml
new file mode 100644
index 0000000000..c0b40675aa
--- /dev/null
+++ b/releasenotes/notes/flamingo-prelude-b72f2599ed9d25d5.yaml
@@ -0,0 +1,24 @@
+---
+prelude: |
+  The Kolla ``21.0.0`` (Flamingo) release modernises the base operating
+  systems and core infrastructure shipped by the containers. Highlights
+  include:
+
+  * Rocky Linux 10 replaces Rocky Linux 9 as the only supported Rocky base
+    image, removing the Delorean/CentOS Cloud SIG dependency and tightening RPM
+    repository handling via ``repos.yaml`` (including a new versioned Erlang
+    source for aarch64).
+  * Data-plane services received major upgrades: ``MariaDB`` now tracks the
+    11.4 LTS series with the upstream health check script and the legacy
+    clustercheck image removed, ``ProxySQL`` moves to 3.x, ``Bifrost`` consumes
+    Ansible 11, ``RabbitMQ`` advances to 4.1, and ``Gnocchi`` is updated to
+    4.7.0.
+  * Observability components were refreshed with ``Fluentd`` 6.x LTS,
+    ``OpenSearch``/``OpenSearch Dashboards`` 3.x, broad ``Prometheus`` exporter
+    and infrastructure bumps (``etcd``, ``helm``, ``letsencrypt-lego``), and the
+    retirement of the ``collectd``, ``telegraf``, and ``prometheus-ovn-exporter``
+    images.
+  * The container portfolio was streamlined: support landed for the
+    ``ironic-pxe-filter`` image and ``neutron-metadata-agent`` wrapper scripts,
+    while dormant services such as ``ironic-inspector`` and ``Venus`` were
+    dropped.
diff --git a/releasenotes/notes/fluentd-update-8db10e760b2dc4d5.yaml b/releasenotes/notes/fluentd-update-8db10e760b2dc4d5.yaml
index 6ecb744c02..7ac12764b0 100644
--- a/releasenotes/notes/fluentd-update-8db10e760b2dc4d5.yaml
+++ b/releasenotes/notes/fluentd-update-8db10e760b2dc4d5.yaml
@@ -1,4 +1,4 @@
 ---
 upgrade:
   - |
-    Update Fluentd to version 6.x LTS.
+    Updates ``Fluentd`` to the 6.x LTS series.
diff --git a/releasenotes/notes/mariadb-11.4-b66b5baf9f5e6cd0.yaml b/releasenotes/notes/mariadb-11.4-b66b5baf9f5e6cd0.yaml
index 17c0f9845f..9fa74e899c 100644
--- a/releasenotes/notes/mariadb-11.4-b66b5baf9f5e6cd0.yaml
+++ b/releasenotes/notes/mariadb-11.4-b66b5baf9f5e6cd0.yaml
@@ -1,5 +1,5 @@
 ---
-features:
+upgrade:
   - |
-    ``MariaDB`` version has been updated to ``11.4 LTS``.
-    This version will be supported until 29th May 2029.
+    Updates ``MariaDB`` to the ``11.4`` LTS release, which is supported until
+    29 May 2029.
diff --git a/releasenotes/notes/opensearch-upgrade-9e263a65f015a376.yaml b/releasenotes/notes/opensearch-upgrade-9e263a65f015a376.yaml
index d7e00e3315..9c3f5a300a 100644
--- a/releasenotes/notes/opensearch-upgrade-9e263a65f015a376.yaml
+++ b/releasenotes/notes/opensearch-upgrade-9e263a65f015a376.yaml
@@ -1,4 +1,4 @@
 ---
 upgrade:
   - |
-    Update OpenSearch and OpenSearch Dashboards to version 3.x.
+    Updates ``OpenSearch`` and ``OpenSearch Dashboards`` to version 3.x.
diff --git a/releasenotes/notes/rabbitmq-41-d881d0b6bbf46446.yaml b/releasenotes/notes/rabbitmq-41-d881d0b6bbf46446.yaml
index 8046fc722e..2456bcf661 100644
--- a/releasenotes/notes/rabbitmq-41-d881d0b6bbf46446.yaml
+++ b/releasenotes/notes/rabbitmq-41-d881d0b6bbf46446.yaml
@@ -1,4 +1,4 @@
 ---
 upgrade:
   - |
-    ``rabbitmq`` version has been updated to ``4.1``.
+    Updates ``RabbitMQ`` to version ``4.1``.
diff --git a/releasenotes/notes/remove-prometheus-ovn-exporter-c5f5005b4d1a4b12.yaml b/releasenotes/notes/remove-prometheus-ovn-exporter-c5f5005b4d1a4b12.yaml
index 6bac399014..04382375e1 100644
--- a/releasenotes/notes/remove-prometheus-ovn-exporter-c5f5005b4d1a4b12.yaml
+++ b/releasenotes/notes/remove-prometheus-ovn-exporter-c5f5005b4d1a4b12.yaml
@@ -1,5 +1,5 @@
 ---
-deprecations:
+upgrade:
   - |
-    The OVN exporter has been removed with immediate effect since 1) it isn't
-    used in Kolla Ansible and 2) the source repo was archived in Dec 2024.
+    Removes the ``prometheus-ovn-exporter`` image because it is unused by
+    Kolla Ansible and the upstream repository was archived in December 2024.
diff --git a/releasenotes/notes/rocky-10-4111fa0160be14ab.yaml b/releasenotes/notes/rocky-10-4111fa0160be14ab.yaml
index 2fccba7963..98ef21f289 100644
--- a/releasenotes/notes/rocky-10-4111fa0160be14ab.yaml
+++ b/releasenotes/notes/rocky-10-4111fa0160be14ab.yaml
@@ -1,12 +1,12 @@
 ---
 features:
   - |
-    Adds support for Rocky 10 as a base container image. This is the only major
-    version of Rocky supported from the 2025.2 release.
+    Adds support for Rocky Linux 10 as a base container image. From the 2025.2
+    release onward, Rocky Linux 10 is the only supported Rocky Linux major version.
 upgrade:
   - |
-    Rocky 9 is no longer supported as a base container image. Rocky users
-    should migrate to Rocky 10.
+    Rocky Linux 9 is no longer supported as a base container image, so
+    deployments using Rocky Linux should migrate to Rocky Linux 10.
   - |
-    The following images were supported by Rocky 9 but lack suitable packages
-    in Rocky, and are no longer supported for Rocky: ``telegraf``.
+    The ``telegraf`` image relied on Rocky Linux 9-only packages and is therefore
+    unavailable for Rocky Linux-based builds.
diff --git a/releasenotes/notes/update-packages-071d1863639fe3e3.yaml b/releasenotes/notes/update-packages-071d1863639fe3e3.yaml
index d8d48ad3f1..efe10a9605 100644
--- a/releasenotes/notes/update-packages-071d1863639fe3e3.yaml
+++ b/releasenotes/notes/update-packages-071d1863639fe3e3.yaml
@@ -1,8 +1,9 @@
 ---
 upgrade:
   - |
-    Update monitoring and key infrastructure components to their latest versions.
-    This upgrade includes several prometheus-related services, as well as Etcd and Lego.
+    Updates monitoring and key infrastructure components to their latest
+    supported versions. This covers several Prometheus exporters as well as
+    ``etcd``, ``helm``, and ``letsencrypt-lego``.
 
     * etcd: 3.5.16 -> 3.6.5
     * helm: 3.16.3 -> 3.19.0
@@ -15,5 +16,5 @@ upgrade:
     * prometheus-node-exporter: 1.8.2 -> 1.9.1
     * prometheus-server: 3.2.1 -> 3.5.0 (LTS)
 
-    Additionally, Prometheus-server has been switched to its Long-Term Support (LTS)
-    version to ensure greater stability and extended support.
+    Additionally, ``prometheus-server`` now tracks the Long-Term Support (LTS)
+    channel to provide longer maintenance windows.

From a03766b07f753e233b9b142f2d0168bacbc23eb8 Mon Sep 17 00:00:00 2001
From: OpenStack Release Bot <infra-root@openstack.org>
Date: Mon, 10 Nov 2025 16:18:04 +0000
Subject: [PATCH 17/20] Update master for stable/2025.2

Add file to the reno documentation build to show release notes for
stable/2025.2.

Use pbr instruction to increment the minor version number
automatically so that master versions are higher than the versions on
stable/2025.2.

Sem-Ver: feature
Change-Id: If6d5a967a12cb6143a5bb1f321d8cc0231552275
Signed-off-by: OpenStack Release Bot <infra-root@openstack.org>
Generated-By: openstack/project-config:roles/copy-release-tools-scripts/files/release-tools/add_release_note_page.sh
---
 releasenotes/source/2025.2.rst | 6 ++++++
 releasenotes/source/index.rst  | 1 +
 2 files changed, 7 insertions(+)
 create mode 100644 releasenotes/source/2025.2.rst

diff --git a/releasenotes/source/2025.2.rst b/releasenotes/source/2025.2.rst
new file mode 100644
index 0000000000..4dae18d869
--- /dev/null
+++ b/releasenotes/source/2025.2.rst
@@ -0,0 +1,6 @@
+===========================
+2025.2 Series Release Notes
+===========================
+
+.. release-notes::
+   :branch: stable/2025.2
diff --git a/releasenotes/source/index.rst b/releasenotes/source/index.rst
index 30aeae854f..690c29a49d 100644
--- a/releasenotes/source/index.rst
+++ b/releasenotes/source/index.rst
@@ -9,6 +9,7 @@ Contents
    :maxdepth: 2
 
    unreleased
+   2025.2
    2025.1
    2024.2
    2024.1

From 0fc73a644bdb7e4f583ba5ebf7ee3fcd60fb8ffc Mon Sep 17 00:00:00 2001
From: Michael Still <mikal@stillhq.com>
Date: Tue, 18 Nov 2025 19:45:29 +1100
Subject: [PATCH 18/20] Transition to the new rabbitmq Debian package archives.

RabbitMQ announced some time ago that the package archives were moving:
https://www.rabbitmq.com/blog/2025/07/16/debian-apt-repositories-are-moving

The old location is no longer working, so this patch transitions to
the new one.

Closes-Bug: #2131736

Change-Id: I6ef0ed9cc40be42a0d98c6a4c83c5c5c26d9cdbf
Signed-off-by: Michael Still <mikal@stillhq.com>
---
 docker/base/Dockerfile.j2                                 | 2 +-
 kolla/template/repos.yaml                                 | 8 ++++----
 kolla/tests/test_methods.py                               | 4 ++--
 ...recated-rabbitmq-package-archive-47548e7a41baa68b.yaml | 7 +++++++
 4 files changed, 14 insertions(+), 7 deletions(-)
 create mode 100644 releasenotes/notes/handle-deprecated-rabbitmq-package-archive-47548e7a41baa68b.yaml

diff --git a/docker/base/Dockerfile.j2 b/docker/base/Dockerfile.j2
index 45e7f9c03b..33df5a7b55 100644
--- a/docker/base/Dockerfile.j2
+++ b/docker/base/Dockerfile.j2
@@ -243,7 +243,7 @@ COPY apt_preferences /etc/apt/preferences.d/kolla-custom
 
 {% set base_apt_keys = [
    {'name': 'erlang-ppa', 'keyid': 'F77F1EDA57EBB1CC'},
-   {'name': 'rabbitmq',   'keyid': '9F4587F226208342'},
+   {'name': 'rabbitmq',   'keyid': '6B73A36E6026DFCA'},
    {'name': 'haproxy',    'keyid': 'CFFB779AADC995E4F350A060505D97A41C61B9CD'},
 ] %}
 
diff --git a/kolla/template/repos.yaml b/kolla/template/repos.yaml
index 6739c9bd1e..7d9d7ec71a 100644
--- a/kolla/template/repos.yaml
+++ b/kolla/template/repos.yaml
@@ -51,14 +51,14 @@ debian:
     component: ""
     gpg_key: "proxysql.asc"
   rabbitmq:
-    url: "https://ppa1.rabbitmq.com/rabbitmq/rabbitmq-server/deb/debian"
+    url: "https://deb1.rabbitmq.com/rabbitmq-server/debian/bookworm"
     suite: "bookworm"
     component: "main"
     gpg_key: "rabbitmq.gpg"
 
 debian-aarch64:
   rabbitmq:
-    url: "https://ppa1.rabbitmq.com/rabbitmq/rabbitmq-server/deb/debian"
+    url: "https://deb1.rabbitmq.com/rabbitmq-server/debian/bookworm"
     suite: "bookworm"
     component: "main"
     # NOTE(mnasiadka): Since rabbitmq is really noarch and community mirror is not
@@ -93,14 +93,14 @@ ubuntu:
     component: ""
     gpg_key: "proxysql.asc"
   rabbitmq:
-    url: "https://ppa1.rabbitmq.com/rabbitmq/rabbitmq-server/deb/ubuntu"
+    url: "https://deb1.rabbitmq.com/rabbitmq-server/ubuntu/noble"
     suite: "noble"
     component: "main"
     gpg_key: "rabbitmq.gpg"
 
 ubuntu-aarch64:
   rabbitmq:
-    url: "https://ppa1.rabbitmq.com/rabbitmq/rabbitmq-server/deb/ubuntu"
+    url: "https://deb1.rabbitmq.com/rabbitmq-server/ubuntu/noble"
     suite: "noble"
     component: "main"
     # NOTE(mnasiadka): Since rabbitmq is really noarch and community mirror is not
diff --git a/kolla/tests/test_methods.py b/kolla/tests/test_methods.py
index 6559c5d4de..2d2fdd3edc 100644
--- a/kolla/tests/test_methods.py
+++ b/kolla/tests/test_methods.py
@@ -191,7 +191,7 @@ def test_enable_repos_debian_arch(self):
         }
 
         result = methods.handle_repos(template_vars, ["rabbitmq"], "enable")
-        expectCmd = "RUN echo 'Uris: https://ppa1.rabbitmq.com/rabbitmq/rabbitmq-server/deb/debian' "  # noqa: E501
+        expectCmd = "RUN echo 'Uris: https://deb1.rabbitmq.com/rabbitmq-server/debian/bookworm' "  # noqa: E501
         expectCmd += ">/etc/apt/sources.list.d/rabbitmq.sources && "
         expectCmd += "echo 'Components: main' "
         expectCmd += ">>/etc/apt/sources.list.d/rabbitmq.sources && "
@@ -236,7 +236,7 @@ def test_enable_repos_debian_multiple(self):
         expectCmd += ">>/etc/apt/sources.list.d/grafana.sources && "
 
         expectCmd += "echo 'Uris: "
-        expectCmd += "https://ppa1.rabbitmq.com/rabbitmq/rabbitmq-server/deb/debian' "  # noqa: E501
+        expectCmd += "https://deb1.rabbitmq.com/rabbitmq-server/debian/bookworm' "  # noqa: E501
         expectCmd += ">/etc/apt/sources.list.d/rabbitmq.sources && "
         expectCmd += "echo 'Components: main' "
         expectCmd += ">>/etc/apt/sources.list.d/rabbitmq.sources && "
diff --git a/releasenotes/notes/handle-deprecated-rabbitmq-package-archive-47548e7a41baa68b.yaml b/releasenotes/notes/handle-deprecated-rabbitmq-package-archive-47548e7a41baa68b.yaml
new file mode 100644
index 0000000000..b24cc3cdc0
--- /dev/null
+++ b/releasenotes/notes/handle-deprecated-rabbitmq-package-archive-47548e7a41baa68b.yaml
@@ -0,0 +1,7 @@
+---
+fixes:
+  - |
+    `As announced in July 2025 <https://www.rabbitmq.com/blog/2025/07/16/debian-apt-repositories-are-moving>`__,
+    the RabbitMQ project has changed the location and signing key for their Debian and
+    Ubuntu packages. The repository configuration has been updated accordingly.
+    `LP#2131736 <https://launchpad.net/bugs/2131736>`__

From 0dedcb82e46b2ed05d8b53f7ddd8fb0ba19049f9 Mon Sep 17 00:00:00 2001
From: OpenStack Release Bot <infra-root@openstack.org>
Date: Mon, 24 Nov 2025 16:16:08 +0000
Subject: [PATCH 19/20] reno: Update master for unmaintained/2024.1

Update the 2024.1 release notes configuration to build from
unmaintained/2024.1.

Change-Id: Id395efcfe0381340318c3bf27090a8f8fc2e9bfe
Signed-off-by: OpenStack Release Bot <infra-root@openstack.org>
Generated-By: openstack/project-config:roles/copy-release-tools-scripts/files/release-tools/change_reno_branch_to_unmaintained.sh
---
 releasenotes/source/2024.1.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/releasenotes/source/2024.1.rst b/releasenotes/source/2024.1.rst
index 4977a4f1a0..6896656be6 100644
--- a/releasenotes/source/2024.1.rst
+++ b/releasenotes/source/2024.1.rst
@@ -3,4 +3,4 @@
 ===========================
 
 .. release-notes::
-   :branch: stable/2024.1
+   :branch: unmaintained/2024.1

From cbbc1b0bca94e0f768be8433ba4bd38cb6f0c583 Mon Sep 17 00:00:00 2001
From: Michal Nasiadka <mnasiadka@gmail.com>
Date: Wed, 26 Nov 2025 18:27:21 +0100
Subject: [PATCH 20/20] rocky: Remove EPEL hack - 10.1 is out

Change-Id: I60de8ef452adad4a9b0d974a2678264b91eb6e3b
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
---
 docker/base/Dockerfile.j2 | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/docker/base/Dockerfile.j2 b/docker/base/Dockerfile.j2
index 33df5a7b55..5ba1d5a874 100644
--- a/docker/base/Dockerfile.j2
+++ b/docker/base/Dockerfile.j2
@@ -115,11 +115,6 @@ RUN {{ macros.install_packages(base_centos_yum_repo_packages | customizable("cen
 {% block base_centos_repo_overrides_post_yum %}{% endblock -%}
     && {{ macros.rpm_security_update(clean_package_cache) }}
 
-{# NOTE(mnasiadka): dumb-init is only in EPEL10.1 onwards and RHEL/Rocky/clones use the same #}
-{#                    EPEL release as the installed distro release #}
-{# TODO: Remove it when Rocky 10.1 is out #}
-RUN dnf config-manager --save --setopt=*.metalink="https://mirrors.fedoraproject.org/metalink?repo=epel-z-10.1&arch=\$basearch" epel
-
 #### END REPO ENABLEMENT
 
 {# We are back to the basic if conditional here which is: