openstack/kolla.git/docker/ceilometer, branch zed-eom

Fix writable rootwrap/privsep config

2022-10-10T15:06:05+00:00

Fixes a hypothetical security issue related to privilege escalation via rootwrap/privsep. A potential vulnerable service could previously allow writes to its rootwrap/privsep config and thus allow for more commands to be run with root privileges via rootwrap/privsep. For a succesful attack, this would also require the service to allow to run arbitrary commands via rootwrap/privsep. Thus far, no such vulnerabilities have been reported and thus this fix is simply strengthening the container images against such an issue in the future. Change-Id: I92c81c77e6a16570a108cde8031f7977930fb02a Closes-Bug: #1874298

adjust permissions on _extend_start files (part II)

2022-04-22T09:34:55+00:00

Tim Shearer started it in 1d96a2bbe1b536b7d7f4cdbf55c6dabae6d058ae. Since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: Ia1797c32fc6a35f9f077c673abf4d8e16e51a760

flatten images a bit

2022-04-21T18:53:14+00:00

As we have one type of images now some RUN calls could be merged so we will have less layers in resulting images. Change-Id: I5178c58fbd8c65efe825dc249c0f1368ef0fe8e0

Adjust permissions on _extend_start files.

2022-04-11T15:22:24+00:00

Explicitly set the permissions on the kolla-toolbox kolla_extend_start file. Also, since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0

docker: drop binary parts

2022-04-09T15:44:26+00:00

Big patch drops all mentions of binary images support. Suggestions are welcome how to split it into parts or handle better. Change-Id: I5d5a46c6ce7734ceb8b844e17b43e359d7cac6e3

Remove last mongo refs

2021-06-29T13:50:17+00:00

Drop installation of pymongo because it is not used by Telemetry since at least Queens [1] [2] and MongoDB is not deployed by Kolla Ansible since Victoria. [1] https://review.opendev.org/c/openstack/ceilometer/+/512700 [2] https://review.opendev.org/c/openstack/aodh/+/373043 Change-Id: Id44ab0fe673f01490cd8ca9c51f465ae7ad95e08

Remove panko

2021-06-11T15:50:27+00:00

Panko has been deprecated and removed from OpenStack. Only stable branches are maintained. Change-Id: Ie35f92737ef36531d7bdc6b9245d529be8096c9c

enable 'libvirt' repo for images with python*-libvirt

2021-03-23T21:08:11+00:00

There are several images installing 'python3-libvirt' package. Which for Debian reside in 'libvirt' repo. So let's enable it where needed. Change-Id: I1c91d27f2578f5ca7c83c4747725b1d9371880b0

ceilometer: do not fail when using an unsupported database type

2020-11-27T10:37:52+00:00

This is necessary if e.g. Prometheus is used. Then the ceilometer-upgrade is not needed. Signed-off-by: Christian Berendt Change-Id: I8690e5543e6b5f37f41fe35f659910fc869c034f

Fix ceilometer-upgrade params

2020-07-09T14:52:55+00:00

It seems [1] has introduced a slight regression in that it tries by default to pass an empty string to ceilometer-upgrade which makes it fail: ceilometer-upgrade: error: unrecognized arguments: (note there is nothing more on that line) This patch fixes that by allowing the params to be of any number, including zero. Backport to Ussuri. [1] 3d587409ee068843cfa28710f09f65af48b69367 Change-Id: I989a1dd30d1656b5c1fda7a46abbf5f265fbb72c Closes-Bug: #1884919