From c2ac4cd0fc30716899db41c46d4bea4f55b7f83f Mon Sep 17 00:00:00 2001
From: saadtariq <saad@stackhpc.com>
Date: Thu, 8 Oct 2026 17:05:04 +0100
Subject: [PATCH 01/17] feat(ci-multinode): move the VXLAN mesh on a Linux
 bridge

---
 etc/kayobe/environments/ci-multinode/networks.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/etc/kayobe/environments/ci-multinode/networks.yml b/etc/kayobe/environments/ci-multinode/networks.yml
index 59d3760b9d..557b62d0c8 100644
--- a/etc/kayobe/environments/ci-multinode/networks.yml
+++ b/etc/kayobe/environments/ci-multinode/networks.yml
@@ -38,7 +38,8 @@ internal_net_name: internal
 # If external_net_name is defined, external_net_names will default to a list
 # containing one item, external_net_name.
 #external_net_names:
-external_net_names: []
+external_net_names:
+  - vxlan_mesh
 
 # Name of the network used to expose the public OpenStack API endpoints.
 public_net_name: public
@@ -131,6 +132,13 @@ provision_oc_allocation_pool_end: 192.168.33.254
 provision_oc_vlan: 107
 provision_oc_zone: "provision_oc"
 
+# Linux bridge carrying the VXLAN mesh. Without the bridge the
+# host will claim the packet and drop if not addressed to its listener.
+# A bridge is needed to flood the packet to both the OS and the OVS
+vxlan_mesh_bridge_ports: "{{ [vxlan_interfaces[0].device] }}"
+vxlan_mesh_bootproto: manual
+vxlan_mesh_mtu: "{{ ansible_facts.default_ipv4.mtu - 50 }}"
+
 ###############################################################################
 # Network virtual patch link configuration.
 

From 79a3864fe91e10f9082a7fbe70124d57cf009145 Mon Sep 17 00:00:00 2001
From: saadtariq <saad@stackhpc.com>
Date: Thu, 8 Oct 2026 17:05:55 +0100
Subject: [PATCH 02/17] feat(ci-multinode): point subinterfaces to the new
 linux bridge as their interface

---
 .../inventory/group_vars/compute/network-interfaces  | 10 +++++++---
 .../group_vars/controllers/network-interfaces        | 12 ++++++++----
 .../environments/ci-multinode/kolla/globals.yml      |  7 -------
 3 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/etc/kayobe/environments/ci-multinode/inventory/group_vars/compute/network-interfaces b/etc/kayobe/environments/ci-multinode/inventory/group_vars/compute/network-interfaces
index 96c6f15c35..8a62a0d063 100644
--- a/etc/kayobe/environments/ci-multinode/inventory/group_vars/compute/network-interfaces
+++ b/etc/kayobe/environments/ci-multinode/inventory/group_vars/compute/network-interfaces
@@ -4,11 +4,15 @@
 
 admin_oc_interface: "{{ ansible_facts.default_ipv4.interface }}"
 
-internal_interface: "{{ vxlan_interfaces[0].device }}.{{ internal_vlan }}"
+# Linux bridge containing the VXLAN mesh device. Open vSwitch reaches the mesh
+# through a veth pair from this bridge, so the host and Neutron both get frames.
+vxlan_mesh_interface: br-vxlan
 
-storage_interface: "{{ vxlan_interfaces[0].device }}.{{ storage_vlan }}"
+internal_interface: "{{ vxlan_mesh_interface }}.{{ internal_vlan }}"
 
-tunnel_interface: "{{ vxlan_interfaces[0].device }}.{{ tunnel_vlan }}"
+storage_interface: "{{ vxlan_mesh_interface }}.{{ storage_vlan }}"
+
+tunnel_interface: "{{ vxlan_mesh_interface }}.{{ tunnel_vlan }}"
 
 ###############################################################################
 # Dummy variable to allow Ansible to accept this file.
diff --git a/etc/kayobe/environments/ci-multinode/inventory/group_vars/controllers/network-interfaces b/etc/kayobe/environments/ci-multinode/inventory/group_vars/controllers/network-interfaces
index 7df8bec280..d15b42a9c3 100644
--- a/etc/kayobe/environments/ci-multinode/inventory/group_vars/controllers/network-interfaces
+++ b/etc/kayobe/environments/ci-multinode/inventory/group_vars/controllers/network-interfaces
@@ -4,13 +4,17 @@
 
 admin_oc_interface: "{{ ansible_facts.default_ipv4.interface }}"
 
-internal_interface: "{{ vxlan_interfaces[0].device }}.{{ internal_vlan }}"
+# Linux bridge containing the VXLAN mesh device. Open vSwitch reaches the mesh
+# through a veth pair from this bridge, so the host and Neutron both get frames.
+vxlan_mesh_interface: br-vxlan
 
-storage_interface: "{{ vxlan_interfaces[0].device }}.{{ storage_vlan }}"
+internal_interface: "{{ vxlan_mesh_interface }}.{{ internal_vlan }}"
 
-tunnel_interface: "{{ vxlan_interfaces[0].device }}.{{ tunnel_vlan }}"
+storage_interface: "{{ vxlan_mesh_interface }}.{{ storage_vlan }}"
 
-public_interface: "{{ vxlan_interfaces[0].device }}.{{ public_vlan }}"
+tunnel_interface: "{{ vxlan_mesh_interface }}.{{ tunnel_vlan }}"
+
+public_interface: "{{ vxlan_mesh_interface }}.{{ public_vlan }}"
 
 public_routes:
   - cidr: "{{ external_cidr }}"
diff --git a/etc/kayobe/environments/ci-multinode/kolla/globals.yml b/etc/kayobe/environments/ci-multinode/kolla/globals.yml
index fd57398aed..875f72191e 100644
--- a/etc/kayobe/environments/ci-multinode/kolla/globals.yml
+++ b/etc/kayobe/environments/ci-multinode/kolla/globals.yml
@@ -35,13 +35,6 @@ cinder_backend_ceph: "yes"
 # Nova Ceph configuration
 nova_backend_ceph: "yes"
 
-# Because this is a vxlan interface, Kayobe can't generate the config for it.
-# Therefore we can't use this interface as the external network
-# (external_net_names). Instead, make external_net_names an empty
-# list, and add the config that would be generated from it here.
-neutron_bridge_name: "{{ vxlan_interfaces[0].device }}-ovs"
-neutron_external_interface: "{{ vxlan_interfaces[0].device }}"
-
 neutron_dns_domain: "{{ root_domain }}."
 
 # OpenSearch memory tuning

From 9b7ac5c7b8a9162e95d8deb9d96d17d195d9f1c2 Mon Sep 17 00:00:00 2001
From: saadtariq <saad@stackhpc.com>
Date: Fri, 9 Oct 2026 15:29:22 +0100
Subject: [PATCH 03/17] fix(ci-multinode): Make StackHPC.vxlan role do the
 enslavement of the mesh device so that it is treated as a VXLAN instead of an
 ethernet port

---
 .../ci-multinode/inventory/group_vars/all/vxlan.yml         | 3 +++
 etc/kayobe/environments/ci-multinode/networks.yml           | 6 ++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/etc/kayobe/environments/ci-multinode/inventory/group_vars/all/vxlan.yml b/etc/kayobe/environments/ci-multinode/inventory/group_vars/all/vxlan.yml
index fe92c42a09..ca788fc3e2 100644
--- a/etc/kayobe/environments/ci-multinode/inventory/group_vars/all/vxlan.yml
+++ b/etc/kayobe/environments/ci-multinode/inventory/group_vars/all/vxlan.yml
@@ -16,3 +16,6 @@ vxlan_vni:
 vxlan_interfaces:
   - device: "vxlan{{ vxlan_vni }}"
     group: "{{ '239.0.0.0/8' | ansible.utils.next_nth_usable(vxlan_vni) }}"
+    # Enslave the mesh to the bridge here, so the role owns the one connection
+    # profile for this device and Kayobe does not overwrite it as an ethernet.
+    bridge: br-vxlan
diff --git a/etc/kayobe/environments/ci-multinode/networks.yml b/etc/kayobe/environments/ci-multinode/networks.yml
index 557b62d0c8..6266bb4b9d 100644
--- a/etc/kayobe/environments/ci-multinode/networks.yml
+++ b/etc/kayobe/environments/ci-multinode/networks.yml
@@ -134,8 +134,10 @@ provision_oc_zone: "provision_oc"
 
 # Linux bridge carrying the VXLAN mesh. Without the bridge the
 # host will claim the packet and drop if not addressed to its listener.
-# A bridge is needed to flood the packet to both the OS and the OVS
-vxlan_mesh_bridge_ports: "{{ [vxlan_interfaces[0].device] }}"
+# A bridge is needed to flood the packet to both the OS and the OVS.
+# Empty ports because stackhpc.vxlan does the enslaving via its bridge option.
+# We dont want MichaelRigart's role to overwrite the Network Manager's VXLAN handling
+vxlan_mesh_bridge_ports: []
 vxlan_mesh_bootproto: manual
 vxlan_mesh_mtu: "{{ ansible_facts.default_ipv4.mtu - 50 }}"
 

From c013411b80d9a207925a32c599629ee2af619ebb Mon Sep 17 00:00:00 2001
From: saadtariq <saad@stackhpc.com>
Date: Fri, 9 Oct 2026 16:00:10 +0100
Subject: [PATCH 04/17] fix(ci-multinode): Create the VXLAN bridge before
 enslaving the mesh so it does not error out on a bridge not exisiting

---
 etc/kayobe/ansible/tools/configure-vxlan.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/etc/kayobe/ansible/tools/configure-vxlan.yml b/etc/kayobe/ansible/tools/configure-vxlan.yml
index 0101b1ce1d..831cce7ccc 100644
--- a/etc/kayobe/ansible/tools/configure-vxlan.yml
+++ b/etc/kayobe/ansible/tools/configure-vxlan.yml
@@ -9,5 +9,25 @@
     ansible_python_interpreter: /usr/bin/python3
     # Work around no known_hosts entry on first boot.
     ansible_ssh_common_args: -o StrictHostKeyChecking=no
+  pre_tasks:
+    # stackhpc.vxlan connects VXLAN to a master when an interface
+    # is of the 'bridge' type, but Network Manager cannot attach the device
+    # before the bridge exists. Kayobe creates the bridge later, so we will create it here
+    # and have Kayobe overwrite it later as needed
+    - name: Get existing NetworkManager connections
+      ansible.builtin.command: nmcli -g NAME connection show
+      become: true
+      changed_when: false
+      register: vxlan_nm_connections
+
+    - name: Ensure a bridge exists for each VXLAN interface that needs one
+      ansible.builtin.command:
+        cmd: >-
+          nmcli connection add type bridge
+          con-name {{ item.bridge }} ifname {{ item.bridge }}
+          stp no ipv4.method disabled ipv6.method disabled
+      become: true
+      loop: "{{ vxlan_interfaces | selectattr('bridge', 'defined') | list }}"
+      when: item.bridge not in vxlan_nm_connections.stdout_lines
   roles:
     - role: stackhpc.vxlan

From d5a9ca7448ed1adf064c38d4888402c195a42afc Mon Sep 17 00:00:00 2001
From: saadtariq <saad@stackhpc.com>
Date: Mon, 12 Oct 2026 16:03:50 +0100
Subject: [PATCH 05/17] feat(ci-multinode): All related setup for the amphora
 driver for Octavia on OVS

---
 .../environments/ci-multinode/controllers.yml |  4 ++
 .../environments/ci-multinode/globals.yml     |  4 ++
 .../group_vars/controllers/network-interfaces |  5 +++
 .../ci-multinode/kolla/config/octavia.conf    |  5 +++
 .../ci-multinode/kolla/globals.yml            | 41 +++++++++++++++----
 .../environments/ci-multinode/networks.yml    | 14 +++++++
 .../environments/ci-multinode/stackhpc-ci.yml |  4 ++
 7 files changed, 70 insertions(+), 7 deletions(-)
 create mode 100644 etc/kayobe/environments/ci-multinode/kolla/config/octavia.conf

diff --git a/etc/kayobe/environments/ci-multinode/controllers.yml b/etc/kayobe/environments/ci-multinode/controllers.yml
index 173bcc3714..d0361b342f 100644
--- a/etc/kayobe/environments/ci-multinode/controllers.yml
+++ b/etc/kayobe/environments/ci-multinode/controllers.yml
@@ -5,6 +5,10 @@ controller_bootstrap_user: "{{ os_distribution if os_distribution == 'ubuntu' el
 controller_lvm_groups:
   - "{{ stackhpc_lvm_group_rootvg }}"
 
+# Octavia management network, for the health manager to receive amphora
+# heartbeats. OVN provider driver needs no management network.
+controller_extra_network_interfaces: "{{ ['lb_mgmt'] if not kolla_enable_ovn | bool else [] }}"
+
 
 ###############################################################################
 # Controller node firewalld configuration.
diff --git a/etc/kayobe/environments/ci-multinode/globals.yml b/etc/kayobe/environments/ci-multinode/globals.yml
index 0976d362c7..e3035f9039 100644
--- a/etc/kayobe/environments/ci-multinode/globals.yml
+++ b/etc/kayobe/environments/ci-multinode/globals.yml
@@ -60,6 +60,10 @@ os_release: >-
 stackhpc_write_barbican_role_id_to_file: true
 stackhpc_barbican_role_id_file_path: "/tmp/barbican-role-id"
 
+# Trust store for Kayobe's own playbooks. The Octavia amphora image
+# register playbook cannot verify Glance's TLS certificate without this.
+openstack_cacert: "{{ '/etc/pki/tls/certs/ca-bundle.crt' if os_distribution == 'rocky' else '/etc/ssl/certs/ca-certificates.crt' }}"
+
 # Enable rebooting to update SELinux state
 selinux_do_reboot: true
 
diff --git a/etc/kayobe/environments/ci-multinode/inventory/group_vars/controllers/network-interfaces b/etc/kayobe/environments/ci-multinode/inventory/group_vars/controllers/network-interfaces
index d15b42a9c3..3e3b83ffe1 100644
--- a/etc/kayobe/environments/ci-multinode/inventory/group_vars/controllers/network-interfaces
+++ b/etc/kayobe/environments/ci-multinode/inventory/group_vars/controllers/network-interfaces
@@ -16,6 +16,11 @@ tunnel_interface: "{{ vxlan_mesh_interface }}.{{ tunnel_vlan }}"
 
 public_interface: "{{ vxlan_mesh_interface }}.{{ public_vlan }}"
 
+# Octavia management network. Bridge as interface instead of mesh device
+# Open vSwitch will still see frames the host has not claimed due to
+# bridge's broadcast
+lb_mgmt_interface: "{{ vxlan_mesh_interface }}.{{ lb_mgmt_vlan }}"
+
 public_routes:
   - cidr: "{{ external_cidr }}"
     gateway: "{{ public_net_name | net_ip( groups['seed'][0] ) }}"
diff --git a/etc/kayobe/environments/ci-multinode/kolla/config/octavia.conf b/etc/kayobe/environments/ci-multinode/kolla/config/octavia.conf
new file mode 100644
index 0000000000..9402556c17
--- /dev/null
+++ b/etc/kayobe/environments/ci-multinode/kolla/config/octavia.conf
@@ -0,0 +1,5 @@
+# Amphorae boot from Ceph-backed Cinder volumes here, which can be slow, so
+# allow far longer than the five minute default for Nova to report them active.
+[controller_worker]
+amp_active_retries = 90
+amp_active_wait_sec = 10
diff --git a/etc/kayobe/environments/ci-multinode/kolla/globals.yml b/etc/kayobe/environments/ci-multinode/kolla/globals.yml
index 875f72191e..1050745ce3 100644
--- a/etc/kayobe/environments/ci-multinode/kolla/globals.yml
+++ b/etc/kayobe/environments/ci-multinode/kolla/globals.yml
@@ -17,9 +17,11 @@ rabbitmq_enable_tls: "yes"
 
 ############################################################################
 # Most development environments will use nested virtualisation, and we can't
-# guarantee that nested KVM support is available. Use QEMU as a lowest common
-# denominator.
-nova_compute_virt_type: qemu
+# guarantee that nested KVM support is available, so QEMU is the lowest common
+# denominator. However, amphorae are unusable under emulation in terms of time
+# during tempest testing and Octavia times out waiting for them to spin up
+# we require KVM when the amphora driver is in use
+nova_compute_virt_type: "{{ 'qemu' if kolla_enable_ovn | bool else 'kvm' }}"
 
 # Reduce the control plane's memory footprint by limiting the number of worker
 # processes to two per-service when running in a VM.
@@ -40,10 +42,35 @@ neutron_dns_domain: "{{ root_domain }}."
 # OpenSearch memory tuning
 opensearch_heap_size: 1g
 
-# Octavia load balancer configuration
-octavia_auto_configure: "no"
-octavia_provider_drivers: "ovn:OVN provider"
-octavia_provider_agents: "ovn"
+# Octavia load balancer configuration.
+#
+# octavia_auto_configure is not set since removing it lets kolla's own default
+# apply, which sets amphora in octavia_provider_drivers. That
+# makes it true for the amphora driver and false for the OVN driver as needed
+
+octavia_provider_drivers: "{{ 'ovn:OVN provider' if kolla_enable_ovn | bool else 'amphora:Amphora provider' }}"
+octavia_provider_agents: "{{ 'ovn' if kolla_enable_ovn | bool else 'amphora_agent' }}"
+
+# Host interface the health manager binds to. octavia.conf references this
+# unconditionally, so fall back to the internal network on OVN, which is what
+# kolla's api_interface default resolves to.
+octavia_network_interface: "{{ (octavia_net_name if not kolla_enable_ovn | bool else internal_net_name) | net_interface(groups['controllers'][0]) }}"
+
+# Management network registered by octavia_auto_configure, so only on OVS.
+octavia_amp_network:
+  name: lb-mgmt-net
+  provider_network_type: vlan
+  provider_segmentation_id: "{{ lb_mgmt_vlan }}"
+  provider_physical_network: physnet1
+  external: false
+  shared: false
+  subnet:
+    name: lb-mgmt-subnet
+    cidr: "{{ lb_mgmt_cidr }}"
+    allocation_pool_start: "{{ lb_mgmt_neutron_allocation_pool_start }}"
+    allocation_pool_end: "{{ lb_mgmt_neutron_allocation_pool_end }}"
+    no_gateway_ip: true
+    enable_dhcp: true
 
 # Manila CephFS configuration
 manila_cephfs_filesystem_name: manila-cephfs
diff --git a/etc/kayobe/environments/ci-multinode/networks.yml b/etc/kayobe/environments/ci-multinode/networks.yml
index 6266bb4b9d..82d7608057 100644
--- a/etc/kayobe/environments/ci-multinode/networks.yml
+++ b/etc/kayobe/environments/ci-multinode/networks.yml
@@ -69,6 +69,9 @@ storage_mgmt_net_name: storage_mgmt
 # hosts
 #cleaning_net_name:
 
+# Name of the network used to manage octavia loadbalancers
+octavia_net_name: lb_mgmt
+
 ###############################################################################
 # Network definitions.
 
@@ -132,6 +135,17 @@ provision_oc_allocation_pool_end: 192.168.33.254
 provision_oc_vlan: 107
 provision_oc_zone: "provision_oc"
 
+# Octavia load balancer management network. VLAN provider network on physnet1
+# reusing the existing VXLAN mesh
+lb_mgmt_cidr: 192.168.34.0/24
+lb_mgmt_mtu: "{{ ansible_facts.default_ipv4.mtu - 50 }}"
+lb_mgmt_vlan: 108
+lb_mgmt_allocation_pool_start: 192.168.34.3
+lb_mgmt_allocation_pool_end: 192.168.34.30
+lb_mgmt_neutron_allocation_pool_start: 192.168.34.100
+lb_mgmt_neutron_allocation_pool_end: 192.168.34.200
+lb_mgmt_zone: lb-mgmt
+
 # Linux bridge carrying the VXLAN mesh. Without the bridge the
 # host will claim the packet and drop if not addressed to its listener.
 # A bridge is needed to flood the packet to both the OS and the OVS.
diff --git a/etc/kayobe/environments/ci-multinode/stackhpc-ci.yml b/etc/kayobe/environments/ci-multinode/stackhpc-ci.yml
index 505586f81c..450d0d1c37 100644
--- a/etc/kayobe/environments/ci-multinode/stackhpc-ci.yml
+++ b/etc/kayobe/environments/ci-multinode/stackhpc-ci.yml
@@ -63,3 +63,7 @@ stackhpc_docker_registry: "{{ stackhpc_repo_mirror_url | regex_replace('^https?:
 
 stackhpc_docker_registry_username: "{{ stackhpc_repo_mirror_username }}"
 stackhpc_docker_registry_password: "{{ stackhpc_repo_mirror_password }}"
+
+# Credentials for downloading the Octavia amphora image from Ark
+stackhpc_release_pulp_username: "{{ stackhpc_repo_mirror_username }}"
+stackhpc_release_pulp_password: "{{ stackhpc_repo_mirror_password }}"

From cbd13fdcb9854ceed3c6af938080be909d87e478 Mon Sep 17 00:00:00 2001
From: saadtariq <saad@stackhpc.com>
Date: Tue, 13 Oct 2026 10:36:49 +0100
Subject: [PATCH 06/17] chore(ci-multinode): ignore generated Octavia
 certificates

---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index b2b5221ca0..e797cd3689 100644
--- a/.gitignore
+++ b/.gitignore
@@ -57,6 +57,7 @@ etc/kayobe/environments/aufn-ceph/kolla/config/nova/ceph.client.glance.keyring
 # Ignore generated Octavia certificates in the AIO environments
 etc/kayobe/environments/aio/kolla/config/octavia/*.pem
 etc/kayobe/environments/ci-aio/kolla/config/octavia/*.pem
+etc/kayobe/environments/ci-multinode/kolla/config/octavia/*.pem
 
 # Tempest logs
 tempest-artifacts

From b1d7a26a9a1be9e771b2abf0af285b1967a15e25 Mon Sep 17 00:00:00 2001
From: saadtariq38 <saad@stackhpc.com>
Date: Wed, 14 Oct 2026 09:28:14 +0100
Subject: [PATCH 07/17] test(ci-multinode): Add Octavia tempest overrides

---
 ...-ci-multinode-octavia-smoke.overrides.conf |  1 +
 ...empest-ci-multinode-octavia.overrides.conf | 56 +++++++++++++++++++
 2 files changed, 57 insertions(+)
 create mode 120000 .automation.conf/tempest/tempest-ci-multinode-octavia-smoke.overrides.conf
 create mode 100644 .automation.conf/tempest/tempest-ci-multinode-octavia.overrides.conf

diff --git a/.automation.conf/tempest/tempest-ci-multinode-octavia-smoke.overrides.conf b/.automation.conf/tempest/tempest-ci-multinode-octavia-smoke.overrides.conf
new file mode 120000
index 0000000000..4ab71e7a3b
--- /dev/null
+++ b/.automation.conf/tempest/tempest-ci-multinode-octavia-smoke.overrides.conf
@@ -0,0 +1 @@
+tempest-ci-multinode-octavia.overrides.conf
\ No newline at end of file
diff --git a/.automation.conf/tempest/tempest-ci-multinode-octavia.overrides.conf b/.automation.conf/tempest/tempest-ci-multinode-octavia.overrides.conf
new file mode 100644
index 0000000000..99a8d42012
--- /dev/null
+++ b/.automation.conf/tempest/tempest-ci-multinode-octavia.overrides.conf
@@ -0,0 +1,56 @@
+# Copy of tempest-ci-multinode.overrides.conf with the [load_balancer] and
+# [network-feature-enabled] sections appended; keep the shared parts in sync.
+# The filename is dictated by config.sh and cannot be made more descriptive.
+
+[DEFAULT]
+openstack_client_http_timeout = 300
+
+[auth]
+compute_quotas = cores:-1,ram:-1
+
+[identity]
+v3_endpoint_type = publicURL
+
+[compute]
+min_compute_nodes = 2
+min_microversion = 2.1
+max_microversion = 2.96
+
+[service-clients]
+http_timeout = 600
+
+[compute-feature-enabled]
+resize = true
+live_migration = true
+block_migration_for_live_migration = false
+volume_backed_live_migration = true
+console_output = true
+
+[volume]
+storage_protocol = ceph
+build_timeout = 600
+min_microversion = 3.0
+max_microversion = 3.71
+
+[image]
+build_timeout = 600
+
+[dashboard]
+dashboard_url = https://192.168.39.2
+
+[load_balancer]
+# The legacy 'octavia' alias is absent from octavia_provider_drivers.
+provider = amphora
+# This environment has no shared IPv6 subnet pool.
+test_with_ipv6 = False
+# Must outlast Octavia's own amp_active_retries * amp_active_wait_sec of 900s.
+lb_build_timeout = 1200
+# Listener and pool waits.
+build_timeout = 900
+# Member add waits.
+check_timeout = 600
+# With port_security below, makes the plugin attach a security group to backends.
+enable_security_groups = True
+
+[network-feature-enabled]
+port_security = True

From aa4cb3b67b37cd54cb299993a9782095535b9d61 Mon Sep 17 00:00:00 2001
From: saadtariq38 <saad@stackhpc.com>
Date: Wed, 14 Oct 2026 12:50:12 +0100
Subject: [PATCH 08/17] docs(ci-multinode): Add release note for Octavia
 amphora support

Covers the Amphora provider driver on OVS, the nova_compute_virt_type
change to kvm, and the move of the VXLAN mesh device into a Linux bridge
so that the host and Neutron both receive frames on the management VLAN.
---
 ...node-octavia-amphora-bc2f989937fc8a59.yaml | 25 +++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 releasenotes/notes/ci-multinode-octavia-amphora-bc2f989937fc8a59.yaml

diff --git a/releasenotes/notes/ci-multinode-octavia-amphora-bc2f989937fc8a59.yaml b/releasenotes/notes/ci-multinode-octavia-amphora-bc2f989937fc8a59.yaml
new file mode 100644
index 0000000000..52f262fd6b
--- /dev/null
+++ b/releasenotes/notes/ci-multinode-octavia-amphora-bc2f989937fc8a59.yaml
@@ -0,0 +1,25 @@
+---
+features:
+  - |
+    The ``ci-multinode`` environment now supports the Octavia Amphora provider
+    driver when ``kolla_enable_ovn`` is ``false``. The load balancer management
+    network is a VLAN provider network on the existing ``physnet1``, carried by
+    the VXLAN mesh.
+    ``tempest-ci-multinode-octavia.overrides.conf`` and
+    ``tempest-ci-multinode-octavia-smoke.overrides.conf`` are provided for
+    running the ``octavia`` and ``octavia-smoke`` Tempest load lists against it.
+  - |
+    The ``ci-multinode`` environment now sets ``nova_compute_virt_type`` to
+    ``kvm`` unless ``kolla_enable_ovn`` is ``true``, because amphorae are
+    effectively unusable (tests fail on timeouts due to slowness) under QEMU emulation during Tempest runs. Hosts
+    therefore require nested virtualisation when the Amphora driver is in use.
+upgrade:
+  - |
+    The VXLAN mesh device in the ``ci-multinode`` environment is now enslaved to
+    a Linux bridge, ``br-vxlan``, and every VLAN subinterface has moved from the
+    mesh device onto that bridge. This was the key change since Open vSwitch reaches the mesh through a veth
+    pair from the bridge and the host and Neutron can now both receive a copy of
+    each frame. A VLAN subinterface on a bare mesh device (the previous implementation) would claim (and then drop) frames before
+    Open vSwitch can see them, which prevented amphorae from reaching the
+    Octavia control plane. This was prominent on amphorae boot up when it could not reach 
+    the DHCP server.

From ce9441eae3751f3f7474423a9a4dbabd0a5607a1 Mon Sep 17 00:00:00 2001
From: saadtariq38 <saad@stackhpc.com>
Date: Wed, 14 Oct 2026 14:08:49 +0100
Subject: [PATCH 09/17] docs(ci-multinode): Document Octavia management network
 and guard KVM

---
 doc/source/operations/octavia.rst             | 24 +++++++++++++++
 .../post.d/10-check-kvm.yml                   | 30 +++++++++++++++++++
 2 files changed, 54 insertions(+)
 create mode 100644 etc/kayobe/environments/ci-multinode/hooks/overcloud-host-configure/post.d/10-check-kvm.yml

diff --git a/doc/source/operations/octavia.rst b/doc/source/operations/octavia.rst
index b404801506..d10b7b4f5c 100644
--- a/doc/source/operations/octavia.rst
+++ b/doc/source/operations/octavia.rst
@@ -2,6 +2,30 @@
 Octavia
 =======
 
+Management network requirements
+===============================
+
+The Amphora provider driver runs each load balancer inside its own virtual
+machine, called an amphora. The Octavia services and the amphorae talk to each
+other directly, so they need to share a network:
+
+* Octavia connects to each amphora on TCP port 9443 to configure it.
+* Each amphora sends health reports back to Octavia on UDP port 5555.
+
+Octavia therefore needs an address of its own on the management network, and
+Neutron needs a network on the same segment to attach the amphorae to.
+
+If both of those are carried by the same network interface on the host, that
+interface must be a Linux bridge. When a plain interface has VLAN subinterfaces
+on it, the host keeps the traffic for itself and Open vSwitch never receives it,
+so amphorae start up but Octavia cannot reach them. A Linux bridge passes a copy
+of the traffic to everything attached to it, so the host and Open vSwitch both
+receive it.
+
+The ``ci-multinode`` environment is set up this way: the VXLAN mesh device sits
+inside a Linux bridge, and Open vSwitch attaches to the same bridge through a
+veth pair.
+
 .. _Amphora image:
 
 Updating amphora images
diff --git a/etc/kayobe/environments/ci-multinode/hooks/overcloud-host-configure/post.d/10-check-kvm.yml b/etc/kayobe/environments/ci-multinode/hooks/overcloud-host-configure/post.d/10-check-kvm.yml
new file mode 100644
index 0000000000..9e300ad1b7
--- /dev/null
+++ b/etc/kayobe/environments/ci-multinode/hooks/overcloud-host-configure/post.d/10-check-kvm.yml
@@ -0,0 +1,30 @@
+---
+
+- hosts: compute
+  gather_facts: true
+  tasks:
+    - name: Assert that the host architecture supports the amphora driver
+      assert:
+        that: ansible_facts.architecture == 'x86_64'
+        fail_msg: >-
+          The Octavia amphora driver is only supported on x86_64 hosts, because
+          the amphora image is built for x86_64. This host is
+          {{ ansible_facts.architecture }}. Set kolla_enable_ovn to true to
+          deploy with the OVN provider driver instead.
+      when: not kolla_enable_ovn | bool
+
+    - name: Check whether /dev/kvm exists
+      stat:
+        path: /dev/kvm
+      register: kvm_device
+      when: not kolla_enable_ovn | bool
+
+    - name: Assert that KVM is available
+      assert:
+        that: kvm_device.stat.exists
+        fail_msg: >-
+          /dev/kvm is not present. The ci-multinode environment uses KVM when
+          the Octavia amphora driver is in use, because amphorae are unusable
+          under emulation. Enable nested virtualisation on this host, or set
+          kolla_enable_ovn to true to deploy with the OVN provider driver.
+      when: not kolla_enable_ovn | bool

From 7b02b50d09a061fdd813b8e4c96c3ebc75002cc8 Mon Sep 17 00:00:00 2001
From: saadtariq38 <saad@stackhpc.com>
Date: Wed, 14 Oct 2026 15:38:46 +0100
Subject: [PATCH 10/17] docs(ci-multinode): Minor update to Octavia management
 documentation

---
 .../ci-multinode-octavia-amphora-bc2f989937fc8a59.yaml    | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/releasenotes/notes/ci-multinode-octavia-amphora-bc2f989937fc8a59.yaml b/releasenotes/notes/ci-multinode-octavia-amphora-bc2f989937fc8a59.yaml
index 52f262fd6b..b1e29220a8 100644
--- a/releasenotes/notes/ci-multinode-octavia-amphora-bc2f989937fc8a59.yaml
+++ b/releasenotes/notes/ci-multinode-octavia-amphora-bc2f989937fc8a59.yaml
@@ -13,6 +13,12 @@ features:
     ``kvm`` unless ``kolla_enable_ovn`` is ``true``, because amphorae are
     effectively unusable (tests fail on timeouts due to slowness) under QEMU emulation during Tempest runs. Hosts
     therefore require nested virtualisation when the Amphora driver is in use.
+  - |
+    The Amphora provider driver in the ``ci-multinode`` environment is
+    supported on x86_64 hosts only, because the amphora image is built for
+    x86_64, and ``kayobe overcloud host configure`` will fail with an
+    explanatory message otherwise. Upgrades have not been tested with the
+    Amphora driver.
 upgrade:
   - |
     The VXLAN mesh device in the ``ci-multinode`` environment is now enslaved to
@@ -21,5 +27,5 @@ upgrade:
     pair from the bridge and the host and Neutron can now both receive a copy of
     each frame. A VLAN subinterface on a bare mesh device (the previous implementation) would claim (and then drop) frames before
     Open vSwitch can see them, which prevented amphorae from reaching the
-    Octavia control plane. This was prominent on amphorae boot up when it could not reach 
+    Octavia control plane. This was prominent on amphorae boot up when it could not reach
     the DHCP server.

From 87f21ecf3114f70183da40a19d465ed4c83150ea Mon Sep 17 00:00:00 2001
From: saadtariq38 <saad@stackhpc.com>
Date: Fri, 16 Oct 2026 09:44:35 +0100
Subject: [PATCH 11/17] feat(ci-multinode): Make the Octavia amphora driver
 opt-in.

LeafCloud does not support kvm and is the default for CI multinode runs at the moment. Amphora driver can be manually enabled for any SMSLab runs
---
 .../environments/ci-multinode/controllers.yml |  2 +-
 .../environments/ci-multinode/globals.yml     |  7 +++++++
 .../post.d/10-check-kvm.yml                   | 13 +++++++------
 .../ci-multinode/kolla/globals.yml            | 10 +++++-----
 ...node-octavia-amphora-bc2f989937fc8a59.yaml | 19 +++++++++++--------
 5 files changed, 31 insertions(+), 20 deletions(-)

diff --git a/etc/kayobe/environments/ci-multinode/controllers.yml b/etc/kayobe/environments/ci-multinode/controllers.yml
index d0361b342f..af763c9eee 100644
--- a/etc/kayobe/environments/ci-multinode/controllers.yml
+++ b/etc/kayobe/environments/ci-multinode/controllers.yml
@@ -7,7 +7,7 @@ controller_lvm_groups:
 
 # Octavia management network, for the health manager to receive amphora
 # heartbeats. OVN provider driver needs no management network.
-controller_extra_network_interfaces: "{{ ['lb_mgmt'] if not kolla_enable_ovn | bool else [] }}"
+controller_extra_network_interfaces: "{{ ['lb_mgmt'] if octavia_amphora_driver_enabled | bool else [] }}"
 
 
 ###############################################################################
diff --git a/etc/kayobe/environments/ci-multinode/globals.yml b/etc/kayobe/environments/ci-multinode/globals.yml
index e3035f9039..90fed64980 100644
--- a/etc/kayobe/environments/ci-multinode/globals.yml
+++ b/etc/kayobe/environments/ci-multinode/globals.yml
@@ -67,6 +67,13 @@ openstack_cacert: "{{ '/etc/pki/tls/certs/ca-bundle.crt' if os_distribution == '
 # Enable rebooting to update SELinux state
 selinux_do_reboot: true
 
+###############################################################################
+# Octavia.
+
+# Use Octavia's amphora provider driver instead of the OVN one. Requires
+# nested virtualisation on the compute hosts, which the CI cloud (Leaf Cloud as of now) does not have.
+octavia_amphora_driver_enabled: false
+
 ###############################################################################
 # Extra vars.
 
diff --git a/etc/kayobe/environments/ci-multinode/hooks/overcloud-host-configure/post.d/10-check-kvm.yml b/etc/kayobe/environments/ci-multinode/hooks/overcloud-host-configure/post.d/10-check-kvm.yml
index 9e300ad1b7..890c9d60a3 100644
--- a/etc/kayobe/environments/ci-multinode/hooks/overcloud-host-configure/post.d/10-check-kvm.yml
+++ b/etc/kayobe/environments/ci-multinode/hooks/overcloud-host-configure/post.d/10-check-kvm.yml
@@ -9,15 +9,15 @@
         fail_msg: >-
           The Octavia amphora driver is only supported on x86_64 hosts, because
           the amphora image is built for x86_64. This host is
-          {{ ansible_facts.architecture }}. Set kolla_enable_ovn to true to
-          deploy with the OVN provider driver instead.
-      when: not kolla_enable_ovn | bool
+          {{ ansible_facts.architecture }}. Set octavia_amphora_driver_enabled
+          to false to deploy with the OVN provider driver instead.
+      when: octavia_amphora_driver_enabled | bool
 
     - name: Check whether /dev/kvm exists
       stat:
         path: /dev/kvm
       register: kvm_device
-      when: not kolla_enable_ovn | bool
+      when: octavia_amphora_driver_enabled | bool
 
     - name: Assert that KVM is available
       assert:
@@ -26,5 +26,6 @@
           /dev/kvm is not present. The ci-multinode environment uses KVM when
           the Octavia amphora driver is in use, because amphorae are unusable
           under emulation. Enable nested virtualisation on this host, or set
-          kolla_enable_ovn to true to deploy with the OVN provider driver.
-      when: not kolla_enable_ovn | bool
+          octavia_amphora_driver_enabled to false to deploy with the OVN
+          provider driver.
+      when: octavia_amphora_driver_enabled | bool
diff --git a/etc/kayobe/environments/ci-multinode/kolla/globals.yml b/etc/kayobe/environments/ci-multinode/kolla/globals.yml
index 1050745ce3..dd8614c454 100644
--- a/etc/kayobe/environments/ci-multinode/kolla/globals.yml
+++ b/etc/kayobe/environments/ci-multinode/kolla/globals.yml
@@ -21,7 +21,7 @@ rabbitmq_enable_tls: "yes"
 # denominator. However, amphorae are unusable under emulation in terms of time
 # during tempest testing and Octavia times out waiting for them to spin up
 # we require KVM when the amphora driver is in use
-nova_compute_virt_type: "{{ 'qemu' if kolla_enable_ovn | bool else 'kvm' }}"
+nova_compute_virt_type: "{{ 'kvm' if octavia_amphora_driver_enabled | bool else 'qemu' }}"
 
 # Reduce the control plane's memory footprint by limiting the number of worker
 # processes to two per-service when running in a VM.
@@ -48,15 +48,15 @@ opensearch_heap_size: 1g
 # apply, which sets amphora in octavia_provider_drivers. That
 # makes it true for the amphora driver and false for the OVN driver as needed
 
-octavia_provider_drivers: "{{ 'ovn:OVN provider' if kolla_enable_ovn | bool else 'amphora:Amphora provider' }}"
-octavia_provider_agents: "{{ 'ovn' if kolla_enable_ovn | bool else 'amphora_agent' }}"
+octavia_provider_drivers: "{{ 'amphora:Amphora provider' if octavia_amphora_driver_enabled | bool else 'ovn:OVN provider' }}"
+octavia_provider_agents: "{{ 'amphora_agent' if octavia_amphora_driver_enabled | bool else 'ovn' }}"
 
 # Host interface the health manager binds to. octavia.conf references this
 # unconditionally, so fall back to the internal network on OVN, which is what
 # kolla's api_interface default resolves to.
-octavia_network_interface: "{{ (octavia_net_name if not kolla_enable_ovn | bool else internal_net_name) | net_interface(groups['controllers'][0]) }}"
+octavia_network_interface: "{{ (octavia_net_name if octavia_amphora_driver_enabled | bool else internal_net_name) | net_interface(groups['controllers'][0]) }}"
 
-# Management network registered by octavia_auto_configure, so only on OVS.
+# Management network registered by octavia_auto_configure, so only with amphora.
 octavia_amp_network:
   name: lb-mgmt-net
   provider_network_type: vlan
diff --git a/releasenotes/notes/ci-multinode-octavia-amphora-bc2f989937fc8a59.yaml b/releasenotes/notes/ci-multinode-octavia-amphora-bc2f989937fc8a59.yaml
index b1e29220a8..a938eb6874 100644
--- a/releasenotes/notes/ci-multinode-octavia-amphora-bc2f989937fc8a59.yaml
+++ b/releasenotes/notes/ci-multinode-octavia-amphora-bc2f989937fc8a59.yaml
@@ -2,17 +2,20 @@
 features:
   - |
     The ``ci-multinode`` environment now supports the Octavia Amphora provider
-    driver when ``kolla_enable_ovn`` is ``false``. The load balancer management
-    network is a VLAN provider network on the existing ``physnet1``, carried by
-    the VXLAN mesh.
-    ``tempest-ci-multinode-octavia.overrides.conf`` and
+    driver. It is opt-in through ``octavia_amphora_driver_enabled``, which
+    defaults to ``false`` because the cloud hosting the CI jobs (Leaf Cloud for now) does not provide
+    nested virtualisation. When it is ``false`` the environment continues to use
+    the OVN provider driver as before. The load balancer management network is a
+    VLAN provider network on the existing ``physnet1``, carried by the VXLAN
+    mesh. ``tempest-ci-multinode-octavia.overrides.conf`` and
     ``tempest-ci-multinode-octavia-smoke.overrides.conf`` are provided for
     running the ``octavia`` and ``octavia-smoke`` Tempest load lists against it.
   - |
-    The ``ci-multinode`` environment now sets ``nova_compute_virt_type`` to
-    ``kvm`` unless ``kolla_enable_ovn`` is ``true``, because amphorae are
-    effectively unusable (tests fail on timeouts due to slowness) under QEMU emulation during Tempest runs. Hosts
-    therefore require nested virtualisation when the Amphora driver is in use.
+    The ``ci-multinode`` environment sets ``nova_compute_virt_type`` to ``kvm``
+    when ``octavia_amphora_driver_enabled`` is ``true``, because amphorae are
+    effectively unusable (tests fail on timeouts due to slowness) under QEMU
+    emulation during Tempest runs. Hosts therefore require nested virtualisation
+    when the Amphora driver is in use.
   - |
     The Amphora provider driver in the ``ci-multinode`` environment is
     supported on x86_64 hosts only, because the amphora image is built for

From 3490b03e4d81b884511859e385578fe3e89bbf8c Mon Sep 17 00:00:00 2001
From: saadtariq38 <saad@stackhpc.com>
Date: Tue, 20 Oct 2026 15:04:44 +0100
Subject: [PATCH 12/17] chore(ci-multinode): Address review comments

Remove CI release note and reworded comment to be more specific
---
 .../ci-multinode/kolla/config/octavia.conf    |  4 +--
 .../ci-multinode/kolla/globals.yml            |  4 ---
 ...node-octavia-amphora-bc2f989937fc8a59.yaml | 34 -------------------
 3 files changed, 2 insertions(+), 40 deletions(-)
 delete mode 100644 releasenotes/notes/ci-multinode-octavia-amphora-bc2f989937fc8a59.yaml

diff --git a/etc/kayobe/environments/ci-multinode/kolla/config/octavia.conf b/etc/kayobe/environments/ci-multinode/kolla/config/octavia.conf
index 9402556c17..b3ba8ce094 100644
--- a/etc/kayobe/environments/ci-multinode/kolla/config/octavia.conf
+++ b/etc/kayobe/environments/ci-multinode/kolla/config/octavia.conf
@@ -1,5 +1,5 @@
-# Amphorae boot from Ceph-backed Cinder volumes here, which can be slow, so
-# allow far longer than the five minute default for Nova to report them active.
+# Amphorae boot from Ceph-backed Cinder volumes here, which can be slow.
+# Increase timeout from 5 minutes to 15 minutes for Nova to report them active.
 [controller_worker]
 amp_active_retries = 90
 amp_active_wait_sec = 10
diff --git a/etc/kayobe/environments/ci-multinode/kolla/globals.yml b/etc/kayobe/environments/ci-multinode/kolla/globals.yml
index dd8614c454..277d41974f 100644
--- a/etc/kayobe/environments/ci-multinode/kolla/globals.yml
+++ b/etc/kayobe/environments/ci-multinode/kolla/globals.yml
@@ -43,10 +43,6 @@ neutron_dns_domain: "{{ root_domain }}."
 opensearch_heap_size: 1g
 
 # Octavia load balancer configuration.
-#
-# octavia_auto_configure is not set since removing it lets kolla's own default
-# apply, which sets amphora in octavia_provider_drivers. That
-# makes it true for the amphora driver and false for the OVN driver as needed
 
 octavia_provider_drivers: "{{ 'amphora:Amphora provider' if octavia_amphora_driver_enabled | bool else 'ovn:OVN provider' }}"
 octavia_provider_agents: "{{ 'amphora_agent' if octavia_amphora_driver_enabled | bool else 'ovn' }}"
diff --git a/releasenotes/notes/ci-multinode-octavia-amphora-bc2f989937fc8a59.yaml b/releasenotes/notes/ci-multinode-octavia-amphora-bc2f989937fc8a59.yaml
deleted file mode 100644
index a938eb6874..0000000000
--- a/releasenotes/notes/ci-multinode-octavia-amphora-bc2f989937fc8a59.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
----
-features:
-  - |
-    The ``ci-multinode`` environment now supports the Octavia Amphora provider
-    driver. It is opt-in through ``octavia_amphora_driver_enabled``, which
-    defaults to ``false`` because the cloud hosting the CI jobs (Leaf Cloud for now) does not provide
-    nested virtualisation. When it is ``false`` the environment continues to use
-    the OVN provider driver as before. The load balancer management network is a
-    VLAN provider network on the existing ``physnet1``, carried by the VXLAN
-    mesh. ``tempest-ci-multinode-octavia.overrides.conf`` and
-    ``tempest-ci-multinode-octavia-smoke.overrides.conf`` are provided for
-    running the ``octavia`` and ``octavia-smoke`` Tempest load lists against it.
-  - |
-    The ``ci-multinode`` environment sets ``nova_compute_virt_type`` to ``kvm``
-    when ``octavia_amphora_driver_enabled`` is ``true``, because amphorae are
-    effectively unusable (tests fail on timeouts due to slowness) under QEMU
-    emulation during Tempest runs. Hosts therefore require nested virtualisation
-    when the Amphora driver is in use.
-  - |
-    The Amphora provider driver in the ``ci-multinode`` environment is
-    supported on x86_64 hosts only, because the amphora image is built for
-    x86_64, and ``kayobe overcloud host configure`` will fail with an
-    explanatory message otherwise. Upgrades have not been tested with the
-    Amphora driver.
-upgrade:
-  - |
-    The VXLAN mesh device in the ``ci-multinode`` environment is now enslaved to
-    a Linux bridge, ``br-vxlan``, and every VLAN subinterface has moved from the
-    mesh device onto that bridge. This was the key change since Open vSwitch reaches the mesh through a veth
-    pair from the bridge and the host and Neutron can now both receive a copy of
-    each frame. A VLAN subinterface on a bare mesh device (the previous implementation) would claim (and then drop) frames before
-    Open vSwitch can see them, which prevented amphorae from reaching the
-    Octavia control plane. This was prominent on amphorae boot up when it could not reach
-    the DHCP server.

From 793c4af47373458ec667ac3a45e3f014618ae21f Mon Sep 17 00:00:00 2001
From: saadtariq38 <saad@stackhpc.com>
Date: Thu, 22 Oct 2026 13:44:20 +0100
Subject: [PATCH 13/17] refactor(ci-multinode): Merge the Octavia Tempest
 overrides into one file

---
 ...-ci-multinode-octavia-smoke.overrides.conf |  1 -
 ...empest-ci-multinode-octavia.overrides.conf | 56 -------------------
 .../tempest-ci-multinode.overrides.conf       | 18 ++++++
 3 files changed, 18 insertions(+), 57 deletions(-)
 delete mode 120000 .automation.conf/tempest/tempest-ci-multinode-octavia-smoke.overrides.conf
 delete mode 100644 .automation.conf/tempest/tempest-ci-multinode-octavia.overrides.conf

diff --git a/.automation.conf/tempest/tempest-ci-multinode-octavia-smoke.overrides.conf b/.automation.conf/tempest/tempest-ci-multinode-octavia-smoke.overrides.conf
deleted file mode 120000
index 4ab71e7a3b..0000000000
--- a/.automation.conf/tempest/tempest-ci-multinode-octavia-smoke.overrides.conf
+++ /dev/null
@@ -1 +0,0 @@
-tempest-ci-multinode-octavia.overrides.conf
\ No newline at end of file
diff --git a/.automation.conf/tempest/tempest-ci-multinode-octavia.overrides.conf b/.automation.conf/tempest/tempest-ci-multinode-octavia.overrides.conf
deleted file mode 100644
index 99a8d42012..0000000000
--- a/.automation.conf/tempest/tempest-ci-multinode-octavia.overrides.conf
+++ /dev/null
@@ -1,56 +0,0 @@
-# Copy of tempest-ci-multinode.overrides.conf with the [load_balancer] and
-# [network-feature-enabled] sections appended; keep the shared parts in sync.
-# The filename is dictated by config.sh and cannot be made more descriptive.
-
-[DEFAULT]
-openstack_client_http_timeout = 300
-
-[auth]
-compute_quotas = cores:-1,ram:-1
-
-[identity]
-v3_endpoint_type = publicURL
-
-[compute]
-min_compute_nodes = 2
-min_microversion = 2.1
-max_microversion = 2.96
-
-[service-clients]
-http_timeout = 600
-
-[compute-feature-enabled]
-resize = true
-live_migration = true
-block_migration_for_live_migration = false
-volume_backed_live_migration = true
-console_output = true
-
-[volume]
-storage_protocol = ceph
-build_timeout = 600
-min_microversion = 3.0
-max_microversion = 3.71
-
-[image]
-build_timeout = 600
-
-[dashboard]
-dashboard_url = https://192.168.39.2
-
-[load_balancer]
-# The legacy 'octavia' alias is absent from octavia_provider_drivers.
-provider = amphora
-# This environment has no shared IPv6 subnet pool.
-test_with_ipv6 = False
-# Must outlast Octavia's own amp_active_retries * amp_active_wait_sec of 900s.
-lb_build_timeout = 1200
-# Listener and pool waits.
-build_timeout = 900
-# Member add waits.
-check_timeout = 600
-# With port_security below, makes the plugin attach a security group to backends.
-enable_security_groups = True
-
-[network-feature-enabled]
-port_security = True
diff --git a/.automation.conf/tempest/tempest-ci-multinode.overrides.conf b/.automation.conf/tempest/tempest-ci-multinode.overrides.conf
index 36b6db7530..c8df1c6169 100644
--- a/.automation.conf/tempest/tempest-ci-multinode.overrides.conf
+++ b/.automation.conf/tempest/tempest-ci-multinode.overrides.conf
@@ -33,3 +33,21 @@ build_timeout = 600
 
 [dashboard]
 dashboard_url = https://192.168.39.2
+
+[load_balancer]
+# The legacy 'octavia' alias is absent from octavia_provider_drivers. Load
+# lists matching octavia*ovn* override this to the OVN provider in config.sh.
+provider = amphora
+# This environment has no shared IPv6 subnet pool.
+test_with_ipv6 = False
+# Must outlast Octavia's own amp_active_retries * amp_active_wait_sec of 900s.
+lb_build_timeout = 1200
+# Listener and pool waits.
+build_timeout = 900
+# Member add waits.
+check_timeout = 600
+# With port_security below, makes the plugin attach a security group to backends.
+enable_security_groups = True
+
+[network-feature-enabled]
+port_security = True

From bf34b5dca95852fb703bafdd3c03a7763a7c5bc3 Mon Sep 17 00:00:00 2001
From: saadtariq38 <saad@stackhpc.com>
Date: Thu, 22 Oct 2026 13:45:15 +0100
Subject: [PATCH 14/17] fix(ci-multinode): Select the Octavia provider from the
 load list

The provider driver is the only Tempest setting that differs between
Octavia runs, and keeping a whole overrides file per provider would
reintroduce the duplication just removed.
---
 .automation.conf/config.sh                          | 13 +++++++++++++
 .../tempest/load-lists/octavia-ovn-smoke            |  2 ++
 2 files changed, 15 insertions(+)
 create mode 100644 .automation.conf/tempest/load-lists/octavia-ovn-smoke

diff --git a/.automation.conf/config.sh b/.automation.conf/config.sh
index 76f2a59a07..f832e5574f 100644
--- a/.automation.conf/config.sh
+++ b/.automation.conf/config.sh
@@ -34,6 +34,19 @@ if [ ! -z ${KAYOBE_ENVIRONMENT:+x} ]; then
     # export KAYOBE_AUTOMATION_TEMPEST_SKIPLIST=ci-multinode-tempest-full
   fi
 
+  # Octavia's provider driver is the only Tempest setting that varies between
+  # load lists, so select it here rather than keeping a near-duplicate
+  # overrides file per provider
+  if [[ "${KAYOBE_AUTOMATION_TEMPEST_LOADLIST:-}" == octavia* ]]; then
+    generated="$(mktemp -d)/tempest-${KAYOBE_ENVIRONMENT}-${KAYOBE_AUTOMATION_TEMPEST_LOADLIST}.overrides.conf"
+    cp "${KAYOBE_AUTOMATION_TEMPEST_CONF_OVERRIDES}" "$generated"
+    if [[ "${KAYOBE_AUTOMATION_TEMPEST_LOADLIST}" == *ovn* ]]; then
+      #rewrite provider value based on driver being used
+      crudini --set "$generated" load_balancer provider ovn
+    fi
+    KAYOBE_AUTOMATION_TEMPEST_CONF_OVERRIDES="$generated"
+  fi
+
 fi
 
 if [[ -z "${KAYOBE_AUTOMATION_TEMPEST_CONF_OVERRIDES:+x}" ]] || [[ ! -e "${KAYOBE_AUTOMATION_TEMPEST_CONF_OVERRIDES}" ]]; then
diff --git a/.automation.conf/tempest/load-lists/octavia-ovn-smoke b/.automation.conf/tempest/load-lists/octavia-ovn-smoke
new file mode 100644
index 0000000000..22d2357eab
--- /dev/null
+++ b/.automation.conf/tempest/load-lists/octavia-ovn-smoke
@@ -0,0 +1,2 @@
+octavia_tempest_plugin.tests.scenario.v2.test_traffic_ops.TrafficOperationsScenarioTest.test_basic_tcp_traffic
+octavia_tempest_plugin.tests.scenario.v2.test_traffic_ops.TrafficOperationsScenarioTest.test_basic_udp_traffic

From c83cb6784fd00cf31eea7219b21f1cbf1dbc90e6 Mon Sep 17 00:00:00 2001
From: saadtariq38 <saad@stackhpc.com>
Date: Thu, 22 Oct 2026 13:45:54 +0100
Subject: [PATCH 15/17] fix(ci-multinode): Create the VXLAN bridge with the
 nmcli module

Replace the nmcli shell invocation with community.general.nmcli, which
Kayobe already provides via the full ansible package.
---
 etc/kayobe/ansible/tools/configure-vxlan.yml | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/etc/kayobe/ansible/tools/configure-vxlan.yml b/etc/kayobe/ansible/tools/configure-vxlan.yml
index 831cce7ccc..15d08c479c 100644
--- a/etc/kayobe/ansible/tools/configure-vxlan.yml
+++ b/etc/kayobe/ansible/tools/configure-vxlan.yml
@@ -21,11 +21,14 @@
       register: vxlan_nm_connections
 
     - name: Ensure a bridge exists for each VXLAN interface that needs one
-      ansible.builtin.command:
-        cmd: >-
-          nmcli connection add type bridge
-          con-name {{ item.bridge }} ifname {{ item.bridge }}
-          stp no ipv4.method disabled ipv6.method disabled
+      community.general.nmcli:
+        type: bridge
+        conn_name: "{{ item.bridge }}"
+        ifname: "{{ item.bridge }}"
+        stp: false
+        method4: disabled
+        method6: disabled
+        state: present
       become: true
       loop: "{{ vxlan_interfaces | selectattr('bridge', 'defined') | list }}"
       when: item.bridge not in vxlan_nm_connections.stdout_lines

From 491d482558ab27ade5cd987d5451450070b73cf0 Mon Sep 17 00:00:00 2001
From: saadtariq38 <saad@stackhpc.com>
Date: Thu, 22 Oct 2026 13:48:30 +0100
Subject: [PATCH 16/17] feat(ci-multinode): Update conditionals to enable every
 supported Octavia provider driver in that deployment and have it select
 driver using loadlist logic

---
 .../environments/ci-multinode/kolla/globals.yml      | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/etc/kayobe/environments/ci-multinode/kolla/globals.yml b/etc/kayobe/environments/ci-multinode/kolla/globals.yml
index 277d41974f..e2c7a5bc89 100644
--- a/etc/kayobe/environments/ci-multinode/kolla/globals.yml
+++ b/etc/kayobe/environments/ci-multinode/kolla/globals.yml
@@ -44,8 +44,16 @@ opensearch_heap_size: 1g
 
 # Octavia load balancer configuration.
 
-octavia_provider_drivers: "{{ 'amphora:Amphora provider' if octavia_amphora_driver_enabled | bool else 'ovn:OVN provider' }}"
-octavia_provider_agents: "{{ 'amphora_agent' if octavia_amphora_driver_enabled | bool else 'ovn' }}"
+# Enable every driver this deployment can support and let the Tempest load
+# list choose which one to actually use.
+octavia_provider_drivers: >-
+  {{ ((['amphora:Amphora provider'] if octavia_amphora_driver_enabled | bool else [])
+     + (['ovn:OVN provider'] if kolla_enable_ovn | bool else []))
+     | join(', ') }}
+octavia_provider_agents: >-
+  {{ ((['amphora_agent'] if octavia_amphora_driver_enabled | bool else [])
+     + (['ovn'] if kolla_enable_ovn | bool else []))
+     | join(', ') }}
 
 # Host interface the health manager binds to. octavia.conf references this
 # unconditionally, so fall back to the internal network on OVN, which is what

From 1526c5f48bd2edfebaa9381d4334c45ecb5d486e Mon Sep 17 00:00:00 2001
From: saadtariq38 <saad@stackhpc.com>
Date: Thu, 22 Oct 2026 13:48:52 +0100
Subject: [PATCH 17/17] fix(ci-multinode): Do not deploy Octavia without a
 provider driver

---
 etc/kayobe/environments/ci-multinode/kolla.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/etc/kayobe/environments/ci-multinode/kolla.yml b/etc/kayobe/environments/ci-multinode/kolla.yml
index bc5d0abfcc..04ca8da744 100644
--- a/etc/kayobe/environments/ci-multinode/kolla.yml
+++ b/etc/kayobe/environments/ci-multinode/kolla.yml
@@ -5,7 +5,8 @@ kolla_enable_cinder: true
 kolla_enable_designate: true
 kolla_enable_magnum: true
 kolla_enable_neutron_provider_networks: true
-kolla_enable_octavia: true
+# Deploy Octavia only when a provider driver can actually work here.
+kolla_enable_octavia: "{{ octavia_amphora_driver_enabled | bool or kolla_enable_ovn | bool }}"
 kolla_enable_valkey: true
 
 kolla_enable_tls_external: true