Unnamed repository; edit this file 'description' to name the repository. https://git.platform-os.org/openstack/kolla.git/atom?h=zed-eom 2022-10-10T15:06:05+00:00 2022-10-10T15:06:05+00:00 Radosław Piliszek radoslaw.piliszek@gmail.com 2022-08-29T18:13:34+00:00 urn:sha1:2daf4331a648cc2df6982c1a6ec47a705e038255 Fixes a hypothetical security issue related to privilege escalation via rootwrap/privsep. A potential vulnerable service could previously allow writes to its rootwrap/privsep config and thus allow for more commands to be run with root privileges via rootwrap/privsep. For a succesful attack, this would also require the service to allow to run arbitrary commands via rootwrap/privsep. Thus far, no such vulnerabilities have been reported and thus this fix is simply strengthening the container images against such an issue in the future. Change-Id: I92c81c77e6a16570a108cde8031f7977930fb02a Closes-Bug: #1874298 2022-09-27T07:40:06+00:00 Marcin Juszkiewicz marcin.juszkiewicz+kolla@linaro.org 2022-04-05T14:53:34+00:00 urn:sha1:878b00013b01e3d02a704ce7c9fac1629cd1a705 OpenStack 'zed' requires Python 3.8+ so RHEL 8 family has to go. This changeset moves to CentOS Stream 9 while move to RockyLinux 9 is planned as final solution. CI moved to CentOS Stream 9 nodes. Depends-on: https://review.opendev.org/c/openstack/kolla-ansible/+/839715 Change-Id: I113b9984294cf8663d3fc0c8840320e1d40ea731 2022-04-21T18:53:14+00:00 Marcin Juszkiewicz marcin.juszkiewicz+kolla@linaro.org 2022-04-21T16:21:42+00:00 urn:sha1:e21aeb5ae955671937055baf57836120af8d4312 As we have one type of images now some RUN calls could be merged so we will have less layers in resulting images. Change-Id: I5178c58fbd8c65efe825dc249c0f1368ef0fe8e0 2022-04-11T15:22:24+00:00 Tim Shearer tshearer@advaoptical.com 2022-04-01T20:22:28+00:00 urn:sha1:1d96a2bbe1b536b7d7f4cdbf55c6dabae6d058ae Explicitly set the permissions on the kolla-toolbox kolla_extend_start file. Also, since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0 2022-04-09T15:44:26+00:00 Marcin Juszkiewicz marcin.juszkiewicz+kolla@linaro.org 2022-04-01T11:41:14+00:00 urn:sha1:1749da2fbf6b395b1a2cd77f349e0bea5d2f4a5e Big patch drops all mentions of binary images support. Suggestions are welcome how to split it into parts or handle better. Change-Id: I5d5a46c6ce7734ceb8b844e17b43e359d7cac6e3 2021-11-23T11:35:33+00:00 Mark Goddard mark@stackhpc.com 2021-06-07T08:08:55+00:00 urn:sha1:3479eb78141a6e8629b6bfb800319ade9e2f9a33 These were added for Debian/binary, but not Ubuntu/binary. Change-Id: I74bfa6326d8a72f9bba409e6a725fdb55b48c6b1 Closes-Bug: #1931075 2021-07-29T10:47:42+00:00 Zuul zuul@review.opendev.org 2021-07-29T10:47:42+00:00 urn:sha1:f95ba3d8a39a6336eac0febab43a9eb0975ad6a2 2021-07-03T09:22:43+00:00 Michal Arbet michal.arbet@ultimum.io 2021-07-03T09:21:56+00:00 urn:sha1:4c2990a99fddc9778a752e865bb59cfe92e84afb This patch is adding python3-masakari-dashboard to debian binary image as we added masakari-dashboard to debian in wallaby cycle. Change-Id: Ie3f357eaae5d1378ada32451dbd74f01f5cd2ba2 2021-07-01T10:18:27+00:00 Michal Arbet michal.arbet@ultimum.io 2021-06-27T12:56:46+00:00 urn:sha1:01d02be25ed043b4541db3ebfc102d013cdc578a The debian-binary-horizon image is missing the default policies files which should be in /etc/openstack-dashboard/default_policies. By copying everything from /etc/openstack-dashboard/policy into /etc/openstack-dashboard, we get the default policy files, as well as commented out policy files (e.g. cinder_policy.yaml) and the nova_policy.d directory containing api-extensions.yaml. Change was merged for ubuntu in [1] but unfortunatelly not for debian, this trivial patch fixes it also for debian. [1] https://review.opendev.org/c/openstack/kolla/+/794589 Closes-Bug: #1933759 Change-Id: I822d640a251e6ed9f71c76a922513e23e4218418 2021-06-03T13:37:45+00:00 Pierre Riteau pierre@stackhpc.com 2021-06-03T13:37:45+00:00 urn:sha1:740448a658f0060b86d56e78915d8b751ade3616 The ubuntu-binary-horizon image is missing the default policies files which should be in /etc/openstack-dashboard/default_policies. By copying everything from /usr/share/openstack-dashboard/openstack_dashboard/conf into /etc/openstack-dashboard, we get the default policy files, as well as commented out policy files (e.g. cinder_policy.yaml) and the nova_policy.d directory containing api-extensions.yaml. Change-Id: I3c6fdcb9b7dd7443a7755599f7e4ee59f67e0a91 Closes-Bug: #1930586