Add RockyLinux 9 support

Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/859570

Change-Id: I7af51d07b8a939c908aa072294061def57dd67de

4 files changed, 11 insertions, 20 deletions

diff --git a/docker/base/Dockerfile.j2 b/docker/base/Dockerfile.j2
index 2531b24a8..11997c583 100644
--- a/docker/base/Dockerfile.j2
+++ b/docker/base/Dockerfile.j2
@@ -69,6 +69,7 @@ Repo files not available for CentOS Stream 9:
  #}
 {% set base_yum_repo_files = [
     'grafana.repo',
+    'influxdb.repo',
     'mariadb.repo',
     'rabbitmq_rabbitmq-server.repo',
     'td.repo',
@@ -86,19 +87,16 @@ SHA1 keys are not supported in RHEL9: https://github.com/rpm-software-management
     'https://downloads.mariadb.com/MariaDB/RPM-GPG-KEY-MariaDB',
     'https://packages.treasuredata.com/GPG-KEY-td-agent',
     'https://github.com/rabbitmq/signing-keys/releases/download/2.0/rabbitmq-release-signing-key.asc',
+    'https://repos.influxdata.com/influxdb.key',
 ] %}
 
 {% if base_arch == 'x86_64' %}
     {% set base_yum_repo_files = base_yum_repo_files + [
-        'influxdb.repo',
         'rabbitmq_rabbitmq-erlang.repo',
     ] %}
     # FIXME(mgoddard): Not available for CentOS 8 yet.
     #   'crmsh.repo',
 
-    {% set base_yum_repo_keys = base_yum_repo_keys + [
-        'https://repos.influxdata.com/influxdb.key',
-    ] %}
 {% elif base_arch == 'aarch64' %}
 {#
 Repo files not available for CentOS Stream 9:
@@ -151,8 +149,6 @@ RUN rm -f /etc/rpm/macros.image-language-conf \
 
 {% block base_centos_repo_overrides_post_rpm %}{% endblock %}
 
-    {% if base_distro == 'centos' %}
-
 {% block base_centos_gpg_key_import %}
 {% endblock %}
 
@@ -187,13 +183,10 @@ RUN rm -f /etc/rpm/macros.image-language-conf \
     'centos9-rabbitmq',
     'centos9-storage',
     'epel',
+    'influxdb',
 ] %}
 
-{% if base_arch == 'x86_64' %}
-    {% set base_centos_yum_repos_to_disable = base_centos_yum_repos_to_disable + [
-        'influxdb',
-    ] %}
-{% elif base_arch == 'aarch64' %}
+{% if base_arch == 'aarch64' %}
 
 {# NOTE(hrw): delorean-deps.repo may force x86-64 repos #}
 
@@ -211,9 +204,6 @@ RUN {{ macros.install_packages(base_centos_yum_repo_packages | customizable("cen
 {% block base_centos_repo_overrides_post_yum %}{% endblock -%}
     && {{ macros.rpm_security_update(clean_package_cache) }}
 
-    {%- endif %}
-    {# Endif for base_distro centos #}
-
 #### END REPO ENABLEMENT
 
 {# We are back to the basic if conditional here which is:
@@ -224,6 +214,7 @@ RUN {{ macros.install_packages(base_centos_yum_repo_packages | customizable("cen
 {# NOTE(hrw): CentOS Stream 9 has curl-minimal, Rocky Linux 9 has curl so we do not install any #}
 {% set base_centos_packages = [
         'ca-certificates',
+        'crypto-policies-scripts',
         'dumb-init',
         'findutils',
         'hostname',
diff --git a/docker/base/httpd_setup.sh b/docker/base/httpd_setup.sh
index fe627652b..3dbf84853 100644
--- a/docker/base/httpd_setup.sh
+++ b/docker/base/httpd_setup.sh
@@ -19,12 +19,12 @@ if [[ "$(whoami)" == 'root' ]]; then
         rm -rf /var/run/httpd/* /run/httpd/* /tmp/httpd*
     fi
 
-    # CentOS 8 has an issue with mod_ssl which produces an invalid Apache
+    # CentOS/Rocky have an issue with mod_ssl which produces an invalid Apache
     # configuration in /etc/httpd/conf.d/ssl.conf. This causes the following error
     # on startup:
     #   SSLCertificateFile: file '/etc/pki/tls/certs/localhost.crt' does not exist or is empty
     # Work around this by generating certificates manually.
-    if [[ ${KOLLA_BASE_DISTRO} = centos ]] && [[ ! -e /etc/pki/tls/certs/localhost.crt ]]; then
+    if [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]] && [[ ! -e /etc/pki/tls/certs/localhost.crt ]]; then
         /usr/libexec/httpd-ssl-gencerts
     fi
 fi
diff --git a/docker/ironic/ironic-pxe/extend_start.sh b/docker/ironic/ironic-pxe/extend_start.sh
index f82d6c3c7..155fbf760 100644
--- a/docker/ironic/ironic-pxe/extend_start.sh
+++ b/docker/ironic/ironic-pxe/extend_start.sh
@@ -7,7 +7,7 @@ function prepare_pxe_pxelinux {
         cp /usr/lib/PXELINUX/pxelinux.0 \
            /usr/lib/syslinux/modules/bios/{chain.c32,ldlinux.c32} \
            ${TFTPBOOT_PATH}/
-    elif [[ "${KOLLA_BASE_DISTRO}" =~ centos ]]; then
+    elif [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]]; then
         if [[ "${TFTPBOOT_PATH}" != /tftpboot ]]; then
             cp /tftpboot/{pxelinux.0,chain.c32,ldlinux.c32} \
                ${TFTPBOOT_PATH}/
@@ -20,7 +20,7 @@ function prepare_pxe_grub {
     if [[ "${KOLLA_BASE_DISTRO}" =~ debian|ubuntu  ]]; then
         shim_src_file="/usr/lib/shim/shim*64.efi.signed"
         grub_src_file="/usr/lib/grub/*-efi-signed/grubnet*64.efi.signed"
-    elif [[ "${KOLLA_BASE_DISTRO}" =~ centos ]]; then
+    elif [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]]; then
         shim_src_file="/boot/efi/EFI/centos/shim*64.efi"
         grub_src_file="/boot/efi/EFI/centos/grub*64.efi"
     fi
@@ -51,7 +51,7 @@ function prepare_ipxe {
         elif [[ ! -e ${TFTPBOOT_PATH}/snponly.efi ]]; then
             ln -s ${TFTPBOOT_PATH}/ipxe.efi ${TFTPBOOT_PATH}/snponly.efi
         fi
-    elif [[ "${KOLLA_BASE_DISTRO}" =~ centos ]]; then
+    elif [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]]; then
         cp /usr/share/ipxe/{undionly.kpxe,ipxe*.efi} ${TFTPBOOT_PATH}/
         if [[ ! -e ${TFTPBOOT_PATH}/ipxe.efi ]]; then
             ln -s ${TFTPBOOT_PATH}/ipxe-${KOLLA_BASE_ARCH}.efi ${TFTPBOOT_PATH}/ipxe.efi
diff --git a/docker/neutron/neutron-base/extend_start.sh b/docker/neutron/neutron-base/extend_start.sh
index c560cedf8..e2a2dfca4 100644
--- a/docker/neutron/neutron-base/extend_start.sh
+++ b/docker/neutron/neutron-base/extend_start.sh
@@ -14,7 +14,7 @@ fi
 # so no need to even use u-a on RHEL 9 family as there is one provider
 # (and there is no u-a for ip6tables so script fails)
 
-if [[ ${KOLLA_BASE_DISTRO} != "centos" ]]; then
+if [[ ! ${KOLLA_BASE_DISTRO} =~ centos|rocky ]]; then
     if /usr/bin/update-alternatives --display iptables; then
         # NOTE(yoctozepto): Kolla-Ansible does not always set KOLLA_LEGACY_IPTABLES;
         # the workaround below ensures it gets set to `false` in such cases to fix