Set inject_facts_as_vars to False to match what we do in
Kolla-Ansible (and this option will default to False in 2.24)
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/972696
Change-Id: Iae2b70ca62fd68400bde9296edcda8e53f14a896
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
According to https://www.influxdata.com/blog/package-signing-key-rotation
the preferred signing key for influxdata package repositories
changed in early 2026. Update to the new preferred key.
Closes-Bug: #2138095
Change-Id: I77d38e713678ea653ded3b14fd0541d3ec0ebee6
Signed-off-by: Michael Still <mikal@stillhq.com>
Without that - these are not run at all
Update Bookworm to Trixie while we're at it
Change-Id: I6fb70da636514b5c1057c16cc2df08b07820bc5f
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
This reverts commit ef12d96731.
Reason for revert: Broke community.mysql
Change-Id: Icb85112c66645d8df00eb0c40076a6bd822f6866
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
networking-generic-switch was added to u-c [1] and it breaks our
install scheme.
Alternative is to remove networking-generic-switch from sources.py,
but that would be a user facing change and if we would pursue that
we would need to do the same for all neutron plugins.
using u-c removal macro to preserve previous approach of installing
n-g-s from a branch tarball compared to a pypi version
[1]: https://review.opendev.org/c/openstack/requirements/+/964059
Change-Id: Ifcee01f9415e9b9de8138b55cd676873a99c86aa
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
This repo enablement is here by mistake, the glusterfs-fuse
package installation has been removed in the original
CentOS Stream 10 patch.
Change-Id: I395fcae7fd39ea7488191690f994ad98a8184f65
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
RabbitMQ announced some time ago that the package archives were moving:
https://www.rabbitmq.com/blog/2025/07/16/debian-apt-repositories-are-moving
The old location is no longer working, so this patch transitions to
the new one.
Closes-Bug: #2131736
Change-Id: I6ef0ed9cc40be42a0d98c6a4c83c5c5c26d9cdbf
Signed-off-by: Michael Still <mikal@stillhq.com>
Add file to the reno documentation build to show release notes for
stable/2025.2.
Use pbr instruction to increment the minor version number
automatically so that master versions are higher than the versions on
stable/2025.2.
Sem-Ver: feature
Change-Id: If6d5a967a12cb6143a5bb1f321d8cc0231552275
Signed-off-by: OpenStack Release Bot <infra-root@openstack.org>
Generated-By: openstack/project-config:roles/copy-release-tools-scripts/files/release-tools/add_release_note_page.sh
To fix arm64 valkey build.
The virtual `valkey` resolves to `valkey-server` in bookworm-backports,
but our global -1000 pin blocks it. Amd64 worked only because extrepo
shipped it. Use valkey directly from the backports packages instead.
follow up to https://review.opendev.org/c/openstack/kolla/+/932174
Change-Id: I846e4f19696ca28758cb9c0400be96c01b079daa
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
Since Venus is removed - that is not needed anymore
Change-Id: I444304139dfbe451b5449a181de1129f073b7535
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
It has been marked as inactive and venus dashboard plugin is breaking
Horizon Kolla builds.
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/964860
Change-Id: I3a04487a75c04ba989fa70f2025db33308671dfb
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
The agent was removed from neutron during 2025.1 cycle. The remaining
implementation to deploy it is being removed from kolla-anible now.
Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/962278
Change-Id: I2cf22b874fcb885752bf3800c8ad8fa7a5eacff7
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
MariaDB clustercheck script has not been maintained and it will not work
with MariaDB 11.4 (the next LTS version).
This is because clustercheck.sh uses ``mysql*`` commands but from
MariaDB 11.4, those commands are not supported.
The health check of MariaDB server containers will be done by new script
which comes with change [1].
Without MariaDB clustercheck, MariaDB server becomes only container image in
the family, so mariadb-base and mariadb-server dockerfiles are merged.
To avoid breaking changes, the name 'mariadb-server' is retained.
Follow-up to rename references in Kolla and K-A from 'mariadb-server' to
'mariadb' would be nice.
[1] https://review.opendev.org/c/openstack/kolla/+/962657
Change-Id: I01278f76ee82b018a854b5862f3caaa8c78a9a30
Signed-off-by: Seunghun Lee <seunghun@stackhpc.com>
Introduce rpm/deb entry in repos.yaml, create a structure
[base_package_type]:
[base_distro]:
[base_distro-$arch]
Allow any of these to be undefined, defaulting to empty dict
This allows to deduplicate entries between distros of the same
base_package_type (rpm/deb)
Sort repos.yaml
Change-Id: Ifc351d5d612e6c6cc82be282aed179c656ae252c
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Fluent Package v5 LTS will reach end of support at
the end of 2025.
Fluent Package v6 LTS will be supported until at least
the end of 2027.
This change updates the apt repository configuration and package version
to use Fluent Package v6 LTS for Ubuntu, Debian and RHEL.
No changes to existing Fluentd configuration files are required.
Change-Id: Iaf3c4de859986629f9768563a319fe0385acff6a
Signed-off-by: Piotr Milewski <vurmil@gmail.com>
keepalived wrapper script as the only one didn't have --rm
in docker/podman invocation - so these didn't get deleted
when stopped/crashed/etc.
Closes-Bug: #2127170
Change-Id: I85ae37250ac4ef629b77ade04826a363e8047a91
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Rename aarch64 to arm64 to sync with OpenDev nodeset naming
Remove base_arch/base_distro/base_distro_version and derive it
from zuul job name
Change-Id: I2f8367ae81d0972517b8712e1cb6ead1044accc4
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Add the ability to configure repositories in the same
way as we do Debuntu ones - via repos.yaml.
Removes .repo files from base - since these are not
needed there anymore.
gpgcheck = 1 is default in docker/base/dnf.conf
Change-Id: I7df7d452c45c57c434d5b4ad15a87963e4d6d0d4
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Currently we are enabling repos irrespective of rpm/deb
statement blocks and not failing in the method used
if a repository is missing.
Downside is - we might be producing one more layer,
but it probably is a more logical approach.
This is required for adding rpm support in repos.yaml
that will also include failing on missing repositories.
Change-Id: I5479c5c935760f00fe4cd307366f261deee3199f
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
It was ommitted in the patch that renamed it from .zuul.d
Change-Id: I8e4470185321fad1be3e2307c7578ca54d197718
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
podman jobs have also been omitted in the original patch
Change-Id: I1ddb4e9ead170f22b231b8595d4dbf7cb0d4fb78
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
pg_config has been moved to postgresql-server, postgresql-devel
only installs a link to pg_config which is unresolvable without
-server package.
Installing postgresql-server-devel to include headers which are
also required for building psycopg2.
Change-Id: I35548a02f652c035c17aabe149752322ffc869c4
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Cinder removed it in I28666e63896fed0f1661b5964ec46952074f4b23
Change-Id: I69ec97fe8480d27942cc923c170ec3cd669caf06
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
In ml2/ovn setups, the neutron-metadata-agent spawns haproxy processes
to serve metadata requests. To run these haproxy instances inside their
own containers, the wrapper script must be available in the
metadata-agent container.
This is a follow up on I679ac66186d457ae53f89469fe22c5662089019a
Change-Id: Ia47af98ff723ebe8ea8461d05a2bc3b58af845f9
Signed-off-by: Maximilian Stinsky <maximilian.stinsky-damke@wiit.cloud>
The goal is to unify common contributor information across
all kolla projects (communication, launchpad links, etc).
Change-Id: Iddcaa8723b364fe4e8619f8fc2b03c93b685db86
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
RDO has staffing problems and has decided to only
support SLURP releases - let's drop reliance on that
repository.
Change-Id: I56f86a1c5262e3ee2bcbb52cae53c3b2655ed87f
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Updates a range of monitoring and core infrastructure components
to their latest stable upstream versions to leverage new
features and bug fixes.
etcd: 3.5.16 -> 3.6.4
letsencrypt-lego: 4.20.4 -> 4.25.2
prometheus-blackbox-exporter: 0.25.0 -> 0.27.0
prometheus-cadvisor: 0.49.2 -> 0.53.0
prometheus-elasticsearch-exporter: 1.8.0 -> 1.9.0
prometheus-memcached-exporter: 0.15.0 -> 0.15.3
prometheus-mysqld-exporter: 0.16.0 -> 0.17.2
prometheus-node-exporter: 1.8.2 -> 1.9.1
prometheus-server: 3.2.1 -> 3.5.0
The Prometheus-server package has also been switched to
a Long-Term Support (LTS) version, which ensures extended
stability and security support.
Change-Id: Ib9805fb6a93a0da887918174d9994caa5f1306d3
Signed-off-by: Piotr Milewski <vurmil@gmail.com>
It should not be required anymore, all these information are dumped
by different means (generic zuul playbooks, etc).
Change-Id: I80569b6fe9e4d779a5448015b8ad9caf09e5abf6
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
RabbitMQ from 4.0.x to 4.1.x
Erlang from 26.2.x to 27.x
Change-Id: I710b2a95c840862f52d812df306d1fb26dd4340b
Signed-off-by: Seunghun Lee <seunghun@stackhpc.com>
Switch the RHEL repo to the stable channel as per [1]. Use new GPG.
Telegraf arm64 builds are enabled again, as binaries exists.
[1] https://repos.influxdata.com/stable/x86_64/
Change-Id: Ie4f6f15404f6965df51f3214506ae9f8bb9b61e7
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
Re-enable the Ubuntu arm64 build. The previous exclusion was due to
uWSGI issue [1], which is no longer reproducible on Ubuntu Noble.
Change-Id: I400e9a9a3bf03053589835f933023eedee504f08
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
This reverts commit 2b42c958ef.
Reason for revert: Make job voting again
Change-Id: Ie3583682ec0d7a55cd9e8bedde9f51550b7c1840
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
9 was used as an interim solution when OpenDev did not support it.
Change-Id: If6101d99c216a9b1142bfdf194f7a053730e28da
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Bumps libvirt exporter source from v1.6.0 to v2.2.0. This fixes some
metrics that were lost when the exporter was changed from the old
"tinkoff" source to "inovex".
See also Icc8a3651d601ab45d448c9d252ca6155219d21cf
Closes-Bug: #2120639
Change-Id: Ib738325603173157b4c482f9de6d5d9cea0b758a
Signed-off-by: Alex Welsh <alex@stackhpc.com>
They have been removed with Icaba9424862b883388bf68d2c3d48138b7b906b0
Not creating local versions like with keystone because Kolla-Ansible
does not use WSGI for Manila yet.
Change-Id: Ia34d848d8641e43681c602c9c4433364e8be1d92
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
It has been removed with I9fa7cd60bf27768db06f69681675fce2e55712af
Change-Id: Ib42be3d56bdb64247ac6f17b8ac1f1baa873f475
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
See I0a8e26e8990eae8108537541159f7810d35b70f1
Change-Id: I95500612168871454ce269b3562a8daccdf4de4f
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Since Docker 28.3.3 the daemon rejects a push that carries no
`X-Registry-Auth` header [1]. The SDK already sets this header when it
finds credentials, so the breakage happens only on anonymous pushes.
During `PushTask.push_image()` we now check whether the SDK can resolve
credentials for the target registry; if it cannot, we inject
`auth_config={}`, causing the SDK to send the minimal "{}" header that
satisfies the daemon while leaving authenticated pushes unchanged.
Drop this addition when [2] is fixed.
[1] https://github.com/moby/moby/pull/50371
[2] https://github.com/docker/docker-py/issues/3348
Closes-Bug: #2119619
Change-Id: I7a2f3fce223afd74741b40bf62836b325fca5b19
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
skyline-apiserver's Dockerfile has a comment around removing a line when
I2dababab7c79e7c37983c1702178419c88e014a5 merges. Given the
referenced change has now merged, remove the TODO and the temporary
fix.
Change-Id: If2b9aff8f1900fb98e038972e775c3eddaad373f
Signed-off-by: Michael Still <mikal@stillhq.com>
to be in sync with kolla-ansible
also add pin to ansible-core
Change-Id: Idf35af1b776d0e908fd328f0ec5eb825f1f2ca9c
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
Enabling repo should be handled by enable_extra_repos macro
Closes-bug: #2117249
Change-Id: I92af980a4fd63540297b6bde0d52b2dfd02f72ce
Signed-off-by: Grzegorz Koper <grzegorzk@stackhpc.com>
Known missing packages:
- mod_auth_mellon - missing SAML support in Keystone/Horizon - built in Kolla COPR
- glusterfs-fuse in manila-share - built in Kolla COPR
- collectd/telegraf - no opstools repository
- redis - needs a switch to valkey
- python3-ethtool - not required for neutron-mlnx-agent since 6 years [1]
Building packages in Kolla COPR is a temporary solution until these show up
in EPEL10.
[1]: Id2cae3ac9ff049e9fc8225551f99e1e99a87fc65
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/951751
Change-Id: I7074fabcf95184fcfd2561648ae1e05acfb0bc11
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Previous apt preference missed the epoch and sub-packages, so no
pinning was applied.
Closes-Bug: #2115893
Change-Id: I5c765db0508a2ffec90ba149bb5ea9b90dd31bc8
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
ovn is running as root, and fluentd can't read it's log files,
so we need to precreate these.
Closes-Bug: #2115244
Change-Id: Icb0e47cf95a67cb4585c71f863e542bc59ff5009
If a configuration file is tracked in the state file
but no longer appears in config.json, it should either be
restored or removed.
This patch introduces a new exception StateMismatch and
updates execute_config_check() to detect such cases. If
any destination path is present in the defaults state but
missing from config.json, we now raise StateMismatch.
A dedicated unit test has been added to verify
this behavior.
Closes-Bug: #2114173
Signed-off-by: Michal Arbet <michal.arbet@ultimum.io>
Change-Id: I6e0b4aaa5722990e3ac647578023f474db3d4381
This change fixes the issue with absent rsync package when
'remote_filesystem_transport = rsync' is enabled in nova_compute.
Closes-Bug: #2113926
Change-Id: Ie6719928e4ec2901d661f44c9f259add35afa269
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
Normally, for other images, we simply copy
etc/*, but Aodh has its api-paste located
elsewhere. This patch copies the default
Aodh api-paste into /etc/aodh/.
Signed-off-by: Michal Arbet <michal.arbet@ultimum.io>
Change-Id: I5eccc1b994c537e1d1adea21520d045674a9d41c
We've seen multiple occassions of all these healthcheck commands
not being able to be executed in 30s after the switch to RMQ 4.1.
Let's put more information in the Docker/Podman healthcheck logs.
Change-Id: I4b1b54983144f5514a6703c255d2cb4fa052a0fb
Since this exporter is no longer developed, and is not used in Kolla
Ansible, remove it immediately. A replacement has been proposed in
change #951971.
Change-Id: Ie47aed221d04bbb2b50ccfbd7c398e6ab6022442
The dibbler-client package has been removed from upstream Rocky repos,
breaking neutron-l3-agent container image builds on RL9. Since the
2025.1 release, package is no longer used in Neutron has been removed
because the project is stale and functionality was untested [1].
This change removes the package from the image build for all
distributions.
[1] https://review.opendev.org/c/openstack/neutron/+/934283
Closes-Bug: #2112575
Change-Id: I35b233a499c6bf1861b376fc441dc8081cfaf5d6
Signed-off-by: Alex Welsh <alex@stackhpc.com>
Kolla Ansible now generates ProxySQL query rules not only based on
the schema name (schemaname), but also on the username. This is
needed to properly route queries that are executed before a database
schema is selected, such as `SET AUTOCOMMIT` or `ROLLBACK`.
To support this, the ProxySQL config sanity check must correctly
deduplicate rules based on both `schemaname` and `username`, and
avoid false positives when both types are used simultaneously.
This change adjusts the logic in `kolla_proxysql_config_sync` to:
- recognize rules by key `schema:<schemaname>` or `user:<username>`
- assign unique rule IDs only to truly distinct rules
- log and skip exact duplicates with appropriate context
This fix is required to support the Kolla Ansible patch below.
Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/951599
Change-Id: I99acd1984ee555a5b6c731e6ee460a33677060d0
We have multiple CI issues currently, make the
kolla-ansible-debian-upgrade job non-voting so that we can merge fixes
in order.
Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I2d7137f3d01eb28f7693113fb690069e2760820f
Ubuntu images were occasionally failing to build due to
unavailability or slowness of the official Ubuntu security
repositories. Although Kolla uses `mirror://` URLs to
leverage Ubuntu mirror infrastructure, the original
`/etc/apt/sources.list.d/ubuntu.sources` file was still
present, causing the system to fallback to default sources.
This commit aligns Ubuntu behavior with Debian by
explicitly removing the distro `.sources` file and relying
solely on the sources configured by Kolla. This ensures
consistent and reproducible builds both in CI and
on local environments.
Closes-Bug: #2112140
Change-Id: I00bcb30662bb12ed8711b28a64ef1941dcce893a
The original script used --incremental-history-name and compressed
full backups as gzip streams. This failed because mariabackup expects
an actual decompressed base directory for incremental backups.
This patch:
- Decompresses the latest full backup into a temporary directory
- Uses that as --incremental-basedir
- Aligns the backup flow with official Mariabackup documentation:
https://mariadb.com/kb/en/incremental-backup-and-restore-with-mariabackup/
This makes the incremental process reliable and fully supported.
Closes-Bug: #2111620
Change-Id: I562ce5e54752015863a20bf113bce74a69e02331
... because stestr is now used instead of nose.
Also drop the VIRTUAL_ENV environment which is now automatically set
by tox.
Change-Id: Ied6e20f5b1dc5de384f29d317bec998e86f26efa
Python 3.13 introduces a behavior change in unittest.mock.mock_open(),
which now calls close() when exiting the context manager
as described in bpo-44185 [1]. This causes additional mock calls to appear,
breaking strict mock_calls assertions.
This patch fix tests and add compatibility for Python 3.13.
From mock documentation [2]:
"bpo-44185: unittest.mock.mock_open() will call the close() method
of the file handle mock when it is exiting from the context manager.
Patch by Samet Yaslan."
[1] https://bugs.python.org/issue44185
[2] https://mock.readthedocs.io/en/latest/changelog.html
Change-Id: Ib8e2a8a20a828c4c69deedd307c9b726f51489f8
Add file to the reno documentation build to show release notes for
stable/2025.1.
Use pbr instruction to increment the minor version number
automatically so that master versions are higher than the versions on
stable/2025.1.
Sem-Ver: feature
Change-Id: I4842c6c95633743dc949e3d19d6c5e295c89af33
These scripts have been based on TripleO version of the
same feature.
Unfortunately due to the fact that Neutron/python is
stripping env vars when it's running dnsmasq/haproxy/etc
processes - we need to do the ,,config'' handling in
copy-wrappers script.
Change-Id: I679ac66186d457ae53f89469fe22c5662089019a
When {{ venv_path }}/lib/python3 already exist and we run the ln
command, we end up with:
/var/lib/kolla/venv/lib/
├── python3 -> python3.9
├── python3.12
│ └── site-packages
└── python3.9
├── python3.12 -> python3.12
└── site-packages
Instead, it should be:
/var/lib/kolla/venv/lib/
├── python3 -> python3.12
├── python3.12
│ └── site-packages
└── python3.9
└── site-packages
Remove the existing link first to ensure it is created properly.
Change-Id: I42dd2490d14070074fe1fa7ae9e0a4cbf095b06f
The new client software version requires the use of a specific group
called "hsmusers", and for consistency reasons, we are specifying both,
the user id and the group id, and inserting the Barbican username inside
of such a group.
More information can be found on
https://www.thalesdocs.com/gphsm/luna/7/docs/pci/Content/install/client_install/linux_install.htm
Change-Id: Ib7d0c879b3741ca472cd0bbf3a9a88a0fee25cac
Signed-off-by: Mauricio Harley <mharley@redhat.com>
Letsencrypt allows using a specific key type for certificates. If
the user has an internal letsencrypt mechanism, such as Vault Acme,
then they have to provide a specific key type as the default is
not supported.
This change will allow a user to specify a key type and use the lego
default in the event that they don't specify it.
Partial-Bug: 2087860
Change-Id: I83e618a861b4d51b6a7893f79c50fdfc35228891
Copy aarch64 snponly.efi to /tftpboot during bootstrapping
of Centos- and Rocky-based ironic-pxe.
Don't use $KOLLA_BASE_ARCH when symlinking to
/tftpboot/ipxe.efi, because an aarch64 variant of this
binary doesn't exist, just x86_64.
Change-Id: Ie19fcb441a2e54a60762e5c8483487b713a29ddd
Support aarch64 ipxe only when using Ubuntu and Rocky
Linux base images, as the Debian ipxe package does not
provide a suitable aarch64 ipxe binary.
Change-Id: If5610148fc80acf13d4eb79fef78349764f08a17
Docker does not support running a container in a given
network namespace (netns) so we need a client installed
in the Neutron container images.
Related-Bug: #1891469
Change-Id: I5349449183dbb7f4ec2042a21526076fb42591b3
It has long been sort of an abomination of the container world,
let's use this deprecation notice as a motivation to work out
a kolla-ansible mechanism utilising regular ironic container
images to deploy standalone ironic.
Change-Id: I6b4e6edc110eebb524396138d24b873cb4ea6726
When building an image, the RUN command grants
permissions which causes the previous layer
to be copied.
During the test, the image was reduced from 2.84GB to 1.57GB
Closes-Bug: #2104007
Change-Id: I7d2367d4c277287f4db2885f5720a35d934f94b7
Ensure that when building etcd with --base-arch aarch64, Kolla
uses the arm64 tarball instead of amd64.
Related-Bug: #2103810
Change-Id: I6248cb6646b2b0c7af1c29f9a0a244cef1c4cf05
Derive debian_arch from base_arch by default when not set by the user.
This ensures that cross-architecture builds correctly download
the appropriate binaries, while preserving any explicit user override.
Closes-Bug: #2103810
Change-Id: I11b7e19ac3a12147138a98fc1e030767f70b44c9
It probably has been omitted in Ubuntu 24.04 introduction since
aarch64 build jobs have not been stable.
Removing from nova-compute since it's already in nova-base,
nova-libvirt's parent is base - so updating to qemu-efi-aarch64
Change-Id: Idae2e87bfc8a556a090085e46f96d11279080f0f
fix: added mdevctl to nova-libvirt debian based containers, mdevctl is an
optional dependency of libvirt needed in 2024.2 for nova vGPU feature.
Closes-Bug: #2088055
Change-Id: Ifa92999672ed267ce877c492c9140fbee271b8b3
In certain deployments ironic-conductor needs to create floppy images to
mount in virtual media. This needs the mtools package installed.
Change-Id: I00ccc47f7a993f13e2b2feb3f6a2565dad32b80c
When kolla is cloning a Git repository during the build
process, the `.git/config` file retains the remote
origin URL, which may expose sensitive credentials if
authentication tokens are embedded in the URL.
This fix ensures that the remote is removed after cloning
to prevent unintended exposure of credentials.
Closes-Bug: #2098904
Change-Id: Iec21fc2363e03133ec77326da7392bc25b40132a
Commit 79a2342395 introduced an ability to
build 'in-house'/'not-built-in' projects with Kolla.
This commits extends this feature with an ability to use configure_user
macro for 'not-built-in' users.
The implementation is done the same way as for 'sources', i.e. engine
after registers new section structure as soon as it finds unknown
'<project>-user' section.
In addition, the documentation and CI are extended to cover
``--docker-dir`` option.
Change-Id: I690d9f3829083f2493bf286a1c45764b9699219b
Previously, the `pycadf` package did not include
configuration files, so they were manually installed
from source. However, this was fixed in pycadf's upstream
in [1], allowing us to rely on the package itself.
Additionally, the `ceilometer_api_audit_map.conf` file
has been removed, as it was dropped in pycadf's upstream
commit here [2]
[1] https://review.opendev.org/c/openstack/pycadf/+/936741
[2] https://review.opendev.org/c/openstack/pycadf/+/930971
Change-Id: I022aa4c403f08385beb83b5d0c81f8abb42eb4a7
Users can override the upper-constraints.txt by setting the source of
openstack-base in kolla-build.conf.
However, bifrost-base Dockerfile so far doesn't pass overridden
upper-constraints file to Bifrost install playbook resulting the
playbook not acknowledging it and just use upstream one.
This change sets the source of Bifrost upper-constraints to use
upper-constraints of openstack-base for consistency among all Kolla
images
With this, change the environment variable UPPER_CONSTRAINTS_FILE is
only affecting kolla-toolbox image.
Therefore, moved UPPER_CONSTRATINS_FILE variable example to the
``kolla_toolbox_pip_conf`` block of kolla-toolbox Dockerfile.
Additionally, updated 'Python packages build options' section of
documentation to represent latest method of changing Python package
related options (including this change).
Change-Id: I0a9c782ca1177ef84e4323cb1e5bfac0fb3f383c
We need newer ovn-ctl with [1] - for now download that from
ovn-org/ovn@master - once 25.03 is branched we should
get that the normal way.
[1]: 2ecba75432
Change-Id: I429f00ed4bdcd24409d14453ab53c5fa11fdb00b
Currently tox -e genconfig fails with stevedore issues,
because tox is not doing sdist.
Closes-Bug: #2051575
Change-Id: Idfc26fe380a546d0fd712a531e5913090b01d808
The package moved to the cinder-base image since it already added to
the cinder-volume in I84c7633765749a5e9ced983505ef290c32154ccc.
Closes-Bug: #2089587
Change-Id: I06e61ab388d9ecfa78e5d1fe1ae9cb8602d1cd36
Signed-off-by: FelipeAFV <ffigueroa@whitestack.com>
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
Fixes /var/log/kolla/neutron/dnsmasq.log rights so
fluentd can read logs from that file.
Closes-Bug: #1693712
Change-Id: I57e36ef07e8840eead2efde77e0ab9dfd4842931
In order to add support to uwsgi (which is opening the log file
after dropping privileges) we need to set proper permissions
for /var/log/kolla/cinder directory
Change-Id: I46da8fad93febbc462cbe42a0d96ef7d423b8965
This patch renames the update-haproxy-cert script to
update-loadbalancer-cert to make the name more generic.
The change is necessary because support for ProxySQL
will be introduced in the next patch, requiring a name
that reflects broader applicability.
To keep the diff in the following patch clean and easier
to review, this patch focuses exclusively on the rename.
Change-Id: I15f9b5cf3976f4298cdc7da4530f2d7d09614e88
This patch fixes recently merged [1] patch.
- Original patch added params function args
eab, hmac, key_id, but then
EXTERNAL_ACCOUNT_BINDING_OPTS var is passed
into obtain_or_renew_certificate which
can't work
- This patch correctly set EXTERNAL_ACCOUNT_BINDING,
HMAC, KEY_ID defaults and then call obtain_or_renew_certificate
function with them. This will ensure that arguments are always
set, so we can write if condtional correctly and process.
[1] https://review.opendev.org/c/openstack/kolla/+/916617
Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/933924
Change-Id: I406ff10edec9dc94b1a3de005080e149ee3ab3f2
This reverts commit 5af5febf50.
Reason for revert: Epoxy cycle is on
In addition to the revert skyline-apiserver aiosqlite u-c
is removed until [1] is merged, designate rootwrap.conf.sample
file has been renamed to rootwrap.conf and pycadf is bumped to 4.0.0.
[1]: https://review.opendev.org/c/openstack/skyline-apiserver/+/935604
Change-Id: I1265633f0913b7927955564fac911a682615004a
Python3-pip installs the dependent package tzdata
and blocks the mount of the /etc/localtime file in docker.
After deleting the symbolic link docker correctly mounts
the external localtime file.
Applies only to ubuntu 24.04, in previous versions
of ubuntu there was no such problem
Closes-Bug: #2091161
Change-Id: I733a50b5ca455cfa4b248dc324500d78c17c817b
So far, the certificates were not part of config.json
files for containers. With future patches that will remove
container restarts based on triggers from config and
service-copy-cert, it is important that all files that change
during config are specified in config.json so that
kolla-set-configs --check can detect those changes and based
on that restart the container. This patch provides prerequisite
for future patch in kolla-ansible.
Comments from kevko:
The script also takes into account whether review [1] is
merged or not, ensuring that it will function correctly in
both cases thanks to review [2], because using the state
file, we can effectively verify whether the config.json that
copies CA certs to /var/lib/kolla/share is being used or not.
If we didn’t handle it this way, we would have to rely on
checking whether the directory /var/lib/kolla/share exists or
some another magic, which is insufficient because various
states and combinations of Kolla image and Kolla-Ansible
versions could result in certificates always being copied.
This method provides a clear and definitive distinction.
[1] https://review.opendev.org/c/openstack/kolla-ansible/+/924651
[2] https://review.opendev.org/c/openstack/kolla/+/915440
Change-Id: I5120f1874f25a9ca8326e6db8b12dee4c81feb56
Signed-off-by: Roman Krček <roman.krcek@tietoevry.com>
Co-Authored-By: Michal Arbet <michal.arbet@ultimum.io>
Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/924651
This patch adds a way to patch files in a Docker
image built by Kolla. This is very useful for several
reasons, specifically:
- Custom modifications
- The stable branch of some library has a fix but no pip
package has been released
- Eliminates the need to package your own pip packages
- Eliminates the need to invent your own versioning to prevent
upstream versioning
- Eliminates the need to manage a pip server
- In other words, it eliminates the need to get a wheel into
the image and install it manually using any method not
previously mentioned
It is also highly desirable because, although Kolla can replace
the source for a service with a custom URL for a tarball or its
own Git repo, it cannot do this for dependencies pulled from pip.
I would also like to point out that this is a feature with its own
code path and works only if the user "inserts" a patch into the folder
patches/docker-image/something.patch and creates an analogous series
file for patch source code.
Simply said, this code will never interfere with the upstream build process
since this feature is not intended for use in upstream.
It is rather meant for downstream users who know what they are doing.
Now they just have an option to patch their images.
Everything works on all layers of the Docker image and stores a report
of applied patches which can then be seen in /etc.
This mechanism is similar as debian patch quilt.
Change-Id: I61d0790c5d4d070b7ea9e8c99c0a76ff5d22bf9d
This commit restructures the handling of configuration
files in set_configs.py, introducing functions for managing
default configuration files first.
Closes-Bug: #2060855
Change-Id: If91e0330dc149143c82d2183b8ddf6fa9f68d80e
Added timestamp with milliseconds, log level, and custom
date format to improve clarity and make logs more useful
for debugging.
Change-Id: Ice2d601eddb54bbb0e7e3be6f03ba6db58256c1f
Add file to the reno documentation build to show release notes for
stable/2024.2.
Use pbr instruction to increment the minor version number
automatically so that master versions are higher than the versions on
stable/2024.2.
Sem-Ver: feature
Change-Id: Ib8db1e811fc8bae9600730536a48b6358cbcf76d
ProxySQL reports its version to MySQL clients,
causing the backup process to fail when ProxySQL is used.
This patch adds a new script that handles backups from
the replica server directly, without modifying the original
backup script. The new script retrieves the server address
via the load balancer and connects directly to the replica
server to execute the backup.
Moreover, this reduces the risk that the backup will be inconsistent
or that it will block OpenStack MySQL clients, because they are
connected to a different server, and no one is connected to the replica,
or that it will overload the load balancer (such as ProxySQL or HAProxy)
which listens on the VIP.
Closes-Bug: #2080818
Change-Id: Ibf7e40e8b059d733e114963022df06180249c650
The 'syslinux' package is not available on aarch64, so it is only
included in the ironic conductor packages for x86_64 systems.
Related-Bug: #1749780
Change-Id: I3eea308a0a70e47dd3b185eece106185b25616f5
This package provides a standalone sysusers binary with
minimal dependencies, designed for use in non-systemd
environments.
This package simply ensures that all packages that want
to install systemd as dependency will have to settle for
this one because the systemd package breaks
systemd-standalone-sysusers, as it is an alternative.
[1] https://packages.debian.org/bookworm/systemd-standalone-sysusers
[2] https://packages.ubuntu.com/noble/systemd-standalone-sysusers
Change-Id: I3ba85069c265844bd2f8b5e6d2b14f32e4898cfd
Since aarch64 OpenDev nodes currently have issues
that cause builds to time out (and we can't extend
over 3 hours since that's OpenDev maximum).
Change-Id: I20d8b7b6de007866f73c41272682f4532987c9e7
Since packages are installed using root during image build - we
need to use sudo when updating those packages when using dev-mode.
Change-Id: Idf14e334d50abeb1719563b1733af0b8425b3b55
This commit removes the hardcoded KOLLA_DISTRO_PYTHON_VERSION
and replaces it with dynamic Python version detection during
container images build. Dockerfiles and scripts now use general
python3 references, simplifying maintenance and ensuring
compatibility with future Python versions.
Test cases relying on distro_python_version were also cleaned up.
Change-Id: I891749598247a5e951ed4a873b16acfd0566f59c
neutron-fwaas requires libnetfilter-log1 when fwaas_v2_log is
enabled on l3 agent.
As this package isn't easily available via rpm, this is only
added for deb platforms.
Partial-Bug: #2079775
Change-Id: I22d05d1a1c6ab92ed5507d6c90b8c2281abfc7af
Kolla checks the status of its configurations
using kolla_set_configs --check. However, this
doesn't work for the command block in the config.json
file. This means that if only the command value changes,
but not the config_files block, which is common practice
in Kolla-Ansible btw, the container will not report the
changes.
This is undesirable and important to fix, especially
considering the planned rework of notifiers in
Kolla-Ansible [1].
[1] https://review.opendev.org/c/openstack/kolla-ansible/+/773243/14
Closes-Bug: #2080861
Change-Id: I2a290da38ea34b05ce3da8fb8b39b6252bf2da47
It seems that at the time of implementing proxysql,
it did not have the --reload parameter, or I overlooked
it back then. In any case, it is available now, and this
patch just removes the deletion of the proxysql database
and keeps it there. The deletion was in the extended start
precisely because proxysql ignored changes in the configuration
file, so the internal database was always rebuilt during
a restart. However, this now works with the --reload parameter.
Change-Id: I47848bb1e9847821c9b5fa25f0d817ef00358dd6
Provides mechanism for future work to fix bug where when package file
manifest changes, the changes were not reflected in to devmode-enabled
container.
It changes the strategy of installing projects in dev mode in containers.
Instead of bind mounting the project's git repository to the venv
of the container, the repository is bind mounted to
/dev-mode/<project_name> from which the it is installed using pip
on every startup of the container using kolla_install_projects script.
Related-bug: #1814515
Change-Id: Ia1bdff87cba73587a03124ab78a56b21c6176373
Signed-off-by: Roman Krček <roman.krcek@tietoevry.com>
This library was used by oslo.log but isn't now. It's being removed
from global-requirements so let's drop it from openstack-base.
Depends-On: https://review.opendev.org/c/openstack/requirements/+/917831
Change-Id: Ie91b533047d59e19bdd56f3a999e377d49a745a8
Original symlinking works fine with a tarball source for the
requirements repo.
However, when user supplies git type source of it, we cannot
guarantee that the source direcotry name contains ``requirements``.
This patch fixes it by moving plugins directory outside of
openstack-base directory, which ultimately allow us to use simpler
symlinking as openstack-base-archive would be the only directory
inside.
Closes-Bug: #2074075
Change-Id: I5a9162a30b23cfabb64dabe5c12c226fa8627abd
Since it was bundled with plugins installation, and we did not
have any plugins in keystone container - it was not installed
at all.
Adding in libkrb5 dependencies for requests-kerberos.
Closes-Bug: #2078305
Change-Id: I51c69d0673280e351daa410d943f769d33a10d6c
The cAdvisor update change [1] mistakenly added a reno to the wrong
folder. Moving it back to the correct folder would accidentally add it
to the master branch. Therefore, the reno is being removed.
[1] https://review.opendev.org/c/openstack/kolla/+/704018
Change-Id: I876f3c88c5bcd3c0a7c776796e9870c8512f90e2
Since Linaro shut down their nodepool provider - OpenDev infra
is left with OSUOSL cloud with max 15 instances running - let's
not put any additional strain on CI (especially that it seems
there are some I/O or similar issues that cause our jobs to
time out).
Change-Id: I7f0f723b37e552c4ea01bf51b6354209608d904a
When using recursive mode to set permissions for a directory as
defined in kolla config.json, all the subdirectories and files will
receive the same permissions. This change adds the option to exclude
specific files or directories - either a name or a regular expression
can be used.
Closes-Bug: #1931294
Closes-Bug: #1972168
Co-Authored-By: Jakub Darmach <jakub@stackhpc.com>
Change-Id: If2f39736e2af34cd91d0976051ff66f06e96ab42
OpenSearch Dashboards 2.16.0 discover page hangs after initial
deployment due to an upstream bug [1].
This change fixes the issue by pinning OpenSearch Dashboards to 2.15.
Note that it seemed safer not to pin OpenSearch to fix this issue, to
avoid breaking deployments that have already deployed 2.16.
[1] https://github.com/opensearch-project/OpenSearch-Dashboards/issues/7626
Closes-Bug: #2077319
Change-Id: I0de9928b2657ab5f31580325e866bff28f2b5510
Will be used to check if the current RabbitMQ version is high enough
before upgrading to the new one.
Change-Id: Ie133d6efc2e4c00002b8f0724e0183eaab35d1c5
This patch fixed build of prometheus-ovn-exporter
when building with --image-name-prefix option.
Closes-Bug: #2076249
Change-Id: I5ba67d6e4bbe1b6d6caa842715b56720a027dc76
codespell, now part of pep8, was failing on master. Also remove
the codespell version pin in tox.ini as it is no longer required.
Change-Id: I309e558a445c0a96f16fd002b8ca232d94620b5a
also add the command to clone the repository
and use the pip-install `--editable` option in
it's long form so it's immediately clear what it does.
Change-Id: I00403f967c06af6d8c718ed1245aaa01f1218add
Signed-off-by: Sven Kieske <kieske@osism.tech>
If the latest and targeted rabbitmq-server dependencies mismatch,
kolla-toolbox will fail to build.
Closes-Bug: #2066171
Change-Id: I64e9442545d98364585e3c632ae9142cd6b4f9bf
Since Rocky 9.4 release - delivered libpqos is 5, not 4 - and
CentOS Stream 9 OpsTools packages have not been rebuilt.
Related-Bug: #2065362
Change-Id: Ic0929becd44f25a9fb8d6d789b8169f41c95a226
Add file to the reno documentation build to show release notes for
stable/2024.1.
Use pbr instruction to increment the minor version number
automatically so that master versions are higher than the versions on
stable/2024.1.
Sem-Ver: feature
Change-Id: Ibd705bc99c018d5d03d00486c10bd65fea13996f
2024-05-08 10:12:00 +00:00
496 changed files with 5138 additions and 2988 deletions
