move to Debian 'bullseye'

Bullseye is now in hard freeze cycle and goes for release.

https://release.debian.org/bullseye/freeze_policy.html

Co-Authored-By: Michal Nasiadka <mnasiadka@gmail.com>

Change-Id: I543965a2741cebfa759576a4c75669a7bacd4208

6 files changed, 89 insertions, 77 deletions

diff --git a/docker/base/Dockerfile.j2 b/docker/base/Dockerfile.j2
index fc55949ee..6c5d9df83 100644
--- a/docker/base/Dockerfile.j2
+++ b/docker/base/Dockerfile.j2
@@ -328,6 +328,18 @@ COPY sources.list /etc/apt/sources.list.d/kolla-custom.list
 
 {% block base_debian_after_sources_list %}{% endblock %}
 
+{# install Debian Openstack repos - they are not mirrored on CI #}
+{% if base_distro == 'debian' %}
+
+RUN apt update \
+ && apt install -y --no-install-recommends extrepo \
+ && extrepo enable openstack_wallaby \
+ && apt purge -y extrepo \
+ && apt --purge autoremove -y \
+ && apt clean
+
+{% endif %}
+
 {% block base_ubuntu_package_apt_preferences %}
 COPY apt_preferences.{{ base_distro }} /etc/apt/preferences
 COPY apt_preferences /etc/apt/preferences.d/kolla-custom
@@ -383,10 +395,8 @@ COPY apt_preferences /etc/apt/preferences.d/kolla-custom
     {% set remote_apt_keys = [
       'https://download.docker.com/linux/debian/gpg',
       'https://packages.grafana.com/gpg.key',
-      'http://buster-ussuri.debian.net/debian/dists/pubkey.gpg',
       'https://packages.treasuredata.com/GPG-KEY-td-agent',
       'https://repos.influxdata.com/influxdb.key',
-      'https://obs.linaro.org/repos/home:/marcin.juszkiewicz/debian-buster/Release.key',
     ] %}
 {% endif %}
 
diff --git a/docker/base/apt_preferences.debian b/docker/base/apt_preferences.debian
index ef693a5d4..e3f7bb790 100644
--- a/docker/base/apt_preferences.debian
+++ b/docker/base/apt_preferences.debian
@@ -1,53 +1,8 @@
-# We want Ceph/nautilus
-Package: ceph* libceph* librados* librbd* librgw* python3-ceph* python3-rados python3-rbd python3-rgw radosgw
-Pin: version 14.*
-Pin-Priority: 1000
-
-# ceph-osd requires smartmontools from backports
-Package: smartmontools
-Pin: version 7.*
-Pin-Priority: 1000
-
 Package: rabbitmq-server
 Pin: version 3.8.*
 Pin-Priority: 1000
 
-# We need erlang 22+ for rabbitmq (aarch64 has v23, x86-64 has v22 and v23 so we use v23)
+# RabbitMQ wants 23+ and we want to stay on 23 if possible
 Package: erlang*
 Pin: version 1:23.*
 Pin-Priority: 1000
-
-# We do not want packages from this repo
-Package: *
-Pin: release o=obs://private/home:marcin.juszkiewicz/debian-buster
-Pin-Priority: 100
-
-# We need libvirt 7.0.0 for nova
-Package: *libvirt*
-Pin: release o=obs://private/home:marcin.juszkiewicz/debian-buster
-Pin-Priority: 600
-
-# on ppc64le we lack libvirt 7.0.0 so let fail with Debian one
-Package: *libvirt*
-Pin: release o=Debian,b=ppc64le
-Pin-Priority: 700
-
-# ovn-host depends on openvswitch from buster
-Package: openvswitch*
-Pin: release n=buster
-Pin-Priority: 700
-
-# we want newer QEMU
-Package: qemu*
-Pin: version 1:5.*
-Pin-Priority: 700
-
-# QEMU depends on those
-Package: libpmem1 libndctl6 libdaxctl1 pmdk-tools libpmemblk1 libpmemlog1 libpmemobj1 libpmempool1 liburing1 libfdt1
-Pin: release n=buster-backports
-Pin-Priority: 700
-
-# nova wants data in /usr/share/qemu/firmware
-Package: qemu-efi-aarch64
-Pin: release n=buster-backports
-Pin-Priority: 700
diff --git a/docker/base/sources.list.debian b/docker/base/sources.list.debian
index d74f36c33..6b975b67c 100644
--- a/docker/base/sources.list.debian
+++ b/docker/base/sources.list.debian
@@ -1,33 +1,8 @@
 # Default repos
-deb http://deb.debian.org/debian buster main
+deb http://deb.debian.org/debian bullseye main
 
 # debian security updates
-deb http://security.debian.org/debian-security buster/updates main
+deb http://deb.debian.org/debian-security bullseye-security main
 
 # debian backports
-deb http://deb.debian.org/debian buster-backports main
-
-# Buster - Victoria repos
-deb http://buster-victoria.debian.net/debian buster-victoria-backports main
-deb http://buster-victoria.debian.net/debian buster-victoria-backports-nochange main
-
-# NOTE(hrw): repositories below are added into image when they are needed as
-# separate files in /etc/apt/sources.list.d/ directory. For that purpose they
-# are defined in kolla/repos.yaml file.
-#
-# Here they stay in case someone needs them.
-
-# elasticsearch (arch:all), logstash (arch:all), kibana (arch:amd64)
-#deb [arch=amd64] https://artifacts.elastic.co/packages/5.x/apt stable main
-
-# Grafana repo
-#deb https://packages.grafana.com/oss/deb stable main
-
-# td-agent for fluentd
-#deb http://packages.treasuredata.com/3/debian/buster buster contrib
-
-# rabbitmq repo
-#deb https://dl.bintray.com/rabbitmq/debian/ buster main
-
-# erlang repo
-#deb https://dl.bintray.com/rabbitmq-erlang/debian/ buster erlang
+deb http://deb.debian.org/debian bullseye-backports main
diff --git a/docker/mariadb/mariadb-server/Dockerfile.j2 b/docker/mariadb/mariadb-server/Dockerfile.j2
index b96e922fe..9ee7ef37d 100644
--- a/docker/mariadb/mariadb-server/Dockerfile.j2
+++ b/docker/mariadb/mariadb-server/Dockerfile.j2
@@ -37,7 +37,11 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 COPY mariadb_sudoers /etc/sudoers.d/kolla_mariadb_sudoers
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
+{% if base_distro == 'debian' %}
+COPY security_reset.expect.debian /usr/local/bin/kolla_security_reset
+{% else %}
 COPY security_reset.expect /usr/local/bin/kolla_security_reset
+{% endif %}
 RUN chmod 755 /usr/local/bin/kolla_extend_start \
     && chmod 755 /usr/local/bin/kolla_security_reset \
     && chmod 750 /etc/sudoers.d \
diff --git a/docker/mariadb/mariadb-server/security_reset.expect.debian b/docker/mariadb/mariadb-server/security_reset.expect.debian
new file mode 100644
index 000000000..ec40eaf90
--- /dev/null
+++ b/docker/mariadb/mariadb-server/security_reset.expect.debian
@@ -0,0 +1,67 @@
+#!/usr/bin/expect -f
+
+if [catch {set timeout $env(DB_MAX_TIMEOUT)}] {set timeout 10}
+spawn mysql_secure_installation
+expect {
+  timeout { send_user "\nFailed to get 'Enter current password for root (enter for none):' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Enter current password for root (enter for none):' prompt\n"; exit 1 }
+  "Enter current password for root (enter for none):"
+}
+send "\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Switch to unix_socket authentication [Y/n] ' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Switch to unix_socket authentication' prompt\n"; exit 1 }
+  "Switch to unix_socket authentication \\\[Y/n\\\] "
+}
+send "n\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Change the root password? [Y/n]' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Change the root password?' prompt\n"; exit 1 }
+  "Change the root password? \\\[Y/n\\\] "
+}
+send "y\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'New password:' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'New password:' prompt\n"; exit 1 }
+  "New password:"
+}
+send "$env(DB_ROOT_PASSWORD)\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Re-enter new password:' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Re-enter new password:' prompt\n"; exit 1 }
+  "Re-enter new password:"
+}
+send "$env(DB_ROOT_PASSWORD)\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Remove anonymous users?' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Remove anonymous users?' prompt\n"; exit 1 }
+  "Remove anonymous users?"
+}
+send "y\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Disallow root login remotely?' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Disallow root login remotely?' prompt\n"; exit 1 }
+  "Disallow root login remotely?"
+}
+send "n\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Remove test database and access to it?' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Remove test database and access to it?' prompt\n"; exit 1 }
+  "Remove test database and access to it?"
+}
+send "y\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Reload privilege tables now?' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Reload privilege tables now?' prompt\n"; exit 1 }
+  "Reload privilege tables now?"
+}
+send "y\r"
+expect eof
diff --git a/docker/openvswitch/openvswitch-base/Dockerfile.j2 b/docker/openvswitch/openvswitch-base/Dockerfile.j2
index 5bc40ec47..1ddf669e9 100644
--- a/docker/openvswitch/openvswitch-base/Dockerfile.j2
+++ b/docker/openvswitch/openvswitch-base/Dockerfile.j2
@@ -34,7 +34,8 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
-RUN mv /usr/sbin/tcpdump /usr/bin/tcpdump \
+# NOTE(hrw): Upstream moved tcpdump to /usr/bin/ in 4.99 version (used in Debian)
+RUN if [ -e /usr/sbin/tcpdump ]; then mv /usr/sbin/tcpdump /usr/bin/tcpdump; fi \
     && touch /usr/local/bin/kolla_openvswitch_extend_start \
     && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_openvswitch_extend_start