Set inject_facts_as_vars to False to match what we do in
Kolla-Ansible (and this option will default to False in 2.24)
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/972696
Change-Id: Iae2b70ca62fd68400bde9296edcda8e53f14a896
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
According to https://www.influxdata.com/blog/package-signing-key-rotation
the preferred signing key for influxdata package repositories
changed in early 2026. Update to the new preferred key.
Closes-Bug: #2138095
Change-Id: I77d38e713678ea653ded3b14fd0541d3ec0ebee6
Signed-off-by: Michael Still <mikal@stillhq.com>
Without that - these are not run at all
Update Bookworm to Trixie while we're at it
Change-Id: I6fb70da636514b5c1057c16cc2df08b07820bc5f
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
This reverts commit ef12d96731.
Reason for revert: Broke community.mysql
Change-Id: Icb85112c66645d8df00eb0c40076a6bd822f6866
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
networking-generic-switch was added to u-c [1] and it breaks our
install scheme.
Alternative is to remove networking-generic-switch from sources.py,
but that would be a user facing change and if we would pursue that
we would need to do the same for all neutron plugins.
using u-c removal macro to preserve previous approach of installing
n-g-s from a branch tarball compared to a pypi version
[1]: https://review.opendev.org/c/openstack/requirements/+/964059
Change-Id: Ifcee01f9415e9b9de8138b55cd676873a99c86aa
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
This repo enablement is here by mistake, the glusterfs-fuse
package installation has been removed in the original
CentOS Stream 10 patch.
Change-Id: I395fcae7fd39ea7488191690f994ad98a8184f65
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
RabbitMQ announced some time ago that the package archives were moving:
https://www.rabbitmq.com/blog/2025/07/16/debian-apt-repositories-are-moving
The old location is no longer working, so this patch transitions to
the new one.
Closes-Bug: #2131736
Change-Id: I6ef0ed9cc40be42a0d98c6a4c83c5c5c26d9cdbf
Signed-off-by: Michael Still <mikal@stillhq.com>
Add file to the reno documentation build to show release notes for
stable/2025.2.
Use pbr instruction to increment the minor version number
automatically so that master versions are higher than the versions on
stable/2025.2.
Sem-Ver: feature
Change-Id: If6d5a967a12cb6143a5bb1f321d8cc0231552275
Signed-off-by: OpenStack Release Bot <infra-root@openstack.org>
Generated-By: openstack/project-config:roles/copy-release-tools-scripts/files/release-tools/add_release_note_page.sh
To fix arm64 valkey build.
The virtual `valkey` resolves to `valkey-server` in bookworm-backports,
but our global -1000 pin blocks it. Amd64 worked only because extrepo
shipped it. Use valkey directly from the backports packages instead.
follow up to https://review.opendev.org/c/openstack/kolla/+/932174
Change-Id: I846e4f19696ca28758cb9c0400be96c01b079daa
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
Since Venus is removed - that is not needed anymore
Change-Id: I444304139dfbe451b5449a181de1129f073b7535
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
It has been marked as inactive and venus dashboard plugin is breaking
Horizon Kolla builds.
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/964860
Change-Id: I3a04487a75c04ba989fa70f2025db33308671dfb
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
The agent was removed from neutron during 2025.1 cycle. The remaining
implementation to deploy it is being removed from kolla-anible now.
Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/962278
Change-Id: I2cf22b874fcb885752bf3800c8ad8fa7a5eacff7
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
MariaDB clustercheck script has not been maintained and it will not work
with MariaDB 11.4 (the next LTS version).
This is because clustercheck.sh uses ``mysql*`` commands but from
MariaDB 11.4, those commands are not supported.
The health check of MariaDB server containers will be done by new script
which comes with change [1].
Without MariaDB clustercheck, MariaDB server becomes only container image in
the family, so mariadb-base and mariadb-server dockerfiles are merged.
To avoid breaking changes, the name 'mariadb-server' is retained.
Follow-up to rename references in Kolla and K-A from 'mariadb-server' to
'mariadb' would be nice.
[1] https://review.opendev.org/c/openstack/kolla/+/962657
Change-Id: I01278f76ee82b018a854b5862f3caaa8c78a9a30
Signed-off-by: Seunghun Lee <seunghun@stackhpc.com>
Introduce rpm/deb entry in repos.yaml, create a structure
[base_package_type]:
[base_distro]:
[base_distro-$arch]
Allow any of these to be undefined, defaulting to empty dict
This allows to deduplicate entries between distros of the same
base_package_type (rpm/deb)
Sort repos.yaml
Change-Id: Ifc351d5d612e6c6cc82be282aed179c656ae252c
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Fluent Package v5 LTS will reach end of support at
the end of 2025.
Fluent Package v6 LTS will be supported until at least
the end of 2027.
This change updates the apt repository configuration and package version
to use Fluent Package v6 LTS for Ubuntu, Debian and RHEL.
No changes to existing Fluentd configuration files are required.
Change-Id: Iaf3c4de859986629f9768563a319fe0385acff6a
Signed-off-by: Piotr Milewski <vurmil@gmail.com>
keepalived wrapper script as the only one didn't have --rm
in docker/podman invocation - so these didn't get deleted
when stopped/crashed/etc.
Closes-Bug: #2127170
Change-Id: I85ae37250ac4ef629b77ade04826a363e8047a91
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Rename aarch64 to arm64 to sync with OpenDev nodeset naming
Remove base_arch/base_distro/base_distro_version and derive it
from zuul job name
Change-Id: I2f8367ae81d0972517b8712e1cb6ead1044accc4
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Add the ability to configure repositories in the same
way as we do Debuntu ones - via repos.yaml.
Removes .repo files from base - since these are not
needed there anymore.
gpgcheck = 1 is default in docker/base/dnf.conf
Change-Id: I7df7d452c45c57c434d5b4ad15a87963e4d6d0d4
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Currently we are enabling repos irrespective of rpm/deb
statement blocks and not failing in the method used
if a repository is missing.
Downside is - we might be producing one more layer,
but it probably is a more logical approach.
This is required for adding rpm support in repos.yaml
that will also include failing on missing repositories.
Change-Id: I5479c5c935760f00fe4cd307366f261deee3199f
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
It was ommitted in the patch that renamed it from .zuul.d
Change-Id: I8e4470185321fad1be3e2307c7578ca54d197718
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
podman jobs have also been omitted in the original patch
Change-Id: I1ddb4e9ead170f22b231b8595d4dbf7cb0d4fb78
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
pg_config has been moved to postgresql-server, postgresql-devel
only installs a link to pg_config which is unresolvable without
-server package.
Installing postgresql-server-devel to include headers which are
also required for building psycopg2.
Change-Id: I35548a02f652c035c17aabe149752322ffc869c4
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Cinder removed it in I28666e63896fed0f1661b5964ec46952074f4b23
Change-Id: I69ec97fe8480d27942cc923c170ec3cd669caf06
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
In ml2/ovn setups, the neutron-metadata-agent spawns haproxy processes
to serve metadata requests. To run these haproxy instances inside their
own containers, the wrapper script must be available in the
metadata-agent container.
This is a follow up on I679ac66186d457ae53f89469fe22c5662089019a
Change-Id: Ia47af98ff723ebe8ea8461d05a2bc3b58af845f9
Signed-off-by: Maximilian Stinsky <maximilian.stinsky-damke@wiit.cloud>
The goal is to unify common contributor information across
all kolla projects (communication, launchpad links, etc).
Change-Id: Iddcaa8723b364fe4e8619f8fc2b03c93b685db86
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
RDO has staffing problems and has decided to only
support SLURP releases - let's drop reliance on that
repository.
Change-Id: I56f86a1c5262e3ee2bcbb52cae53c3b2655ed87f
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Updates a range of monitoring and core infrastructure components
to their latest stable upstream versions to leverage new
features and bug fixes.
etcd: 3.5.16 -> 3.6.4
letsencrypt-lego: 4.20.4 -> 4.25.2
prometheus-blackbox-exporter: 0.25.0 -> 0.27.0
prometheus-cadvisor: 0.49.2 -> 0.53.0
prometheus-elasticsearch-exporter: 1.8.0 -> 1.9.0
prometheus-memcached-exporter: 0.15.0 -> 0.15.3
prometheus-mysqld-exporter: 0.16.0 -> 0.17.2
prometheus-node-exporter: 1.8.2 -> 1.9.1
prometheus-server: 3.2.1 -> 3.5.0
The Prometheus-server package has also been switched to
a Long-Term Support (LTS) version, which ensures extended
stability and security support.
Change-Id: Ib9805fb6a93a0da887918174d9994caa5f1306d3
Signed-off-by: Piotr Milewski <vurmil@gmail.com>
It should not be required anymore, all these information are dumped
by different means (generic zuul playbooks, etc).
Change-Id: I80569b6fe9e4d779a5448015b8ad9caf09e5abf6
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
RabbitMQ from 4.0.x to 4.1.x
Erlang from 26.2.x to 27.x
Change-Id: I710b2a95c840862f52d812df306d1fb26dd4340b
Signed-off-by: Seunghun Lee <seunghun@stackhpc.com>
Switch the RHEL repo to the stable channel as per [1]. Use new GPG.
Telegraf arm64 builds are enabled again, as binaries exists.
[1] https://repos.influxdata.com/stable/x86_64/
Change-Id: Ie4f6f15404f6965df51f3214506ae9f8bb9b61e7
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
Re-enable the Ubuntu arm64 build. The previous exclusion was due to
uWSGI issue [1], which is no longer reproducible on Ubuntu Noble.
Change-Id: I400e9a9a3bf03053589835f933023eedee504f08
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
This reverts commit 2b42c958ef.
Reason for revert: Make job voting again
Change-Id: Ie3583682ec0d7a55cd9e8bedde9f51550b7c1840
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
9 was used as an interim solution when OpenDev did not support it.
Change-Id: If6101d99c216a9b1142bfdf194f7a053730e28da
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Bumps libvirt exporter source from v1.6.0 to v2.2.0. This fixes some
metrics that were lost when the exporter was changed from the old
"tinkoff" source to "inovex".
See also Icc8a3651d601ab45d448c9d252ca6155219d21cf
Closes-Bug: #2120639
Change-Id: Ib738325603173157b4c482f9de6d5d9cea0b758a
Signed-off-by: Alex Welsh <alex@stackhpc.com>
They have been removed with Icaba9424862b883388bf68d2c3d48138b7b906b0
Not creating local versions like with keystone because Kolla-Ansible
does not use WSGI for Manila yet.
Change-Id: Ia34d848d8641e43681c602c9c4433364e8be1d92
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
It has been removed with I9fa7cd60bf27768db06f69681675fce2e55712af
Change-Id: Ib42be3d56bdb64247ac6f17b8ac1f1baa873f475
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
See I0a8e26e8990eae8108537541159f7810d35b70f1
Change-Id: I95500612168871454ce269b3562a8daccdf4de4f
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Since Docker 28.3.3 the daemon rejects a push that carries no
`X-Registry-Auth` header [1]. The SDK already sets this header when it
finds credentials, so the breakage happens only on anonymous pushes.
During `PushTask.push_image()` we now check whether the SDK can resolve
credentials for the target registry; if it cannot, we inject
`auth_config={}`, causing the SDK to send the minimal "{}" header that
satisfies the daemon while leaving authenticated pushes unchanged.
Drop this addition when [2] is fixed.
[1] https://github.com/moby/moby/pull/50371
[2] https://github.com/docker/docker-py/issues/3348
Closes-Bug: #2119619
Change-Id: I7a2f3fce223afd74741b40bf62836b325fca5b19
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
skyline-apiserver's Dockerfile has a comment around removing a line when
I2dababab7c79e7c37983c1702178419c88e014a5 merges. Given the
referenced change has now merged, remove the TODO and the temporary
fix.
Change-Id: If2b9aff8f1900fb98e038972e775c3eddaad373f
Signed-off-by: Michael Still <mikal@stillhq.com>
to be in sync with kolla-ansible
also add pin to ansible-core
Change-Id: Idf35af1b776d0e908fd328f0ec5eb825f1f2ca9c
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
Enabling repo should be handled by enable_extra_repos macro
Closes-bug: #2117249
Change-Id: I92af980a4fd63540297b6bde0d52b2dfd02f72ce
Signed-off-by: Grzegorz Koper <grzegorzk@stackhpc.com>
Known missing packages:
- mod_auth_mellon - missing SAML support in Keystone/Horizon - built in Kolla COPR
- glusterfs-fuse in manila-share - built in Kolla COPR
- collectd/telegraf - no opstools repository
- redis - needs a switch to valkey
- python3-ethtool - not required for neutron-mlnx-agent since 6 years [1]
Building packages in Kolla COPR is a temporary solution until these show up
in EPEL10.
[1]: Id2cae3ac9ff049e9fc8225551f99e1e99a87fc65
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/951751
Change-Id: I7074fabcf95184fcfd2561648ae1e05acfb0bc11
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Previous apt preference missed the epoch and sub-packages, so no
pinning was applied.
Closes-Bug: #2115893
Change-Id: I5c765db0508a2ffec90ba149bb5ea9b90dd31bc8
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
ovn is running as root, and fluentd can't read it's log files,
so we need to precreate these.
Closes-Bug: #2115244
Change-Id: Icb0e47cf95a67cb4585c71f863e542bc59ff5009
If a configuration file is tracked in the state file
but no longer appears in config.json, it should either be
restored or removed.
This patch introduces a new exception StateMismatch and
updates execute_config_check() to detect such cases. If
any destination path is present in the defaults state but
missing from config.json, we now raise StateMismatch.
A dedicated unit test has been added to verify
this behavior.
Closes-Bug: #2114173
Signed-off-by: Michal Arbet <michal.arbet@ultimum.io>
Change-Id: I6e0b4aaa5722990e3ac647578023f474db3d4381
This change fixes the issue with absent rsync package when
'remote_filesystem_transport = rsync' is enabled in nova_compute.
Closes-Bug: #2113926
Change-Id: Ie6719928e4ec2901d661f44c9f259add35afa269
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
Normally, for other images, we simply copy
etc/*, but Aodh has its api-paste located
elsewhere. This patch copies the default
Aodh api-paste into /etc/aodh/.
Signed-off-by: Michal Arbet <michal.arbet@ultimum.io>
Change-Id: I5eccc1b994c537e1d1adea21520d045674a9d41c
We've seen multiple occassions of all these healthcheck commands
not being able to be executed in 30s after the switch to RMQ 4.1.
Let's put more information in the Docker/Podman healthcheck logs.
Change-Id: I4b1b54983144f5514a6703c255d2cb4fa052a0fb
Since this exporter is no longer developed, and is not used in Kolla
Ansible, remove it immediately. A replacement has been proposed in
change #951971.
Change-Id: Ie47aed221d04bbb2b50ccfbd7c398e6ab6022442
The dibbler-client package has been removed from upstream Rocky repos,
breaking neutron-l3-agent container image builds on RL9. Since the
2025.1 release, package is no longer used in Neutron has been removed
because the project is stale and functionality was untested [1].
This change removes the package from the image build for all
distributions.
[1] https://review.opendev.org/c/openstack/neutron/+/934283
Closes-Bug: #2112575
Change-Id: I35b233a499c6bf1861b376fc441dc8081cfaf5d6
Signed-off-by: Alex Welsh <alex@stackhpc.com>
Kolla Ansible now generates ProxySQL query rules not only based on
the schema name (schemaname), but also on the username. This is
needed to properly route queries that are executed before a database
schema is selected, such as `SET AUTOCOMMIT` or `ROLLBACK`.
To support this, the ProxySQL config sanity check must correctly
deduplicate rules based on both `schemaname` and `username`, and
avoid false positives when both types are used simultaneously.
This change adjusts the logic in `kolla_proxysql_config_sync` to:
- recognize rules by key `schema:<schemaname>` or `user:<username>`
- assign unique rule IDs only to truly distinct rules
- log and skip exact duplicates with appropriate context
This fix is required to support the Kolla Ansible patch below.
Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/951599
Change-Id: I99acd1984ee555a5b6c731e6ee460a33677060d0
We have multiple CI issues currently, make the
kolla-ansible-debian-upgrade job non-voting so that we can merge fixes
in order.
Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I2d7137f3d01eb28f7693113fb690069e2760820f
Ubuntu images were occasionally failing to build due to
unavailability or slowness of the official Ubuntu security
repositories. Although Kolla uses `mirror://` URLs to
leverage Ubuntu mirror infrastructure, the original
`/etc/apt/sources.list.d/ubuntu.sources` file was still
present, causing the system to fallback to default sources.
This commit aligns Ubuntu behavior with Debian by
explicitly removing the distro `.sources` file and relying
solely on the sources configured by Kolla. This ensures
consistent and reproducible builds both in CI and
on local environments.
Closes-Bug: #2112140
Change-Id: I00bcb30662bb12ed8711b28a64ef1941dcce893a
The original script used --incremental-history-name and compressed
full backups as gzip streams. This failed because mariabackup expects
an actual decompressed base directory for incremental backups.
This patch:
- Decompresses the latest full backup into a temporary directory
- Uses that as --incremental-basedir
- Aligns the backup flow with official Mariabackup documentation:
https://mariadb.com/kb/en/incremental-backup-and-restore-with-mariabackup/
This makes the incremental process reliable and fully supported.
Closes-Bug: #2111620
Change-Id: I562ce5e54752015863a20bf113bce74a69e02331
... because stestr is now used instead of nose.
Also drop the VIRTUAL_ENV environment which is now automatically set
by tox.
Change-Id: Ied6e20f5b1dc5de384f29d317bec998e86f26efa
Python 3.13 introduces a behavior change in unittest.mock.mock_open(),
which now calls close() when exiting the context manager
as described in bpo-44185 [1]. This causes additional mock calls to appear,
breaking strict mock_calls assertions.
This patch fix tests and add compatibility for Python 3.13.
From mock documentation [2]:
"bpo-44185: unittest.mock.mock_open() will call the close() method
of the file handle mock when it is exiting from the context manager.
Patch by Samet Yaslan."
[1] https://bugs.python.org/issue44185
[2] https://mock.readthedocs.io/en/latest/changelog.html
Change-Id: Ib8e2a8a20a828c4c69deedd307c9b726f51489f8
Add file to the reno documentation build to show release notes for
stable/2025.1.
Use pbr instruction to increment the minor version number
automatically so that master versions are higher than the versions on
stable/2025.1.
Sem-Ver: feature
Change-Id: I4842c6c95633743dc949e3d19d6c5e295c89af33
These scripts have been based on TripleO version of the
same feature.
Unfortunately due to the fact that Neutron/python is
stripping env vars when it's running dnsmasq/haproxy/etc
processes - we need to do the ,,config'' handling in
copy-wrappers script.
Change-Id: I679ac66186d457ae53f89469fe22c5662089019a
When {{ venv_path }}/lib/python3 already exist and we run the ln
command, we end up with:
/var/lib/kolla/venv/lib/
├── python3 -> python3.9
├── python3.12
│ └── site-packages
└── python3.9
├── python3.12 -> python3.12
└── site-packages
Instead, it should be:
/var/lib/kolla/venv/lib/
├── python3 -> python3.12
├── python3.12
│ └── site-packages
└── python3.9
└── site-packages
Remove the existing link first to ensure it is created properly.
Change-Id: I42dd2490d14070074fe1fa7ae9e0a4cbf095b06f
The new client software version requires the use of a specific group
called "hsmusers", and for consistency reasons, we are specifying both,
the user id and the group id, and inserting the Barbican username inside
of such a group.
More information can be found on
https://www.thalesdocs.com/gphsm/luna/7/docs/pci/Content/install/client_install/linux_install.htm
Change-Id: Ib7d0c879b3741ca472cd0bbf3a9a88a0fee25cac
Signed-off-by: Mauricio Harley <mharley@redhat.com>
Letsencrypt allows using a specific key type for certificates. If
the user has an internal letsencrypt mechanism, such as Vault Acme,
then they have to provide a specific key type as the default is
not supported.
This change will allow a user to specify a key type and use the lego
default in the event that they don't specify it.
Partial-Bug: 2087860
Change-Id: I83e618a861b4d51b6a7893f79c50fdfc35228891
Copy aarch64 snponly.efi to /tftpboot during bootstrapping
of Centos- and Rocky-based ironic-pxe.
Don't use $KOLLA_BASE_ARCH when symlinking to
/tftpboot/ipxe.efi, because an aarch64 variant of this
binary doesn't exist, just x86_64.
Change-Id: Ie19fcb441a2e54a60762e5c8483487b713a29ddd
Support aarch64 ipxe only when using Ubuntu and Rocky
Linux base images, as the Debian ipxe package does not
provide a suitable aarch64 ipxe binary.
Change-Id: If5610148fc80acf13d4eb79fef78349764f08a17
Docker does not support running a container in a given
network namespace (netns) so we need a client installed
in the Neutron container images.
Related-Bug: #1891469
Change-Id: I5349449183dbb7f4ec2042a21526076fb42591b3
It has long been sort of an abomination of the container world,
let's use this deprecation notice as a motivation to work out
a kolla-ansible mechanism utilising regular ironic container
images to deploy standalone ironic.
Change-Id: I6b4e6edc110eebb524396138d24b873cb4ea6726
When building an image, the RUN command grants
permissions which causes the previous layer
to be copied.
During the test, the image was reduced from 2.84GB to 1.57GB
Closes-Bug: #2104007
Change-Id: I7d2367d4c277287f4db2885f5720a35d934f94b7
Ensure that when building etcd with --base-arch aarch64, Kolla
uses the arm64 tarball instead of amd64.
Related-Bug: #2103810
Change-Id: I6248cb6646b2b0c7af1c29f9a0a244cef1c4cf05
Derive debian_arch from base_arch by default when not set by the user.
This ensures that cross-architecture builds correctly download
the appropriate binaries, while preserving any explicit user override.
Closes-Bug: #2103810
Change-Id: I11b7e19ac3a12147138a98fc1e030767f70b44c9
It probably has been omitted in Ubuntu 24.04 introduction since
aarch64 build jobs have not been stable.
Removing from nova-compute since it's already in nova-base,
nova-libvirt's parent is base - so updating to qemu-efi-aarch64
Change-Id: Idae2e87bfc8a556a090085e46f96d11279080f0f
fix: added mdevctl to nova-libvirt debian based containers, mdevctl is an
optional dependency of libvirt needed in 2024.2 for nova vGPU feature.
Closes-Bug: #2088055
Change-Id: Ifa92999672ed267ce877c492c9140fbee271b8b3
In certain deployments ironic-conductor needs to create floppy images to
mount in virtual media. This needs the mtools package installed.
Change-Id: I00ccc47f7a993f13e2b2feb3f6a2565dad32b80c
When kolla is cloning a Git repository during the build
process, the `.git/config` file retains the remote
origin URL, which may expose sensitive credentials if
authentication tokens are embedded in the URL.
This fix ensures that the remote is removed after cloning
to prevent unintended exposure of credentials.
Closes-Bug: #2098904
Change-Id: Iec21fc2363e03133ec77326da7392bc25b40132a
Commit 79a2342395 introduced an ability to
build 'in-house'/'not-built-in' projects with Kolla.
This commits extends this feature with an ability to use configure_user
macro for 'not-built-in' users.
The implementation is done the same way as for 'sources', i.e. engine
after registers new section structure as soon as it finds unknown
'<project>-user' section.
In addition, the documentation and CI are extended to cover
``--docker-dir`` option.
Change-Id: I690d9f3829083f2493bf286a1c45764b9699219b
Previously, the `pycadf` package did not include
configuration files, so they were manually installed
from source. However, this was fixed in pycadf's upstream
in [1], allowing us to rely on the package itself.
Additionally, the `ceilometer_api_audit_map.conf` file
has been removed, as it was dropped in pycadf's upstream
commit here [2]
[1] https://review.opendev.org/c/openstack/pycadf/+/936741
[2] https://review.opendev.org/c/openstack/pycadf/+/930971
Change-Id: I022aa4c403f08385beb83b5d0c81f8abb42eb4a7
Users can override the upper-constraints.txt by setting the source of
openstack-base in kolla-build.conf.
However, bifrost-base Dockerfile so far doesn't pass overridden
upper-constraints file to Bifrost install playbook resulting the
playbook not acknowledging it and just use upstream one.
This change sets the source of Bifrost upper-constraints to use
upper-constraints of openstack-base for consistency among all Kolla
images
With this, change the environment variable UPPER_CONSTRAINTS_FILE is
only affecting kolla-toolbox image.
Therefore, moved UPPER_CONSTRATINS_FILE variable example to the
``kolla_toolbox_pip_conf`` block of kolla-toolbox Dockerfile.
Additionally, updated 'Python packages build options' section of
documentation to represent latest method of changing Python package
related options (including this change).
Change-Id: I0a9c782ca1177ef84e4323cb1e5bfac0fb3f383c
We need newer ovn-ctl with [1] - for now download that from
ovn-org/ovn@master - once 25.03 is branched we should
get that the normal way.
[1]: 2ecba75432
Change-Id: I429f00ed4bdcd24409d14453ab53c5fa11fdb00b
Currently tox -e genconfig fails with stevedore issues,
because tox is not doing sdist.
Closes-Bug: #2051575
Change-Id: Idfc26fe380a546d0fd712a531e5913090b01d808
The package moved to the cinder-base image since it already added to
the cinder-volume in I84c7633765749a5e9ced983505ef290c32154ccc.
Closes-Bug: #2089587
Change-Id: I06e61ab388d9ecfa78e5d1fe1ae9cb8602d1cd36
Signed-off-by: FelipeAFV <ffigueroa@whitestack.com>
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
Fixes /var/log/kolla/neutron/dnsmasq.log rights so
fluentd can read logs from that file.
Closes-Bug: #1693712
Change-Id: I57e36ef07e8840eead2efde77e0ab9dfd4842931
In order to add support to uwsgi (which is opening the log file
after dropping privileges) we need to set proper permissions
for /var/log/kolla/cinder directory
Change-Id: I46da8fad93febbc462cbe42a0d96ef7d423b8965
This patch renames the update-haproxy-cert script to
update-loadbalancer-cert to make the name more generic.
The change is necessary because support for ProxySQL
will be introduced in the next patch, requiring a name
that reflects broader applicability.
To keep the diff in the following patch clean and easier
to review, this patch focuses exclusively on the rename.
Change-Id: I15f9b5cf3976f4298cdc7da4530f2d7d09614e88
This patch fixes recently merged [1] patch.
- Original patch added params function args
eab, hmac, key_id, but then
EXTERNAL_ACCOUNT_BINDING_OPTS var is passed
into obtain_or_renew_certificate which
can't work
- This patch correctly set EXTERNAL_ACCOUNT_BINDING,
HMAC, KEY_ID defaults and then call obtain_or_renew_certificate
function with them. This will ensure that arguments are always
set, so we can write if condtional correctly and process.
[1] https://review.opendev.org/c/openstack/kolla/+/916617
Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/933924
Change-Id: I406ff10edec9dc94b1a3de005080e149ee3ab3f2
This reverts commit 5af5febf50.
Reason for revert: Epoxy cycle is on
In addition to the revert skyline-apiserver aiosqlite u-c
is removed until [1] is merged, designate rootwrap.conf.sample
file has been renamed to rootwrap.conf and pycadf is bumped to 4.0.0.
[1]: https://review.opendev.org/c/openstack/skyline-apiserver/+/935604
Change-Id: I1265633f0913b7927955564fac911a682615004a
Python3-pip installs the dependent package tzdata
and blocks the mount of the /etc/localtime file in docker.
After deleting the symbolic link docker correctly mounts
the external localtime file.
Applies only to ubuntu 24.04, in previous versions
of ubuntu there was no such problem
Closes-Bug: #2091161
Change-Id: I733a50b5ca455cfa4b248dc324500d78c17c817b
So far, the certificates were not part of config.json
files for containers. With future patches that will remove
container restarts based on triggers from config and
service-copy-cert, it is important that all files that change
during config are specified in config.json so that
kolla-set-configs --check can detect those changes and based
on that restart the container. This patch provides prerequisite
for future patch in kolla-ansible.
Comments from kevko:
The script also takes into account whether review [1] is
merged or not, ensuring that it will function correctly in
both cases thanks to review [2], because using the state
file, we can effectively verify whether the config.json that
copies CA certs to /var/lib/kolla/share is being used or not.
If we didn’t handle it this way, we would have to rely on
checking whether the directory /var/lib/kolla/share exists or
some another magic, which is insufficient because various
states and combinations of Kolla image and Kolla-Ansible
versions could result in certificates always being copied.
This method provides a clear and definitive distinction.
[1] https://review.opendev.org/c/openstack/kolla-ansible/+/924651
[2] https://review.opendev.org/c/openstack/kolla/+/915440
Change-Id: I5120f1874f25a9ca8326e6db8b12dee4c81feb56
Signed-off-by: Roman Krček <roman.krcek@tietoevry.com>
Co-Authored-By: Michal Arbet <michal.arbet@ultimum.io>
Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/924651
This patch adds a way to patch files in a Docker
image built by Kolla. This is very useful for several
reasons, specifically:
- Custom modifications
- The stable branch of some library has a fix but no pip
package has been released
- Eliminates the need to package your own pip packages
- Eliminates the need to invent your own versioning to prevent
upstream versioning
- Eliminates the need to manage a pip server
- In other words, it eliminates the need to get a wheel into
the image and install it manually using any method not
previously mentioned
It is also highly desirable because, although Kolla can replace
the source for a service with a custom URL for a tarball or its
own Git repo, it cannot do this for dependencies pulled from pip.
I would also like to point out that this is a feature with its own
code path and works only if the user "inserts" a patch into the folder
patches/docker-image/something.patch and creates an analogous series
file for patch source code.
Simply said, this code will never interfere with the upstream build process
since this feature is not intended for use in upstream.
It is rather meant for downstream users who know what they are doing.
Now they just have an option to patch their images.
Everything works on all layers of the Docker image and stores a report
of applied patches which can then be seen in /etc.
This mechanism is similar as debian patch quilt.
Change-Id: I61d0790c5d4d070b7ea9e8c99c0a76ff5d22bf9d
This commit restructures the handling of configuration
files in set_configs.py, introducing functions for managing
default configuration files first.
Closes-Bug: #2060855
Change-Id: If91e0330dc149143c82d2183b8ddf6fa9f68d80e
Added timestamp with milliseconds, log level, and custom
date format to improve clarity and make logs more useful
for debugging.
Change-Id: Ice2d601eddb54bbb0e7e3be6f03ba6db58256c1f
Add file to the reno documentation build to show release notes for
stable/2024.2.
Use pbr instruction to increment the minor version number
automatically so that master versions are higher than the versions on
stable/2024.2.
Sem-Ver: feature
Change-Id: Ib8db1e811fc8bae9600730536a48b6358cbcf76d
ProxySQL reports its version to MySQL clients,
causing the backup process to fail when ProxySQL is used.
This patch adds a new script that handles backups from
the replica server directly, without modifying the original
backup script. The new script retrieves the server address
via the load balancer and connects directly to the replica
server to execute the backup.
Moreover, this reduces the risk that the backup will be inconsistent
or that it will block OpenStack MySQL clients, because they are
connected to a different server, and no one is connected to the replica,
or that it will overload the load balancer (such as ProxySQL or HAProxy)
which listens on the VIP.
Closes-Bug: #2080818
Change-Id: Ibf7e40e8b059d733e114963022df06180249c650
The 'syslinux' package is not available on aarch64, so it is only
included in the ironic conductor packages for x86_64 systems.
Related-Bug: #1749780
Change-Id: I3eea308a0a70e47dd3b185eece106185b25616f5
This package provides a standalone sysusers binary with
minimal dependencies, designed for use in non-systemd
environments.
This package simply ensures that all packages that want
to install systemd as dependency will have to settle for
this one because the systemd package breaks
systemd-standalone-sysusers, as it is an alternative.
[1] https://packages.debian.org/bookworm/systemd-standalone-sysusers
[2] https://packages.ubuntu.com/noble/systemd-standalone-sysusers
Change-Id: I3ba85069c265844bd2f8b5e6d2b14f32e4898cfd
Since aarch64 OpenDev nodes currently have issues
that cause builds to time out (and we can't extend
over 3 hours since that's OpenDev maximum).
Change-Id: I20d8b7b6de007866f73c41272682f4532987c9e7
Since packages are installed using root during image build - we
need to use sudo when updating those packages when using dev-mode.
Change-Id: Idf14e334d50abeb1719563b1733af0b8425b3b55
This commit removes the hardcoded KOLLA_DISTRO_PYTHON_VERSION
and replaces it with dynamic Python version detection during
container images build. Dockerfiles and scripts now use general
python3 references, simplifying maintenance and ensuring
compatibility with future Python versions.
Test cases relying on distro_python_version were also cleaned up.
Change-Id: I891749598247a5e951ed4a873b16acfd0566f59c
neutron-fwaas requires libnetfilter-log1 when fwaas_v2_log is
enabled on l3 agent.
As this package isn't easily available via rpm, this is only
added for deb platforms.
Partial-Bug: #2079775
Change-Id: I22d05d1a1c6ab92ed5507d6c90b8c2281abfc7af
Kolla checks the status of its configurations
using kolla_set_configs --check. However, this
doesn't work for the command block in the config.json
file. This means that if only the command value changes,
but not the config_files block, which is common practice
in Kolla-Ansible btw, the container will not report the
changes.
This is undesirable and important to fix, especially
considering the planned rework of notifiers in
Kolla-Ansible [1].
[1] https://review.opendev.org/c/openstack/kolla-ansible/+/773243/14
Closes-Bug: #2080861
Change-Id: I2a290da38ea34b05ce3da8fb8b39b6252bf2da47
It seems that at the time of implementing proxysql,
it did not have the --reload parameter, or I overlooked
it back then. In any case, it is available now, and this
patch just removes the deletion of the proxysql database
and keeps it there. The deletion was in the extended start
precisely because proxysql ignored changes in the configuration
file, so the internal database was always rebuilt during
a restart. However, this now works with the --reload parameter.
Change-Id: I47848bb1e9847821c9b5fa25f0d817ef00358dd6
Provides mechanism for future work to fix bug where when package file
manifest changes, the changes were not reflected in to devmode-enabled
container.
It changes the strategy of installing projects in dev mode in containers.
Instead of bind mounting the project's git repository to the venv
of the container, the repository is bind mounted to
/dev-mode/<project_name> from which the it is installed using pip
on every startup of the container using kolla_install_projects script.
Related-bug: #1814515
Change-Id: Ia1bdff87cba73587a03124ab78a56b21c6176373
Signed-off-by: Roman Krček <roman.krcek@tietoevry.com>
This library was used by oslo.log but isn't now. It's being removed
from global-requirements so let's drop it from openstack-base.
Depends-On: https://review.opendev.org/c/openstack/requirements/+/917831
Change-Id: Ie91b533047d59e19bdd56f3a999e377d49a745a8
Original symlinking works fine with a tarball source for the
requirements repo.
However, when user supplies git type source of it, we cannot
guarantee that the source direcotry name contains ``requirements``.
This patch fixes it by moving plugins directory outside of
openstack-base directory, which ultimately allow us to use simpler
symlinking as openstack-base-archive would be the only directory
inside.
Closes-Bug: #2074075
Change-Id: I5a9162a30b23cfabb64dabe5c12c226fa8627abd
Since it was bundled with plugins installation, and we did not
have any plugins in keystone container - it was not installed
at all.
Adding in libkrb5 dependencies for requests-kerberos.
Closes-Bug: #2078305
Change-Id: I51c69d0673280e351daa410d943f769d33a10d6c
The cAdvisor update change [1] mistakenly added a reno to the wrong
folder. Moving it back to the correct folder would accidentally add it
to the master branch. Therefore, the reno is being removed.
[1] https://review.opendev.org/c/openstack/kolla/+/704018
Change-Id: I876f3c88c5bcd3c0a7c776796e9870c8512f90e2
Since Linaro shut down their nodepool provider - OpenDev infra
is left with OSUOSL cloud with max 15 instances running - let's
not put any additional strain on CI (especially that it seems
there are some I/O or similar issues that cause our jobs to
time out).
Change-Id: I7f0f723b37e552c4ea01bf51b6354209608d904a
When using recursive mode to set permissions for a directory as
defined in kolla config.json, all the subdirectories and files will
receive the same permissions. This change adds the option to exclude
specific files or directories - either a name or a regular expression
can be used.
Closes-Bug: #1931294
Closes-Bug: #1972168
Co-Authored-By: Jakub Darmach <jakub@stackhpc.com>
Change-Id: If2f39736e2af34cd91d0976051ff66f06e96ab42
OpenSearch Dashboards 2.16.0 discover page hangs after initial
deployment due to an upstream bug [1].
This change fixes the issue by pinning OpenSearch Dashboards to 2.15.
Note that it seemed safer not to pin OpenSearch to fix this issue, to
avoid breaking deployments that have already deployed 2.16.
[1] https://github.com/opensearch-project/OpenSearch-Dashboards/issues/7626
Closes-Bug: #2077319
Change-Id: I0de9928b2657ab5f31580325e866bff28f2b5510
Will be used to check if the current RabbitMQ version is high enough
before upgrading to the new one.
Change-Id: Ie133d6efc2e4c00002b8f0724e0183eaab35d1c5
This patch fixed build of prometheus-ovn-exporter
when building with --image-name-prefix option.
Closes-Bug: #2076249
Change-Id: I5ba67d6e4bbe1b6d6caa842715b56720a027dc76
codespell, now part of pep8, was failing on master. Also remove
the codespell version pin in tox.ini as it is no longer required.
Change-Id: I309e558a445c0a96f16fd002b8ca232d94620b5a
also add the command to clone the repository
and use the pip-install `--editable` option in
it's long form so it's immediately clear what it does.
Change-Id: I00403f967c06af6d8c718ed1245aaa01f1218add
Signed-off-by: Sven Kieske <kieske@osism.tech>
If the latest and targeted rabbitmq-server dependencies mismatch,
kolla-toolbox will fail to build.
Closes-Bug: #2066171
Change-Id: I64e9442545d98364585e3c632ae9142cd6b4f9bf
Since Rocky 9.4 release - delivered libpqos is 5, not 4 - and
CentOS Stream 9 OpsTools packages have not been rebuilt.
Related-Bug: #2065362
Change-Id: Ic0929becd44f25a9fb8d6d789b8169f41c95a226
Add file to the reno documentation build to show release notes for
stable/2024.1.
Use pbr instruction to increment the minor version number
automatically so that master versions are higher than the versions on
stable/2024.1.
Sem-Ver: feature
Change-Id: Ibd705bc99c018d5d03d00486c10bd65fea13996f
openvswitch package is already installed in nova-base from
CentOS NFV SIG repos - and in nova-compute we don't enable this
repo - so we get openvswitch installed from RDO packages.
Closes-Bug: #2064098
Change-Id: If39e045357563111219a008fa7a81a82ef906627
This partially reverts commit fe1a74da98
for Masakari only.
Reason for revert: Masakari CI is working
Change-Id: I486b261acefb90f9e442c7d1746a98bebf2f2aca
ansible-core 2.16 requires py3.10+ on the host running
ansible-playbook - let's use Python 3.11 on RPM distros
to have the same version of ansible-core used on all
distributions.
Change-Id: I2caf2c972cd0283889fadde01bdd6a53e5f66ed9
2.15 patch was 2023.2 only - because we missed it last cycle [1]
ansible-core 2.16 requires python3.10 which is not the default
python in Rocky Linux 9 - therefore we use 2.15 there for now
[1]: https://review.opendev.org/c/openstack/kolla/+/910148
Change-Id: Ic8cc29230d82f4d1f07a3c97c3dcbcd14ac76074
The Tinkoff/libvirt-exporter is archived. Latest release in December
2022. The inovex/prometheus-libvirt-exporter is an active fork that will
most probably become a prometheus community exporter in the future [1].
Unfortunately this exporter is not 100% compatible with Tinkoff exporter
that we are using currently [2].
[1]: https://github.com/prometheus-community/community/issues/50
[2]: https://github.com/inovex/prometheus-libvirt-exporter/issues/22
Change-Id: Icc8a3651d601ab45d448c9d252ca6155219d21cf
Since 2.13 OpenSearch and OpenSearch-Dashboards packages
install files in /usr/share/opensearch and
/usr/share/opensearch-dashboards with root:root ownership
instead of using opensearch/opensearch-dashboards user.
Closes-Bug: #2061877
Change-Id: I3831d8ab76c8c7136ce7869db3d0d1e05b4ba8f8
pin opensearch and opensearch-dashboards to 2.12. for now
Closes-Bug: #2060668
Related-Bug: #2060306
Change-Id: I3df4823d78474d94e138ff73f0f577bd247bdad0
Signed-off-by: Sven Kieske <kieske@osism.tech>
Pinning Erlang to 26.2.* (max supported version as per [1]),
so we don't break this in future when Erlang 26.3 becomes
available.
[1]: https://rabbitmq-website.pages.dev/docs/which-erlang
Change-Id: I1fd03a67914386129d7b0bb9be6aca86982f98f3
Those are failing now due to fixed setting of debian_arch variable
that was omitted in the general patch.
This patch also adds a validation on debian_arch cfg option
Change-Id: I372fe0bce4fc502eacce214d24c5bddd198bc33f
Bifrost has moved to use the native in-band inspection support in
Ironic[1]. Some features are missing (such as introspection rules), so
it may still be desirable to use ironic-inspector for these use cases.
It also requires changes to the inspection interface of the ironic nodes
(ironic-inspector -> agent), so it also desirable to support
ironic-inspector for backwards compatability reasons. We should consider
dropping ironic-inspector once the native interface reaches feature
parity.
This will install ironic-inspector into the image, but will still
require configuration in bifrost.yml to use it.
[1] dcbf1d98b9
Change-Id: I3cc8455647339c67ba51620d5aff8a3acbf58dab
Partial-Bug: #2054685
Since 2.12 OpenSearch requires setting initial admin password,
that is not trivial/weak.
Closes-Bug: #2054586
Change-Id: I6b6ef656bc2009a2dc3cdfcb01956d50fba4b7b9
Move most curl sources to sources.py, so it can be automatically
updated in future.
This also makes overriding the versions/locations/sha256 easier.
Change-Id: Ib3497fe96162ae190e5c113cacaaa3ef8334f590
The main goal is to be able to build ARM
images on standard x86 hardware. Add simple
functions supported by python-py and
podman-py to enable creation of container
images on emulated architectures.
Change-Id: I1526b460f6e271c2ec63ab3a3b1dc348d742e96d
The local_settings.py config is rendered by kolla-ansible
orchestration, which is not a good approach because upstream
local_settings.py can be changed anytime and that can be a problem,
as it was shown recently with the new version of horizon.
Fortunately, horizon supports local_settings overrides in
local_settings.d directory and moreover it's preffered
way how to configure horizon as per doc [1].
This patch just change the structure of files to support it.
[1] https://docs.openstack.org/horizon/latest/configuration/settings.html
Change-Id: Ib0c060adffe5287d786ba9247c6b962732cdb5e0
Patch [1] fixed invoking of ip command in
one script but forgot to fix on another place
in another script.
This patch is follow-up path and fix the same
issue in those script.
[1] https://review.opendev.org/c/openstack/kolla/+/906516
Change-Id: I5e41a550e438fb3e4008a9e6b8df35c4775c5c30
Global-requirements changed upper-constraints in [1].
Because of that change skyline and gnocchi build is now failing.
This patch fixes upper-constraints for those projects.
[1] https://review.opendev.org/c/openstack/requirements/+/900435
Change-Id: I09cc2635cd422a859ccded887affb58dfbdc60ad
As per the current release tested runtime, we test
till python 3.11 so updating the same in python
classifier in setup.cfg
Change-Id: I462764b6ff8f8da0270daba82f2d6937070ba3c7
This code was valid for centos:8 and centos:stream8, but is not required
for centos:stream9 or rockylinux:9 which do not include this file.
Change-Id: I50f78d73afe0944dd91998ab9799fa2f36cc46a3
env-setup script removes epel-release and this
breaks our CI template overrides.
It is also more geared towards using in opendev
CI - let's just install proper Ansible version
instead.
Change-Id: I68f645bef05dd15eba41479e3ef6713100fb87d0
Add file to the reno documentation build to show release notes for
stable/2023.2.
Use pbr instruction to increment the minor version number
automatically so that master versions are higher than the versions on
stable/2023.2.
Sem-Ver: feature
Change-Id: I6ae1d206ec742105f5a3a53a81053757d0626b98
This dependency was added to podman-py in version 4.8.0, but not added
properly to their requirements. Install it explicitly for our tox
and integration testing as a workaround.
[0] https://github.com/containers/podman-py/issues/350
Change-Id: Ic0d9b2c26fe5474f579b72d6779243b7ad39b420
Since change I1bc19f8198da3f9ab2ae2a8864c3349b21b0249e we install the
centos-release-ceph-reef package as a dependency, but some code was
still expecting the quincy package.
Change-Id: I8ebcf815d80f3bead25e0078d69b34e17ad013bd
The script for database synchronization is missing in the venus-api image,
which makes it impossible to create the required database tables during
venus deployment.
Closes-Bug: #2029915
Change-Id: Ibbf75fa73b8397ea3686b42cec6cad6d8f6d3858
* capture podman config
* podman info needs sudo permissions
* before this fix, the podman info command failed with:
Error: cannot set up namespace using "/usr/bin/newuidmap":
should have setuid or have filecaps setuid: exit status 1
Change-Id: Ib3fe039a8c35421b56eedbd2d5197217b4a15a9a
This reverts commit 881e3925c7.
Reason for revert: switch back to master, to be followed by switch to bobcat when available
Change-Id: Ib8fdad41a669fc8404b8de2de5361db9547c4ea2
Example:
Traceback (most recent call last):
File "/home/ubuntu/kolla/kolla/image/build.py", line 79, in run
task.run()
File "/home/ubuntu/kolla/kolla/image/tasks.py", line 144, in run
self.builder(self.image)
File "/home/ubuntu/kolla/kolla/image/tasks.py", line 424, in builder
if isinstance(e, podman.errors.exceptions.BuildError):
NameError: name 'podman' is not defined
Change-Id: I947c77750b3ccfb975e010c2042a3716e3e46bde
Add podman as an option to choose for container engine
for kolla-build (--engine podman)
Signed-off-by: Konstantin Yarovoy <konstantin.yarovoy@tietoevry.com>
Co-Authored-By: Michal Arbet <michal.arbet@ultimum.io>
Change-Id: I068c906df97745e397408d8c3ef6af47ee037638
In the aarch64 image build,
use debian_arch to determine packages of different architectures.
Closes-Bug: #2036874
Change-Id: Ic86e6c22840f658bb68387aac688918d4db1f766
This patch is adding "API layer" to letsencrypt
images which is represented by set of scripts inside.
This scripts are called by kolla-ansible orchestration.
Change-Id: I61b70fb4e12ba03b96e79004e735d2ead0f52319
kolla/tests/test_build.py::MainTest::test_run_build [65/1834]
/home/marcin/devel/linaro/kolla/kolla/kolla/image/build.py:117: DeprecationWarning: distutils Version classes are deprecated. Use packaging.version instead.
StrictVersion(docker.__version__)
Change-Id: I2ebc8b0e35c67bf893deb89ea7fa0146dedd4640
In [0] we switched to using gnocchi from master, since we were needing a
fix that had not been released yet. Now gnocchi has release 4.6.0 with
the fix, switch back to using that tagged version.
[0] I3ca4e10508c26b752412789502ceb917ecb4dbeb
Change-Id: I22b39914b58ead7fa7addb1a1265353567d92476
Introduces a new block `openstack_base_override_upper_constraints` to
provide users with the capability to globally override version
constraints for services.
This enables more flexible dependency management across all services.
Change-Id: I0d627487973311de8b23dd1519d41a0cab622fac
Signed-off-by: Sahid Orentino Ferdjaoui <sahid.ferdjaoui@industrialdiscipline.com>
This commit adds the ironic-prometheus-exporter, following the
conventions used by the previously integrated exporters. '[The] Ironic
Prometheus Exporter is a Tool to expose hardware sensor data in the
Prometheus format through an HTTP endpoint.'[0]
[0] https://opendev.org/openstack/ironic-prometheus-exporter
Change-Id: If833f1f4a33c27cdc941dcc7cd5bbb06b26e1eaf
Change to use docker.DockerClient instead of the low level
docker.APIClient.
Signed-off-by: Konstantin Yarovoy <konstantin.yarovoy@tietoevry.com>
Change-Id: I88842c17d8e6ddbe89b984c7b5e0367ed356fa50
Commit [1] deletes the relevant operation permission of the
/etc/freezer directory, causing the freezer-scheduler to have
no permission when creating the jobs_dir directory in the
/etc/freezer directory. This patch creates partent dir of
jobs_dir for freezer-scheduler, so that, freezer-scheduler
process can startup successfully.
[1] https://review.opendev.org/c/openstack/kolla/+/722102
Related-Bug: #2031953
Change-Id: I9c7fea3e0f70ff2e15394e99e26d21c548b95b16
This added to make Rocky/Centos similar to Ubuntu/Debian
to provide /server-status handler for local monitoring of the Apache.
Since I3ec1af6353c3ecc64589599abe375b0ae9b14d5c is merged it safe
to add this change.
Change-Id: I14ba7e0319b7eb0390361d397d4baad0e9a3f0b1
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
The grafana opensearch datasource was missing from the docker image.
This commit installs the datasource plugin.
Change-Id: Ia3a39c975abf815a66765f2f98c4789d6cec33d7
We move to use some components from distribution instead of 3rdparty
repos. At least for now - this may/will change later.
Packages from Debian:
- Erlang 25.2
- MariaDB 10.11
Some Ubuntu/jammy repositories are used in places where there is not
(yet) Debian/bookworm one.
openvswitch-netcontrold image fails as it needs to be converted to use
virtualenv - added into unbuildable images for now.
See https://etherpad.opendev.org/p/kolla-bobcat-ptg#L199 for more information.
Depends-On: https://review.opendev.org/891946
Change-Id: I45b5a5980fb2318f1aab23a3a6aaf0922563b171
This reverts commit 5505cd000c.
Reason: Closed#1304 [1] as completed.
Also build from master until new tag releases since #1304 fixed
in master [2] only.
1. https://github.com/gnocchixyz/gnocchi/issues/1304
2. b52f7414d5
Change-Id: I3ca4e10508c26b752412789502ceb917ecb4dbeb
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
In [0] the secret name was changed, but the references to it stayed
untouched.
[0] Ieceadb1f56908ce752f48b0884ed5cf764bc1ecd
Change-Id: I729b4c3ee9e91ee05b5d2413031669cd25d87156
For start we will use same APT sources.list format as we used in past
(and use with Ubuntu). But we need to remove what is in container to
make sure that CI jobs would use mirror only.
Change-Id: I82dd0e8667e44250d2892538819c12e6c775618b
Debian:bookworm container does not have 'adduser' installed so
we need to do it before we touch /etc/adduser.conf file.
In Bookworm configuration file for adduser changed.
Change-Id: Ic06f3c0e42fb7854e5b198c9b868f10cd507cd24
2023.1 'Antelope' has stable/ branch so we can go back to master.
rocky/centos: mark bifrost unbuildable - EPEL issues - will be
fixed separately
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/886395
Change-Id: I523e7465c3cf87ae4ee3fd16b3a79ddb0b707b37
Revert this commit when [1] is solved.
1. https://github.com/gnocchixyz/gnocchi/issues/1304
Change-Id: Iafeb9093340621d65a9c9cd126d65679d981dfb1
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
This patch is replacing ppa.launchpadcontent.net
by ppa1.novemberain.com.
Reason for replacement is that only latest erlang version
is available on the current ppa source.
Setting Debian ARM jobs non voting for now, since the new ppa
does not contain arm64 packages.
This repo is based on the official Erlang/OTP package
for Debian. The RabbitMQ team adapted the upstream package
to produce packages for more/different combinations of
Erlang/OTP, Debian and Ubuntu releases.
Change-Id: Iddec6ec555f98e13c2f199e5ca7dad7f4819b1a8
If mariadb-clustercheck starts before mariadb, the directory may not
exist, and the command fails.
This is necessary for the refactored MariaDB restart in
I5a12670d07077d24047aaff57ce8d33ccf7156ff.
Change-Id: Ie1b36eb9a403611c2f86aa4c1d500d324e5291f3
Add file to the reno documentation build to show release notes for
stable/2023.1.
Use pbr instruction to increment the minor version number
automatically so that master versions are higher than the versions on
stable/2023.1.
Sem-Ver: feature
Change-Id: I2e10f0aceb2eec74870d68311d14edd5672f702a
docker-py reworked their version function and now it does not
return a string [1].
Example:
>>> import docker
>>> docker.version
<module 'docker.version' from '/home/cloud-user/kolla-venv/lib64/python3.9/site-packages/docker/version.py'>
[1]: cd2c35a9b6
Closes-Bug: #2018559
Change-Id: I5ec0fbfdaf18cf53a6b5bf91236d3e040daa9d7e
Add support for writing the build summary to a JSON file. This is more
machine-friendly than the current approach of writing to standard output
at the end of the build.
The file is configured via [DEFAULT] summary_json_file.
Change-Id: I9868af5d00977750d0673fc48f8863a99f878dc8
upper_constraints_remove() macro allows to remove line
upper_constraints_version_change() allows to change versions
This way we have cleaner way to alter u-c in those images which need it.
Change-Id: I8fc354b8aa4d03fcd3ecfb9cbfe75de67492a0e3
Since I650fcbc8f773fad8116338f6fb0cf7b4f4f17b33 builds from git fails
on plugins with an exception: 'tarfile.ReadError: not a gzip file'
because the test checks only gzip compressed archives but plugins
created as plain tar files. This change fixes the issue using
transparent compression support and also adds some debug info.
Closes-Bug: #1990432
Change-Id: If0f9b4dd058a257d0653332d1b663e150c717304
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
Co-Authored-by: Michal Nasiadka <mnasiadka@gmail.com>
This change was agreed during the Bobcat PTG to better reflect the
status of these projects in Kolla.
Change-Id: Ice2ff5eaa0991c65b6c534721f13182dbb27d14c
This patch adds support for the new OVN Neutron Agent [1]. This
new agent will include any needed OVN functionality not implemented
in ovn-controller. This agent will, in a future, include the
metadata service, superseding the OVN Metadata Agent.
[1]https://review.opendev.org/c/openstack/neutron-specs/+/868076
Related-Bug: #2000385
Related-Bug: #1998608
Change-Id: Ib15a89ce9ba7b1c5121a627da9d130dc5bf5a044
Debian 'bookworm' does not like when someone installs Python packages
into system directories. So instead of installing 'virtualenv' from pip
we move to use 'python3 -m venv' which we install from distribution
repositories (on Debian/Ubuntu as EL9 has it in base 'python3').
Change-Id: I7092b561d81c362ca24f84a3d753e777e5625ab3
In addition to that, mark bifrost unbuildable since it's
failing on EPEL 9 enablement.
Closes-Bug: #1990432
Change-Id: I650fcbc8f773fad8116338f6fb0cf7b4f4f17b33
When adding a dashboard to grafana the containers aren't restarted when
they should be. This is due to a bug in Kolla where the logic to
determine whether or the container needs to be restarted fails in the
case where the file does not exist in the container. This patch adds
more comprehensive checks for container restarts in the set_configs.py
file. This patch also adds a test to ensure that the functions work as
expected.
Closes-Bug: #1997984
Co-Authored-By: Will Szumski <will@stackhpc.com>
Change-Id: I67f5f12700d7b55f26bff81e9b54559303da6d83
state present only defines mount in /etc/fstab, does
not do the actual mount
Need to symlink /var/lib/docker to separate disk,
work-dir only templates out dockerfiles and downloaded
content
Change-Id: I06e262cd48d33ccfc0634589c82dcac80dff51af
It seems that on some nodepool providers (rax for sure),
we get 40G boot disk and 80G additional disk, while
on others we get 80G boot disk only.
Change-Id: I179c41032239f5f0ce6055c79295b32c33fe67a5
We have a high number of POST_FAILURE jobs failing on at least
one container push - let's fix that.
Change-Id: I0015dd4d3ffe5b3e1202ebcfde2b2c72c4655b41
The ipxe package in Ubuntu Jammy includes snponly.efi [1]. Remove code
to handle Focal in which snponly.efi is absent from the ipxe package.
[1] https://packages.ubuntu.com/jammy/all/ipxe/filelist
Change-Id: I5f494de36e6400b5486c1fb786b73c9e1512a046
Docker 23.* is out and it started failing with apparmor_parser
related messages - it seems apparmor is missing in the OpenDev image.
Change-Id: I2a6d98e3c1d2d1b7c97a8e6172decbf56e77042d
It's useful to have a templated out version of the Dockerfiles
in order to diagnose errors like "error on line xxx" after
tests/templates/template-override.j2 gets applied.
Change-Id: I5443454d8b020aa1c5552e11f6039e582a002431
Skyline is a new dashboard for openstack. It contains
skyline-apiserver and skyline-console.
We will build both skyline-apiserver and skyline-console
images for skyline.
Implements: blueprint skyline
Change-Id: I68a562f15bf4fdda82b86c446e14fc8b5594413a
By default in both Debian:11 and Ubuntu:22.04 'netcat' means
'netcat-openbsd'.
Debian 'bookworm' 12 will not have such default. So let install proper
package.
Change-Id: I9795fca15aa3e9d59eb686ff749245bf618639cf
Calls to `ovs-vsctl` in `ovs_ensure_configured.sh` did not get checked
for errors.
This can cause false success statuses when
the script is run by automation tools such as ansible.
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/870540
Closes-bug: #1999778
Change-Id: Iad83132b61efadbf09aa9aa2edf96235085764c6
Mistral-api is started using wsgi and apache2 in the
container need to start with the root user, like nova-api.
Closes-bug: #2000915
Signed-off-by: Arnaud Morin <arnaud.morin@ovhcloud.com>
Change-Id: Icace8576dcf0085a5e51eb453cbad2ac89c7358e
Definition of 3rdparty repo can contain also url to gnupg key used to
sign files there.
DNF knows how to handle that so we do not need to import keys in base
image anymore.
Functionality stays as people may use own repos with own keys.
Change-Id: I88e8e86ca35ee1b6b6b5551c3ca8698f0ed814cb
This option allows you to define 'locals' style dependencies as relative
to a $locals_base variable, similar to how $tarballs_base works. This
can help you avoid defining the same hard-coded path in kolla-build, and
instead pass it to kolla via a flag.
Similar to $tarballs_base, this works via oslo_config's existing
interpolation functionality[1].
Example usage:
[DEFAULT]
locals_base = /opt/openstack
[neutron-base]
type = local
location = $locals_base/neutron/neutron-stable-rocky.tar.gz
[1]:
https://docs.openstack.org/oslo.config/latest/reference/configuration-files.html#option-value-interpolation
Change-Id: I8670db4dde4dac26df28502637eadc6b854261cf
libvirt-exporter repo has been moved from
AlexZzz (https://github.com/AlexZzz/libvirt-exporter)
to Tinkoff organization and is maintained by this organization
now. The old link redirects to the new one.
This commit prevents unnecessary redirect and adds clarity.
Change-Id: Ie810149de353e12655994ba9ef371c85dea7f7a8
This is an automatically generated patch to ensure unit testing
is in place for all the of the tested runtimes for antelope. Also,
updating the template name to generic one.
See also the PTI in governance [1].
[1]: https://governance.openstack.org/tc/reference/project-testing-interface.html
Change-Id: Ice4b5ba33919f5c982fa798cf7984590581ead2e
Add file to the reno documentation build to show release notes for
stable/zed.
Use pbr instruction to increment the minor version number
automatically so that master versions are higher than the versions on
stable/zed.
Sem-Ver: feature
Change-Id: Icf2770f4b883cf4db1dc2da244395c576b11ee60
Use bash to call shell scripts instead of adding them explicitly to
allowlist_externals. Drop external command that is no longer being used.
Change-Id: I4f90fbcc3a679660c437e99a3aa1f81747b72054
- fixed amount of quotes to make them work
- fixed Debian/Ubuntu rabbitmq/erlang info
- fixed syntax in Ansible update
Change-Id: I2730c6336ca3029c411e497b0851109eaec0e249
follow-up on I1d624bd2f87be93a386147c5d7403a5524e41633 to support
all upcoming minor releases of the Rocky Linux 9.x (Blue Onyx).
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
Change-Id: Ifad1da69122381cec10be4a882f80dab665cfc33
A recent change to git [1] introduced a new behaviour to work around a
CVE [2] that disallows any git operations in directories not owned by
the current user.
A fix was introduced for general checkouts, but it was not applied
to the plugins archive, resulting in PBR still not working as intended.
[1] 8959555cee
[2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24765.
Closes-Bug: #1969096
Related-Bug: #1968877
Co-Authored-By: Mark Goddard <mark@stackhpc.com>
Co-Authored-By: Marcin Juszkiewicz <marcin.juszkiewicz+kolla@linaro.org>
Signed-off-by: Jakub Neumann <jneumann@cloudferro.com>
Change-Id: Ib3a37eebb29d975fc51a117cecdff74baafd8941
And they use release version in /etc/os-release so we need to adapt.
Telegraf also needs to be marked unbuildable because of [1].
[1]: https://github.com/influxdata/telegraf/issues/12303
Change-Id: I1d624bd2f87be93a386147c5d7403a5524e41633
As discussed during the last PTG (Antelope 2023.1) [1].
The added page discusses two properties of the Kolla ecosystem
that are important mostly to contributors.
Clean up the "Contributing" page a bit along the way.
[1] https://etherpad.opendev.org/p/kolla-antelope-ptg
Change-Id: I0c7dd35ac9bbd050b708d5baae2504d3bd56828d
Add engine adapter module to allow additon of other container engines,
create one common EngineClient that would be called in all other
modules.
Based on patch by Konstantin Yarovoy <konstantin.yarovoy@tietoevry.com>
Change-Id: Ice6467086bd292af086322afc3fc4e869d89eefa
Wallaby has been moved to EM state, so it will receive no more releases.
Also, being optimistic, zed is already being added to the list of stable
branches, so we don't forget it when we actually cut that branch.
Add a small note about this being referenced once per month in regular
Kolla meetings. Also update the example link to a patch that actually
matches the description.
Change-Id: Ie3b4e4461dbfe35808250a929b3e95f880242aed
In Zed PTG we decided to limit the amount of release notes
this change adds the criteria when reno is required to the docs
[1]: https://etherpad.opendev.org/p/kolla-zed-ptg#L149
Change-Id: I4f153a619eb57a75ebdb1aba4b71e422b30d74fe
kolla-build cmd '--docker-dir' option specified a default value
of an empty list, this was causing a warning on tox genconfig.
Change-Id: I204a067d76395ef5ad4d3ce23243f196eab3bdd5
Closes-Bug: #1827146
PPA from Team RabbitMQ [1] provides newer Erlang for Debian/Ubuntu.
This way we have latest Erlang on both distributions and both
architectures.
1. https://launchpad.net/~rabbitmq/+archive/ubuntu/rabbitmq-erlang
Change-Id: Iec7e8461f9eb757e1576cf3898068306c5436239
Fixes a hypothetical security issue related to privilege escalation via
rootwrap/privsep. A potential vulnerable service could previously allow
writes to its rootwrap/privsep config and thus allow for more commands
to be run with root privileges via rootwrap/privsep. For a succesful
attack, this would also require the service to allow to run arbitrary
commands via rootwrap/privsep. Thus far, no such vulnerabilities have
been reported and thus this fix is simply strengthening the container
images against such an issue in the future.
Change-Id: I92c81c77e6a16570a108cde8031f7977930fb02a
Closes-Bug: #1874298
Swift deployment is broken since CVE-2022-38060 fixed sudoers file in
the I66476a2b396e2cbe41e68ac51f57aae1806b2ed8. The kolla-toolbox
container have their own virtualenv path differs from all other
containers. This change adds the correct sudoers secure_path
configuration needed only for kolla-toolbox conainer.
Related-Bug: #1985784
Change-Id: I3651576ee354364d639c187ff750491667ecab56
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
Adds a deprecation notice for Monasca service in Kolla with its
dependencies: Kafka, Storm and Zookeeper.
Change-Id: I8f08abb1722e558e3874fd7d92322598d55de563
PROJECT_ROOT mangling is already done in kolla/cmd/build.py (which is
called as 'kolla-build' or 'tools/build.py' or directly) so it is not
needed here.
Now we can sort imports and drop not needed ones.
Change-Id: Iac6ea537491e5c00ce6fb4b4e8f07a9124e9fa8b
Only kolla/cmd/build.py is an executable script used by user (either as
'kolla-build' or 'tools/build.py' or directly).
Change-Id: Ia1ba2699f425749f9d4f2cdba27caeb97bc3d668
As part of kolla/image/ refactoring we move KollaWorker related classes
into own file.
Based on patch by Konstantin Yarovoy <konstantin.yarovoy@tietoevry.com>
Change-Id: I55c3f6b34631048b2463b02e6ea611d7e4c1a912
As part of kolla/image/ refactoring we move build related task classes
into own file.
Based on patch by Konstantin Yarovoy <konstantin.yarovoy@tietoevry.com>
Change-Id: I093620679016b37e1664c9fe4cf7559433e744b7
As part of kolla/image/ refactoring we move status enums/consts into
own file.
Based on patch by Konstantin Yarovoy <konstantin.yarovoy@tietoevry.com>
Change-Id: I940816c7e487f6d5c7abc4446226e2992cf9e63d
As part of kolla/image/ refactoring we move information about
unbuildable images to own file. Like we did with users and sources in
past.
Based on patch by Konstantin Yarovoy <konstantin.yarovoy@tietoevry.com>
Change-Id: I759ab49a3ef488042984067c1eca93e945805678
This is necessary if using nova-compute with RBD backend (directly,
not via Cinder) and wishing to make an instance image to Glance
while (1) following the recommended Ceph permissions which do not
give Nova write permissions to the images' pool or (2) not using
RBD with Glance or (3) not revealing what Glance actually uses
as the backend (hiding locations).
Change-Id: I88e1e0ca01b2b2effad9515b905cc761fbb5d2d4
This reverts commit ea3ed3f933.
Reason for revert: fixed qemu packages are now in Debian:
Change-Id: I7b2fac6e4b6c53ea637e849b4fa171ab5126a09f
INFO:kolla.common.utils.nova-libvirt:Successfully tagged test/nova-libvirt:debian
Repo definitions in RHEL 9 rebuilds use metalink method for most of
entries which makes our use of sed obsolete.
This patch adds file with definitions of all CS9 repos we use and
moves all official definitions a side at start of build. After build our
definitions get removed and official ones are restored.
Similar is done for RockyLinux 9 builds but there RL9 repos are used
from official mirrors while CS9/EPEL ones are from OpenDev mirrors.
Final images will have repos in wrong enabled/disabled state.
Change-Id: I04121fd5ca9894b6deeda3808808cbffd6b97811
We do not have Erlang 25 for CentOS Stream 9 on AArch64 so we revert to
use Erlang 24 from CentOS repository.
Also synced Erlang and RabbitMQ versions between images.
Change-Id: I1480de095eaea66c3a83a61ca3ff269953181e39
Follow-up to I5ce2eb66a647e1805f086aa37942bf5d13eb4106
So far, I have only observed these causing weird errors later but,
in theory, ignoring these could allow the rest of the code to use
archival (so wrong) entries.
Change-Id: I9cef5ceeb78d431ca232c7b196c48eef5d2ccbca
The goal of the swtpm project is to provide a TPM emulator (TPM 1.2 &
TPM 2) that can be integrated into virtualized environments, such as
virtual machines and containers.
Nova supports it for quite a while:
https://review.opendev.org/c/openstack/nova/+/631363
Change-Id: Ifb7e0f1632805807851720873a70179218bdf372
OpenStack 'zed' requires Python 3.8+ so RHEL 8 family has to go.
This changeset moves to CentOS Stream 9 while move to RockyLinux 9 is
planned as final solution.
CI moved to CentOS Stream 9 nodes.
Depends-on: https://review.opendev.org/c/openstack/kolla-ansible/+/839715
Change-Id: I113b9984294cf8663d3fc0c8840320e1d40ea731
doc says:
> If dirs_exist_ok is false (the default) and dst already exists, a
> FileExistsError is raised. If dirs_exist_ok is true, the copying
> operation will continue if it encounters existing directories, and files
> within the dst tree will be overwritten by corresponding files from the
> src tree.
So we do not have to copy dirs/files one by one and tell
shutil.copytree() to handle everything.
Change-Id: I97d9c8261351b8fd88f088c1463cc508e07792e7
With source base images we use small amount of packages from there.
Some Python/JS updates and novnc/spice stuff.
Change-Id: I41d8d3ae0e43ba7b54b126e076134f13dcab7859
This is a follow-up to [0], removing jobs also from experimental to
avoid unnecessary runs. Since zuul complains about an empty project
stanza, remove the whole block, it can always be restored from git
history if needed.
[0] I32bef531896777bfb463bb401ebba1d488a16bf9
Change-Id: If68d548957adb8c6584dcab4582ef8396cccf0b2
In Zed cycle, we have dropped the python 3.6/3.7[1] testing
and its support. Updating the python classifier also to reflect the same.
[1] https://governance.openstack.org/tc/reference/runtimes/zed.html
Change-Id: If7955df1073adadad2d306c3d9b74d1479cd334a
Change default 0 retries to 5, that should help for transient
errors (timeouts, HTTP 408, 429, 500, 502, 503 or 504).
Change-Id: Iad3c7270579ffb38299269481ac64d5582abaa22
With version 6.0.0 of the docker python module, their implementation of
versioning has changed, making our check for old versions fail. Since
version 3.0.0 is from 2018, we should be safe to assume that as a
minimum version though, so we can just get rid of the special handling
of older versions.
Change-Id: I077b7b5acf2c1f9beb6da06d3555e2ebe30831d1
The etcd3 extra in tooz has been deprecated [1] as the library it uses
under the hood, python-etcd3, is currently stale and unmaintained. It
will be removed in a future release. Stop installing this.
[1] 7ee2780af8
Change-Id: Ib54a2868cb33de5fc2800f314b2811c67ef13461
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
mariadb - downloads.mariadb.com doesn't have jammy version, should
be there soon - using Ubuntu provided version for now
telegraf/collectd - collectd packages missing in Jammy - marked
as unbuildable
monasca - requires new librdkafka, no wheel for Python 3.10 for now
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/846070
Change-Id: I11b4fbcaba165824252902d0270ce1dbbc3d6e9d
Publishing container images to Docker Hub was failing with:
state is present but all of the following are missing: source
This is caused by the recent Ansible upgrade by Zuul [1]: the source
parameter is mandatory since Ansible 2.12.
[1] https://review.opendev.org/c/openstack/project-config/+/849120
Change-Id: I232fe835f5a650c258243f1ee4720480f2e6e7b1
This patch is updating ProxySQL from
version 2.3 to version 2.4, which
has several new features and bugfixes.
Change-Id: I625f72aac591aee8b1efe51f0b4a9e7660e6dbdc
Removes a dependency on RDO for install etcd in CentOS images.
Aligns version of etcd across all distributions, see below:
```
(venv-kolla) [will@juno kolla]$ docker run --rm -it kolla/ubuntu-source-etcd:yoga bash
()[etcd@730a011b670a /]$ etcd --version
etcd Version: 3.2.26
Git SHA: Not provided (use ./build instead of go build)
Go Version: go1.13.7
Go OS/Arch: linux/amd64
```
```
(venv-kolla) [will@juno kolla]$ sudo docker run -it kolla/centos-source-etcd:yoga bash
()[etcd@9aa486c9e94f /]$ etcd --version
etcd Version: 3.2.21
Git SHA: 3ac81f3
Go Version: go1.12.8
Go OS/Arch: linux/amd64
```
```
(venv-kolla) [will@juno kolla]$ docker run --rm -it kolla/debian-source-etcd:yoga bash
()[etcd@b49cb5fcdf87 /]$ etcd --version
etcd Version: 3.3.25
Git SHA: Not provided (use ./build instead of go build)
Go Version: go1.15.9
Go OS/Arch: linux/amd64
```
This will also allow us to update to a more recent version in the
future. We have to be careful not to jump by more than one point release
to ensure compatibility:
https://etcd.io/docs/v3.5/upgrades/upgrading-etcd/#upgrading-an-etcd-v3x-cluster
Change-Id: I62a34256fb7395d0448af169ac3cf036f60cd290
Downstream users are often building their own
custom images from their own forked git.
Reasoning can be various - added fixes not merged yet,
some customizations and etc.
Because of this, it's very usefull to have information
about git commit in images, and this is exactly what
that patch does.
If images are built from pip source, kolla_version
LABEL contains kolla version.
Change-Id: If81989603185528dae86df52e8f8d0f94cdca85d
INFO:kolla.common.utils.monasca-base:
Install the latest version of librdkafka from the Confluent
repositories, see http://docs.confluent.io/current/installation.html"
No more monasca for aarch64.
Change-Id: Ice6f1ab4a08d0ef07ce2434bfef704b68e90f9d0
Kolla project images cover several distributions on multiple
architectures. Not all packages come from distribution repositories.
This patch adds documentation about such cases.
Change-Id: I870aa6acd875fc1425f25a435f0701850cf97285
1. There was no %s for the image.name
2. The image name is in the logger, so the source is more useful (which
may be a plugin or addition)
TrivialFix
Change-Id: If95a8a41d2caf6738d4ccb9ddb651a06018743f4
Skydive versions prior to 0.28.0 panic on newer versions of libc.
Fixed upstream in 0.28, see: https://github.com/skydive-project/skydive/issues/2329
This should be backported to at least xena and yoga, as skydive is
currently not working with centos 8 on these releases.
Closes-Bug: #1940862
Change-Id: I177949b9319a977c9cd9121eb28b710256b72a5a
This change fixes an issue with 'apt-get update' command and stop
container building with erroneous source repositories.
Change-Id: I5ce2eb66a647e1805f086aa37942bf5d13eb4106
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
We kept CS8 jobs while waiting to get CentOS Stream 9 support ready.
But we have situations where OpenStack projects fail due to lack of new
enough (3.8+) Python in CS8.
Time to make CS8 go away.
Change-Id: I32bef531896777bfb463bb401ebba1d488a16bf9
Add a reference on how the release tooling can be used.
Add a bullet point to the meeting agenda.
Drop reference to milestones on launchpad, which are no longer being
used.
Change-Id: I66492a7c74a05849b35a157f7782a6596887427f
Several people use Kolla behind firewall/proxy. Internal mirrors are
often in use then. We do not provide a way to replace repos.yaml file in
an easy way which may lead to complicated solutions or template
overrides.
This patch adds a way to provide own copy of repos.yaml file.
Change-Id: I0b07da22fea27e0ff4e90aaad19e50d84ff9a121
Replaces Certbot with Lego for certificate retrieval and renewal.
Lego includes support for DNS ACME Challenges.
Adds ssh-client to LetsEncrypt and ssh-server to HAProxy to allow both
the transfer of Let's Encrypt certificates to the HAProxy container and
to enable live updating of HAProxy certifices using the HAProxy API
exposed on the local HAProxy socket.
Implements: blueprint letsencrypt-https
Change-Id: I737e1ce5bfc37d0703879c8272a9e915084c5ca6
Adds a relevant reno to inform users about the change and the
possibility to customise the prefix.
Additionally, this patch includes the fix to Ubuntu image builds
regarding rabbitmq and erlang.
Both the changes are required to fix master CI.
Change-Id: I6bc8b489a810849744c8bead6b9e350c5d3e36b7
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/843752
Following up on [1], Bifrost also needs to use correct u-c and,
surprise-surprise, this is set via a third variable, this time
environment one for the bash script. Oh well. Let's do it.
This has the added benefit of not requiring additional
download of u-c as it reuses the already existing one.
[1] https://review.opendev.org/c/openstack/kolla/+/842276
Change-Id: I2cc79c476d089977b57006dd4ce2e9a8c6206aa1
This is I2cbf1f539880d512aa223c3ef3a4b19ee18854ac extended to fix
the case when a git repository is used with a git repo.
This is probably a rarer use case but, still, we use it in CI
for in-review changes testing.
Change-Id: I77b0dcd2e9dfd8ea8390a471b80c8954b67ef91b
The CONFIG REWRITE command rewrites the redis.conf
file the server was started with, applying the minimal
changes needed to make it reflect the configuration
currently used by the server, which may be different
compared to the original one because of the use of
the CONFIG SET command.
https://redis.io/commands/config-rewrite/
Because of above behaviour it's needed to
hack kolla's CMD.
Without this hack container's
/usr/local/bin/kolla_set_configs --check
is always reporting changed state even if
config is not changed.
Therefore redis containers are always restarted
by kolla-ansible. This patch is fixing this.
Change-Id: I8245b9e753fa4175dacfa679a078f63876b0d327
Partial-Bug: #1967664
Bifrost decides on the branches to use by itself.
Early in the cycle, they are often not set correctly and may
break our CI.
This patch ensures we force Bifrost to use the expected branches,
making us independent of Bifrost getting fixed.
Change-Id: I33dbca927062284fd7a06ab6db732dd5e2219c40
This change switches published images names from the current
format <base_distro>-<image_name>:<openstack_release>-<arch_suffix>
to a preciser and image-oriented (for better variant listing) format
<image_name>:<openstack_release>-<base_distro>-<base_distro_version>-<arch_suffix>
Change-Id: I6a4b5c2087b94f96f72aa9d0d0781ff14d3ee6bb
Cinder-volume container can operate on multipath devices but
fails to do so due to absent multipath package for several images.
This fix explicitely adds multipath to the image.
Closes-Bug: #1970541
Change-Id: I14af40078508b06e46866b77ab200228ec827a0d
Tim Shearer started it in 1d96a2bbe1.
Since all extend_start files are sourced rather than executed, the executable
bits are now cleared throughout the project.
Change-Id: Ia1797c32fc6a35f9f077c673abf4d8e16e51a760
There is proposed change in kolla-ansible below
which is changing the way how central-logging
works and adding native fluent logging.
Because of this, it's needed to add python
fluent library to openstack images.
Proposed Change:
- https://review.opendev.org/#/c/755775/
Change-Id: Iedc782a3317c93a2af0da4696fd71c05e0e4a55e
As we have one type of images now some RUN calls could be merged so we
will have less layers in resulting images.
Change-Id: I5178c58fbd8c65efe825dc249c0f1368ef0fe8e0
We can drop temporary 'use-short-names' argument and make short
(kolla/debian-nova-libvirt:master) image names default.
Kolla Ansible is using short names now.
Change-Id: I153355353cd12aa25adaa9c87438a478748dfb28
This patch is changing the way how keepalived
checks daemons liveness.
Check_alive.sh will find checks for daemons
which are copied by kolla-ansible and return 0/1
if alive/down.
This patch is required for proxysql HA.
Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/770215
Change-Id: I68836918466beb572e42ffedce127747290ad481
--use-short-names argument drops 'install_type' from image names:
kolla/debian-openstack-base:14.1.0
This should allow to get rid of '-source' in image names without
disrupting CI jobs.
Switch publish jobs to use short names so k-a tests will have ready to
use images for both long and short names.
Change-Id: I29c9d51f4b518a4e2d3157ab5d6cc434fb83f2ef
We have 'quiet' mode where only minimal data is printed to the console.
But there were no logs at all then.
This change generates log files (if 'logs-dir' argument is used) during
quiet build.
Also enables 'quiet' mode for CI so Zuul will not have to parse 29MB
JSON file each time.
Change-Id: If7d5c2807f0947a8bbbc1ceb8531c9b9c9287c1f
This reverts commit 09c890b124.
Reason for revert: That change caused all Kolla's work items to be
transferred. This includes tarballs, their extracted contents, cloned
git repositories, etc. to also be transferred to swift which takes
extra time, pollutes logs and decreases the stability of jobs slightly
(the mechanism is not designed for this kind of load).
The collection of templated Dockerfiles in CI has to be reimplemented
if it is wanted.
Change-Id: Ideaf66ce18c993802f4d20f490caa47cec0dde5e
The only place where it stays is argument parsing where it gets ignored.
Hardcoded to 'source' to make merging both kolla and kolla-ansible
changes easier.
Change-Id: I6890a7ec7baf507f8acd75b42bbd0fb17c2e4511
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/837620
A recent change to git [1] introduced a new behaviour to work around a
CVE [2] that disallows any git operations in directories not owned by
the current user.
This may seem unrelated to installation, but it plays havoc with PBR,
which calls out to git to get to get revision history. So if you are
"pip install"-ing from a source tree you don't own, the PBR git calls
in that tree now fail and the install blows up.
When using type=source, kolla clones the repository, then creates a
tarball from it, which is ADDed to the image. The ownership of the files
in the tarball is preserved, which in this case will be the user running
kolla-build. Since the Docker build runs as root, we hit the PBR issue.
Our solution is to make sure that any tarball we generate from git
sources have all files owned by root:root so that the root user is able
to use git commands when building container images.
[1] 8959555cee
[2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24765.
Closes-Bug: #1969096
Related-Bug: #1968877
Co-Authored-By: Mark Goddard <mark@stackhpc.com>
Change-Id: I2cbf1f539880d512aa223c3ef3a4b19ee18854ac
Explicitly set the permissions on the kolla-toolbox kolla_extend_start
file. Also, since all extend_start files are sourced rather than
executed, the executable bits are now cleared throughout the project.
Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0
*-source-upgrade kept old names as we need to add *-binary-upgrade ones
to check previous_release-binary/* -> current_release/* upgrade path
k-a jobs will go in separate patch
Change-Id: Ieba3260ffa11fa2d3982f379f95abed9f840028d
Big patch drops all mentions of binary images support. Suggestions are
welcome how to split it into parts or handle better.
Change-Id: I5d5a46c6ce7734ceb8b844e17b43e359d7cac6e3
We no longer support binary images. This patch removes a way to build
them.
"--install-type" argument has one available option now. Later in cycle
it will be ignored.
Change-Id: If0e881d253d6a4c89ffe27831a661df321b6d5b6
Add file to the reno documentation build to show release notes for
stable/yoga.
Use pbr instruction to increment the minor version number
automatically so that master versions are higher than the versions on
stable/yoga.
Sem-Ver: feature
Change-Id: Id9ff668719c6b7510eaf83dd68449d2c84da4054
During Yoga PTG we agreed about dropping support for binary images in
Zed cycle.
On start of build user was greeted with "binary images are deprecated"
message when tried to build them.
Part 1: dropping binary images from CI
Change-Id: I8035c53aef60717e8b2fd928bca75db1caf56aa5
This reverts commit b69c589718.
Reason for revert: The original commit was a hotfix to work around build failures, we should try to move back to a normal state again.
Change-Id: Iff79de9dabcd4bba795f3c44d3017baa5a860306
2021-12-21 05:18:48 +00:00
711 changed files with 10854 additions and 10740 deletions
&& sed -i 's|^exec_dirs.*|exec_dirs=/var/lib/kolla/venv/bin,/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/bin,/usr/local/sbin|g' /etc/designate/rootwrap.conf
