diff --git a/coriolis/tests/integration/keystone_utils.py b/coriolis/tests/integration/keystone_utils.py
index 18e6fb3b..c304afe3 100644
--- a/coriolis/tests/integration/keystone_utils.py
+++ b/coriolis/tests/integration/keystone_utils.py
@@ -31,7 +31,7 @@
# kolla publishes the official Keystone images that kolla-ansible deploys in
# production OpenStack.
-KEYSTONE_IMAGE = "quay.io/openstack.kolla/keystone:2024.1-ubuntu-noble"
+KEYSTONE_IMAGE = "quay.io/openstack.kolla/keystone:2026.1-ubuntu-noble"
# Project / domain / role name used to bootstrap Keystone for this session.
PROJECT_NAME = 'integration-project'
@@ -53,39 +53,43 @@
sleep 5
done
-exec /usr/sbin/apache2 -DFOREGROUND
+exec /var/lib/kolla/venv/bin/uwsgi --ini /etc/keystone/keystone-uwsgi.ini
"""
-_WSGI_CONF = """
-Listen 0.0.0.0:5000
-
-ServerSignature Off
-ServerTokens Prod
-TraceEnable off
-
-ErrorLog "/var/log/kolla/keystone/apache-error.log"
-
- CustomLog "/var/log/kolla/keystone/apache-access.log" common
-
-
-
-
- AllowOverride None
- Options None
- Require all granted
-
-
-
-
- WSGIDaemonProcess keystone-public processes=2 threads=1 \
-user=keystone group=keystone display-name=keystone-public
- WSGIProcessGroup keystone-public
- WSGIScriptAlias / /var/lib/kolla/venv/bin/keystone-wsgi-public
- WSGIApplicationGroup %{GLOBAL}
- WSGIPassAuthorization On
- ErrorLog "/var/log/kolla/keystone/keystone-apache-public-error.log"
- CustomLog "/var/log/kolla/keystone/keystone-apache-public-access.log" common
-
+# Keystone 2026.1 (and its kolla image) dropped Apache in favour of uWSGI, which
+# Keystone ships configuration for itself ("httpd/keystone-uwsgi-public.ini" in
+# the source tree).
+_UWSGI_INI = """
+[uwsgi]
+module = keystone.wsgi.api:application
+
+http = 0.0.0.0:5000
+
+# By default, the uWSGI http router closes the connection after every response
+# without announcing it, so clients that pool connections (python requests, used by
+# keystoneauth1) reuse a closed socket and fail with "Connection reset by peer" or
+# "Remote end closed connection without response". Enable proper keep-alive.
+http-keepalive = 1
+http-auto-chunked = true
+add-header = Connection: Keep-Alive
+
+# Keystone tokens and catalog documents are large; the 4k default is too small.
+buffer-size = 65535
+
+master = true
+processes = 2
+threads = 4
+enable-threads = true
+
+# This ensures that file descriptors aren't shared between keystone processes.
+lazy-apps = true
+
+# Recommended by uWSGI to avoid a thundering herd on accept.
+thunder-lock = true
+
+# "docker stop" sends SIGTERM, which uWSGI otherwise treats as a request to
+# gracefully reload, leaving the master running until the stop timeout expires.
+die-on-term = true
"""
@@ -213,13 +217,13 @@ def _write_config_files(self):
with open(os.path.join(config_dir, "keystone.conf"), "w") as f:
f.write(keystone_conf)
- with open(os.path.join(config_dir, "wsgi-keystone.conf"), "w") as f:
- f.write(_WSGI_CONF)
+ with open(os.path.join(config_dir, "keystone-uwsgi.ini"), "w") as f:
+ f.write(_UWSGI_INI)
with open(os.path.join(config_dir, "keystone-startup.sh"), "w") as f:
f.write(_STARTUP_SH)
# Its only purpose is to force kolla_set_configs to create the
- # /var/log/kolla/keystone directory that Apache logs into (it only
+ # /var/log/kolla/keystone directory that Keystone logs into (it only
# creates parent directories of "config_files" destinations).
with open(os.path.join(config_dir, "log_dir_placeholder"), "w"):
pass
@@ -240,8 +244,8 @@ def _write_config_files(self):
"perm": "0600",
},
{
- "source": "/var/lib/kolla/config_files/wsgi-keystone.conf",
- "dest": "/etc/apache2/conf-enabled/wsgi-keystone.conf",
+ "source": "/var/lib/kolla/config_files/keystone-uwsgi.ini",
+ "dest": "/etc/keystone/keystone-uwsgi.ini",
"owner": "root",
"perm": "0644",
},