feat: Kea dhcp

apps/appsets/project-understack.yaml

@@ -7,38 +7,40 @@ metadata:
   # they move between AppProject's
 spec:
   sourceRepos:
-  - '*'
+    - "*"
   destinations:
-  - namespace: 'argo'
-    server: '*'
-  - namespace: 'argocd'
-    server: '*'
-  - namespace: 'argo-events'
-    server: '*'
-  - namespace: 'understack-cdn'
-    server: '*'
-  - namespace: 'cert-manager'
-    server: '*'
-  - namespace: 'dex'
-    server: '*'
-  - namespace: 'nautobot'
-    server: '*'
-  - namespace: 'nautobotop'
-    server: '*'
-  - namespace: 'undersync'
-    server: '*'
-  - namespace: 'openstack'
-    server: '*'
-  - namespace: 'monitoring'
-    server: '*'
-  - namespace: 'otel-collector'
-    server: '*'
-  - namespace: 'kube-system'
-    server: '*'
-  - namespace: 'envoy-gateway'
-    server: '*'
-  - namespace: 'rook-ceph'
-    server: '*'
+    - namespace: "argo"
+      server: "*"
+    - namespace: "argocd"
+      server: "*"
+    - namespace: "argo-events"
+      server: "*"
+    - namespace: "understack-cdn"
+      server: "*"
+    - namespace: "cert-manager"
+      server: "*"
+    - namespace: "dex"
+      server: "*"
+    - namespace: "kea"
+      server: "*"
+    - namespace: "nautobot"
+      server: "*"
+    - namespace: "nautobotop"
+      server: "*"
+    - namespace: "undersync"
+      server: "*"
+    - namespace: "openstack"
+      server: "*"
+    - namespace: "monitoring"
+      server: "*"
+    - namespace: "otel-collector"
+      server: "*"
+    - namespace: "kube-system"
+      server: "*"
+    - namespace: "envoy-gateway"
+      server: "*"
+    - namespace: "rook-ceph"
+      server: "*"
   clusterResourceWhitelist:
-  - group: '*'
-    kind: '*'
+    - group: "*"
+      kind: "*"

charts/argocd-understack/README.md

@@ -177,6 +177,7 @@ Components deployed on site clusters:
 | argo-workflows | `site.argo_workflows` | Workflow engine |
 | chrony | `site.chrony` | NTP service |
 | envoy-configs | `site.envoy_configs` | Gateway configs |
+| kea | `site.kea` | DHCP server |
 | openstack-exporter | `site.openstack_exporter` | Metrics exporter |
 | openstack-memcached | `site.openstack_memcached` | Caching |
 | site-workflows | `site.site_workflows` | Site workflows |

charts/argocd-understack/templates/application-kea.yaml

@@ -0,0 +1,47 @@
+{{- if eq (include "understack.isEnabled" (list $.Values.site "kea")) "true" }}
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: {{ printf "%s-%s" $.Release.Name "kea" }}
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/compare-options: ServerSideDiff=true,IncludeMutationWebhook=true
+{{- include "understack.appLabelsBlock" $ | nindent 2 }}
+spec:
+  destination:
+    # TODO: revert to `kea` once that namespace is deployable again
+    namespace: openstack
+    server: {{ $.Values.cluster_server }}
+  project: understack
+  sources:
+  - chart: kea-dhcp
+    helm:
+      ignoreMissingValueFiles: true
+      releaseName: kea
+      valueFiles:
+      - $understack/components/kea/values.yaml
+      - $deploy/{{ include "understack.deploy_path" $ }}/kea/values.yaml
+    repoURL: https://mglants.github.io/charts
+    targetRevision: {{ $.Values.site.kea.chartVersion }}
+  - ref: understack
+    repoURL: {{ include "understack.understack_url" $ }}
+    targetRevision: {{ include "understack.understack_ref" $ }}
+  - path: {{ include "understack.deploy_path" $ }}/kea
+    ref: deploy
+    repoURL: {{ include "understack.deploy_url" $ }}
+    targetRevision: {{ include "understack.deploy_ref" $ }}
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    managedNamespaceMetadata:
+      annotations:
+        argocd.argoproj.io/sync-options: Delete=false
+    syncOptions:
+    - CreateNamespace=true
+    - ServerSideApply=true
+    - RespectIgnoreDifferences=true
+    - ApplyOutOfSyncOnly=true
+{{- end }}

charts/argocd-understack/values.yaml

@@ -475,6 +475,15 @@ site:
     # @default -- false
     enabled: false
 
+  # -- Kea DHCP server
+  kea:
+    # -- Enable/disable deploying Kea DHCP
+    # @default -- false
+    enabled: false
+    # -- Chart version for Kea DHCP
+    # renovate: datasource=helm depName=kea-dhcp registryUrl=https://mglants.github.io/charts
+    chartVersion: "0.7.1"
+
   # -- External DNS operator
   external_dns:
     # -- Enable/disable deploying External DNS

components/images-openstack.yaml

@@ -22,12 +22,12 @@ images:
     keystone_fernet_setup: "ghcr.io/rackerlabs/understack/keystone:2026.1"
 
     # ironic
-    ironic_api: "ghcr.io/rackerlabs/understack/ironic:2026.1"
-    ironic_conductor: "ghcr.io/rackerlabs/understack/ironic:2026.1"
-    ironic_pxe: "ghcr.io/rackerlabs/understack/ironic:2026.1"
-    ironic_pxe_init: "ghcr.io/rackerlabs/understack/ironic:2026.1"
+    ironic_api: "ghcr.io/rackerlabs/understack/ironic:pr-2111"
+    ironic_conductor: "ghcr.io/rackerlabs/understack/ironic:pr-2111"
+    ironic_pxe: "ghcr.io/rackerlabs/understack/ironic:pr-2111"
+    ironic_pxe_init: "ghcr.io/rackerlabs/understack/ironic:pr-2111"
     ironic_pxe_http: "docker.io/nginx:1.29.8"
-    ironic_db_sync: "ghcr.io/rackerlabs/understack/ironic:2026.1"
+    ironic_db_sync: "ghcr.io/rackerlabs/understack/ironic:pr-2111"
     # these want curl which apparently is in the openstack-client image
     ironic_manage_cleaning_network: "ghcr.io/rackerlabs/understack/openstack-client:2025.2"
     ironic_retrive_cleaning_network: "ghcr.io/rackerlabs/understack/openstack-client:2025.2"

components/ironic/kustomization.yaml

@@ -6,7 +6,7 @@ resources:
   - ironic-mariadb-db.yaml
   - ironic-rabbitmq-queue.yaml
   - dnsmasq-pvc.yaml
-  - dnsmasq-ss.yaml
+#  - dnsmasq-ss.yaml
   - ironic-ks-user-baremetal.yaml
     # less than ideal addition but necessary so that we can have the ironic.conf.d loading
     # working due to the way the chart hardcodes the config-file parameter which then

components/ironic/values.yaml

@@ -90,7 +90,7 @@ conf:
       # https://docs.openstack.org/ironic/latest/admin/drivers/idrac.html#timeout-when-powering-off
       post_deploy_get_power_state_retry_interval: 18
     dhcp:
-      dhcp_provider: dnsmasq
+      dhcp_provider: kea
     oslo_messaging_notifications:
       driver: messagingv2
     oslo_messaging_rabbit:

components/kea/values.yaml

@@ -0,0 +1,13 @@
+# Default values for kea-dhcp. Using upstream chart defaults for now.
+#
+# The chart's own DHCP Service is left at chart defaults (ClusterIP). External
+# reachability is provided per-site via a hand-written LoadBalancer Service in
+# each site's deploy-repo kea/ overlay, working around a chart bug where
+# setting service.dhcp.annotations renders invalid YAML (missing newline in
+# templates/service.yaml, still present on chart main as of 0.7.1).
+
+kea:
+  ctrlagent:
+    #Needed for HA, monitoring and stork
+    enabled: true
+    loglevel: "DEBUG"

docs/deploy-guide/components/kea.md

@@ -0,0 +1,39 @@
+---
+charts:
+- kea-dhcp
+deploy_overrides:
+  helm:
+    mode: values
+  kustomize:
+    mode: second_source
+---
+
+# kea
+
+Kea DHCP server (ISC Kea) for site network DHCP service.
+
+## Deployment Scope
+
+- Cluster scope: site
+- Values key: `site.kea`
+- ArgoCD Application template: `charts/argocd-understack/templates/application-kea.yaml`
+
+## How to Enable
+
+Set this component to enabled in your deployment values file:
+
+```yaml title="$CLUSTER_NAME/deploy.yaml"
+site:
+  kea:
+    enabled: true
+```
+
+## How ArgoCD Builds It
+
+{{ component_argocd_builds() }}
+
+## Deployment Repo Content
+
+{{ secrets_disclaimer }}
+
+Currently deployed with upstream chart defaults; no required deployment-repo overrides yet.

properdocs.yml

@@ -188,6 +188,7 @@ nav:
       - deploy-guide/components/ironic.md
       - deploy-guide/components/ironic-hardware-exporter.md
       - deploy-guide/components/karma.md
+      - deploy-guide/components/kea.md
       - deploy-guide/components/keystone.md
       - deploy-guide/components/mariadb-operator.md
       - deploy-guide/components/monitoring.md

python/ironic-understack/ironic_understack/conf.py

@@ -26,6 +26,24 @@ def setup_conf():
                 "1d": "bmc",
             },
         ),
+        cfg.StrOpt(
+            "kea_url",
+            default="http://kea-kea-dhcp-ctrl.openstack.svc.cluster.local:8000",
+            help="URL of the Kea DHCP server's HTTP API endpoint. "
+            "This endpoint is used for managing DHCP "
+            "configuration, reservations, leases and subnet "
+            "operations through Kea's HTTP API interface.",
+        ),
+        cfg.IntOpt(
+            "kea_request_timeout",
+            default=10,
+            help="Timeout in seconds for requests to the Kea API.",
+        ),
+        cfg.IntOpt(
+            "kea_max_retries",
+            default=3,
+            help="Maximum number of retry attempts for failed " "requests.",
+        ),
     ]
     cfg.CONF.register_group(grp)
     cfg.CONF.register_opts(opts, group=grp)