Unnamed repository; edit this file 'description' to name the repository. https://git.platform-os.org/openstack/kolla.git/atom?h=zed-eol 2023-04-04T08:41:00+00:00 2023-04-04T08:41:00+00:00 Rafal Lewandowski rafal@stackhpc.com 2023-03-29T09:44:58+00:00 urn:sha1:b2296aa5c0ad7ed80a7795b262fa65a0c170cbb2 Closes-Bug: #2009484 Change-Id: I01578289e65010748bfaf6d6b81861764aa62368 (cherry picked from commit 2050aa35dbd074610adee5611194fde280cfea20) 2022-10-10T15:06:05+00:00 Radosław Piliszek radoslaw.piliszek@gmail.com 2022-08-29T18:13:34+00:00 urn:sha1:2daf4331a648cc2df6982c1a6ec47a705e038255 Fixes a hypothetical security issue related to privilege escalation via rootwrap/privsep. A potential vulnerable service could previously allow writes to its rootwrap/privsep config and thus allow for more commands to be run with root privileges via rootwrap/privsep. For a succesful attack, this would also require the service to allow to run arbitrary commands via rootwrap/privsep. Thus far, no such vulnerabilities have been reported and thus this fix is simply strengthening the container images against such an issue in the future. Change-Id: I92c81c77e6a16570a108cde8031f7977930fb02a Closes-Bug: #1874298 2022-09-27T07:40:06+00:00 Marcin Juszkiewicz marcin.juszkiewicz+kolla@linaro.org 2022-04-05T14:53:34+00:00 urn:sha1:878b00013b01e3d02a704ce7c9fac1629cd1a705 OpenStack 'zed' requires Python 3.8+ so RHEL 8 family has to go. This changeset moves to CentOS Stream 9 while move to RockyLinux 9 is planned as final solution. CI moved to CentOS Stream 9 nodes. Depends-on: https://review.opendev.org/c/openstack/kolla-ansible/+/839715 Change-Id: I113b9984294cf8663d3fc0c8840320e1d40ea731 2022-08-26T19:31:29+00:00 Radosław Piliszek radoslaw.piliszek@gmail.com 2022-08-26T19:25:53+00:00 urn:sha1:e5748194b2013cf08bf4dfc78b8559721e4b8a96 To be able to drop the dummy arg. Change-Id: Ibcc3e6b4e6015604c218e384d87de7b9e9aed4c8 2022-08-09T12:51:13+00:00 Radosław Piliszek radoslaw.piliszek@gmail.com 2022-05-29T16:39:45+00:00 urn:sha1:8a84479778190b5c9824a591f9c330c0001b9e8b It can still be optionally enabled in Kolla Ansible. Change-Id: I34ec4a2e9505e9b4c1b8306b87fcd7242a0da227 2022-04-21T18:53:14+00:00 Marcin Juszkiewicz marcin.juszkiewicz+kolla@linaro.org 2022-04-21T16:21:42+00:00 urn:sha1:e21aeb5ae955671937055baf57836120af8d4312 As we have one type of images now some RUN calls could be merged so we will have less layers in resulting images. Change-Id: I5178c58fbd8c65efe825dc249c0f1368ef0fe8e0 2022-04-11T15:22:24+00:00 Tim Shearer tshearer@advaoptical.com 2022-04-01T20:22:28+00:00 urn:sha1:1d96a2bbe1b536b7d7f4cdbf55c6dabae6d058ae Explicitly set the permissions on the kolla-toolbox kolla_extend_start file. Also, since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0 2022-04-09T15:44:26+00:00 Marcin Juszkiewicz marcin.juszkiewicz+kolla@linaro.org 2022-04-01T11:41:14+00:00 urn:sha1:1749da2fbf6b395b1a2cd77f349e0bea5d2f4a5e Big patch drops all mentions of binary images support. Suggestions are welcome how to split it into parts or handle better. Change-Id: I5d5a46c6ce7734ceb8b844e17b43e359d7cac6e3 2020-08-11T17:07:09+00:00 Radosław Piliszek radoslaw.piliszek@gmail.com 2020-08-10T19:14:07+00:00 urn:sha1:6319bc6f559ab5c49a7ad701b606b58af62337b0 This is a follow-up on "Refactor httpd install to base image" [1]. It seems a copy-paste algorithm was used to craft Dockerfiles for some httpd-enabled services which resulted in an abundance of ldappool packages getting installed, even in the 'source' case. This seems to have also kept ldappool at a lower version because it did not get updated via pip later. This patch deals with that and also moves ldap deps for Keystone to their proper place in 'source' case (extras). Note Keystone client gets installed in openstack-base. Cinder does not need to include Keystone either. [1] https://review.opendev.org/744037 Change-Id: I017d7a6a5d2b1ae6c04556dcf172453a36de5be7 2020-08-10T09:51:07+00:00 James Kirsch generalfuzz@gmail.com 2020-07-30T19:36:39+00:00 urn:sha1:5bdf514645e6ba603f813f299c68ff7fb12daa3c Refactor installing and initial setup of httpd and mod wsgi from individual services to base image. Change-Id: I651a55a9ebe258ef403d33de010a4dfb368a4021