openstack/kolla.git/docker/keystone, branch stable/2025.2

Move repo enablement to respective rpm blocks

2025-10-02T08:37:07+00:00

Currently we are enabling repos irrespective of rpm/deb statement blocks and not failing in the method used if a repository is missing. Downside is - we might be producing one more layer, but it probably is a more logical approach. This is required for adding rpm support in repos.yaml that will also include failing on missing repositories. Change-Id: I5479c5c935760f00fe4cd307366f261deee3199f Signed-off-by: Michal Nasiadka

keystone: Add local wsgi file

2025-08-07T07:50:14+00:00

It has been removed with I9fa7cd60bf27768db06f69681675fce2e55712af Change-Id: Ib42be3d56bdb64247ac6f17b8ac1f1baa873f475 Signed-off-by: Michal Nasiadka

Merge "Move to CentOS Stream 10"

2025-07-17T11:54:34+00:00

Move to CentOS Stream 10

2025-07-16T14:05:50+00:00

Known missing packages: - mod_auth_mellon - missing SAML support in Keystone/Horizon - built in Kolla COPR - glusterfs-fuse in manila-share - built in Kolla COPR - collectd/telegraf - no opstools repository - redis - needs a switch to valkey - python3-ethtool - not required for neutron-mlnx-agent since 6 years [1] Building packages in Kolla COPR is a temporary solution until these show up in EPEL10. [1]: Id2cae3ac9ff049e9fc8225551f99e1e99a87fc65 Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/951751 Change-Id: I7074fabcf95184fcfd2561648ae1e05acfb0bc11 Signed-off-by: Michal Nasiadka

keystone: Remove ARGS to support uwsgi

2025-06-09T08:56:33+00:00

Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/952093 Change-Id: I38688e442b995d38e9826fbb545b6ab09e06bdf5

Add mechanism for patching files in containers

2024-11-15T08:04:30+00:00

This patch adds a way to patch files in a Docker image built by Kolla. This is very useful for several reasons, specifically: - Custom modifications - The stable branch of some library has a fix but no pip package has been released - Eliminates the need to package your own pip packages - Eliminates the need to invent your own versioning to prevent upstream versioning - Eliminates the need to manage a pip server - In other words, it eliminates the need to get a wheel into the image and install it manually using any method not previously mentioned It is also highly desirable because, although Kolla can replace the source for a service with a custom URL for a tarball or its own Git repo, it cannot do this for dependencies pulled from pip. I would also like to point out that this is a feature with its own code path and works only if the user "inserts" a patch into the folder patches/docker-image/something.patch and creates an analogous series file for patch source code. Simply said, this code will never interfere with the upstream build process since this feature is not intended for use in upstream. It is rather meant for downstream users who know what they are doing. Now they just have an option to patch their images. Everything works on all layers of the Docker image and stores a report of applied patches which can then be seen in /etc. This mechanism is similar as debian patch quilt. Change-Id: I61d0790c5d4d070b7ea9e8c99c0a76ff5d22bf9d

keystone: Fix requests-kerberos installation

2024-08-29T06:20:56+00:00

Since it was bundled with plugins installation, and we did not have any plugins in keystone container - it was not installed at all. Adding in libkrb5 dependencies for requests-kerberos. Closes-Bug: #2078305 Change-Id: I51c69d0673280e351daa410d943f769d33a10d6c

Stop removing missing /run/nologin in RPM images

2024-01-08T21:39:33+00:00

This code was valid for centos:8 and centos:stream8, but is not required for centos:stream9 or rockylinux:9 which do not include this file. Change-Id: I50f78d73afe0944dd91998ab9799fa2f36cc46a3

keystone: Fix for missing libldap-common package for debian

2023-03-29T09:44:58+00:00

Closes-Bug: #2009484 Change-Id: I01578289e65010748bfaf6d6b81861764aa62368

Fix writable rootwrap/privsep config

2022-10-10T15:06:05+00:00

Fixes a hypothetical security issue related to privilege escalation via rootwrap/privsep. A potential vulnerable service could previously allow writes to its rootwrap/privsep config and thus allow for more commands to be run with root privileges via rootwrap/privsep. For a succesful attack, this would also require the service to allow to run arbitrary commands via rootwrap/privsep. Thus far, no such vulnerabilities have been reported and thus this fix is simply strengthening the container images against such an issue in the future. Change-Id: I92c81c77e6a16570a108cde8031f7977930fb02a Closes-Bug: #1874298