Merge pull request #1464 from rackerlabs/alter-auth

chore: update mod_auth_openidc and use the ansible container by default to setup keystone

Author: cardoe

ansible/keystone_bootstrap.yaml ansible/keystone-post-deploy.yamlansible/keystone_bootstrap.yaml renamed to ansible/keystone-post-deploy.yaml

@@ -5,7 +5,7 @@ images:
 
   tags:
     # these are common across all these OpenStack Helm installations
-    bootstrap: "quay.io/airshipit/heat:2025.2-ubuntu_jammy"
+    bootstrap: "ghcr.io/rackerlabs/understack/ansible:latest"
     db_init: "quay.io/airshipit/heat:2025.2-ubuntu_jammy"
     db_drop: "quay.io/airshipit/heat:2025.2-ubuntu_jammy"
     ks_user: "quay.io/airshipit/heat:2025.2-ubuntu_jammy"

components/images-openstack.yaml

@@ -2,15 +2,11 @@
 ---
 release_group: null
 
-images:
-  tags:
-    bootstrap: "ghcr.io/rackerlabs/understack/ansible:latest"
-
 bootstrap:
   enabled: true
   ks_user: admin
   script: |
-    ansible-runner run /runner --playbook keystone_bootstrap.yaml -vv
+    ansible-runner run /runner --playbook keystone-post-deploy.yaml -vv
 
 network:
   # configure OpenStack Helm to use Undercloud's ingress

components/keystone/values.yaml

@@ -3,9 +3,12 @@
 ARG OPENSTACK_VERSION="required_argument"
 FROM quay.io/airshipit/keystone:${OPENSTACK_VERSION}-ubuntu_jammy
 
-ADD --checksum=sha256:deb52ea8304a41ee0331e4ba87a9f82ff643464b6d34084e161f58ec11c25a69 https://github.com/OpenIDC/mod_auth_openidc/releases/download/v2.4.16.5/libapache2-mod-auth-openidc_2.4.16.5-1.jammy_amd64.deb /tmp
+# renovate: datasource=github-releases depName=OpenIDC/mod_auth_openidc
+ARG MOD_AUTH_OPENIDC_VERSION=2.4.16.11
+ARG MOD_AUTH_OPENIDC_SHA256=f5b8751fe2dc7e249c8bf0f7b376cecf90427ba8ba280f18f850fc658047f091
+ADD --checksum=sha256:${MOD_AUTH_OPENIDC_SHA256} https://github.com/OpenIDC/mod_auth_openidc/releases/download/v${MOD_AUTH_OPENIDC_VERSION}/libapache2-mod-auth-openidc_${MOD_AUTH_OPENIDC_VERSION}-1.jammy_amd64.deb /tmp
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
-        /tmp/libapache2-mod-auth-openidc_2.4.16.5-1.jammy_amd64.deb \
+        /tmp/libapache2-mod-auth-openidc_${MOD_AUTH_OPENIDC_VERSION}-1.jammy_amd64.deb \
     && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/*.deb