Conversation
Pass certificate and CA material through existing charm configuration. Keep the private key routed through the Juju secret mapping. Expose supported generic certificate and TLS-enable options through the existing model-generated CLI, manifest, and Terraform path. Describe Nimble certificate input as PEM bundle content and cover public, secret, boolean, and path placement across backends. Depends-On: canonical/snap-cinder-volume#97 Depends-On: https://review.opendev.org/c/openstack/sunbeam-charms/+/1001791 Partial-Bug: #2161732 Assisted-By: Codex (gpt-5-6-sol) Signed-off-by: Guillaume Boutry <guillaume.boutry@canonical.com>
Collaborator
Author
|
This change is a bit far-reaching, but aligning on actually declared options from the cinder drivers on 2026.1 This test has been tested end-to-end using: With the following manifest: core:
software:
charms:
cinder-volume:
channel: 2026.1/edge
config:
snap-channel: 2026.1/edge/lp2161732
cinder-volume-ceph:
channel: 2026.1/edge
cinder-k8s:
channel: 2026.1/edge
glance-k8s:
channel: 2026.1/edge
horizon-k8s:
channel: 2026.1/edge
keystone-k8s:
channel: 2026.1/edge
neutron-k8s:
channel: 2026.1/edge
nova-k8s:
channel: 2026.1/edge
openstack-hypervisor:
channel: 2026.1/edge
config:
snap-channel: 2026.1/edge
placement-k8s:
channel: 2026.1/edge
sunbeam-clusterd:
channel: 2026.1/edge
config:
snap-channel: 2026.1/edge
sunbeam-machine:
channel: 2026.1/edge
epa-orchestrator:
channel: 2026.1/edge
microceph:
channel: squid/stable
config:
snap-channel: squid/stable
microovn:
channel: 26.03/stable
openstack-network-agents:
channel: 2026.1/edge
config:
snap-channel: 2026.1/edge
microcluster-token-distributor:
channel: v1/stable
role-distributor:
channel: latest/stable
sunbeam-ovn-proxy:
channel: 2026.1/edge
mysql-k8s:
channel: 8.0/beta
storage:
database: 4G
mysql-router-k8s:
channel: 8.0/candidate
juju:
bootstrap_args:
- --bootstrap-constraints
- root-disk=10G
- --config
- caas-image-repo=ghcr.io/juju
config:
proxy:
# Configure proxy for access to external network resources?
proxy_required: false
# Enter value for http_proxy:
http_proxy:
# Enter value for https_proxy:
https_proxy:
# Enter value for no_proxy:
no_proxy:
region: LizardTwo
database: single
bootstrap:
# Management CIDRs shared by the hosts (separated by comma)
management_cidr: 192.168.98.0/24
k8s-addons:
loadbalancer: 192.168.98.230-192.168.98.254
user:
# Populate OpenStack cloud with demo user, default images, flavors etc
run_demo_setup: True
# Username to use for access to OpenStack
username: gtestos
# Password to use for access to OpenStack
password: demo
# Network range to use for project network
cidr: 192.168.122.0/24
# List of nameservers guests should use for DNS resolution
nameservers: 192.168.98.2
# Enable ping and SSH access to instances?
security_group_rules: True
# Local or remote access to VMs
remote_access_location: remote
physnet: physnet1
external-networks:
physnet1:
# CIDR of network to use for external networking (computebr10)
cidr: 10.20.30.0/24
# IP address of default gateway for external network
gateway: 10.20.30.1
# Start of IP allocation range for external network
range: 10.20.30.2-10.20.30.254
# Network type for access to external network
network_type: flat
# VLAN ID to use for external network
# segmentation_id:
# Free network interface that will be configured for external traffic
nics:
bm0.res: enp6s0
# MicroCeph config
endpoints:
ingress-internal:
ip: 192.168.98.234
hostname: internal.sunbeam.res
ingress-public:
ip: 192.168.98.233
hostname: public.sunbeam.res
ingress-rgw:
ip: 192.168.98.235
hostname: s3.sunbeam.res
microceph_config:
bm0.res:
osd_devices: /dev/disk/by-id/scsi-SQEMU_QEMU_HARDDISK_lxd_bm0_osd0,/dev/disk/by-id/scsi-SQEMU_QEMU_HARDDISK_lxd_bm0_osd1,/dev/disk/by-id/scsi-SQEMU_QEMU_HARDDISK_lxd_bm0_osd2
features:
baremetal:
software:
charms:
ironic-conductor-k8s:
channel: 2026.1/edge
ironic-k8s:
channel: 2026.1/edge
nova-ironic-k8s:
channel: 2026.1/edge
neutron-baremetal-switch-config-k8s:
channel: 2026.1/edge
neutron-generic-switch-config-k8s:
channel: 2026.1/edge
caas:
software:
charms:
magnum-k8s:
channel: 2026.1/edge
dns:
software:
charms:
designate-bind-k8s:
channel: 9/edge
designate-k8s:
channel: 2026.1/edge
images-sync:
software:
charms:
openstack-images-sync-k8s:
channel: 2026.1/edge
instance-recovery:
software:
charms:
consul-k8s:
channel: 1.19/edge
consul-client:
channel: 1.19/edge
masakari-k8s:
channel: 2026.1/edge
ldap:
software:
charms:
keystone-ldap-k8s:
channel: 2026.1/edge
loadbalancer:
software:
charms:
multus:
channel: latest/stable
octavia-k8s:
channel: 2026.1/edge
openstack-port-cni-k8s:
channel: 2026.1/edge
orchestration:
software:
charms:
heat-k8s:
channel: 2026.1/edge
resource-optimization:
software:
charms:
watcher-k8s:
channel: 2026.1/edge
shared-filesystem:
software:
charms:
manila-k8s:
channel: 2026.1/edge
manila-cephfs-k8s:
channel: 2026.1/edge
manila-data:
channel: 2026.1/edge
secrets:
software:
charms:
barbican-k8s:
channel: 2026.1/edge
telemetry:
software:
charms:
aodh-k8s:
channel: 2026.1/edge
ceilometer-k8s:
channel: 2026.1/edge
gnocchi-k8s:
channel: 2026.1/edge
openstack-exporter-k8s:
channel: 2026.1/edge
validation:
software:
charms:
tempest-k8s:
channel: 2026.1/edge
storage:
netapp:
inst1:
software:
charms:
cinder-volume-netapp:
channel: 2026.1/edge/lp2161732 |
hemanthnakkina
approved these changes
Aug 24, 2026
hemanthnakkina
left a comment
hemanthnakkina
left a comment
Collaborator
There was a problem hiding this comment.
LGTM, waiting for charm change to land
hmlanigan
reviewed
Aug 31, 2026
hmlanigan
left a comment
hmlanigan
left a comment
There was a problem hiding this comment.
Please update the jira work item link to appropriate one.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pass certificate and CA material through existing charm configuration. Keep the private key routed through the Juju secret mapping.
Partial-bug: #2161732
Assisted-By: Codex (gpt-5-6-sol)
QA steps
Deploy NetApp backend with certificates.
Links
Jira card: OPEN-4680