openstack/kolla.git/kolla/image/kolla_worker.py, branch master

Merge "Allow lowercase from"

2026-09-22T23:23:44+00:00

Drop support for CentOS Stream 10

2026-09-10T11:20:18+00:00

Change-Id: I5973943fe83bbb00cfc8623c0cd4d4b98b369315 Signed-off-by: Michal Nasiadka

Add cleanup_repos to revert build_only overrides

2026-08-05T08:13:09+00:00

Repos marked build_only: true are backed up before handle_repos() overwrites them and restored at the end of each image build, so CI mirror URLs are not baked into the final image. The cleanup RUN was injected into every Dockerfile, not just images that called handle_repos() for those repos. Child images with no backup fell through to "rm -f", deleting the inherited repo file (e.g. debian.sources in bifrost-base, breaking cpio install). Fix by adding a {repo}.enabled sentinel that handle_repos creates when it processes a build_only repo, making the cleanup conditional on that sentinel. Change-Id: Ie5b9970a4575b6258dc238059d3f33ddfe155789 Signed-off-by: Michal Nasiadka

Allow lowercase from

2026-07-30T14:06:23+00:00

Change-Id: I42cf2aac795e9f61692deec956de0bedab55086f Signed-off-by: Michal Nasiadka

Move PIP_* env variables to ARG and config

2026-07-30T13:55:31+00:00

Leaving empty CI template_overrides file in case we need to use it in future. Change-Id: Ic46f1a594bcc330536bc78d93ece10e60622f6d4 Signed-off-by: Michal Nasiadka

Migrate to pyproject.toml

2026-07-06T19:59:40+00:00

[tool.setuptools.data-files] does not support recursive directory installation. The old setup.cfg [files] worked because PBR's FilesConfig.expand_globs() used os.walk() to expand docker/*, but this hook is not triggered by the pbr.build PEP-517 backend. Move docker/ into kolla/ and use [tool.setuptools.package-data] instead. Update kolla_worker._get_images_dir() to check the kolla package directory first so both editable and regular installs work. Change-Id: I4fc452c03740ef22ebbb4e8d0d86c4f4783e2d09 Signed-off-by: Michal Nasiadka

kolla-build: fix build-date LABEL invalidating Docker layer cache

2026-06-24T13:00:26+00:00

The build-date label was rendered into a LABEL instruction on line 3 of every Dockerfile template, immediately after FROM. Because Docker invalidates the cache for a changed instruction and all subsequent layers, a date change caused a full rebuild of every image on each new calendar day, even when nothing else had changed. Fix this by removing build-date from the Dockerfile templates and applying it as a --label argument at build time via image.labels. Labels passed on the build command line are not part of the Dockerfile cache key, so the date is still recorded in the image metadata without affecting layer caching. Change-Id: I8ef0d85bab1a999a4d09f7cbf0c088ca00fdcf77 Signed-off-by: Michal Nasiadka

kolla-build: Use SandboxedEnvironment to prevent SSTI

2026-06-10T23:45:30+00:00

Switch from jinja2.Environment to jinja2.sandbox.SandboxedEnvironment to block Server-Side Template Injection attacks. Closes-Bug: #2146056 Change-Id: Iecd1d8dcf99007e3339120961c7c1d0ca12f83d8 Signed-off-by: Michal Nasiadka

Add OCI standard labels to container images

2026-03-30T18:47:21+00:00

Currently, Kolla images lack standard metadata, making it difficult to identify their build source, creation time, or exact version solely by inspecting the image artifact. This patch introduces the addition of Open Container Initiative (OCI) standard labels to all generated images. The build process now detects metadata (utilizing `direct_url.json` for pip-installed packages to avoid subprocess calls) and injects the following labels into the container runtime config: * org.opencontainers.image.authors * org.opencontainers.image.created * org.opencontainers.image.description * org.opencontainers.image.licenses * org.opencontainers.image.revision * org.opencontainers.image.source * org.opencontainers.image.title * org.opencontainers.image.url * org.opencontainers.image.version Example output: "Labels": { "org.opencontainers.image.authors": "Kolla Project (https://launchpad.net/kolla)", "org.opencontainers.image.created": "2025-12-22T14:02:47.015819", "org.opencontainers.image.description": "OpenStack Kolla keystone-ssh image", "org.opencontainers.image.licenses": "Apache-2.0", "org.opencontainers.image.revision": "96b54022857ccef8dc6bb11789abe32119827109", "org.opencontainers.image.source": "https://opendev.org/openstack/kolla", "org.opencontainers.image.title": "keystone-ssh", "org.opencontainers.image.url": "https://opendev.org/openstack/kolla", "org.opencontainers.image.version": "master-ubuntu-noble" } This enhancement improves the interoperability of Kolla images with standard container tools and registries that display OCI metadata. Change-Id: I3451940c90180ba91759c839987434e94251e32e Signed-off-by: Piotr Milewski

debian: Use {{ openstack_release_codename }} for extrepo

2025-09-23T12:51:50+00:00

Change-Id: I5e89a9a241f746a2cbab723ea5fc57ea65ad5ee5 Signed-off-by: Michal Nasiadka