openstack/kolla.git/kolla/image, branch stable/2025.2Unnamed repository; edit this file 'description' to name the repository.
https://git.platform-os.org/openstack/kolla.git/atom?h=stable%2F2025.22026-06-11T19:36:36+00:00kolla-build: Use SandboxedEnvironment to prevent SSTI2026-06-11T19:36:36+00:00Michal Nasiadkamnasiadka@gmail.com2026-06-10T16:27:50+00:00urn:sha1:0d0b8dda3a8b50c0f6d5dace2246132f88c2dfd3
Switch from jinja2.Environment to
jinja2.sandbox.SandboxedEnvironment to block Server-Side Template
Injection attacks.
Closes-Bug: #2146056
Change-Id: Iecd1d8dcf99007e3339120961c7c1d0ca12f83d8
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
(cherry picked from commit 0b20ffce09552014fa52c45de574511dc2200ac5)
Merge "debian: Use {{ openstack_release_codename }} for extrepo"2025-10-06T14:17:59+00:00Zuulzuul@review.opendev.org2025-10-06T14:17:59+00:00urn:sha1:ccaf00b93663fceb56571c8920b549a58c3603d2Move to Rocky Linux 102025-10-01T12:39:22+00:00Michal Nasiadkamnasiadka@gmail.com2025-08-05T12:24:11+00:00urn:sha1:d4b777bb060517dbb0b648d5d7d5c07336969866
Depends-On: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/961237
Change-Id: Idd809f5efd2d308c1565d7635e67af0a431d18f7
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
debian: Use {{ openstack_release_codename }} for extrepo2025-09-23T12:51:50+00:00Michal Nasiadkamnasiadka@gmail.com2025-08-06T08:36:11+00:00urn:sha1:d9a4b6cfa946e66f6304c06e6fc27a5c7b72d56c
Change-Id: I5e89a9a241f746a2cbab723ea5fc57ea65ad5ee5
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Merge "Enable Prometheus mtail build for ARM64"2025-08-20T13:58:48+00:00Zuulzuul@review.opendev.org2025-08-20T13:58:48+00:00urn:sha1:1c5239e1938a03a64a838ac54ea5e7c5681c6f83Merge "Influxdb: use stable RHEL repo"2025-08-20T13:49:14+00:00Zuulzuul@review.opendev.org2025-08-20T13:49:14+00:00urn:sha1:ec3b0a173095dc87b3a8ec5b678668ebff9b9568Influxdb: use stable RHEL repo2025-08-18T18:15:13+00:00Bartosz Bezakbartosz@stackhpc.com2025-08-18T11:56:54+00:00urn:sha1:444a81b62bb5ccb571f82e34f4ce0c48d8f639bf
Switch the RHEL repo to the stable channel as per [1]. Use new GPG.
Telegraf arm64 builds are enabled again, as binaries exists.
[1] https://repos.influxdata.com/stable/x86_64/
Change-Id: Ie4f6f15404f6965df51f3214506ae9f8bb9b61e7
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
Enable Barbican build on Ubuntu ARM642025-08-18T18:05:57+00:00Bartosz Bezakbartosz@stackhpc.com2025-08-18T11:26:48+00:00urn:sha1:85878fe6a89f1a881ac276ec10dbfa0c093fadb2
Re-enable the Ubuntu arm64 build. The previous exclusion was due to
uWSGI issue [1], which is no longer reproducible on Ubuntu Noble.
Change-Id: I400e9a9a3bf03053589835f933023eedee504f08
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
Enable Prometheus mtail build for ARM642025-08-18T14:48:41+00:00Bartosz Bezakbartosz@stackhpc.com2025-08-18T11:22:41+00:00urn:sha1:a7ada218ccd6730f6a0529f88d656dc466461b04
arm64 binaries are available currently.
Change-Id: Iabf606848a6160eaf9e2494a2564f37c6db09882
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
send empty X-Registry-Auth for anonymous pushes2025-08-06T09:50:39+00:00Bartosz Bezakbartosz@stackhpc.com2025-08-04T09:31:26+00:00urn:sha1:ddac7ca1ed393609b7bda8753db3598f1ae02648
Since Docker 28.3.3 the daemon rejects a push that carries no
`X-Registry-Auth` header [1]. The SDK already sets this header when it
finds credentials, so the breakage happens only on anonymous pushes.
During `PushTask.push_image()` we now check whether the SDK can resolve
credentials for the target registry; if it cannot, we inject
`auth_config={}`, causing the SDK to send the minimal "{}" header that
satisfies the daemon while leaving authenticated pushes unchanged.
Drop this addition when [2] is fixed.
[1] https://github.com/moby/moby/pull/50371
[2] https://github.com/docker/docker-py/issues/3348
Closes-Bug: #2119619
Change-Id: I7a2f3fce223afd74741b40bf62836b325fca5b19
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>