Unnamed repository; edit this file 'description' to name the repository. https://git.platform-os.org/openstack/kolla.git/atom?h=zed-eol 2022-10-10T15:06:05+00:00 2022-10-10T15:06:05+00:00 Radosław Piliszek radoslaw.piliszek@gmail.com 2022-08-29T18:13:34+00:00 urn:sha1:2daf4331a648cc2df6982c1a6ec47a705e038255 Fixes a hypothetical security issue related to privilege escalation via rootwrap/privsep. A potential vulnerable service could previously allow writes to its rootwrap/privsep config and thus allow for more commands to be run with root privileges via rootwrap/privsep. For a succesful attack, this would also require the service to allow to run arbitrary commands via rootwrap/privsep. Thus far, no such vulnerabilities have been reported and thus this fix is simply strengthening the container images against such an issue in the future. Change-Id: I92c81c77e6a16570a108cde8031f7977930fb02a Closes-Bug: #1874298 2022-10-03T10:31:08+00:00 Michal Nasiadka mnasiadka@gmail.com 2022-10-03T10:30:27+00:00 urn:sha1:1d924eff038b0238aca8ca40fbd1c1dd68f57ed9 Change-Id: I6c82ef5b148b3ebdc8241871117dbe6cd68ed070 2022-09-30T14:17:34+00:00 Michal Nasiadka mnasiadka@gmail.com 2022-09-27T10:18:01+00:00 urn:sha1:0883532434fff341c444d8fce8e28fcff3f5e769 Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/859570 Change-Id: I7af51d07b8a939c908aa072294061def57dd67de 2022-04-22T09:34:55+00:00 Marcin Juszkiewicz marcin@juszkiewicz.com.pl 2022-04-22T09:34:55+00:00 urn:sha1:016c5ed30c0fe6c46004731d13ec0748daa6c70c Tim Shearer started it in 1d96a2bbe1b536b7d7f4cdbf55c6dabae6d058ae. Since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: Ia1797c32fc6a35f9f077c673abf4d8e16e51a760 2022-04-21T18:53:14+00:00 Marcin Juszkiewicz marcin.juszkiewicz+kolla@linaro.org 2022-04-21T16:21:42+00:00 urn:sha1:e21aeb5ae955671937055baf57836120af8d4312 As we have one type of images now some RUN calls could be merged so we will have less layers in resulting images. Change-Id: I5178c58fbd8c65efe825dc249c0f1368ef0fe8e0 2022-04-11T15:22:24+00:00 Tim Shearer tshearer@advaoptical.com 2022-04-01T20:22:28+00:00 urn:sha1:1d96a2bbe1b536b7d7f4cdbf55c6dabae6d058ae Explicitly set the permissions on the kolla-toolbox kolla_extend_start file. Also, since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0 2022-04-09T15:44:26+00:00 Marcin Juszkiewicz marcin.juszkiewicz+kolla@linaro.org 2022-04-01T11:41:14+00:00 urn:sha1:1749da2fbf6b395b1a2cd77f349e0bea5d2f4a5e Big patch drops all mentions of binary images support. Suggestions are welcome how to split it into parts or handle better. Change-Id: I5d5a46c6ce7734ceb8b844e17b43e359d7cac6e3 2022-04-05T19:46:10+00:00 Mark Goddard mark@stackhpc.com 2022-04-05T08:31:06+00:00 urn:sha1:1bb57ae116b4b8931bfcd512038b436f77c67e0c This is needed to support PXE and iPXE at the same time. We will move /tftpboot and /httpboot to /var/lib/ironic/. With these paths configurable via an environment variable, we can support a clean transition. This patch also cleans up pxelinux part, making it analogous to grub and ipxe parts. RHEL leftover mention is removed. Co-Authored-By: Radosław Piliszek <radoslaw.piliszek@gmail.com> Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/832159 Change-Id: I1ae81217c8bbf606c903c8009a372662ca3ab08c 2022-02-10T12:44:14+00:00 Mark Goddard mark@stackhpc.com 2022-02-10T10:58:55+00:00 urn:sha1:909710d739f1d7d4c2ef0865ebc9338f260aaa5b When using Ironic with UEFI boot mode and iPXE booting, nodes will attempt to chainload iPXE using a Network Boot Program (NBP). This is configured in Ironic via [pxe] uefi_ipxe_bootfile_name, and the default since Xena is snponly.efi. In Wallaby and earlier releases, the default was ipxe.efi. These files need to be available in the /tftpboot directory of the ironic-pxe image. The current default of snponly.efi was not present for any supported distros. ipxe.efi was present for Debian/Ubuntu but not CentOS, which appends the architecture to the filename (e.g. ipxe-x86_64.efi). This change ensures that both ipxe.efi and snponly.efi exist in /tftpboot for all supported distributions, ensuring that both the current and previous Ironic defaults should work. Where these files have different names, we use symlinks to allow for any deployers overriding the filenames in configuration. Closes-Bug: #1959203 Change-Id: I79e78dca550262fc86b092a036f9ea96b214ab48 2022-01-26T19:48:34+00:00 Xinliang Liu xinliang.liu@linaro.org 2020-05-15T07:12:56+00:00 urn:sha1:b6e057d694d90d50ea278411d0edf20afe427e13 Use distro provided GRUB efi instead of creating it like ironic GRUB setup doc[1]. This avoids below ubuntu ironic-python-agent images PXE booting failure. ---------- error: invalid magic number. error: you need to load the kernel first. Press any key to continue... ---------- This also fixes x86_64 uefi pxe booting issue by setting up GRUB efi for x86_64. Besides, GRUB setup only needs to do once at bootstrap stage. [1]: https://docs.openstack.org/ironic/train/install/configure-pxe.html#uefi-pxe-GRUB-setup Closes-Bug: #1879265 Change-Id: I8be5bdf5f1a62751aefe6bd0959e8f558fcfe591