openstack/kolla.git/docker/glance, branch stable/2025.2

Return missing systemd-udev into cinder and glance containers

2026-04-15T17:07:07+00:00

systemd-udev package provides /usr/lib/udev/scsi_id tool, required for operating with scsi-attached storage Closes-Bug: #2148205 Change-Id: I7b0c25d361fc61992089ee88625fb3ab63c12fb4 Signed-off-by: Victor Chembaev (cherry picked from commit 5096d8bff2519e983cb1c1b06a96a55f1849d87a)

Move repo enablement to respective rpm blocks

2025-10-02T08:37:07+00:00

Currently we are enabling repos irrespective of rpm/deb statement blocks and not failing in the method used if a repository is missing. Downside is - we might be producing one more layer, but it probably is a more logical approach. This is required for adding rpm support in repos.yaml that will also include failing on missing repositories. Change-Id: I5479c5c935760f00fe4cd307366f261deee3199f Signed-off-by: Michal Nasiadka

Enable EPEL repo for Ceph deps in glance and gnocchi

2025-07-04T10:31:31+00:00

Ceph Reef client dependencies now require EPEL repo on EL9. See thread here [1]. [1] https://lists.centos.org/hyperkitty/list/devel%40lists.centos.org/thread/BZM3RO2LNAMB47FBT2QO3ZOSGBHPCO3V/ Closes-Bug: #2115448 Change-Id: I87e4135425e721f2f750402b3fcc6404643a3bd3 Signed-off-by: Bartosz Bezak

Fix glance-api: add missing lsscsi package

2025-05-30T10:56:31+00:00

Closes-Bug: #2111828 Change-Id: I8e20c77a8f1538162fc1dac9dc92c837348a09f4

Install pycadf from pypi package

2025-02-06T12:43:24+00:00

Previously, the `pycadf` package did not include configuration files, so they were manually installed from source. However, this was fixed in pycadf's upstream in [1], allowing us to rely on the package itself. Additionally, the `ceilometer_api_audit_map.conf` file has been removed, as it was dropped in pycadf's upstream commit here [2] [1] https://review.opendev.org/c/openstack/pycadf/+/936741 [2] https://review.opendev.org/c/openstack/pycadf/+/930971 Change-Id: I022aa4c403f08385beb83b5d0c81f8abb42eb4a7

Add mechanism for patching files in containers

2024-11-15T08:04:30+00:00

This patch adds a way to patch files in a Docker image built by Kolla. This is very useful for several reasons, specifically: - Custom modifications - The stable branch of some library has a fix but no pip package has been released - Eliminates the need to package your own pip packages - Eliminates the need to invent your own versioning to prevent upstream versioning - Eliminates the need to manage a pip server - In other words, it eliminates the need to get a wheel into the image and install it manually using any method not previously mentioned It is also highly desirable because, although Kolla can replace the source for a service with a custom URL for a tarball or its own Git repo, it cannot do this for dependencies pulled from pip. I would also like to point out that this is a feature with its own code path and works only if the user "inserts" a patch into the folder patches/docker-image/something.patch and creates an analogous series file for patch source code. Simply said, this code will never interfere with the upstream build process since this feature is not intended for use in upstream. It is rather meant for downstream users who know what they are doing. Now they just have an option to patch their images. Everything works on all layers of the Docker image and stores a report of applied patches which can then be seen in /etc. This mechanism is similar as debian patch quilt. Change-Id: I61d0790c5d4d070b7ea9e8c99c0a76ff5d22bf9d

CI: Add codespell for spell checking

2024-04-15T14:56:34+00:00

Fix existing spell checking Change-Id: Ief7b8f2d427b2557c84fda9b3774ed85ceb105f4

Fix openstack CADF audit maps and installation

2024-01-17T11:52:20+00:00

This patch fixes missing pycadf's audit maps for services and change the way how pycadf is installed. Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/905858 Closes-Bug: #2047941 Change-Id: I9b43d1a9990ad8aa7381ea81b0f2d692967be949

Glance-api fails due to absent multipath tools

2023-04-13T11:07:48+00:00

Closes-Bug: #2015500 Change-Id: Ifa095a4a5a4a2476b356b082b9b57b491c9e29db Signed-off-by: Maksim Malchuk

Fix writable rootwrap/privsep config

2022-10-10T15:06:05+00:00

Fixes a hypothetical security issue related to privilege escalation via rootwrap/privsep. A potential vulnerable service could previously allow writes to its rootwrap/privsep config and thus allow for more commands to be run with root privileges via rootwrap/privsep. For a succesful attack, this would also require the service to allow to run arbitrary commands via rootwrap/privsep. Thus far, no such vulnerabilities have been reported and thus this fix is simply strengthening the container images against such an issue in the future. Change-Id: I92c81c77e6a16570a108cde8031f7977930fb02a Closes-Bug: #1874298