Reach kolla-ansible's own playbooks, and keep its fact cache fresh

[ideaship]

Why

The kolla branch of Run._prepare_task lets osism-ansible claim a role whenever
osism-ansible ships a playbook of that name:

role not in ["common"]
and "osism-ansible" in MAP_ROLE2RUNTIME
and role in MAP_ROLE2RUNTIME["osism-ansible"]

The override is needed — stepca, fix-gh973, nova-update-cell-mappings and
friends are kolla-environment playbooks implemented in osism-ansible. But the
test never asks which environment osism-ansible ships the name for, and the
kolla- prefix is stripped just above. So any name kolla-ansible advertises as
kolla-<x> whose bare form osism-ansible registers for a different environment
collapses onto that entry and is sent to osism-ansible with ENVIRONMENT=kolla,
where run-kolla.sh finds nothing:

ERROR: service <x> in environment kolla not available

Exactly three names collide, all registered by osism-ansible for generic:

command	before	after
osism apply kolla-facts	not available	runs
osism apply kolla-gather-facts	not available	runs
osism apply kolla-certificates	not available	runs

All three have been unreachable, in every spelling, since #877 added the
override — kolla-certificates from two days after #612 deliberately renamed the
play to make it addressable. Nobody noticed because all three were redundant
then: one fact-cache keyspace meant osism-ansible's gather served kolla too, and
OSISM handles TLS separately from kolla's certificates play.

ansible-core 2.19 changed that by namespacing cache entries per schema, so kolla
now needs to write its own generation. Background:

• current/next deploy lanes dark since 2026-07-25 — ansible-core 2.19 fact-cache namespacing vs. the shared fact cache issues#1420

What

1. apply: keep kolla playbooks in kolla-ansible — also require
   MAP_ROLE2ENVIRONMENT.get(role) == "kolla". stepca and friends map to
   kolla and keep running in osism-ansible; facts, gather-facts and
   certificates map to generic and fall through to kolla-ansible. Version
   independent: these commands should work on any ansible-core.
2. facts: gather in the kolla runtime too — dispatch_kolla_facts() queues
   /ansible/kolla-facts.yml in the kolla-ansible runtime; the periodic
   gather_facts task and osism sync facts both call it. Without the periodic
   half a one-shot gather decays: fact_caching_timeout is 86400 while
   GATHER_FACTS_SCHEDULE is 43200, and only osism-ansible's generation was ever
   rewritten. Guarded on kolla-ansible being in MAP_ROLE2RUNTIME, since that
   container is the only consumer of its own queue and is
   enable_kolla_ansible-gated.

The guard runs in a worker, not in setup_periodic_tasks: /interface is not
mounted into the beat container, so MAP_ROLE2RUNTIME is empty there and the
guard would never pass. Verified live — in a container without /interface the
map is {} and the dispatch is skipped; osismclient sees all three runtimes.

Verification

3245 unit tests pass; 8 new ones cover both routing directions, both guard
branches and the sync facts paths.

Live routing probe against a real cluster's /interface/playbooks maps:

facts, kolla-facts, gather-facts,
certificates, kolla-certificates      -> kolla-ansible
stepca, fix-gh973,
nova-update-cell-mappings             -> osism-ansible
keystone, common                      -> kolla-ansible   (unchanged)

End-to-end: osism apply kolla-facts runs 7/7 hosts failed=0 and resets the
Redis TTL, with no manual -e flags. osism sync facts produces two PLAY
RECAPs, one per runtime.

Companion

The playbook-side half — the gather_subset fix that makes kolla-facts.yml
runnable, and the gather import that covers the deploy path — is in:

• Give kolla-ansible a fact-cache writer of its own container-image-kolla-ansible#945

That PR is what fixes the deploy path; this one makes the operator commands and
the periodic refresh work. Land the gather_subset fix first, since these
commands otherwise reach a playbook that cannot run.

🤖 Generated with Claude Code