Misc 2026-related fixes

[Alex-Welsh]

Rebuilt all kolla images, should be closer to getting check-review working. Now using OVN 26.03 🎉
Bumped the kayobe pin, there's also some kolla changes required to get images building, but I'm hoping to just get them merged upstream and synced to our fork.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2acabee6-722b-41f3-8462-bb21483f8f17

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Rebuilt Rocky Kolla images for 2026.1 and updated image tags. Enabled RPM repository build_only settings and refreshed package repository versions. Added Grafana and OpenSearch Dashboards vulnerability exceptions. Bumped the Kayobe dependency to include an inventory fix.

Walkthrough

The change refreshes Kolla image and repository configuration, updates Pulp repository versions, adds two Trivy vulnerability allowlists, and pins Kayobe to a new commit.

Changes

Kolla content refresh

Layer / File(s)	Summary
Image and repository configuration etc/kayobe/kolla-image-tags.yml, etc/kayobe/kolla/repos.yaml	The Rocky Linux 10 OpenStack image tag changed. Several Rocky Linux 10 image entries were removed. Ubuntu repositories now use lowercase trusted: true. Configured repositories now use build_only: true.
Pulp repository versions etc/kayobe/pulp-repo-versions.yml	Repository version timestamps changed. Grafana APT and Ubuntu Noble Fluent version entries were added.
Vulnerability and dependency updates etc/kayobe/trivy/allowed-vulnerabilities.yml, requirements.txt	Grafana and OpenSearch Dashboards vulnerability allowlists were added. The pinned Kayobe commit changed.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• stackhpc/stackhpc-kayobe-config#2454: Updates the same Kolla and Trivy configuration areas.
• stackhpc/stackhpc-kayobe-config#2499: Modifies overlapping Kolla image tag and repository definitions.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 0d242632-21bb-404c-a3f2-1d28e3793d87

📥 Commits

Reviewing files that changed from the base of the PR and between 4fd9e9b and 1c3a776.

📒 Files selected for processing (5)

• etc/kayobe/kolla-image-tags.yml
• etc/kayobe/kolla/repos.yaml
• etc/kayobe/pulp-repo-versions.yml
• etc/kayobe/trivy/allowed-vulnerabilities.yml
• requirements.txt

📜 Review details

⏰ Context from checks skipped due to timeout. (3)

• GitHub Check: stackhpc/check
• GitHub Check: Ansible 2.19 lint with Python 3.12
• GitHub Check: Ansible 2.20 lint with Python 3.12

🧰 Additional context used

🧠 Learnings (1)

📚 Learning: 2026-07-27T12:28:31.134Z

Learnt from: seunghun1ee
Repo: stackhpc/stackhpc-kayobe-config PR: 2454
File: etc/kayobe/pulp.yml:566-568
Timestamp: 2026-07-27T12:28:31.134Z
Learning: For `etc/kayobe/stackhpc.yml`, the configured Kolla-Ansible source `stackhpc/kolla-ansiblestackhpc/2026.1` no longer defines or deploys InfluxDB and does not contain `kolla_enable_influxdb`. InfluxDB should not be required in `etc/kayobe/pulp.yml` `stackhpc_pulp_images_kolla`; a remaining `kolla_enable_influxdb` setting in ci-builder configuration is obsolete and does not enable a deployable service.

Applied to files:

• etc/kayobe/pulp-repo-versions.yml

🪛 OSV Scanner (2.4.0)

requirements.txt

[MEDIUM] 1-1: idna 3.9.0: undefined

(PYSEC-2026-215)

---

[MEDIUM] 1-1: idna 3.9.0: Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

(GHSA-65pc-fj4g-8rjx)

---

[MEDIUM] 1-1: requests 2.32.5: undefined

(PYSEC-2026-2275)

---

[MEDIUM] 1-1: requests 2.32.5: Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

(GHSA-gc5v-m9x4-r6x2)

🔇 Additional comments (5)

etc/kayobe/trivy/allowed-vulnerabilities.yml (1)

30-32: 🔒 Security & Privacy

Provide scan evidence and removal tracking for both exceptions.

The script scopes these identifiers to the grafana and opensearch_dashboards images. Add scan evidence for each finding and a removal condition for CVE-2026-59873. Remove each exception when its image contains the fixed package version.

requirements.txt (1)

1-1: 🔒 Security & Privacy

Document transitive dependency reachability before merging.

requirements.txt and Kayobe’s pinned requirements do not declare idna or requests. Kayobe has no direct calls to idna.encode or requests.utils.extract_zipped_paths. Establish the installed dependency graph and document whether another dependency reaches either API.

etc/kayobe/kolla-image-tags.yml (1)

7-20: LGTM!

etc/kayobe/kolla/repos.yaml (1)

30-119: LGTM!

Also applies to: 126-126

etc/kayobe/pulp-repo-versions.yml (1)

4-6: LGTM!

Also applies to: 9-10, 13-19, 22-25, 28-36, 40-49

[seunghun1ee]

Testing check-review

[Alex-Welsh]

Alright, I think I'm done with this thing

[mnasiadka]

LGTM