Unnamed repository; edit this file 'description' to name the repository. https://git.platform-os.org/openstack/kolla.git/atom?h=train-eol 2022-03-09T10:51:06+00:00 2022-03-09T10:51:06+00:00 Mark Goddard mark@stackhpc.com 2022-03-08T15:06:07+00:00 urn:sha1:3db029c8bf001a4d3bcd5be1c1b35c736013f32e We need 3.7 in Train in order to handle the transition from CentOS 7 to 8. The RabbitMQ image ends up with 3.7.28, but for certainty, this change removes the CentOS RabbitMQ 3.8 repository that was added with the switch to Delorean for CentOS Stream 8. Change-Id: I120be2b28a7214e6b03976719319e4208d8050ab 2022-03-04T09:55:43+00:00 Michal Nasiadka mnasiadka@gmail.com 2022-02-14T14:21:40+00:00 urn:sha1:76841d99ec35dccf7231ef67938aaf3629957a6e This is part of the effort to allow a migration path for operators using CentOS 7 and Train today. Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/831265 Change-Id: I75373eb21c4269c20f72603ad4cf162a472de25b (cherry picked from commit 67d6d28b6208cc004a50f19be1386d88c2404bc4) 2021-05-10T12:21:59+00:00 Marcin Juszkiewicz marcin.juszkiewicz@linaro.org 2020-01-10T15:40:50+00:00 urn:sha1:3b378b0a10570b91549a23055863d14e869768b5 Infra mirrors get their indices rebuilt to avoid broken indices (due to partial update). Unfortunately, this wipes out the cryptographic signatures. Our approach so far was disabling apt security features globally. However, this is not a valid choice for external repos. It hid an issue we introduced with new RabbitMQ repos missing proper keys installed in the image. This caused permanent failures outside of our CI. Our process should be as close as possible to users' experience. This patch makes CI trust only the mirrors that have their indices rebuilt (so infra mirrors). For Train, fixed missing override parts as well. And it includes also: - I8209770ca1353fd89aacef0859ca3a373645c6b2 - Icb745f628c1c50d9f20df022b08ddc46fccc270c - Id3b55ac470a977be7ee7decdef3b49e8d89a130f Change-Id: Ic5abc4b87fd76f87aba383abf43e95ba70629fcb Co-Authored-By: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org> (cherry picked from commit c364c8be85f4653bf7af1c7ac0378823553e7441) (cherry picked from commit 4a482380408d107c59119b379add34f4b8e87ad7) 2021-05-06T10:55:34+00:00 Michal Nasiadka mnasiadka@gmail.com 2021-04-15T11:14:11+00:00 urn:sha1:c9b0e2ae402345a606a90878a643ee5560615c1a bintray is being shut down 1st of May 2021, rabbitmq docs direct users to packagecloud - so let's move. For Victoria and below, includes I6a3ba599af3deedd450b4ffff6b86a0c04628340 (base: drop Linaro OBS key for CentOS and Ubuntu) For Train, fixes also the order of rpm gpg key imports and yum operations (otherwise CentOS 8 [with dnf] fails because repos are enabled early and keys are missing). And it also pins erlang version where required. Change-Id: I499251d13ca77aea2215f8a879b7bb8dd51f1c9f (cherry picked from commit 641b936bc7fd33203a80bb3827fce7c44d010476) 2021-04-08T08:42:00+00:00 Marcin Juszkiewicz marcin.juszkiewicz@linaro.org 2021-04-07T09:55:23+00:00 urn:sha1:56a570ddcdc287644e31c950f7591d355f61d6f4 We want to have all uses of curl behave the same so we ship config file for it in all images. So do it at start of image so 'base' makes use of config too. Change-Id: I95aa64f0b292cd020574dbedd320ef90529cc7a4 (cherry picked from commit 4328a5b3cc0e90e32952ecfeab2b63407ee8e22a) 2021-01-26T11:55:00+00:00 Zuul zuul@review.opendev.org 2021-01-26T11:55:00+00:00 urn:sha1:f6c4fc69d93754843709f045d0bf9ebf6c416cba 2021-01-24T15:58:13+00:00 Gaël THEROND (Fl1nt) gael.therond@bitswalk.com 2020-09-17T12:38:21+00:00 urn:sha1:278893ef1d9bc8f7d013685d0676ce2458fcaaaa * "Use distribution-provided pip" * "Use python's pip module invocation method" * "Install pip earlier in order to avoid multiple installation" * "Remove pip_version variable requirement and call" (cherry picked from commit b93c40a3635fbce72e48dc29120e50484cba36ca) - fixed source type builds. - in openstack-base: install virtualenv using upper-constraints (just like in kolla-toolbox) Co-authored-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org> Co-authored-by: Radosław Piliszek <radoslaw.piliszek@gmail.com> Depends-on: https://review.opendev.org/c/openstack/kolla-ansible/+/772198 Closes-bug: #1893204 Change-Id: Id0e738044a1931f9d611a7281a48ea4a593f1cf1 2020-12-15T19:42:57+00:00 abraden C-Albert.Braden@charter.com 2020-12-07T19:20:44+00:00 urn:sha1:617421fb380f8b26531c4c4ac78b65a3f5a135ec Backport this until Train. CentOS 8.3 renamed system repos. [1] This caused failures when disabling and enabling. More details in the referenced bug report. Notice CentOS 8.2 and below will no longer work. Train backport also includes some fixes for the fallout from the new pip resolver. * cap bandit<1.6.3, since bandit no longer supports Python 2. * mark kuryr-libnetwork unbuildable for source images. * mark almanach-base & dragonflow-base unbuildable for Debian & Ubuntu source images. * Don't install networking-hyperv in source neutron-server images. pip complains of a conflict. (https://bugs.launchpad.net/kolla/+bug/1907826) [1] https://wiki.centos.org/Manuals/ReleaseNotes/CentOS8.2011#Yum_repo_file_and_repoid_changes Change-Id: I2d67b3ed7b7c521bc755ec9a87365c9962a9eeff Closes-Bug: #1907213 Closes-Bug: #1907826 Co-Authored-By: Radosław Piliszek <radoslaw.piliszek@gmail.com> Depends-On: https://review.opendev.org/766211 Depends-On: https://review.opendev.org/767157 2020-09-04T07:13:58+00:00 Radosław Piliszek radoslaw.piliszek@gmail.com 2020-06-23T09:34:09+00:00 urn:sha1:fec2c701dc36ea8d246b69290f5546bf37d414b3 Train only. In CentOS 8 Train we had a mix of rmq upstream and rdo packages, erlang was from RDO and rmq (3.7) from rmq. As this is not really tested by any other party, I propose to unify the sources of both. Change-Id: I52094ce9e3d98cbdedfdc23c8a43dd3093ce1771 Closes-bug: #1884034 2020-07-06T14:45:03+00:00 Michele Baldessari michele@acksyn.org 2020-06-11T09:47:02+00:00 urn:sha1:0e6465543e4ae91c9b791944444e72905a716a6d A bit like we did for I3e0e86026f5a4a78473bed824cd1682d3a020cd5 we should remove the nss-systemd lookup from containers. The reasons for this are as follows: 1) Just like for I3e0e86026f5a4a78473bed824cd1682d3a020cd5 when this nss module is triggered it tries to talk to dbus. It triggers a bunch of selinux denials and it makes little sense to open all containers to talk to dbus. In particular, if a container is run as non-privileged and bind-mounts /run from the host, we will hit selinux denials like the following: type=USER_AVC msg=audit(1592337775.860:74119): pid=1284 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.DBus member=Hello dest=org.freedesktop.DBus spid=406228 scontext=system_u:system_r:container_t:s0:c162,c886 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'UID="dbus" AUID="unset" SAUID="dbus" 2) It just makes little sense in a kolla-world to have containers talk to dbus/systemd and it saves us some time when a lookup triggers the systemd module for whatever reason. Especially because the nss-systemd module does a few things which are not useful in a container (ensures that the root and nobody users and groups remain resolvable, SystemD's DynamicUser= feature, provide Lookup API via Varlink) The sed regex gives us the wanted results: $ diff -u /etc/nsswitch.conf.orig /etc/nsswitch.conf --- /etc/nsswitch.conf.orig 2020-06-19 07:18:10.974580755 +0000 +++ /etc/nsswitch.conf 2020-06-19 07:20:12.260230103 +0000 @@ -53,9 +53,9 @@ # group: db files # In order of likelihood of use to accelerate lookup. -passwd: sss files systemd +passwd: sss files shadow: files sss -group: sss files systemd +group: sss files hosts: files dns myhostname services: files sss netgroup: sss Related-Bug: #1883849 Change-Id: I81e5b7abf4571fece13a029e25911e9e4dece673 (cherry picked from commit dc2ddfa9750f94430a5b04b62fc1fa6adcb234f8)