Move to CentOS Stream 9

OpenStack 'zed' requires Python 3.8+ so RHEL 8 family has to go.

This changeset moves to CentOS Stream 9 while move to RockyLinux 9 is
planned as final solution.

CI moved to CentOS Stream 9 nodes.

Depends-on: https://review.opendev.org/c/openstack/kolla-ansible/+/839715

Change-Id: I113b9984294cf8663d3fc0c8840320e1d40ea731

22 files changed, 105 insertions, 69 deletions

diff --git a/docker/base/Dockerfile.j2 b/docker/base/Dockerfile.j2
index a25be51c5..13af63149 100644
--- a/docker/base/Dockerfile.j2
+++ b/docker/base/Dockerfile.j2
@@ -62,10 +62,14 @@ COPY dnf.conf /etc/dnf/dnf.conf
 {% endblock %}
 
 #### BEGIN REPO ENABLEMENT
+{#
+Repo files not available for CentOS Stream 9:
+    'elasticsearch.repo',  # signed with SHA1 key https://github.com/elastic/elasticsearch/issues/85876
+    'grafana.repo',        # signed with SHA1 key https://github.com/grafana/grafana/issues/41036
+    'proxysql.repo',       # no repository yet for RHEL9 family
+ #}
 {% set base_yum_repo_files = [
-    'elasticsearch.repo',
-    'grafana.repo',
-    'proxysql.repo',
+    'mariadb.repo',
     'rabbitmq_rabbitmq-server.repo',
     'td.repo',
 ] %}
@@ -73,35 +77,41 @@ COPY dnf.conf /etc/dnf/dnf.conf
 {% set base_yum_url_packages = [
 ] %}
 
-{% set base_yum_repo_keys = [
+{#
+SHA1 keys are not supported in RHEL9: https://github.com/rpm-software-management/rpm/issues/1977
     'https://artifacts.elastic.co/GPG-KEY-elasticsearch',
     'https://packages.grafana.com/gpg.key',
+ #}
+{% set base_yum_repo_keys = [
     'https://downloads.mariadb.com/MariaDB/RPM-GPG-KEY-MariaDB',
-    'https://repo.proxysql.com/ProxySQL/proxysql-2.4.x/repo_pub_key',
-    'https://github.com/rabbitmq/signing-keys/releases/download/2.0/rabbitmq-release-signing-key.asc',
     'https://packages.treasuredata.com/GPG-KEY-td-agent',
 ] %}
 
 {% if base_arch == 'x86_64' %}
     {% set base_yum_repo_files = base_yum_repo_files + [
         'influxdb.repo',
-        'mariadb.repo',
         'rabbitmq_rabbitmq-erlang.repo',
     ] %}
     # FIXME(mgoddard): Not available for CentOS 8 yet.
     #   'crmsh.repo',
 
     {% set base_yum_repo_keys = base_yum_repo_keys + [
+        'https://github.com/rabbitmq/signing-keys/releases/download/2.0/rabbitmq-release-signing-key.asc',
         'https://repos.influxdata.com/influxdb.key',
     ] %}
 {% elif base_arch == 'aarch64' %}
-    {% set base_yum_repo_files = base_yum_repo_files + [
+{#
+Repo files not available for CentOS Stream 9:
         'erlang-solutions.repo',
-        'mariadb-aarch64.repo',
+ #}
+    {% set base_yum_repo_files = base_yum_repo_files + [
     ] %}
 
-    {% set base_yum_repo_keys = base_yum_repo_keys + [
+{#
+SHA1 keys are not supported in RHEL9: https://github.com/rpm-software-management/rpm/issues/1977
         'https://packages.erlang-solutions.com/rpm/erlang_solutions.asc',
+ #}
+    {% set base_yum_repo_keys = base_yum_repo_keys + [
     ] %}
 {% endif %}
 
@@ -150,8 +160,7 @@ RUN rm -f /etc/rpm/macros.image-language-conf \
 ] %}
 
 {% set base_centos_yum_repo_packages = [
-    'centos-release-ceph-pacific',
-    'centos-release-nfv-extras',
+    'centos-release-ceph-quincy',
     'centos-release-nfv-openvswitch',
     'centos-release-opstools',
     'epel-release',
@@ -168,20 +177,26 @@ RUN rm -f /etc/rpm/macros.image-language-conf \
 # from delorean or rdo-release-* package
 # https://review.rdoproject.org/r/c/rdo-infra/ansible-role-dlrn/+/33241
 {% set base_centos_yum_repos_to_disable = [
-    'advanced-virtualization',
-    'centos-nfv-extras',
-    'centos-nfv-ovs',
-    'centos-ceph-pacific',
+    'centos-ceph-quincy',
     'centos-nfv-openvswitch',
     'centos-opstools',
+    'centos9-nfv-ovs',
+    'centos9-opstools',
+    'centos9-rabbitmq',
+    'centos9-storage',
     'epel',
-    'epel-modular',
 ] %}
 
 {% if base_arch == 'x86_64' %}
     {% set base_centos_yum_repos_to_disable = base_centos_yum_repos_to_disable + [
         'influxdb',
     ] %}
+{% elif base_arch == 'aarch64' %}
+
+{# NOTE(hrw): delorean-deps.repo may force x86-64 repos #}
+
+RUN sed -i -e "s/x86_64/aarch64/g" /etc/yum.repos.d/delorean-deps.repo
+
 {% endif %}
 
 RUN {{ macros.install_packages(base_centos_yum_repo_packages | customizable("centos_yum_repo_packages"), chain=True, clean=False) }}
@@ -204,9 +219,9 @@ RUN {{ macros.install_packages(base_centos_yum_repo_packages | customizable("cen
 
 {% block base_redhat_binary_versionlock %}{% endblock %}
 
+{# NOTE(hrw): CentOS Stream 9 has curl-minimal, Rocky Linux 9 has curl so we do not install any #}
 {% set base_centos_packages = [
         'ca-certificates',
-        'curl',
         'dumb-init',
         'findutils',
         'hostname',
diff --git a/docker/base/mariadb-aarch64.repo b/docker/base/mariadb-aarch64.repo
deleted file mode 100644
index 79929e8e9..000000000
--- a/docker/base/mariadb-aarch64.repo
+++ /dev/null
@@ -1,6 +0,0 @@
-[mariadb]
-name = MariaDB Server
-baseurl = https://dlm.mariadb.com/repo/mariadb-server/10.6/yum/rhel/8/aarch64
-gpgcheck = 1
-enabled = 0
-module_hotfixes = 1
diff --git a/docker/base/mariadb.repo b/docker/base/mariadb.repo
index 7420fcd35..43ea786a5 100644
--- a/docker/base/mariadb.repo
+++ b/docker/base/mariadb.repo
@@ -1,6 +1,6 @@
 [mariadb]
 name = MariaDB Server
-baseurl = https://dlm.mariadb.com/repo/mariadb-server/10.6/yum/rhel/8/x86_64
+baseurl = https://dlm.mariadb.com/repo/mariadb-server/10.6/yum/rhel/$releasever/$basearch
 gpgcheck = 1
 enabled = 0
 module_hotfixes = 1
diff --git a/docker/base/rabbitmq_rabbitmq-erlang.repo b/docker/base/rabbitmq_rabbitmq-erlang.repo
index bcb4f40f1..59d49c492 100644
--- a/docker/base/rabbitmq_rabbitmq-erlang.repo
+++ b/docker/base/rabbitmq_rabbitmq-erlang.repo
@@ -1,5 +1,6 @@
 [rabbitmq_rabbitmq-erlang]
 name=rabbitmq_rabbitmq-erlang
+# https://www.rabbitmq.com/install-rpm.html lists "el/8" for CentOS Stream 9
 baseurl=https://packagecloud.io/rabbitmq/erlang/el/8/$basearch
 gpgcheck=1
 enabled=0
diff --git a/docker/bifrost/bifrost-base/Dockerfile.j2 b/docker/bifrost/bifrost-base/Dockerfile.j2
index 9592798b2..7c4fed946 100644
--- a/docker/bifrost/bifrost-base/Dockerfile.j2
+++ b/docker/bifrost/bifrost-base/Dockerfile.j2
@@ -12,6 +12,12 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {# NOTE(mgoddard): EPEL required for nginx #}
 {{ macros.enable_extra_repos(['epel']) }}
 
+{% set bifrost_base_packages = [
+    'cpio',
+] %}
+
+{{ macros.install_packages(bifrost_base_packages | customizable("packages")) }}
+
 ENV VENV /var/lib/kolla/venv
 
 {% set bifrost_base_pip_packages = [
diff --git a/docker/collectd/Dockerfile.j2 b/docker/collectd/Dockerfile.j2
index 0190b71f5..85194cc26 100644
--- a/docker/collectd/Dockerfile.j2
+++ b/docker/collectd/Dockerfile.j2
@@ -30,12 +30,10 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
       'collectd-dbi',
       'collectd-disk',
       'collectd-dns',
-      'collectd-generic-jmx',
       'collectd-ipmi',
       'collectd-log_logstash',
       'collectd-logparser',
       'collectd-mcelog',
-      'collectd-memcachec',
       'collectd-mysql',
       'collectd-netlink',
       'collectd-openldap',
@@ -59,7 +57,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
   {% if base_arch =='x86_64' %}
       {% set collectd_packages = collectd_packages + [
         'collectd-hugepages',
-        'collectd-iptables',
         'collectd-pcie-errors',
         'collectd-pmu',
         'collectd-rdt',
diff --git a/docker/cron/Dockerfile.j2 b/docker/cron/Dockerfile.j2
index fbbd68500..860fae576 100644
--- a/docker/cron/Dockerfile.j2
+++ b/docker/cron/Dockerfile.j2
@@ -12,6 +12,11 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
         'cronie',
         'logrotate'
     ] %}
+
+# NOTE(hrw): In RHEL 9 family it is done by systemd timer, we want cron to
+# handle it.
+COPY logrotate /etc/cron.daily/logrotate
+
 {% elif base_package_type == 'deb' %}
     {% set cron_packages = [
         'cron',
diff --git a/docker/cron/extend_start.sh b/docker/cron/extend_start.sh
index 7f78e8500..3476302e1 100644
--- a/docker/cron/extend_start.sh
+++ b/docker/cron/extend_start.sh
@@ -3,15 +3,19 @@
 CRON_LOGROTATE_CURRENT_PATH="$(find /etc/cron* -name logrotate)"
 CRON_LOGROTATE_CURRENT_SCHEDULE=$(echo "${CRON_LOGROTATE_CURRENT_PATH}" | sed -r 's/(.*)(hourly|daily|weekly|monthly)(.*)/\2/g')
 
-# Pass only for hourly|daily|weekly|monthly
-if [[ "${KOLLA_LOGROTATE_SCHEDULE:-undefined}" =~ hourly|daily|weekly|monthly ]]; then
+if [ -z $CRON_LOGROTATE_CURRENT_PATH ]; then
+    echo "logrotate is not handled by cron"
+else
+    # Pass only for hourly|daily|weekly|monthly
+    if [[ "${KOLLA_LOGROTATE_SCHEDULE:-undefined}" =~ hourly|daily|weekly|monthly ]]; then
 
-    CRON_LOGROTATE_DESIRED_PATH="/etc/cron.${KOLLA_LOGROTATE_SCHEDULE}/logrotate"
+        CRON_LOGROTATE_DESIRED_PATH="/etc/cron.${KOLLA_LOGROTATE_SCHEDULE}/logrotate"
 
-    if [[ "${CRON_LOGROTATE_CURRENT_PATH}" != "${CRON_LOGROTATE_DESIRED_PATH}" ]]; then
-        mv ${CRON_LOGROTATE_CURRENT_PATH} ${CRON_LOGROTATE_DESIRED_PATH}
-        CRON_LOGROTATE_CURRENT_SCHEDULE="${KOLLA_LOGROTATE_SCHEDULE}"
+        if [[ "${CRON_LOGROTATE_CURRENT_PATH}" != "${CRON_LOGROTATE_DESIRED_PATH}" ]]; then
+            mv ${CRON_LOGROTATE_CURRENT_PATH} ${CRON_LOGROTATE_DESIRED_PATH}
+            CRON_LOGROTATE_CURRENT_SCHEDULE="${KOLLA_LOGROTATE_SCHEDULE}"
+        fi
     fi
-fi
 
-echo "[i] Cron schedule for logrotate is currently set to: ${CRON_LOGROTATE_CURRENT_SCHEDULE}."
+    echo "[i] Cron schedule for logrotate is currently set to: ${CRON_LOGROTATE_CURRENT_SCHEDULE}."
+fi
diff --git a/docker/cron/logrotate b/docker/cron/logrotate
new file mode 100755
index 000000000..1ac157001
--- /dev/null
+++ b/docker/cron/logrotate
@@ -0,0 +1,18 @@
+#!/bin/sh
+
+# skip in favour of systemd timer
+if [ -d /run/systemd/system ]; then
+    exit 0
+fi
+
+# this cronjob persists removals (but not purges)
+if [ ! -x /usr/sbin/logrotate ]; then
+    exit 0
+fi
+
+/usr/sbin/logrotate /etc/logrotate.conf
+EXITVALUE=$?
+if [ $EXITVALUE != 0 ]; then
+    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
+fi
+exit $EXITVALUE
diff --git a/docker/horizon/Dockerfile.j2 b/docker/horizon/Dockerfile.j2
index 1a2352e21..62053f88a 100644
--- a/docker/horizon/Dockerfile.j2
+++ b/docker/horizon/Dockerfile.j2
@@ -7,7 +7,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 {% import "macros.j2" as macros with context %}
 
-{{ macros.enable_extra_repos(['powertools']) }}
 {{ macros.configure_user(name='horizon') }}
 
 {% if base_package_type == 'rpm' %}
diff --git a/docker/iscsid/Dockerfile.j2 b/docker/iscsid/Dockerfile.j2
index ca6e44080..091666b5f 100644
--- a/docker/iscsid/Dockerfile.j2
+++ b/docker/iscsid/Dockerfile.j2
@@ -26,8 +26,9 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {{ macros.install_packages(iscsid_packages | customizable("packages"))  }}
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
+# NOTE(hrw): CentOS Stream 9 lacks initiatorname.iscsi file
 RUN chmod 644 /usr/local/bin/kolla_extend_start \
-    && rm /etc/iscsi/initiatorname.iscsi
+    && rm -f /etc/iscsi/initiatorname.iscsi
 
 {% block iscsid_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/keystone/keystone-base/Dockerfile.j2 b/docker/keystone/keystone-base/Dockerfile.j2
index fc5f814a2..0415e0ace 100644
--- a/docker/keystone/keystone-base/Dockerfile.j2
+++ b/docker/keystone/keystone-base/Dockerfile.j2
@@ -17,8 +17,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
         'openldap-devel',
     ] %}
 
-RUN dnf module enable mod_auth_openidc -y
-
 {% elif base_package_type == 'deb' %}
     {% set keystone_base_packages = [
         'libapache2-mod-auth-mellon',
diff --git a/docker/kolla-toolbox/Dockerfile.j2 b/docker/kolla-toolbox/Dockerfile.j2
index 618bf3719..20822738b 100644
--- a/docker/kolla-toolbox/Dockerfile.j2
+++ b/docker/kolla-toolbox/Dockerfile.j2
@@ -17,7 +17,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {{ macros.enable_extra_repos(['epel']) }}
 {% endif %}
 
-{{ macros.enable_extra_repos(['erlang', 'openvswitch', 'powertools', 'rabbitmq']) }}
+{{ macros.enable_extra_repos(['crb', 'erlang', 'openvswitch', 'rabbitmq']) }}
 
 {% if base_package_type == 'rpm' %}
 
diff --git a/docker/mariadb/mariadb-server/Dockerfile.j2 b/docker/mariadb/mariadb-server/Dockerfile.j2
index d3f6d440f..2be384f6d 100644
--- a/docker/mariadb/mariadb-server/Dockerfile.j2
+++ b/docker/mariadb/mariadb-server/Dockerfile.j2
@@ -10,7 +10,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {{ macros.configure_user(name='mysql') }}
 
 {# NOTE(mgoddard): EPEL required for pv package #}
-{{ macros.enable_extra_repos(['epel']) }}
+{{ macros.enable_extra_repos(['epel', 'mariadb']) }}
 
 {% if base_package_type == 'rpm' %}
     {% set mariadb_packages = [
diff --git a/docker/neutron/neutron-base/extend_start.sh b/docker/neutron/neutron-base/extend_start.sh
index 32108209d..c560cedf8 100644
--- a/docker/neutron/neutron-base/extend_start.sh
+++ b/docker/neutron/neutron-base/extend_start.sh
@@ -6,26 +6,28 @@ fi
 if [[ $(stat -c %a /var/log/kolla/neutron) != "755" ]]; then
     chmod 755 /var/log/kolla/neutron
 fi
-if [[ ${KOLLA_BASE_DISTRO} == "centos" ]]; then
-    export UPDATE_ALTERNATIVES="/usr/sbin/update-alternatives"
-else
-    export UPDATE_ALTERNATIVES="/usr/bin/update-alternatives"
-fi
 
-# set legacy iptables to allow kernels not supporting iptables-nft
-# CentOS has update-alternatives 1.13, so use --display (not --query)
-if $UPDATE_ALTERNATIVES --display iptables; then
-    # NOTE(yoctozepto): Kolla-Ansible does not always set KOLLA_LEGACY_IPTABLES;
-    # the workaround below ensures it gets set to `false` in such cases to fix
-    # this code under `set -o nounset`.
-    KOLLA_LEGACY_IPTABLES=${KOLLA_LEGACY_IPTABLES-false}
+# NOTE(hrw): from RHEL 9 release notes:
+# "Iptables-nft and ipset are now deprecated, which included the utilities,
+#  iptables, ip6tables, ebtables, and arptables. These are all replaced by the
+#  nftables framework."
+# so no need to even use u-a on RHEL 9 family as there is one provider
+# (and there is no u-a for ip6tables so script fails)
+
+if [[ ${KOLLA_BASE_DISTRO} != "centos" ]]; then
+    if /usr/bin/update-alternatives --display iptables; then
+        # NOTE(yoctozepto): Kolla-Ansible does not always set KOLLA_LEGACY_IPTABLES;
+        # the workaround below ensures it gets set to `false` in such cases to fix
+        # this code under `set -o nounset`.
+        KOLLA_LEGACY_IPTABLES=${KOLLA_LEGACY_IPTABLES-false}
 
-    if [[ $KOLLA_LEGACY_IPTABLES == "true" ]]; then
-        sudo $UPDATE_ALTERNATIVES --set iptables /usr/sbin/iptables-legacy
-        sudo $UPDATE_ALTERNATIVES --set ip6tables /usr/sbin/ip6tables-legacy
-    else
-        sudo $UPDATE_ALTERNATIVES --auto iptables
-        sudo $UPDATE_ALTERNATIVES --auto ip6tables
+        if [[ $KOLLA_LEGACY_IPTABLES == "true" ]]; then
+            sudo /usr/bin/update-alternatives --set iptables /usr/sbin/iptables-legacy
+            sudo /usr/bin/update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
+        else
+            sudo /usr/bin/update-alternatives --auto iptables
+            sudo /usr/bin/update-alternatives --auto ip6tables
+        fi
     fi
 fi
 
diff --git a/docker/nova/nova-compute/Dockerfile.j2 b/docker/nova/nova-compute/Dockerfile.j2
index 2db11a224..5420e9363 100644
--- a/docker/nova/nova-compute/Dockerfile.j2
+++ b/docker/nova/nova-compute/Dockerfile.j2
@@ -42,9 +42,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
         ] %}
     {% endif %}
 
-{{ macros.install_packages(nova_compute_packages | customizable("packages")) }} \
-    && dnf remove -y linux-firmware \
-    && dnf clean all
+{{ macros.install_packages(nova_compute_packages | customizable("packages")) }}
 
 {% elif base_package_type == 'deb' %}
 
diff --git a/docker/nova/nova-libvirt/Dockerfile.j2 b/docker/nova/nova-libvirt/Dockerfile.j2
index 199707b69..100b0c2d6 100644
--- a/docker/nova/nova-libvirt/Dockerfile.j2
+++ b/docker/nova/nova-libvirt/Dockerfile.j2
@@ -25,7 +25,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
         'openvswitch',
         'qemu-img',
         'qemu-kvm',
-        'trousers'
     ] %}
     {% if base_arch == 'x86_64' %}
         {% set nova_libvirt_packages = nova_libvirt_packages + [
diff --git a/docker/openstack-base/Dockerfile.j2 b/docker/openstack-base/Dockerfile.j2
index cd21a65b9..36d02f62f 100644
--- a/docker/openstack-base/Dockerfile.j2
+++ b/docker/openstack-base/Dockerfile.j2
@@ -7,7 +7,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 {% import "macros.j2" as macros with context %}
 
-{{ macros.enable_extra_repos(['opstools', 'powertools']) }}
+{{ macros.enable_extra_repos(['crb']) }}
 
 {% if base_package_type == 'rpm' %}
     {% set openstack_base_packages = [
@@ -55,7 +55,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 {% endif %}
 
-{{ macros.enable_extra_repos(['powertools']) }}
 {{ macros.install_packages(openstack_base_packages | customizable("packages")) }}
 
 {% set openstack_base_pip_packages = [
diff --git a/docker/prometheus/prometheus-libvirt-exporter/Dockerfile.j2 b/docker/prometheus/prometheus-libvirt-exporter/Dockerfile.j2
index d341af1e2..0cf606ad1 100644
--- a/docker/prometheus/prometheus-libvirt-exporter/Dockerfile.j2
+++ b/docker/prometheus/prometheus-libvirt-exporter/Dockerfile.j2
@@ -5,6 +5,8 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 {% import "macros.j2" as macros with context %}
 
+{{ macros.enable_extra_repos(['crb']) }}
+
 {% block prometheus_libvirt_exporter_header %}{% endblock %}
 
 {% if base_package_type == 'rpm' %}
diff --git a/docker/rabbitmq/Dockerfile.j2 b/docker/rabbitmq/Dockerfile.j2
index 9dc7d2363..7d524df68 100644
--- a/docker/rabbitmq/Dockerfile.j2
+++ b/docker/rabbitmq/Dockerfile.j2
@@ -14,7 +14,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {{ macros.enable_extra_repos(['epel']) }}
 {% endif %}
 
-{{ macros.enable_extra_repos(['erlang', 'powertools', 'rabbitmq']) }}
+{{ macros.enable_extra_repos(['crb', 'erlang', 'rabbitmq']) }}
 
 {% block rabbitmq_install %}
 {% if base_package_type == 'rpm' %}
diff --git a/docker/vitrage/vitrage-base/Dockerfile.j2 b/docker/vitrage/vitrage-base/Dockerfile.j2
index aaa1dd55d..d971584c2 100644
--- a/docker/vitrage/vitrage-base/Dockerfile.j2
+++ b/docker/vitrage/vitrage-base/Dockerfile.j2
@@ -7,7 +7,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 {% import "macros.j2" as macros with context %}
 
-{{ macros.enable_extra_repos(['powertools']) }}
 {{ macros.configure_user(name='vitrage') }}
 
 {% if base_package_type == 'rpm' %}
diff --git a/docker/watcher/watcher-base/Dockerfile.j2 b/docker/watcher/watcher-base/Dockerfile.j2
index aae288e56..7850642b7 100644
--- a/docker/watcher/watcher-base/Dockerfile.j2
+++ b/docker/watcher/watcher-base/Dockerfile.j2
@@ -7,7 +7,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 {% import "macros.j2" as macros with context %}
 
-{{ macros.enable_extra_repos(['powertools']) }}
 {{ macros.configure_user(name='watcher') }}
 
 ADD watcher-base-archive /watcher-base-source