From 198cb41a7648ce90906149a7e9c0498ab166be12 Mon Sep 17 00:00:00 2001
From: OpenStack Release Bot <infra-root@openstack.org>
Date: Thu, 18 Apr 2024 10:48:36 +0000
Subject: [PATCH 01/22] Update .gitreview for stable/2024.1

Change-Id: Ibf79144113e8dd608a12c7771973a7cbe3e3ebeb
---
 .gitreview | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitreview b/.gitreview
index 975ab6dbf..381540c37 100644
--- a/.gitreview
+++ b/.gitreview
@@ -2,3 +2,4 @@
 host=review.opendev.org
 port=29418
 project=openstack/puppet-openstack-integration.git
+defaultbranch=stable/2024.1

From c15721c794331536754d7409484d3384f14edfd2 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Thu, 18 Apr 2024 22:03:07 +0900
Subject: [PATCH 02/22] Switch to stable/2024.1

Since 2024.1 release was created we can start testing the release
content. Note that Ubuntu continues using 2023.2 until 2024.1 is
released in UCA.

Change-Id: Ia366cf2886d3b68fad190cb47e914949747b9cfe
---
 Puppetfile         | 60 +++++++++++++++++++++++-----------------------
 configure_facts.sh |  2 +-
 manifests/repos.pp |  4 ++--
 3 files changed, 33 insertions(+), 33 deletions(-)

diff --git a/Puppetfile b/Puppetfile
index d0fd54c27..6bdc9944d 100644
--- a/Puppetfile
+++ b/Puppetfile
@@ -3,15 +3,15 @@
 ## OpenStack modules
 mod 'aodh',
   :git => 'https://opendev.org/openstack/puppet-aodh',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'barbican',
   :git => 'https://opendev.org/openstack/puppet-barbican',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'ceilometer',
   :git => 'https://opendev.org/openstack/puppet-ceilometer',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'ceph',
   :git => 'https://opendev.org/openstack/puppet-ceph',
@@ -19,111 +19,111 @@ mod 'ceph',
 
 mod 'cinder',
   :git => 'https://opendev.org/openstack/puppet-cinder',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'cloudkitty',
   :git => 'https://opendev.org/openstack/puppet-cloudkitty',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'designate',
   :git => 'https://opendev.org/openstack/puppet-designate',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'glance',
   :git => 'https://opendev.org/openstack/puppet-glance',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'gnocchi',
   :git => 'https://opendev.org/openstack/puppet-gnocchi',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'heat',
   :git => 'https://opendev.org/openstack/puppet-heat',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'horizon',
   :git => 'https://opendev.org/openstack/puppet-horizon',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'ironic',
   :git => 'https://opendev.org/openstack/puppet-ironic',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'keystone',
   :git => 'https://opendev.org/openstack/puppet-keystone',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'magnum',
   :git => 'https://opendev.org/openstack/puppet-magnum',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'manila',
   :git => 'https://opendev.org/openstack/puppet-manila',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'mistral',
   :git => 'https://opendev.org/openstack/puppet-mistral',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'neutron',
   :git => 'https://opendev.org/openstack/puppet-neutron',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'nova',
   :git => 'https://opendev.org/openstack/puppet-nova',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'octavia',
   :git => 'https://opendev.org/openstack/puppet-octavia',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'openstack_extras',
   :git => 'https://opendev.org/openstack/puppet-openstack_extras',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'openstacklib',
   :git => 'https://opendev.org/openstack/puppet-openstacklib',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'oslo',
   :git => 'https://opendev.org/openstack/puppet-oslo',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'ovn',
   :git => 'https://opendev.org/openstack/puppet-ovn',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'placement',
   :git => 'https://opendev.org/openstack/puppet-placement',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'swift',
   :git => 'https://opendev.org/openstack/puppet-swift',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'tempest',
   :git => 'https://opendev.org/openstack/puppet-tempest',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'trove',
   :git => 'https://opendev.org/openstack/puppet-trove',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'vswitch',
   :git => 'https://opendev.org/openstack/puppet-vswitch',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'vitrage',
   :git => 'https://opendev.org/openstack/puppet-vitrage',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'watcher',
   :git => 'https://opendev.org/openstack/puppet-watcher',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 mod 'zaqar',
   :git => 'https://opendev.org/openstack/puppet-zaqar',
-  :ref => 'master'
+  :ref => 'stable/2024.1'
 
 ## External modules
 mod 'kmod',
diff --git a/configure_facts.sh b/configure_facts.sh
index 745915fa1..da55a6d1d 100644
--- a/configure_facts.sh
+++ b/configure_facts.sh
@@ -18,7 +18,7 @@ export OS_NAME_VERS=${ID}${VERSION_ID}
 
 # Write out facts to the facter folder when we generate them.
 export WRITE_FACTS=${WRITE_FACTS:-true}
-export OPENSTACK_VERSION=${OPENSTACK_VERSION:-master}
+export OPENSTACK_VERSION=${OPENSTACK_VERSION:-caracal}
 export DLRN_TAG=${DLRN_TAG:-puppet-passed-ci}
 export DLRN_ROOT=${DLRN_ROOT:-${OS_NAME_VERS}-${OPENSTACK_VERSION}}
 export DLRN_BASE=${DLRN_BASE:-${DLRN_ROOT}/${DLRN_TAG}}
diff --git a/manifests/repos.pp b/manifests/repos.pp
index 8efacbc5c..21c0807e8 100644
--- a/manifests/repos.pp
+++ b/manifests/repos.pp
@@ -61,11 +61,11 @@
       )
       $delorean_repo = pick(
         $facts['delorean_repo_path'],
-        "https://trunk.rdoproject.org/centos${facts['os']['release']['major']}-master/puppet-passed-ci/delorean.repo"
+        "https://trunk.rdoproject.org/centos${facts['os']['release']['major']}-caracal/puppet-passed-ci/delorean.repo"
       )
       $delorean_deps_repo = pick(
         $facts['delorean_deps_repo_path'],
-        "https://trunk.rdoproject.org/centos${facts['os']['release']['major']}-master/delorean-deps.repo"
+        "https://trunk.rdoproject.org/centos${facts['os']['release']['major']}-caracal/delorean-deps.repo"
       )
 
       class { 'openstack_extras::repo::redhat::redhat':

From c0f4d7e680c0229f415a8fa72ec414bd0d010a35 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Wed, 17 Apr 2024 14:57:18 +0900
Subject: [PATCH 03/22] vitrage: Stop tweaking config/log directory

... because current vitrage-tempest-plugin does not need access to
vitrage config files or log files.

Also remove the not for old bug which was already resolved.

Change-Id: Ic50a72a80277345b78368c81c7889721af9ef10d
(cherry picked from commit 726c408409f4f3c866d37a3d3ebdf43f4020f99b)
---
 manifests/vitrage.pp | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/manifests/vitrage.pp b/manifests/vitrage.pp
index faa79f44d..82535b8c2 100644
--- a/manifests/vitrage.pp
+++ b/manifests/vitrage.pp
@@ -42,7 +42,6 @@
   }
 
   class { 'vitrage':
-    # TODO(ansmith): separate transports when bug/1711716 closed
     default_transport_url      => os_transport_url({
       'transport' => $::openstack_integration::config::messaging_notify_proto,
       'host'      => $::openstack_integration::config::host,
@@ -63,21 +62,6 @@
     notification_driver        => 'messagingv2',
   }
 
-  # Make sure tempest can read the configuration files
-  # default installation has a 640 premission
-  -> file { '/etc/vitrage':
-    ensure  => directory,
-    recurse => true,
-    mode    => '0644',
-  }
-
-  # Make sure tempest can write to the log directory
-  # default installation has a 755 premission
-  -> file { '/var/log/vitrage':
-    ensure => directory,
-    mode   => '0766',
-  }
-
   class { 'vitrage::keystone::auth':
     public_url   => "${::openstack_integration::config::base_url}:8999",
     internal_url => "${::openstack_integration::config::base_url}:8999",

From 8bc32df455c0410238056da4ace2977822059668 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Thu, 25 Apr 2024 10:08:55 +0900
Subject: [PATCH 04/22] Enable ceilometer-polling in acceptance tests

... and also ensure that gnocchi publisher is completely disabled.

Change-Id: If4179972103b30b5e0aad195d4ed8497e15938bd
(cherry picked from commit 7ca6492d1796d82b9ad5fb9a22cb0fcb260d7aef)
---
 manifests/ceilometer.pp | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/manifests/ceilometer.pp b/manifests/ceilometer.pp
index a2dbea530..ca9616cf5 100644
--- a/manifests/ceilometer.pp
+++ b/manifests/ceilometer.pp
@@ -64,9 +64,6 @@
     Class['ceilometer::keystone::auth'] -> Exec['ceilometer-upgrade']
     Class['gnocchi::keystone::auth'] -> Exec['ceilometer-upgrade']
 
-    $sample_pipeline_publishers = ['gnocchi://']
-    $event_pipeline_publishers = ['gnocchi://']
-
     class { 'ceilometer::coordination':
       backend_url => $::openstack_integration::config::tooz_url,
     }
@@ -74,9 +71,9 @@
     class { 'ceilometer::agent::notification':
       workers                   => 2,
       manage_pipeline           => true,
-      pipeline_publishers       => $sample_pipeline_publishers,
+      pipeline_publishers       => ['gnocchi://'],
       manage_event_pipeline     => true,
-      event_pipeline_publishers => $event_pipeline_publishers,
+      event_pipeline_publishers => ['gnocchi://'],
     }
     class { 'ceilometer::agent::polling':
       manage_polling    => true,
@@ -92,7 +89,17 @@
     class { 'ceilometer::db::sync':
       extra_params => '--skip-gnocchi-resource-types',
     }
-    class { 'ceilometer::agent::notification': }
+    class { 'ceilometer::agent::notification':
+      workers                   => 2,
+      manage_pipeline           => true,
+      pipeline_publishers       => [],
+      manage_event_pipeline     => true,
+      event_pipeline_publishers => [],
+    }
+    class { 'ceilometer::agent::polling':
+      manage_polling    => true,
+      compute_namespace => false,
+    }
   }
 
   class { 'ceilometer::agent::service_credentials':

From 1f1263d16b578602598d5ed2fcaa8397f8caf1cb Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sat, 20 Apr 2024 12:40:46 +0900
Subject: [PATCH 05/22] tempest: Avoid unnecessary package installation

When tempest should be installed from source, we don't (shouldn't)
install tempest packages.

Depends-on: https://review.opendev.org/917083
Change-Id: Ic22610b897f6e3de8d9d0de11cc387314cdb0d7b
(cherry picked from commit 0ff08bc9aa8dad162f6d7e0861c888ca47539c36)
---
 manifests/tempest.pp |  1 -
 run_tests.sh         | 27 +++++++++++++--------------
 2 files changed, 13 insertions(+), 15 deletions(-)

diff --git a/manifests/tempest.pp b/manifests/tempest.pp
index 59b653a67..f8488f941 100644
--- a/manifests/tempest.pp
+++ b/manifests/tempest.pp
@@ -345,7 +345,6 @@
     img_disk_format                    => $image_format,
     compute_build_interval             => 10,
     ca_certificates_file               => $::openstack_integration::params::ca_bundle_cert_path,
-    manage_tests_packages              => true,
     attach_encrypted_volume            => $attach_encrypted_volume,
     tempest_workspace                  => '/tmp/openstack/tempest',
     run_ssh                            => true,
diff --git a/run_tests.sh b/run_tests.sh
index c38cef149..48aa7ec2f 100755
--- a/run_tests.sh
+++ b/run_tests.sh
@@ -205,6 +205,11 @@ fi
 # Added tempest specific values to common.yaml
 if [ "${TEMPEST_FROM_SOURCE,,}" = false ]; then
     echo "tempest::install_from_source: false" >> ${SCRIPT_DIR}/hiera/common.yaml
+    echo "tempest::manage_tests_packages: true" >> ${SCRIPT_DIR}/hiera/common.yaml
+    echo "tempest::magnum::manage_tests_packages: true" >> ${SCRIPT_DIR}/hiera/common.yaml
+else
+    echo "tempest::manage_tests_packages: false" >> ${SCRIPT_DIR}/hiera/common.yaml
+    echo "tempest::magnum::manage_tests_packages: false" >> ${SCRIPT_DIR}/hiera/common.yaml
 fi
 
 # Run puppet and assert something changes.
@@ -269,11 +274,6 @@ print_header 'Prepare Tempest'
 $SUDO touch /tmp/openstack/tempest/test-include-list.txt /tmp/openstack/tempest/test-exclude-list.txt
 $SUDO chown -R "$(id -u):$(id -g)" /tmp/openstack/tempest/
 
-if uses_debs; then
-    pkglist="tempest python3-stestr python3-os-testr python3-tempest"
-    $SUDO apt-get install -y $pkglist
-fi
-
 set +e
 # Select what to test:
 # Smoke suite
@@ -370,10 +370,15 @@ if [ "${TEMPEST_FROM_SOURCE,,}" = true ]; then
     /tmp/openstack/tempest/run_tempest/bin/pip3 setup.py install
     popd
 
+    run_tempest/bin/pip3 install os-testr
     run_tempest/bin/stestr init
     export tempest_binary="run_tempest/bin/tempest"
+    export stestr="run_tempest/bin/stestr"
+    export subunit2html="run_tempest/bin/subunit2html"
 else
     export tempest_binary="/usr/bin/tempest"
+    export stestr="/usr/bin/stestr"
+    export subunit2html="/usr/bin/subunit2html"
 fi
 
 # List tempest version
@@ -393,16 +398,10 @@ $tempest_binary run --include-list=/tmp/openstack/tempest/test-include-list.txt
 
 RESULT=$?
 set -e
-if [ -d .testrepository ]; then
-    testr last --subunit > /tmp/openstack/tempest/testrepository.subunit
-elif [ -d .stestr ]; then
-    if type "stestr-3" 2>/dev/null; then
-        stestr-3 last --subunit > /tmp/openstack/tempest/testrepository.subunit
-    else
-        stestr last --subunit > /tmp/openstack/tempest/testrepository.subunit
-    fi
+if [ -d .stestr ]; then
+    $stestr last --subunit > /tmp/openstack/tempest/testrepository.subunit
 fi
-subunit2html /tmp/openstack/tempest/testrepository.subunit /tmp/openstack/tempest/testr_results.html
+$subunit2html /tmp/openstack/tempest/testrepository.subunit /tmp/openstack/tempest/testr_results.html
 print_header 'SELinux Alerts (Tempest)'
 #catch_selinux_alerts
 

From bc5145bd9a75502033e90326fac069681f364feb Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sat, 20 Apr 2024 12:00:16 +0900
Subject: [PATCH 06/22] Ubuntu: Switch to Caracal

Change-Id: I4230a0686167eb0319d2d45e91b1d3cbe7c2b088
(cherry picked from commit 68b4fb56547da3d4ad147dc494b0b8d367518097)
---
 manifests/repos.pp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/manifests/repos.pp b/manifests/repos.pp
index 21c0807e8..c3521f7dd 100644
--- a/manifests/repos.pp
+++ b/manifests/repos.pp
@@ -16,7 +16,7 @@
         'Ubuntu': {
           include apt
           class { 'openstack_extras::repo::debian::ubuntu':
-            release         => 'bobcat',
+            release         => 'caracal',
             package_require => true,
             uca_location    => pick($facts['uca_mirror_host'], 'http://ubuntu-cloud.archive.canonical.com/ubuntu'),
           }
@@ -24,7 +24,7 @@
         'Debian': {
           include apt
           class { 'openstack_extras::repo::debian::debian':
-            release         => 'bobcat',
+            release         => 'caracal',
             package_require => true,
           }
         }

From 855990a013a4db1da635cd9cce427d60b8c62803 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sun, 5 May 2024 14:46:07 +0900
Subject: [PATCH 07/22] Ubuntu: Disable Trove

UCA Caracal does not provide the trove packages. The old versions in
the main jammy repository is installed and it causes the deployment
failure.

Related-Bug: #2064838
Change-Id: I7f1e0317c24da3c1bb21dea699b6f68f4f2ba9d6
(cherry picked from commit d3ff19770d0c008a21778484ec67299667ac4baa)
---
 fixtures/scenario003.pp | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/fixtures/scenario003.pp b/fixtures/scenario003.pp
index df726a10f..4eb52aa59 100644
--- a/fixtures/scenario003.pp
+++ b/fixtures/scenario003.pp
@@ -23,9 +23,13 @@
 case $facts['os']['family'] {
   'Debian': {
     $ipv6 = false
+    # NOTE(tkajinam): UCA Caracal does not provide trove packages
+    # https://bugs.launchpad.net/ubuntu/+source/openstack-trove/+bug/2064838
+    $trove_enabled = false
   }
   'RedHat': {
     $ipv6 = true
+    $trove_enabled = true
   }
   default: {
     fail("Unsupported osfamily (${facts['os']['family']})")
@@ -56,7 +60,9 @@
 class { 'openstack_integration::nova':
   cinder_enabled => true,
 }
-include openstack_integration::trove
+if $trove_enabled {
+  include openstack_integration::trove
+}
 class { 'openstack_integration::horizon':
   heat_enabled => true
 }
@@ -72,7 +78,7 @@
 
 class { 'openstack_integration::tempest':
   designate      => true,
-  trove          => true,
+  trove          => $trove_enabled,
   mistral        => true,
   horizon        => true,
   # NOTE(tkajinam): The scenario job we enable requires cinder, which is not

From 03bb16aa61d0ed78efb764fa5a7202644bb7cbfd Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Fri, 10 May 2024 23:00:51 +0900
Subject: [PATCH 08/22] redis: Generate tls certs timely for redis-sentinel

The same certs are used by not only redis but also redis-sentinel so
the certs should be generated at the appropriate timing for sentinel
installation/configuration.

Change-Id: I50e08ff61d3e4152777b425fe15f2f48fcea6070
(cherry picked from commit 0a9c65cbe1f7aa9507bc8accc50b249b9782d2e8)
---
 manifests/redis.pp | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/manifests/redis.pp b/manifests/redis.pp
index aac853b5c..1580b979c 100644
--- a/manifests/redis.pp
+++ b/manifests/redis.pp
@@ -46,8 +46,14 @@
 
   if $::openstack_integration::config::ssl {
     openstack_integration::ssl_key { 'redis':
-      require => Package[$::redis::package_name],
-      notify  => Service[$::redis::service_name],
+      require => [
+        Package[$::redis::package_name],
+        Package[$::redis::sentinel::package_name],
+      ],
+      notify  => [
+        Service[$::redis::service_name],
+        Service[$::redis::sentinel::service_name],
+      ]
     }
   }
 }

From 9e98a441b3c59d61ae377bbdf3c8d0cd15c475b1 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sat, 20 Apr 2024 12:04:54 +0900
Subject: [PATCH 09/22] Ubuntu: Switch back to official repository

We replaced the ceph official repository by UCA because the official
repository didn't provide packages for jammy but now the packages
for jammy are available.

Change-Id: I4cb520c7250d0920f677c6411a493859bbf2a0ae
(cherry picked from commit b2aaa0db1d578991b95806fb08ee7d2839f34f00)
---
 manifests/repos.pp | 44 ++++++++++++++++----------------------------
 1 file changed, 16 insertions(+), 28 deletions(-)

diff --git a/manifests/repos.pp b/manifests/repos.pp
index c3521f7dd..d976c2ed7 100644
--- a/manifests/repos.pp
+++ b/manifests/repos.pp
@@ -2,14 +2,6 @@
 
   $ceph_version_real = pick($facts['ceph_version'], 'reef')
 
-  if $facts['os']['name'] == 'Ubuntu' and versioncmp($facts['os']['release']['major'], '22') >= 0 {
-    # NOTE(tkajinam): Upstream ceph repository does not provide packages for
-    #                 Ubuntu Jammy, so we use packages from UCA.
-    $enable_ceph_repository = false
-  } else {
-    $enable_ceph_repository = true
-  }
-
   case $facts['os']['family'] {
     'Debian': {
       case $facts['os']['name'] {
@@ -34,20 +26,18 @@
       }
 
       $ceph_mirror = pick($facts['ceph_mirror_host'], "http://download.ceph.com/debian-${ceph_version_real}/")
-      if $enable_ceph_repository {
-        # Ceph is both packaged on UCA and official download.ceph.com packages
-        # which we mirror. We want to use the official packages or our mirror.
-        if $ceph_mirror !~ '^http://download.ceph.com/.*' {
-          $ceph_version_cap = capitalize($ceph_version_real)
-          apt::pin { 'ceph':
-            priority   => 1001,
-            originator => "Ceph ${ceph_version_cap}",
-          }
-        } else {
-          apt::pin { 'ceph':
-            priority => 1001,
-            origin   => 'download.ceph.com',
-          }
+      # Ceph is both packaged on UCA and official download.ceph.com packages
+      # which we mirror. We want to use the official packages or our mirror.
+      if $ceph_mirror !~ '^http://download.ceph.com/.*' {
+        $ceph_version_cap = capitalize($ceph_version_real)
+        apt::pin { 'ceph':
+          priority   => 1001,
+          originator => "Ceph ${ceph_version_cap}",
+        }
+      } else {
+        apt::pin { 'ceph':
+          priority => 1001,
+          origin   => 'download.ceph.com',
         }
       }
 
@@ -101,12 +91,10 @@
     }
   }
 
-  if $enable_ceph_repository {
-    class { 'ceph::repo':
-      enable_sig  => $enable_sig,
-      enable_epel => $enable_epel,
-      ceph_mirror => $ceph_mirror,
-    }
+  class { 'ceph::repo':
+    enable_sig  => $enable_sig,
+    enable_epel => $enable_epel,
+    ceph_mirror => $ceph_mirror,
   }
 
   # NOTE(tobias-urdin): Needed where augeas is used, like puppet-ovn.

From 9240306586bf4f5d2ccf84c8f7d26a526f36bb47 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Mon, 3 Jun 2024 23:54:20 +0900
Subject: [PATCH 10/22] swift: Fix missing log directory in Ubuntu

... and capture rsyslog config files to ensure that rsyslog is properly
configured.

Backport note:
This backport includes fb7629634d72305660d56c8012ba8a7334c97d55 to
ensure the /etc/rsyslog.d directory is captured.

Change-Id: I0b9884b092706f633513b2bd49d368efe924585a
(cherry picked from commit b3251241bee7826b4dbb06529bcf173e72a3bab9)
---
 copy_logs.sh       | 8 ++++++++
 manifests/swift.pp | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/copy_logs.sh b/copy_logs.sh
index c302a4b18..070ca8623 100755
--- a/copy_logs.sh
+++ b/copy_logs.sh
@@ -101,6 +101,14 @@ if which journalctl &> /dev/null; then
     sudo journalctl --no-pager > $LOG_DIR/syslog.txt
 fi
 
+# rsyslog
+if [ -d /etc/rsyslog.d ]; then
+    sudo cp -r /etc/rsyslog.d $LOG_DIR/etc/
+fi
+if [ -f /etc/rsyslog.conf ]; then
+    sudo cp /etc/rsyslog.conf $LOG_DIR/etc/
+fi
+
 # network interfaces
 if [ -d /etc/sysconfig/network-scripts ]; then
     sudo cp -r /etc/sysconfig/network-scripts $LOG_DIR/etc/sysconfig/
diff --git a/manifests/swift.pp b/manifests/swift.pp
index dde07c4c2..a38889e4b 100644
--- a/manifests/swift.pp
+++ b/manifests/swift.pp
@@ -14,7 +14,7 @@
     before  => Anchor['swift::service::begin'],
   }
 
-  if ($facts['os']['name'] == 'Debian') {
+  if ($facts['os']['family'] == 'Debian') {
     # Ubuntu/Debian requires particular permissions for rsyslog to work
     $log_dir_owner = $facts['os']['name'] ? {
       'Debian' => 'swift',

From 8ceb4a17adbe4b3a1ad16aeaefa7a69069c351e7 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sun, 21 Jul 2024 23:55:16 +0900
Subject: [PATCH 11/22] Neutron: Enable vlan network

... so that we can test creation of vlan provider network.

Also disable tenant networks with flat of vlan because just allowing
vxlan is enough.

Change-Id: I9ac277803ee440d0258a5672d1592505c5aeea30
(cherry picked from commit a14b6fc1748b5fd394307213194994b9ea077e31)
---
 manifests/neutron.pp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/manifests/neutron.pp b/manifests/neutron.pp
index 29d626920..523b75d9a 100644
--- a/manifests/neutron.pp
+++ b/manifests/neutron.pp
@@ -308,9 +308,10 @@
   }
   class { 'neutron::plugins::ml2':
     type_drivers         => [$overlay_network_type, 'vlan', 'flat'],
-    tenant_network_types => [$overlay_network_type, 'vlan', 'flat'],
+    tenant_network_types => [$overlay_network_type],
     extension_drivers    => 'port_security,qos',
     mechanism_drivers    => $drivers_real,
+    network_vlan_ranges  => 'external:1000:2999',
     max_header_size      => $max_header_size,
     overlay_ip_version   => $::openstack_integration::config::ip_version,
   }

From b16108c67e6fab474600e000265e6647f3987919 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Mon, 3 Jun 2024 21:21:46 +0900
Subject: [PATCH 12/22] aio: Enable nova-cinder integration

AIO has both nova and cinder enabled, so we can enable the integration
between these services.

Change-Id: Id4dca3ac05ca2f69bb6da48ab8ef224af09c1502
(cherry picked from commit eda12cd2562f8df5cd169b4b55fbad598fbddb35)
---
 fixtures/scenario-aio.pp | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fixtures/scenario-aio.pp b/fixtures/scenario-aio.pp
index 8ee8973e9..783a524da 100644
--- a/fixtures/scenario-aio.pp
+++ b/fixtures/scenario-aio.pp
@@ -23,12 +23,14 @@
 include openstack_integration::glance
 include openstack_integration::neutron
 include openstack_integration::placement
-include openstack_integration::nova
+class { 'openstack_integration::nova':
+  cinder_enabled => true,
+}
 include openstack_integration::cinder
 include openstack_integration::horizon
 include openstack_integration::provision
 
 class { 'openstack_integration::tempest':
-  horizon => true,
   cinder  => true,
+  horizon => true,
 }

From 93d2fc72b8d7061d1b5c3c820029dab1290d4fa5 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Wed, 21 Aug 2024 14:00:06 +0900
Subject: [PATCH 13/22] Drop usage of 'update-ca-trust force-enable'

... because the subcommand does not exist actually. The command fails
with the following error in recent CentOS Stream 9.

```
Error: Unknown command: force-enable

Usage: /usr/bin/update-ca-trust [extract] [-o DIR|--output=DIR]

Update the system trust store in /etc/pki/ca-trust/extracted.

COMMANDS
(absent/empty command): Same as the extract command described below.

extract: Instruct update-ca-trust to scan the source configuration in
/usr/share/pki/ca-trust-source and /etc/pki/ca-trust/source and produce
updated versions of the consolidated configuration files stored below
the /etc/pki/ca-trust/extracted directory hierarchy.

EXTRACT OPTIONS
-o DIR, --output=DIR: Write the extracted trust store into the given
directory instead of updating /etc/pki/ca-trust/extracted.
```

Change-Id: I38bbfc08a73823d2fd6e00974e277130cbff7e12
(cherry picked from commit fe9a9105cb91de1c92f1d0b361b1111b055a7118)
---
 manifests/params.pp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/manifests/params.pp b/manifests/params.pp
index ab5af4766..4f8c1d7cf 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -4,7 +4,7 @@
     'RedHat': {
       $ca_bundle_cert_path = '/etc/ssl/certs/ca-bundle.crt'
       $cert_path           = '/etc/pki/ca-trust/source/anchors/puppet_openstack.pem'
-      $update_ca_certs_cmd = '/usr/bin/update-ca-trust force-enable && /usr/bin/update-ca-trust extract'
+      $update_ca_certs_cmd = '/usr/bin/update-ca-trust extract'
       $mysql_charset       = 'utf8'
       $mysql_collate       = 'utf8_general_ci'
       $mysql_conf_dir      = '/etc/my.cnf.d'

From 0e4898eb4f0acd4092f25a24c8fe2997cd4f9296 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sun, 15 Sep 2024 00:54:23 +0900
Subject: [PATCH 14/22] Fix outdated number of scenarios mentioned

Currently we have 5 scenarios instead of 4.

Change-Id: I045d758e09b7639cdca628ea7d230997cd45007b
(cherry picked from commit 02aca06f645295652d7d82d34c66f0554f272dca)
---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 85fd463b9..c57d34944 100644
--- a/README.md
+++ b/README.md
@@ -29,7 +29,7 @@ Infrastructure environment.
 Description
 -----------
 
-OpenStack Infrastructure is deploying four jobs per supported Operating System
+OpenStack Infrastructure is deploying 5 jobs per supported Operating System
 (Ubuntu and CentOS): scenario001, scenario002, scenario003, scenario004, and
 scenario005.
 
@@ -37,7 +37,7 @@ The manifest files under the fixtures directory is used to compose the required
 services for each senario. The manifest files under the manifests directory
 is used to set up basic set of a single component (like nova, cinder and so on).
 
-OpenStack services are balanced between four scenarios because OpenStack
+OpenStack services are balanced between 5 scenarios because OpenStack
 Infastructure Jenkins slaves can not afford the load of running everything on
 the same node.
 One manifest (scenario-aio) is used for people who want to [run a simple All-In-One

From 790dc6ac6fe62a15ee3cd7e4ce0768b2a46f7238 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sun, 15 Sep 2024 23:16:54 +0900
Subject: [PATCH 15/22] Fix inconsistent deployment architecture switch

Only scenario 004 used 'Ubuntu or not' while the other scenarios use
'Debian family or not'.

Change-Id: I6f9d1181c9e51ea97129f12ee36bbfa9f0cde189
(cherry picked from commit 37195f63e427615cba335498579f2222060f3c0f)
---
 fixtures/scenario004.pp | 39 +++++++++++++++++++++------------------
 1 file changed, 21 insertions(+), 18 deletions(-)

diff --git a/fixtures/scenario004.pp b/fixtures/scenario004.pp
index bd9b3931d..eccbadf91 100644
--- a/fixtures/scenario004.pp
+++ b/fixtures/scenario004.pp
@@ -20,24 +20,27 @@
   $ssl = true
 }
 
-if $facts['os']['name'] == 'Ubuntu' {
-  $ipv6                = false
-  # TODO(tobias-urdin): No service plugin 'BGPVPN'
-  $bgpvpn_enabled      = false
-  # TODO(tobias-urdin): Plugin 'networking_l2gw.services.l2gateway.plugin.L2GatewayPlugin' not found.
-  $l2gw_enabled        = false
-  # FIXME(ykarel) Disable bgp_dragent until Ubuntu python3 stein(with stein packages) jobs are ready
-  $bgp_dragent_enabled = false
-  # TODO(tkajinam): Enable these along with the other plugins
-  $vpnaas_enabled      = false
-  $taas_enabled        = false
-} else {
-  $ipv6                = true
-  $bgpvpn_enabled      = true
-  $l2gw_enabled        = true
-  $bgp_dragent_enabled = true
-  $vpnaas_enabled      = true
-  $taas_enabled        = true
+case $facts['os']['family'] {
+  'Debian': {
+    $ipv6 = false
+    # TODO(tkajinam): Need additional work to load the plugins
+    $bgpvpn_enabled = false
+    $l2gw_enabled = false
+    $bgp_dragent_enabled = false
+    $vpnaas_enabled = false
+    $taas_enabled = false
+  }
+  'RedHat': {
+    $ipv6 = true
+    $bgpvpn_enabled = true
+    $l2gw_enabled = true
+    $bgp_dragent_enabled = true
+    $vpnaas_enabled = true
+    $taas_enabled = true
+  }
+  default: {
+    fail("Unsupported osfamily (${facts['os']['family']})")
+  }
 }
 
 include openstack_integration

From f76e8cd88df78f10536c4ac0542d309670fdc77c Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Thu, 26 Sep 2024 21:50:08 +0900
Subject: [PATCH 16/22] Ensure en language pack is installed

... to avoid the following error in rabbitmq_user provider.

Cannot parse invalid user line: /usr/bin/sh: warning:
setlocale: LC_ALL: cannot change locale (en_US.UTF-8)

Conflicts:
	playbooks/prepare-node-common.yaml

Change-Id: I22534383ef8f6e0da860f53501eb8ccbc256de87
(cherry picked from commit 400a3e51e5ecac37abfeac5c475857fda771770c)
---
 playbooks/prepare-node-common.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/playbooks/prepare-node-common.yaml b/playbooks/prepare-node-common.yaml
index 4c26af2b5..7f39d55dd 100644
--- a/playbooks/prepare-node-common.yaml
+++ b/playbooks/prepare-node-common.yaml
@@ -42,7 +42,8 @@
           - libxslt-devel
           - ruby-devel
           - zlib-devel
-          - rubygem-rexml
+          - langpacks-en
+          - glibc-langpack-en
 
       when:
         - ansible_os_family == 'RedHat'

From c3bb6192dc84993225bf8f2bb2fda062202dbc83 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Mon, 14 Oct 2024 13:30:00 +0900
Subject: [PATCH 17/22] Avoid using internal exec resources for dependencies

... so that we can refactor resources in ceph::pool.

Change-Id: I98c66422b92a5a1b64ab90f646713f60b175645e
(cherry picked from commit 9e4cd7852e7dd321e42dcd77a0664362120030d7)
(cherry picked from commit e9ca68508f55fd7cbe24ecbba1bc5439ed74ecfc)
---
 manifests/cinder.pp  | 4 ++--
 manifests/glance.pp  | 2 +-
 manifests/gnocchi.pp | 2 +-
 manifests/nova.pp    | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/manifests/cinder.pp b/manifests/cinder.pp
index db1423a49..57c576795 100644
--- a/manifests/cinder.pp
+++ b/manifests/cinder.pp
@@ -160,7 +160,7 @@
         manage_volume_type => true,
       }
       # make sure ceph pool exists before running Cinder Volume
-      Exec['create-cinder'] -> Service['cinder-volume']
+      Ceph::Pool['cinder'] -> Service['cinder-volume']
     }
     default: {
       fail("Unsupported backend (${backend})")
@@ -179,7 +179,7 @@
         backup_ceph_user => 'openstack',
       }
       # make sure ceph pool exists before running Cinder Backup
-      Exec['create-backups'] -> Service['cinder-backup']
+      Ceph::Pool['backups'] -> Service['cinder-backup']
     }
     default: {}
   }
diff --git a/manifests/glance.pp b/manifests/glance.pp
index 8eddeaff9..39bf8f8ee 100644
--- a/manifests/glance.pp
+++ b/manifests/glance.pp
@@ -69,7 +69,7 @@
         rbd_store_pool => 'glance',
       }
       # make sure ceph pool exists before running Glance API
-      Exec['create-glance'] -> Service['glance-api']
+      Ceph::Pool['glance'] -> Service['glance-api']
       $default_backend = 'rbd1'
     }
     'swift': {
diff --git a/manifests/gnocchi.pp b/manifests/gnocchi.pp
index 91a5e9a7e..a8c91fa94 100644
--- a/manifests/gnocchi.pp
+++ b/manifests/gnocchi.pp
@@ -108,7 +108,7 @@
         manage_rados  => true,
       }
       # make sure ceph pool exists before running gnocchi (dbsync & services)
-      Exec['create-gnocchi'] -> Exec['gnocchi-db-sync']
+      Ceph::Pool['gnocchi'] -> Anchor['gnocchi::dbsync::begin']
     }
     'swift': {
       class { 'gnocchi::storage::swift':
diff --git a/manifests/nova.pp b/manifests/nova.pp
index fd5de0466..6d2b0be5d 100644
--- a/manifests/nova.pp
+++ b/manifests/nova.pp
@@ -261,7 +261,7 @@
       manage_ceph_client      => false,
     }
     # make sure ceph pool exists before running nova-compute
-    Exec['create-nova'] -> Service['nova-compute']
+    Ceph::Pool['nova'] -> Service['nova-compute']
   } else {
     include openstacklib::iscsid
     Service['iscsid'] -> Service['nova-compute']

From 4770fd9630af1d3e8c275965f5ed463468c82129 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Fri, 31 May 2024 14:11:20 +0900
Subject: [PATCH 18/22] Add experimental puppet 8 functional jobs

Add integration jobs and litmus jobs using Puppet 8 as experimental
jobs, to improve the test coverage with Puppet 8.

Depends-on: https://review.opendev.org/c/openstack/puppet-nova/+/920867
Change-Id: I3a8e27bace1ea3e82ba16a97964ceb010bfec6f3
(cherry picked from commit 7cd6e9b9cf4e7bc43556518f2d2fb8b5f96da0e0)
---
 zuul.d/integration.yaml | 85 +++++++++++++++++++++++++++++++++++++++++
 zuul.d/layout.yaml      | 25 ++++++++++++
 zuul.d/litmus.yaml      | 25 +++++++++++-
 3 files changed, 134 insertions(+), 1 deletion(-)

diff --git a/zuul.d/integration.yaml b/zuul.d/integration.yaml
index 177926311..f0c3a0284 100644
--- a/zuul.d/integration.yaml
+++ b/zuul.d/integration.yaml
@@ -110,3 +110,88 @@
       nodes:
         - name: centos-9-stream
           label: centos-9-stream
+
+### puppet 8 jobs ###
+
+- job:
+    name: puppet-openstack-integration-8
+    parent: puppet-openstack-integration-run-base
+    abstract: true
+    voting: false
+    vars:
+      puppet: 8
+
+- job:
+    name: puppet-openstack-integration-8-scenario001
+    parent: puppet-openstack-integration-8
+    abstract: true
+    vars:
+      scenario: scenario001
+
+- job:
+    name: puppet-openstack-integration-8-scenario001-tempest-centos-9-stream
+    parent: puppet-openstack-integration-8-scenario001
+    nodeset:
+      nodes:
+        - name: centos-9-stream
+          label: centos-9-stream
+
+- job:
+    name: puppet-openstack-integration-8-scenario002
+    parent: puppet-openstack-integration-8
+    abstract: true
+    vars:
+      scenario: scenario002
+
+- job:
+    name: puppet-openstack-integration-8-scenario002-tempest-centos-9-stream
+    parent: puppet-openstack-integration-8-scenario002
+    nodeset:
+      nodes:
+        - name: centos-9-stream
+          label: centos-9-stream
+
+- job:
+    name: puppet-openstack-integration-8-scenario003
+    parent: puppet-openstack-integration-8
+    abstract: true
+    vars:
+      scenario: scenario003
+
+- job:
+    name: puppet-openstack-integration-8-scenario003-tempest-centos-9-stream
+    parent: puppet-openstack-integration-8-scenario003
+    nodeset:
+      nodes:
+        - name: centos-9-stream
+          label: centos-9-stream
+
+- job:
+    name: puppet-openstack-integration-8-scenario004
+    parent: puppet-openstack-integration-8
+    abstract: true
+    vars:
+      scenario: scenario004
+
+- job:
+    name: puppet-openstack-integration-8-scenario004-tempest-centos-9-stream
+    parent: puppet-openstack-integration-8-scenario004
+    nodeset:
+      nodes:
+        - name: centos-9-stream
+          label: centos-9-stream
+
+- job:
+    name: puppet-openstack-integration-8-scenario005
+    parent: puppet-openstack-integration-8
+    abstract: true
+    vars:
+      scenario: scenario005
+
+- job:
+    name: puppet-openstack-integration-8-scenario005-tempest-centos-9-stream
+    parent: puppet-openstack-integration-8-scenario005
+    nodeset:
+      nodes:
+        - name: centos-9-stream
+          label: centos-9-stream
diff --git a/zuul.d/layout.yaml b/zuul.d/layout.yaml
index 2624b2ad3..b2d8609b3 100644
--- a/zuul.d/layout.yaml
+++ b/zuul.d/layout.yaml
@@ -42,6 +42,9 @@
         - puppet-openstack-libraries-puppet-unit-7.29-centos-9-stream
         - puppet-openstack-libraries-puppet-unit-7.29-ubuntu-jammy
         - puppet-openstack-libraries-litmus-7.29-centos-9-stream
+    experimental:
+      jobs:
+        - puppet-openstack-libraries-litmus-8.5-centos-9-stream
 
 # integration jobs
 - project-template:
@@ -65,6 +68,13 @@
         - puppet-openstack-integration-7-scenario003-tempest-centos-9-stream
         - puppet-openstack-integration-7-scenario004-tempest-centos-9-stream
         - puppet-openstack-integration-7-scenario005-tempest-centos-9-stream
+    experimental:
+      jobs:
+        - puppet-openstack-integration-8-scenario001-tempest-centos-9-stream
+        - puppet-openstack-integration-8-scenario002-tempest-centos-9-stream
+        - puppet-openstack-integration-8-scenario003-tempest-centos-9-stream
+        - puppet-openstack-integration-8-scenario004-tempest-centos-9-stream
+        - puppet-openstack-integration-8-scenario005-tempest-centos-9-stream
 
 - project-template:
     name: puppet-openstack-integration-jobs-scenario001
@@ -75,6 +85,9 @@
     gate:
       jobs:
         - puppet-openstack-integration-7-scenario001-tempest-centos-9-stream
+    experimental:
+      jobs:
+        - puppet-openstack-integration-8-scenario001-tempest-centos-9-stream
 
 - project-template:
     name: puppet-openstack-integration-jobs-scenario002
@@ -85,6 +98,9 @@
     gate:
       jobs:
         - puppet-openstack-integration-7-scenario002-tempest-centos-9-stream
+    experimental:
+      jobs:
+        - puppet-openstack-integration-8-scenario002-tempest-centos-9-stream
 
 - project-template:
     name: puppet-openstack-integration-jobs-scenario003
@@ -95,6 +111,9 @@
     gate:
       jobs:
         - puppet-openstack-integration-7-scenario003-tempest-centos-9-stream
+    experimental:
+      jobs:
+        - puppet-openstack-integration-8-scenario003-tempest-centos-9-stream
 
 - project-template:
     name: puppet-openstack-integration-jobs-scenario004
@@ -105,6 +124,9 @@
     gate:
       jobs:
         - puppet-openstack-integration-7-scenario004-tempest-centos-9-stream
+    experimental:
+      jobs:
+        - puppet-openstack-integration-8-scenario004-tempest-centos-9-stream
 
 - project-template:
     name: puppet-openstack-integration-jobs-scenario005
@@ -115,3 +137,6 @@
     gate:
       jobs:
         - puppet-openstack-integration-7-scenario005-tempest-centos-9-stream
+    experimental:
+      jobs:
+        - puppet-openstack-integration-8-scenario005-tempest-centos-9-stream
diff --git a/zuul.d/litmus.yaml b/zuul.d/litmus.yaml
index 46ff71619..008411e86 100644
--- a/zuul.d/litmus.yaml
+++ b/zuul.d/litmus.yaml
@@ -56,6 +56,16 @@
     vars:
       puppet_gem_version: 7.29
 
+- job:
+    name: puppet-openstack-litmus-8.5-centos-9-stream
+    parent: puppet-openstack-litmus-module-base
+    nodeset: centos-9-stream
+    voting: false
+    vars:
+      puppet_gem_version: 8.5
+      dnf_modules:
+        ruby: 3.1
+
 - job:
     name: puppet-openstack-litmus-latest-ubuntu-jammy
     parent: puppet-openstack-litmus-module-base
@@ -74,11 +84,21 @@
 - job:
     name: puppet-openstack-libraries-litmus-7.29-ubuntu-jammy
     parent: puppet-openstack-litmus-libraries-base
-    voting: false
     nodeset: ubuntu-jammy
+    voting: false
     vars:
       puppet_gem_version: 7.29
 
+- job:
+    name: puppet-openstack-libraries-litmus-8.5-centos-9-stream
+    parent: puppet-openstack-litmus-libraries-base
+    nodeset: centos-9-stream
+    voting: false
+    vars:
+      puppet_gem_version: 8.5
+      dnf_modules:
+        ruby: 3.1
+
 - job:
     name: puppet-openstack-libraries-litmus-latest-ubuntu-jammy
     parent: puppet-openstack-litmus-libraries-base
@@ -97,3 +117,6 @@
     gate:
       jobs:
         - puppet-openstack-litmus-7.29-centos-9-stream
+    experimental:
+      jobs:
+        - puppet-openstack-litmus-8.5-centos-9-stream

From dc5ae3a7230009162d9cc62ead06be75654efa4e Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Thu, 23 Jan 2025 20:44:40 +0900
Subject: [PATCH 19/22] Promote puppet 8 jobs

Puppet 7 is reaching its EOL very soon. Enable testing with Puppet 8
to prepare complete migration to Puppet 8. Note that litmus jobs are
kept non-voting in this step but will later be made voting.

Change-Id: I4578a2265f962ec38b7bddb19e0dfbb624d117de
(cherry picked from commit ed57a60dccffe3d294314b768bec79707e34b9fa)
(cherry picked from commit 65af6d5d140974c83ec061ad29c19fe538a1c01a)
---
 zuul.d/integration.yaml |  1 -
 zuul.d/layout.yaml      | 40 ++++++++++++++--------------------------
 zuul.d/libraries.yaml   |  5 ++---
 zuul.d/litmus.yaml      | 12 +++++-------
 zuul.d/unit.yaml        |  8 ++++----
 5 files changed, 25 insertions(+), 41 deletions(-)

diff --git a/zuul.d/integration.yaml b/zuul.d/integration.yaml
index f0c3a0284..08a31546a 100644
--- a/zuul.d/integration.yaml
+++ b/zuul.d/integration.yaml
@@ -117,7 +117,6 @@
     name: puppet-openstack-integration-8
     parent: puppet-openstack-integration-run-base
     abstract: true
-    voting: false
     vars:
       puppet: 8
 
diff --git a/zuul.d/layout.yaml b/zuul.d/layout.yaml
index b2d8609b3..22d9efc88 100644
--- a/zuul.d/layout.yaml
+++ b/zuul.d/layout.yaml
@@ -30,10 +30,13 @@
         - puppet-openstack-libraries-puppet-syntax-8-centos-9-stream
         - puppet-openstack-libraries-puppet-unit-7.29-centos-9-stream
         - puppet-openstack-libraries-puppet-unit-7.29-ubuntu-jammy
-        - puppet-openstack-libraries-puppet-unit-8.5-centos-9-stream
+        - puppet-openstack-libraries-litmus-7.29-centos-9-stream
+        - puppet-openstack-libraries-litmus-7.29-ubuntu-jammy
+        - puppet-openstack-libraries-puppet-unit-8.10-centos-9-stream
         - puppet-openstack-libraries-puppet-unit-latest-ubuntu-jammy
         - puppet-openstack-libraries-litmus-7.29-centos-9-stream
         - puppet-openstack-libraries-litmus-7.29-ubuntu-jammy
+        - puppet-openstack-libraries-litmus-8.10-centos-9-stream
         - puppet-openstack-libraries-litmus-latest-ubuntu-jammy
     gate:
       jobs:
@@ -42,9 +45,6 @@
         - puppet-openstack-libraries-puppet-unit-7.29-centos-9-stream
         - puppet-openstack-libraries-puppet-unit-7.29-ubuntu-jammy
         - puppet-openstack-libraries-litmus-7.29-centos-9-stream
-    experimental:
-      jobs:
-        - puppet-openstack-libraries-litmus-8.5-centos-9-stream
 
 # integration jobs
 - project-template:
@@ -61,6 +61,11 @@
         - puppet-openstack-integration-7-scenario003-tempest-centos-9-stream
         - puppet-openstack-integration-7-scenario004-tempest-centos-9-stream
         - puppet-openstack-integration-7-scenario005-tempest-centos-9-stream
+        - puppet-openstack-integration-8-scenario001-tempest-centos-9-stream
+        - puppet-openstack-integration-8-scenario002-tempest-centos-9-stream
+        - puppet-openstack-integration-8-scenario003-tempest-centos-9-stream
+        - puppet-openstack-integration-8-scenario004-tempest-centos-9-stream
+        - puppet-openstack-integration-8-scenario005-tempest-centos-9-stream
     gate:
       jobs:
         - puppet-openstack-integration-7-scenario001-tempest-centos-9-stream
@@ -68,13 +73,6 @@
         - puppet-openstack-integration-7-scenario003-tempest-centos-9-stream
         - puppet-openstack-integration-7-scenario004-tempest-centos-9-stream
         - puppet-openstack-integration-7-scenario005-tempest-centos-9-stream
-    experimental:
-      jobs:
-        - puppet-openstack-integration-8-scenario001-tempest-centos-9-stream
-        - puppet-openstack-integration-8-scenario002-tempest-centos-9-stream
-        - puppet-openstack-integration-8-scenario003-tempest-centos-9-stream
-        - puppet-openstack-integration-8-scenario004-tempest-centos-9-stream
-        - puppet-openstack-integration-8-scenario005-tempest-centos-9-stream
 
 - project-template:
     name: puppet-openstack-integration-jobs-scenario001
@@ -82,12 +80,10 @@
       jobs:
         - puppet-openstack-integration-7-scenario001-tempest-ubuntu-jammy
         - puppet-openstack-integration-7-scenario001-tempest-centos-9-stream
+        - puppet-openstack-integration-8-scenario001-tempest-centos-9-stream
     gate:
       jobs:
         - puppet-openstack-integration-7-scenario001-tempest-centos-9-stream
-    experimental:
-      jobs:
-        - puppet-openstack-integration-8-scenario001-tempest-centos-9-stream
 
 - project-template:
     name: puppet-openstack-integration-jobs-scenario002
@@ -95,12 +91,10 @@
       jobs:
         - puppet-openstack-integration-7-scenario002-tempest-ubuntu-jammy
         - puppet-openstack-integration-7-scenario002-tempest-centos-9-stream
+        - puppet-openstack-integration-8-scenario002-tempest-centos-9-stream
     gate:
       jobs:
         - puppet-openstack-integration-7-scenario002-tempest-centos-9-stream
-    experimental:
-      jobs:
-        - puppet-openstack-integration-8-scenario002-tempest-centos-9-stream
 
 - project-template:
     name: puppet-openstack-integration-jobs-scenario003
@@ -108,12 +102,10 @@
       jobs:
         - puppet-openstack-integration-7-scenario003-tempest-ubuntu-jammy
         - puppet-openstack-integration-7-scenario003-tempest-centos-9-stream
+        - puppet-openstack-integration-8-scenario003-tempest-centos-9-stream
     gate:
       jobs:
         - puppet-openstack-integration-7-scenario003-tempest-centos-9-stream
-    experimental:
-      jobs:
-        - puppet-openstack-integration-8-scenario003-tempest-centos-9-stream
 
 - project-template:
     name: puppet-openstack-integration-jobs-scenario004
@@ -121,12 +113,10 @@
       jobs:
         - puppet-openstack-integration-7-scenario004-tempest-ubuntu-jammy
         - puppet-openstack-integration-7-scenario004-tempest-centos-9-stream
+        - puppet-openstack-integration-8-scenario004-tempest-centos-9-stream
     gate:
       jobs:
         - puppet-openstack-integration-7-scenario004-tempest-centos-9-stream
-    experimental:
-      jobs:
-        - puppet-openstack-integration-8-scenario004-tempest-centos-9-stream
 
 - project-template:
     name: puppet-openstack-integration-jobs-scenario005
@@ -134,9 +124,7 @@
       jobs:
         - puppet-openstack-integration-7-scenario005-tempest-ubuntu-jammy
         - puppet-openstack-integration-7-scenario005-tempest-centos-9-stream
+        - puppet-openstack-integration-8-scenario005-tempest-centos-9-stream
     gate:
       jobs:
         - puppet-openstack-integration-7-scenario005-tempest-centos-9-stream
-    experimental:
-      jobs:
-        - puppet-openstack-integration-8-scenario005-tempest-centos-9-stream
diff --git a/zuul.d/libraries.yaml b/zuul.d/libraries.yaml
index 26b757fdd..71e581d45 100644
--- a/zuul.d/libraries.yaml
+++ b/zuul.d/libraries.yaml
@@ -16,12 +16,11 @@
       puppet_gem_version: 7.29
 
 - job:
-    name: puppet-openstack-libraries-puppet-unit-8.5-centos-9-stream
+    name: puppet-openstack-libraries-puppet-unit-8.10-centos-9-stream
     parent: puppet-openstack-libraries-puppet-unit-base
     nodeset: centos-9-stream
-    voting: false
     vars:
-      puppet_gem_version: 8.5
+      puppet_gem_version: 8.10
       dnf_modules:
         ruby: 3.1
 
diff --git a/zuul.d/litmus.yaml b/zuul.d/litmus.yaml
index 008411e86..fe79b94cb 100644
--- a/zuul.d/litmus.yaml
+++ b/zuul.d/litmus.yaml
@@ -57,12 +57,12 @@
       puppet_gem_version: 7.29
 
 - job:
-    name: puppet-openstack-litmus-8.5-centos-9-stream
+    name: puppet-openstack-litmus-8.10-centos-9-stream
     parent: puppet-openstack-litmus-module-base
     nodeset: centos-9-stream
     voting: false
     vars:
-      puppet_gem_version: 8.5
+      puppet_gem_version: 8.10
       dnf_modules:
         ruby: 3.1
 
@@ -90,12 +90,12 @@
       puppet_gem_version: 7.29
 
 - job:
-    name: puppet-openstack-libraries-litmus-8.5-centos-9-stream
+    name: puppet-openstack-libraries-litmus-8.10-centos-9-stream
     parent: puppet-openstack-litmus-libraries-base
     nodeset: centos-9-stream
     voting: false
     vars:
-      puppet_gem_version: 8.5
+      puppet_gem_version: 8.10
       dnf_modules:
         ruby: 3.1
 
@@ -113,10 +113,8 @@
       jobs:
         - puppet-openstack-litmus-7.29-centos-9-stream
         - puppet-openstack-litmus-7.29-ubuntu-jammy
+        - puppet-openstack-litmus-8.10-centos-9-stream
         - puppet-openstack-litmus-latest-ubuntu-jammy
     gate:
       jobs:
         - puppet-openstack-litmus-7.29-centos-9-stream
-    experimental:
-      jobs:
-        - puppet-openstack-litmus-8.5-centos-9-stream
diff --git a/zuul.d/unit.yaml b/zuul.d/unit.yaml
index 3e8ce8537..6d531b91f 100644
--- a/zuul.d/unit.yaml
+++ b/zuul.d/unit.yaml
@@ -16,12 +16,11 @@
       puppet_gem_version: 7.29
 
 - job:
-    name: puppet-openstack-unit-8.5-centos-9-stream
+    name: puppet-openstack-unit-8.10-centos-9-stream
     parent: puppet-openstack-unit-base
     nodeset: centos-9-stream
-    voting: false
     vars:
-      puppet_gem_version: 8.5
+      puppet_gem_version: 8.10
       dnf_modules:
         ruby: 3.1
 
@@ -39,9 +38,10 @@
       jobs:
         - puppet-openstack-unit-7.29-centos-9-stream
         - puppet-openstack-unit-7.29-ubuntu-jammy
-        - puppet-openstack-unit-8.5-centos-9-stream
+        - puppet-openstack-unit-8.10-centos-9-stream
         - puppet-openstack-unit-latest-ubuntu-jammy
     gate:
       jobs:
         - puppet-openstack-unit-7.29-centos-9-stream
         - puppet-openstack-unit-7.29-ubuntu-jammy
+        - puppet-openstack-unit-8.10-centos-9-stream

From 7fc8382809a826ddf072199582fc92522b25d6ec Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Fri, 14 Feb 2025 00:12:53 +0900
Subject: [PATCH 20/22] Unpin bundler in litmus

We removed the pin for the other jobs by [1].

[1] c03f2eaf7a7aa0d5a6a4e86c8dc1ebc01f2fc928

Change-Id: Ic133a697c9aa240fb5eb1b4f7e904ede010ead33
(cherry picked from commit 177c53a2cc6c6d64fe5e94d2bdd4fca343e8760b)
(cherry picked from commit 4e9e1e6ed9117155b6777d82052d31ea7c7ca87f)
---
 playbooks/run-litmus-tests.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/playbooks/run-litmus-tests.yaml b/playbooks/run-litmus-tests.yaml
index 5ae818091..c54cde033 100644
--- a/playbooks/run-litmus-tests.yaml
+++ b/playbooks/run-litmus-tests.yaml
@@ -20,7 +20,6 @@
           export GEM_BIN_DIR=$GEM_HOME/bin
           ruby <<EOF
           cmd = 'gem install bundler --no-document --verbose --no-user-install --bindir=${GEM_BIN_DIR}'
-          cmd += ' -v 2.2.11'
           system(cmd)
           EOF
           $GEM_BIN_DIR/bundle config set --local without system_tests

From 47ae381c9960c05294681d16a27399092dce1925 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Sun, 6 Apr 2025 22:50:36 +0900
Subject: [PATCH 21/22] Fix wrong command to install n-t-p

Change-Id: I88782bc32ecc6cdee47982a67dac8160112d0a3e
(cherry picked from commit a24472d3d87cc3b43bb0e83dbd368379d563c03d)
(cherry picked from commit e880c95ee09460c4e9619604d53291bbe3b92695)
---
 run_tests.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/run_tests.sh b/run_tests.sh
index 48aa7ec2f..5c8adf902 100755
--- a/run_tests.sh
+++ b/run_tests.sh
@@ -367,7 +367,7 @@ if [ "${TEMPEST_FROM_SOURCE,,}" = true ]; then
     fi
     pushd /tmp/openstack/neutron-tempest-plugin
     /tmp/openstack/tempest/run_tempest/bin/pip3 install -c https://opendev.org/openstack/requirements/raw/branch/master/upper-constraints.txt -U -r requirements.txt
-    /tmp/openstack/tempest/run_tempest/bin/pip3 setup.py install
+    /tmp/openstack/tempest/run_tempest/bin/python3 setup.py install
     popd
 
     run_tempest/bin/pip3 install os-testr

From 3882cb49602566933fcb51d6f0bfffc7cbb4ab9e Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <kajinamit@oss.nttdata.com>
Date: Wed, 25 Feb 2026 22:24:43 +0900
Subject: [PATCH 22/22] Install libffi package

... to fix the failure during installing fiddle.

Also fix Redis idempotency.

Change-Id: I90644b6f03208fb0e41f18bf53b89281af764aaf
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
Signed-off-by: Tobias Urdin <tobias.urdin@binero.com>
(cherry picked from commit faeb9c58bfec2ffc53328e771be7fae89f32d70f)
(cherry picked from commit b167ca32792577b4c1b0ff5161d283180ac25acf)
(cherry picked from commit 05ead8b0dabca26068dcc7889e3a9ebb3c3cc0c3)
(cherry picked from commit 353a4224b1b5b8e1a319fd9df6c9a9633addb5b2)
---
 Puppetfile                         |  5 +++--
 manifests/ssl_key.pp               | 10 +++++-----
 playbooks/prepare-node-common.yaml |  3 +++
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/Puppetfile b/Puppetfile
index 6bdc9944d..dbdee58e0 100644
--- a/Puppetfile
+++ b/Puppetfile
@@ -184,7 +184,7 @@ mod 'memcached',
 
 mod 'dns',
   :git => 'https://github.com/theforeman/puppet-dns',
-  :ref => '10.3.0'
+  :ref => '12.1.0'
 
 mod 'archive',
   :git => 'https://github.com/voxpupuli/puppet-archive',
@@ -200,7 +200,8 @@ mod 'ssh_keygen',
 
 mod 'redis',
   :git => 'https://github.com/voxpupuli/puppet-redis',
-  :ref => 'v10.0.0'
+  # NOTE(tkajinam): Temporal bump to fix broken idempotency
+  :ref => '27a95724b0a9597bbd9a314a96ff47da7eaaac18'
 
 mod 'systemd',
   :git => 'https://github.com/voxpupuli/puppet-systemd',
diff --git a/manifests/ssl_key.pp b/manifests/ssl_key.pp
index 31cad59e5..3a5296468 100644
--- a/manifests/ssl_key.pp
+++ b/manifests/ssl_key.pp
@@ -26,14 +26,14 @@
   if $key_path == undef {
     file { "/etc/${name}/ssl":
       ensure                  => directory,
-      owner                   => $name,
-      mode                    => '0775',
+      owner                   => $key_owner,
+      mode                    => '0750',
       selinux_ignore_defaults => true,
     }
     file { "/etc/${name}/ssl/private":
       ensure                  => directory,
-      owner                   => $name,
-      mode                    => '0755',
+      owner                   => $key_owner,
+      mode                    => '0750',
       require                 => File["/etc/${name}/ssl"],
       selinux_ignore_defaults => true,
       before                  => File[$_key_path]
@@ -45,6 +45,6 @@
     owner                   => $key_owner,
     source                  => "puppet:///modules/openstack_integration/ipv${openstack_integration::config::ip_version}.key",
     selinux_ignore_defaults => true,
-    mode                    => '0600',
+    mode                    => '0640',
   }
 }
diff --git a/playbooks/prepare-node-common.yaml b/playbooks/prepare-node-common.yaml
index 7f39d55dd..289d7ea62 100644
--- a/playbooks/prepare-node-common.yaml
+++ b/playbooks/prepare-node-common.yaml
@@ -44,6 +44,7 @@
           - zlib-devel
           - langpacks-en
           - glibc-langpack-en
+          - libffi-devel
 
       when:
         - ansible_os_family == 'RedHat'
@@ -73,6 +74,7 @@
         - libxslt-dev
         - ruby-dev
         - zlib1g-dev
+        - libffi-dev
         - python3-pip
 
     - name: Install Ruby dependencies (Debian)
@@ -88,4 +90,5 @@
         - libxslt1-dev
         - ruby-dev
         - zlib1g-dev
+        - libffi-dev
         - python3-pip