enums: deploy valkey from 2025.2

kolla replaced Redis with Valkey at OpenStack 2025.2: from that release
kolla-redis.yml is not shipped and playbooks.yml has no redis entry. The
three collections that listed Role("redis") -- nutshell,
collection-infrastructure and cloudpod-infrastructure -- therefore carry
a role that cannot resolve on 2025.2 and later, and valkey was never
added, so nothing deploys the replacement either. On 2026.1 that aborts
"osism apply nutshell" once common succeeds, and every coordination
backend osism/defaults points at valkey has no backend at all.

Give each of the three collections both backends under disjoint,
adjacent bounds, so exactly one is selected on any release: never both,
never neither. On 2025.1 both plays exist, and the bound rather than the
playbook is what keeps valkey out, matching enable_valkey in
osism/defaults.

A second test pins that a bounded role has no dependencies. Excluding
one promotes its dependents but not the prerequisite it was, and nothing
at expansion time can supply a replacement, so the resulting graph can
be well formed and still ordered wrongly. Forcing that decision in CI,
in the change that introduces such a role, is the only place it is cheap
to make: kolla 2026.1 also dissolved common into logs, kolla_toolbox,
cron and fluentd, and common has six dependents, so that migration trips
this test rather than silently reordering a deployment.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Roger Luethi <luethi@osism.tech>

Author: ideaship

osism/data/enums.py

@@ -228,7 +228,10 @@ def bounded_roles(roles):
                 ),
                 Role("openvswitch", dependencies=[Role("ovn")]),
                 Role("memcached"),
-                Role("redis"),
+                # kolla replaced redis with valkey at OpenStack 2025.2; on 2025.1
+                # both plays exist but osism/defaults leaves enable_valkey off.
+                Role("redis", until="2025.1"),
+                Role("valkey", since="2025.2"),
                 Role("rabbitmq"),
             ],
         ),
@@ -289,7 +292,8 @@ def bounded_roles(roles):
                 ),
                 Role("openvswitch", dependencies=[Role("ovn")]),
                 Role("memcached"),
-                Role("redis"),
+                Role("redis", until="2025.1"),
+                Role("valkey", since="2025.2"),
                 Role("rabbitmq"),
             ],
         ),
@@ -433,7 +437,8 @@ def bounded_roles(roles):
                 ),
                 Role("openvswitch", dependencies=[Role("ovn")]),
                 Role("memcached"),
-                Role("redis"),
+                Role("redis", until="2025.1"),
+                Role("valkey", since="2025.2"),
                 Role("rabbitmq"),
             ],
         ),

tests/unit/data/test_enums.py

@@ -391,3 +391,109 @@ def test_bounded_roles_includes_a_bounded_parent_and_its_bounded_child():
     parent = Role("parent", until="2025.1", dependencies=[child])
 
     assert list(bounded_roles([parent])) == [parent, child]
+
+
+# ---------------------------------------------------------------------------
+# The key-value store cut-over
+# ---------------------------------------------------------------------------
+
+
+KVS_COLLECTIONS = ["nutshell", "collection-infrastructure", "cloudpod-infrastructure"]
+
+
+@pytest.mark.parametrize("collection", KVS_COLLECTIONS)
+def test_kvs_collections_carry_both_backends(collection):
+    roles = MAP_ROLE2ROLE[collection]
+
+    assert find_role(roles, "redis") is not None
+    assert find_role(roles, "valkey") is not None
+
+
+@pytest.mark.parametrize("collection", KVS_COLLECTIONS)
+def test_kvs_backends_are_bounded_and_disjoint(collection):
+    roles = MAP_ROLE2ROLE[collection]
+    redis = find_role(roles, "redis")
+    valkey = find_role(roles, "valkey")
+
+    assert redis.until == (2025, 1)
+    assert redis.since is None
+    assert valkey.since == (2025, 2)
+    assert valkey.until is None
+
+
+@pytest.mark.parametrize("collection", KVS_COLLECTIONS)
+@pytest.mark.parametrize(
+    "release,expected",
+    [
+        ((2024, 2), "redis"),
+        ((2025, 1), "redis"),
+        ((2025, 2), "valkey"),
+        ((2026, 1), "valkey"),
+    ],
+)
+def test_exactly_one_backend_per_release(collection, release, expected):
+    """Never both, never neither -- on any release, past or future."""
+    roles = MAP_ROLE2ROLE[collection]
+    selected = [
+        name
+        for name in ("redis", "valkey")
+        if find_role(roles, name).deployed_in(release)
+    ]
+
+    assert selected == [expected]
+
+
+def test_only_the_kvs_roles_carry_bounds():
+    """A bound anywhere else is new and wants its own test above."""
+    bounded = {
+        role.name for roles in MAP_ROLE2ROLE.values() for role in bounded_roles(roles)
+    }
+
+    assert bounded == {"redis", "valkey"}
+
+
+def test_no_bounded_role_has_dependencies():
+    """A release-bounded role must be a leaf, until someone settles ordering.
+
+    Excluding a role promotes its dependencies into the surrounding group so
+    the subtree survives. That keeps the subtree and its position among
+    retained siblings, but not what the excluded role supplied to it:
+    ``chain(pt, st)`` runs a role BEFORE its ``dependencies``, so they are its
+    dependents and it is their prerequisite. Promote them past an excluded
+    parent and they run with no predecessor -- a well-formed task graph that
+    may be ordered wrongly, which is worse than an error because it looks
+    intentional. Nothing at expansion time can know which retained or
+    replacement role belongs in that place.
+
+    So the decision is forced here, in CI, in the change that introduces such
+    a role -- not at deploy time, and not only for whoever reads the design
+    document. The case this exists for is the kolla 2026.1 split of ``common``
+    into ``logs``, ``kolla_toolbox``, ``cron`` and ``fluentd``: ``common`` has
+    six dependents, so bounding it trips this test.
+
+    If you are here because you added one: decide what runs in the excluded
+    role's place on each release, encode that, and replace this test with one
+    that pins the ordering you chose.
+    """
+    offenders = {
+        role.name: [dependency.name for dependency in role.dependencies]
+        for roles in MAP_ROLE2ROLE.values()
+        for role in bounded_roles(roles)
+        if role.dependencies
+    }
+
+    assert not offenders, (
+        f"release-bounded roles with dependencies: {offenders}. "
+        "Excluding one promotes its dependents but not the prerequisite it "
+        "was; settle the ordering and replace this test. See the docstring."
+    )
+
+
+def test_valkey_absent_from_collections_that_never_had_redis():
+    """The cut-over touches exactly the three collections that listed redis."""
+    for name, roles in MAP_ROLE2ROLE.items():
+        if name in KVS_COLLECTIONS:
+            continue
+
+        assert find_role(roles, "valkey") is None, name
+        assert find_role(roles, "redis") is None, name