openstack-k8s-operators · amartyasinha · Mar 31, 2026
diff --git a/docs/source/build-docs.sh b/docs/source/build-docs.sh
@@ -6,10 +6,11 @@ VENV_DIR="${DOCS_DIR}/_venv"
 BUILD_TYPE="${BUILD_TYPE:=static}"
 
 # Create a virtual environment and activate it
-python -m venv ${VENV_DIR} && source ${VENV_DIR}/bin/activate
-pip3 install -r ${DOCS_DIR}/doc-requirements.txt
+# shellcheck disable=SC1091  # activate script is created by venv command
+python -m venv "${VENV_DIR}" && source "${VENV_DIR}"/bin/activate
+pip3 install -r "${DOCS_DIR}"/doc-requirements.txt
 
-cd ${DOCS_DIR}/source
+cd "${DOCS_DIR}"/source
 
 # Fake the ansible_collections path for python imports
 SITE_PACKAGES=$(python -c 'import site; print(site.getsitepackages()[0])')

diff --git a/roles/devscripts/files/lv-cinder-volumes.sh b/roles/devscripts/files/lv-cinder-volumes.sh
@@ -10,8 +10,8 @@ fi
 
 disk_str=''
 for disk in ${_disks}; do
-    pvcreate ${disk}
+    pvcreate "${disk}"
     disk_str="${disk_str} ${disk}"
 done
 
-vgcreate cinder-volumes ${disk_str}
+vgcreate cinder-volumes "${disk_str}"
diff --git a/roles/nat64_appliance/files/elements/nat64-router/static/usr/local/sbin/configure-nat64 b/roles/nat64_appliance/files/elements/nat64-router/static/usr/local/sbin/configure-nat64
@@ -23,6 +23,7 @@ if [ -f /etc/nat64/config-complete ]; then
     exit 0
 fi
 
+# shellcheck disable=SC1091  # Config file is generated at runtime in target environment
 source /etc/nat64/config-data
 
 if [ -z "${NAT64_IPV6_PREFIX}" ]; then
@@ -42,28 +43,28 @@ NAT64_TAYGA_IPV4=${NAT64_TAYGA_IPV4:-"192.168.255.1"}
 function replace_vars {
 
     pushd /etc/nat64/v6-dnsmasq
-        sed -i s~%%_NAT64_HOST_IPV6_%%~${NAT64_HOST_IPV6%%/*}~g dnsmasq.conf
+        sed -i s~%%_NAT64_HOST_IPV6_%%~"${NAT64_HOST_IPV6%%/*}"~g dnsmasq.conf
     popd
 
     pushd /etc/unbound/
-        sed -i s~%%_NAT64_IPV6_PREFIX_%%~${NAT64_IPV6_PREFIX}~g unbound.conf
-        sed -i s~%%_NAT64_TAYGA_IPV6_PREFIX_%%~${NAT64_TAYGA_IPV6_PREFIX}~g unbound.conf
+        sed -i s~%%_NAT64_IPV6_PREFIX_%%~"${NAT64_IPV6_PREFIX}"~g unbound.conf
+        sed -i s~%%_NAT64_TAYGA_IPV6_PREFIX_%%~"${NAT64_TAYGA_IPV6_PREFIX}"~g unbound.conf
     popd
 
     pushd /etc/tayga
-        sed -i s~%%_NAT64_TAYGA_IPV4_%%~${NAT64_TAYGA_IPV4}~g default.conf
-        sed -i s~%%_NAT64_TAYGA_IPV6_PREFIX_%%~${NAT64_TAYGA_IPV6_PREFIX}~g default.conf
-        sed -i s~%%_NAT64_TAYGA_DYNAMIC_POOL_%%~${NAT64_TAYGA_DYNAMIC_POOL}~g default.conf
+        sed -i s~%%_NAT64_TAYGA_IPV4_%%~"${NAT64_TAYGA_IPV4}"~g default.conf
+        sed -i s~%%_NAT64_TAYGA_IPV6_PREFIX_%%~"${NAT64_TAYGA_IPV6_PREFIX}"~g default.conf
+        sed -i s~%%_NAT64_TAYGA_DYNAMIC_POOL_%%~"${NAT64_TAYGA_DYNAMIC_POOL}"~g default.conf
     popd
 
     pushd /etc/NetworkManager/system-connections
-        sed -i s~%%_NAT64_TAYGA_IPV6_%%~${NAT64_TAYGA_IPV6}~g nat64.nmconnection
-        sed -i s~%%_NAT64_TAYGA_IPV6_PREFIX_%%~${NAT64_TAYGA_IPV6_PREFIX}~g nat64.nmconnection
-        sed -i s~%%_NAT64_TAYGA_DYNAMIC_POOL_%%~${NAT64_TAYGA_DYNAMIC_POOL}~g nat64.nmconnection
+        sed -i s~%%_NAT64_TAYGA_IPV6_%%~"${NAT64_TAYGA_IPV6}"~g nat64.nmconnection
+        sed -i s~%%_NAT64_TAYGA_IPV6_PREFIX_%%~"${NAT64_TAYGA_IPV6_PREFIX}"~g nat64.nmconnection
+        sed -i s~%%_NAT64_TAYGA_DYNAMIC_POOL_%%~"${NAT64_TAYGA_DYNAMIC_POOL}"~g nat64.nmconnection
     popd
 
     pushd /etc/nftables
-        sed -i s~%%_NAT64_TAYGA_DYNAMIC_POOL_%%~${NAT64_TAYGA_DYNAMIC_POOL}~g nat64.nft
+        sed -i s~%%_NAT64_TAYGA_DYNAMIC_POOL_%%~"${NAT64_TAYGA_DYNAMIC_POOL}"~g nat64.nft
     popd
 }
 

diff --git a/roles/openshift_provisioner_node/files/add_bridge_port.sh b/roles/openshift_provisioner_node/files/add_bridge_port.sh
@@ -10,19 +10,19 @@ set -euo pipefail
 BRIDGE_NAME=${1}
 IFACE_NAME=${2}
 
-CONN_NAME=$(nmcli -t -f GENERAL.CONNECTION dev show ${IFACE_NAME} | cut -d ':' -f 2)
+CONN_NAME=$(nmcli -t -f GENERAL.CONNECTION dev show "${IFACE_NAME}" | cut -d ':' -f 2)
 PORT_NAME=${BRIDGE_NAME}-p0
 
-check_port=$(nmcli con show | grep -c ${PORT_NAME}) || true
+check_port=$(nmcli con show | grep -c "${PORT_NAME}") || true
 
-if [ ${check_port} -ne 0 ]; then
+if [ "${check_port}" -ne 0 ]; then
     echo "Bridge port available. Nothing to do"
     exit 0
 fi
 
-check_iface=$(nmcli dev status | grep -c ${IFACE_NAME}) || true
+check_iface=$(nmcli dev status | grep -c "${IFACE_NAME}") || true
 
-if [ ${check_iface} -eq 0 ]; then
+if [ "${check_iface}" -eq 0 ]; then
     echo "Invalid device name"
     exit 1
 fi
@@ -31,9 +31,9 @@ nohup bash -c "
     nmcli con down \"${CONN_NAME}\"
     nmcli con delete \"${CONN_NAME}\"
     nmcli con add connection.type 802-3-ethernet \
-        connection.id ${PORT_NAME} \
-        connection.interface-name ${IFACE_NAME} \
-        connection.master ${BRIDGE_NAME} \
+        connection.id \"${PORT_NAME}\" \
+        connection.interface-name \"${IFACE_NAME}\" \
+        connection.master \"${BRIDGE_NAME}\" \
         connection.slave-type bridge
 "
 

diff --git a/roles/update/files/continuous-test.sh b/roles/update/files/continuous-test.sh
@@ -54,7 +54,7 @@ set -eu
 ## AUTHOR
 ##   Athlan-Guyot Sofer <sathlang@redhat.com>
 ## ---------------------------------------------------------------------
-FILE=$(basename $0)
+FILE=$(basename "$0")
 
 CT_PARENT=${CT_PARENT:-true}
 CT_CHILD=${CT_CHILD:-false}
@@ -72,7 +72,7 @@ process_sigterm_parent() {
     echo "$$: Parent received term signal" >&2
     if [ -n "${CT_PID}" ]; then
         echo "$$: received term signal: killing $CT_PID" >&2
-        kill -s USR1 $CT_PID
+        kill -s USR1 "$CT_PID"
     else
         # Should not happen.
         echo "$$: received term signal: killing group" >&2
@@ -114,15 +114,15 @@ if "${CT_PARENT}"; then
     else
         export CT_TTY=/dev/null
     fi
-    exec 2>$CT_TTY
+    exec 2>"$CT_TTY"
     echo "entering parent $$ $FILE" >&2
     export CT_SCRIPT_ARGS=${CT_SCRIPT_ARGS:-""}
     export CT_SCRIPT="${@:?'SCRIPT cannot be empty.'}"
     export CT_PREFIX="${CT_PREFIX:-}"
     export CT_PIDFILE="${CT_PIDFILE:-}"
     export CT_CHILD=true
     export CT_PARENT=false
-    setsid ${CT_DIR}/${FILE} "$@" </dev/null >$CT_TTY 2>$CT_TTY &
+    setsid "${CT_DIR}"/"${FILE}" "$@" </dev/null >"$CT_TTY" 2>"$CT_TTY" &
     CT_PID=$!
     if $DEBUG ; then
         trap process_sigterm_parent SIGTERM SIGINT
@@ -137,8 +137,8 @@ fi
 
 if "${CT_CHILD}"; then
     if [ -n "${CT_TTY}" ]; then
-        exec 2> ${CT_TTY}
-        exec 1> ${CT_TTY}
+        exec 2> "${CT_TTY}"
+        exec 1> "${CT_TTY}"
     else
         CT_TTY=/dev/null
     fi
@@ -160,30 +160,30 @@ if "${CT_CHILD}"; then
     echo $$ > "${CT_PIDFILE}"
     # Main loop where eventually run the script.
     while ! $CT_STOP; do
-        setsid ${CT_DIR}/$FILE "$@" </dev/null 2>$CT_TTY
+        setsid "${CT_DIR}"/"$FILE" "$@" </dev/null 2>"$CT_TTY"
     done
     echo "Leaving child $$ running $FILE" >&2
     if [ -z "${CT_PREFIX}" ]; then
         CT_ENDFILE="${CT_DIR}/continuous-test-$$.done"
     else
         CT_ENDFILE="${CT_DIR}/${CT_PREFIX}-$$.done"
     fi
-    date > $CT_ENDFILE
+    date > "$CT_ENDFILE"
     sync
     exit 0
 fi
 
-exec >>$CT_LOGFILE
+exec >>"$CT_LOGFILE"
 mkdir -p "${CT_CMD_OUT_DIR}"
 echo "entering loop $$ $CT_SCRIPT" >&2
 # We cannot have to jobs in the same seconds, or else we will
 # overwrite the file. sleep 1 prevents this.
 sleep 1
 start_time="$(date +%s)"
-start_time_h="$(date -d@${start_time})"
+start_time_h="$(date -d@"${start_time}")"
 echo -n "${start_time_h} (${start_time}) "
 set +e
-"${CT_SCRIPT}" ${CT_SCRIPT_ARGS} &>> "${CT_CMD_OUT_DIR}/${start_time}.log"
+"${CT_SCRIPT}" "${CT_SCRIPT_ARGS}" &>> "${CT_CMD_OUT_DIR}/${start_time}.log"
 RC="${?}"
 set -e
 end_time="$(date +%s)"

diff --git a/scripts/bindep-install b/scripts/bindep-install
@@ -23,12 +23,13 @@ set -xeuo
 
 ## Vars ----------------------------------------------------------------------
 
-export BINDEP_FILE="${BINDEP_FILE:-$(dirname $(readlink -f ${BASH_SOURCE[0]}))/../bindep.txt}"
+export BINDEP_FILE="${BINDEP_FILE:-$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/../bindep.txt}"
 
 
 ## Main ----------------------------------------------------------------------
 
 # Source distribution information
+# shellcheck disable=SC1091  # OS release files are system-provided and may not exist in dev environment
 source /etc/os-release || source /usr/lib/os-release
 RHT_PKG_MGR=$(command -v dnf || command -v yum)
 
@@ -37,7 +38,7 @@ RHT_PKG_MGR=$(command -v dnf || command -v yum)
 BINDEP_PKGS=''
 case ${USE_VENV:-'yes'} in
     y|yes|true)
-        BINDEP_PKGS=$(${HOME}/test-python/bin/bindep -b -f "${BINDEP_FILE}" test || true)
+        BINDEP_PKGS=$("${HOME}"/test-python/bin/bindep -b -f "${BINDEP_FILE}" test || true)
         ;;
     *)
         BINDEP_PKGS=$(bindep -b -f "${BINDEP_FILE}" test || true)
@@ -47,7 +48,7 @@ esac
 if [[ ${#BINDEP_PKGS} -gt 0 ]]; then
     case "${ID,,}" in
         amzn|rhel|centos|fedora)
-            sudo "${RHT_PKG_MGR}" install -y ${BINDEP_PKGS}
+            sudo "${RHT_PKG_MGR}" install -y "${BINDEP_PKGS}"
             ;;
     esac
 fi
diff --git a/scripts/check_k8s_snippets_comment.sh b/scripts/check_k8s_snippets_comment.sh
@@ -10,15 +10,15 @@ if [[ $missing_comment != '' ]]; then
     echo
     echo "${missing_comment}"
     echo
-    let "exit_code+=1"
+    ((exit_code+=1))
 fi
 
 set_path=$(grep -r --exclude="OWNERS" '^# source: ' roles/ci_gen_kustomize_values/templates | sed 's!roles/ci_gen_kustomize_values/templates/!!')
-while read match; do
+while read -r match; do
     tmpl=$(echo "${match}" | cut -d ':' -f 1)
     comment=$(echo "${match}" | cut -d ':' -f 3 | tr -d '[:space:]')
     if [[ "${tmpl}" != "${comment}" ]]; then
-        let "exit_code+=1"
+        ((exit_code+=1))
         echo "${tmpl} doesn't have correct 'source': ${comment}"
     fi
 done <<< "${set_path}"

diff --git a/scripts/create_external_ceph_params.sh b/scripts/create_external_ceph_params.sh
@@ -55,9 +55,9 @@ ssh osp-undercloud-0 "cat ~/external_ceph_params.yaml"
 echo "Copying Ceph configuration files from $CEPH_NODE to osp-controller-0..."
 
 echo "Creating directory on controller..."
-ssh osp-controller-0 mkdir -p $HOME/ceph_client
+ssh osp-controller-0 mkdir -p "\$HOME"/ceph_client
 
-ssh "$CEPH_NODE" sudo cat /etc/ceph/ceph.conf | ssh osp-controller-0 "cat > $HOME/ceph_client/ceph.conf"
-ssh "$CEPH_NODE" sudo cat /etc/ceph/ceph.client.admin.keyring | ssh osp-controller-0 "cat > $HOME/ceph_client/ceph.client.admin.keyring"
+ssh "$CEPH_NODE" sudo cat /etc/ceph/ceph.conf | ssh osp-controller-0 "cat > \$HOME/ceph_client/ceph.conf"
+ssh "$CEPH_NODE" sudo cat /etc/ceph/ceph.client.admin.keyring | ssh osp-controller-0 "cat > \$HOME/ceph_client/ceph.client.admin.keyring"
 
-echo " Done! Files copied to osp-controller-0:$HOME/ceph_client/"
+echo " Done! Files copied to osp-controller-0:\$HOME/ceph_client/"
diff --git a/scripts/prepare_doc_build_env.sh b/scripts/prepare_doc_build_env.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 set -xe
 
-PROJECT_DIR="$(dirname $(readlink -f $0))/../"
+PROJECT_DIR="$(dirname "$(readlink -f "$0")")/../"
 
 # Create a symlink for ansible_collections python package
 SITE_PACKAGES=$(python -c "import site; print(site.getsitepackages()[0])")
@@ -12,10 +12,10 @@ ansible-galaxy collection install -U .. -p "${SITE_PACKAGES}"
 
 # Create links for roles' README.md in
 # docs/source/roles
-for i in ${PROJECT_DIR}/roles/*/README.md; do
-    dir_name=$(dirname ${i})
-    role_name=$(basename ${dir_name})
-    test -L docs/source/roles/${role_name}.md || \
-    ln -s ../../../roles/${role_name}/README.md \
-        docs/source/roles/${role_name}.md
+for i in "${PROJECT_DIR}"/roles/*/README.md; do
+    dir_name=$(dirname "${i}")
+    role_name=$(basename "${dir_name}")
+    test -L docs/source/roles/"${role_name}".md || \
+    ln -s ../../../roles/"${role_name}"/README.md \
+        docs/source/roles/"${role_name}".md
 done
diff --git a/scripts/run_ansible_test b/scripts/run_ansible_test
@@ -21,7 +21,7 @@ set -o pipefail
 set -xeuo
 
 ## Vars ----------------------------------------------------------------------
-PROJECT_DIR="$(dirname $(readlink -f ${BASH_SOURCE[0]}))/../"
+PROJECT_DIR="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/../"
 USE_VENV=${USE_VENV:-yes}
 HOME=${HOME:-/tmp}
 ANSIBLE_GALAXY_RETIRES=5
@@ -31,11 +31,9 @@ export ANSIBLE_LOCAL_TMP=${HOME}
 export ANSIBLE_REMOTE_TMP=${HOME}
 
 ansible_test='ansible-test'
-collection_path='/usr/share/ansible/collections/ansible_collections'
 case ${USE_VENV} in
     y|yes|true):
         ansible_test="${HOME}/test-python/bin/ansible-test"
-        collection_path="${HOME}/.ansible/collections/ansible_collections"
         ;;
 esac
 
@@ -51,7 +49,7 @@ ansible_version=$(python3 -c "import ansible; print(ansible.__version__)" | sed
 cat  "${HOME}/.ansible/collections/ansible_collections/cifmw/general/tests/sanity/ignore.txt" >> \
     "${HOME}/.ansible/collections/ansible_collections/cifmw/general/tests/sanity/ignore-${ansible_version}.txt"
 
-pushd ${HOME}/.ansible/collections/ansible_collections/cifmw/general
+pushd "${HOME}"/.ansible/collections/ansible_collections/cifmw/general
 
 if [ -d tests/unit ]; then
     ${ansible_test} units --color=yes --requirements -vv

diff --git a/scripts/run_molecule b/scripts/run_molecule
@@ -21,7 +21,7 @@ set -o pipefail
 set -xeuo
 
 ## Vars ----------------------------------------------------------------------
-PROJECT_DIR="$(dirname $(readlink -f ${BASH_SOURCE[0]}))/../"
+PROJECT_DIR="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/../"
 ROLE_DIR=$1
 USE_VENV=${USE_VENV:-yes}
 MOLECULE_CONFIG=${MOLECULE_CONFIG:-.config/molecule/config_podman.yml}
@@ -49,16 +49,16 @@ git clone https://github.com/openstack-k8s-operators/install_yamls /root/src/git
 
 export ANSIBLE_ACTION_PLUGINS=./plugins/action:~/.ansible/plugins/action:/usr/share/ansible/plugins/actions
 for rolepath in ${ROLES_LIST}; do
-    role=$(echo $rolepath|sed "s|${local_roledir}||" | cut -f1 -d /)
-    test -d ${role} || continue
+    role=$(echo "$rolepath"|sed "s|${local_roledir}||" | cut -f1 -d /)
+    test -d "${role}" || continue
     echo "Running molecule against: ${role}"
-    pushd $role
+    pushd "$role"
     case ${USE_VENV} in
         y|yes|true)
-            ${HOME}/test-python/bin/molecule -c "${PROJECT_DIR}${MOLECULE_CONFIG}" ${TEST_VERBOSITY} test --all
+            "${HOME}"/test-python/bin/molecule -c "${PROJECT_DIR}${MOLECULE_CONFIG}" "${TEST_VERBOSITY}" test --all
             ;;
         *)
-            molecule -c "${PROJECT_DIR}${MOLECULE_CONFIG}" ${TEST_VERBOSITY} test --all
+            molecule -c "${PROJECT_DIR}${MOLECULE_CONFIG}" "${TEST_VERBOSITY}" test --all
             ;;
     esac
     popd

diff --git a/scripts/setup_env b/scripts/setup_env
@@ -20,7 +20,8 @@ set -o pipefail
 set -xeuo
 
 ## Vars ----------------------------------------------------------------------
-export PROJECT_DIR="$(dirname $(dirname $(readlink -f ${BASH_SOURCE[0]})))"
+PROJECT_DIR="$(dirname "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")")"
+export PROJECT_DIR
 # NOTE(cloudnull): Disable ansible compat check, caters to the case where
 #                  system ansible may be installed.
 export ANSIBLE_SKIP_CONFLICT_CHECK=1
@@ -29,8 +30,8 @@ USE_VENV=${USE_VENV:-'yes'}
 
 ## Main ----------------------------------------------------------------------
 # Source distribution information
+# shellcheck disable=SC1091  # OS release files are system-provided and may not exist in dev environment
 source /etc/os-release || source /usr/lib/os-release
-RHT_PKG_MGR=$(command -v dnf)
 PYTHON_EXEC=$(command -v python3)
 SYSTEM_PIP=$(dirname "$PYTHON_EXEC")/pip3
 
@@ -63,9 +64,9 @@ esac
 sudo -k
 
 # Ensure the required ci file is presnet
-mkdir -p ${HOME}/ci/yum.repos.d
-cp /etc/ci/mirror_info.sh ${HOME}/ci || touch ${HOME}/ci/mirror_info.sh
-cp -r /opt/yum.repos.d/* ${HOME}/ci/yum.repos.d || cp -r /etc/yum.repos.d/* ${HOME}/ci/yum.repos.d
+mkdir -p "${HOME}"/ci/yum.repos.d
+cp /etc/ci/mirror_info.sh "${HOME}"/ci || touch "${HOME}"/ci/mirror_info.sh
+cp -r /opt/yum.repos.d/* "${HOME}"/ci/yum.repos.d || cp -r /etc/yum.repos.d/* "${HOME}"/ci/yum.repos.d
 
 
 case ${USE_VENV} in
@@ -82,7 +83,7 @@ esac
 "${PIP}" install pip setuptools bindep --upgrade
 "${PROJECT_DIR}/scripts/bindep-install"
 
-${SYSTEM_PIP} install ${PIP_INSTALL_ARGUMENTS}
+${SYSTEM_PIP} install "${PIP_INSTALL_ARGUMENTS}"
 
 # Display list of installed packages with versions (debugging failures)
 "${SYSTEM_PIP}" freeze