openstack/kolla.git/docker/keystone/keystone-fernet, branch master

Migrate to pyproject.toml

2026-07-06T19:59:40+00:00

[tool.setuptools.data-files] does not support recursive directory installation. The old setup.cfg [files] worked because PBR's FilesConfig.expand_globs() used os.walk() to expand docker/*, but this hook is not triggered by the pbr.build PEP-517 backend. Move docker/ into kolla/ and use [tool.setuptools.package-data] instead. Update kolla_worker._get_images_dir() to check the kolla package directory first so both editable and regular installs work. Change-Id: I4fc452c03740ef22ebbb4e8d0d86c4f4783e2d09 Signed-off-by: Michal Nasiadka

kolla-build: fix build-date LABEL invalidating Docker layer cache

2026-06-24T13:00:26+00:00

The build-date label was rendered into a LABEL instruction on line 3 of every Dockerfile template, immediately after FROM. Because Docker invalidates the cache for a changed instruction and all subsequent layers, a date change caused a full rebuild of every image on each new calendar day, even when nothing else had changed. Fix this by removing build-date from the Dockerfile templates and applying it as a --label argument at build time via image.labels. Labels passed on the build command line are not part of the Dockerfile cache key, so the date is still recorded in the image metadata without affecting layer caching. Change-Id: I8ef0d85bab1a999a4d09f7cbf0c088ca00fdcf77 Signed-off-by: Michal Nasiadka

Add mechanism for patching files in containers

2024-11-15T08:04:30+00:00

This patch adds a way to patch files in a Docker image built by Kolla. This is very useful for several reasons, specifically: - Custom modifications - The stable branch of some library has a fix but no pip package has been released - Eliminates the need to package your own pip packages - Eliminates the need to invent your own versioning to prevent upstream versioning - Eliminates the need to manage a pip server - In other words, it eliminates the need to get a wheel into the image and install it manually using any method not previously mentioned It is also highly desirable because, although Kolla can replace the source for a service with a custom URL for a tarball or its own Git repo, it cannot do this for dependencies pulled from pip. I would also like to point out that this is a feature with its own code path and works only if the user "inserts" a patch into the folder patches/docker-image/something.patch and creates an analogous series file for patch source code. Simply said, this code will never interfere with the upstream build process since this feature is not intended for use in upstream. It is rather meant for downstream users who know what they are doing. Now they just have an option to patch their images. Everything works on all layers of the Docker image and stores a report of applied patches which can then be seen in /etc. This mechanism is similar as debian patch quilt. Change-Id: I61d0790c5d4d070b7ea9e8c99c0a76ff5d22bf9d

Adjust permissions on _extend_start files.

2022-04-11T15:22:24+00:00

Explicitly set the permissions on the kolla-toolbox kolla_extend_start file. Also, since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0

Stop to use the future module.

2020-06-02T18:21:11+00:00

The __future__ module [1] was used in this context to ensure compatibility between python 2 and python 3. We previously dropped the support of python 2.7 [2] and now we only support python 3 so we don't need to continue to use this module and the imports listed below. Imports commonly used and their related PEPs: - `division` is related to PEP 238 [3] - `print_function` is related to PEP 3105 [4] - `unicode_literals` is related to PEP 3112 [5] - `with_statement` is related to PEP 343 [6] - `absolute_import` is related to PEP 328 [7] [1] https://docs.python.org/3/library/__future__.html [2] https://governance.openstack.org/tc/goals/selected/ussuri/drop-py27.html [3] https://www.python.org/dev/peps/pep-0238 [4] https://www.python.org/dev/peps/pep-3105 [5] https://www.python.org/dev/peps/pep-3112 [6] https://www.python.org/dev/peps/pep-0343 [7] https://www.python.org/dev/peps/pep-0328 Change-Id: Ie97dcb610b6c723ba08a84ad79763bbbd4af20d9

Add block labels to all Dockerfiles

2020-03-01T17:25:58+00:00

Change-Id: I9692dda817ef134d647247431565e1b58cf9da41

Change fetch_fernet_tokens.py behaviour to check for minimum number of tokens

2020-01-22T07:45:36+00:00

Change is required to properly implement logic in fernet-node-sync.sh on kolla-ansible side - to add a check if fernet key store is populated with required number of tokens. Change-Id: I51ed61e34a1dd79532b4528e56a9cd9011d46e6d Related-Bug: #1846789

Adapt fetch-fernet-tokens script to Python 3

2020-01-13T13:08:39+00:00

Backport: train Closes-Bug: #1859047 Change-Id: I9032e43bffa3a3de6c33a4ab59f65bafb0129dd5

Fix bandit failure B105 in keystone fernet

2019-05-09T15:18:17+00:00

>> Issue: [B105:hardcoded_password_string] Possible hardcoded password: '/etc/keystone/fernet-keys' Severity: Low Confidence: Medium Location: docker/keystone/keystone-fernet/fetch_fernet_tokens.py:27 More Info: https://bandit.readthedocs.io/en/latest/plugins/b105_hardcoded_password_string.html Ignore bandit failures on this line. Change-Id: I9828c23e4bcec7553a69aa5f20e990e0ef0538ea Closes-Bug: #1828416

Use base_package_type

2019-01-17T15:23:41+00:00

This change updates the docker files to use base_package_type instead of doing specific distro checks for the rhel/deb generic cases. The base_distro is still available and is used when a specific distro needs a customization but if the differences are purely rpm vs deb, then the base_package_type can be used. Change-Id: I8d720bb185df65a0178061ccf20b1ab2265da2c5