Merge "Migrate to pyproject.toml"

371 files changed, 10882 insertions, 0 deletions

diff --git a/kolla/docker/aodh/aodh-api/Dockerfile.j2 b/kolla/docker/aodh/aodh-api/Dockerfile.j2
new file mode 100644
index 000000000..b420df814
--- /dev/null
+++ b/kolla/docker/aodh/aodh-api/Dockerfile.j2
@@ -0,0 +1,16 @@
+FROM {{ namespace }}/{{ image_prefix }}aodh-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block aodh_api_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+COPY extend_start.sh /usr/local/bin/kolla_aodh_extend_start
+RUN chmod 644 /usr/local/bin/kolla_aodh_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block aodh_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/aodh/aodh-api/extend_start.sh b/kolla/docker/aodh/aodh-api/extend_start.sh
new file mode 100644
index 000000000..575b0e584
--- /dev/null
+++ b/kolla/docker/aodh/aodh-api/extend_start.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    aodh-dbsync
+    exit 0
+fi
diff --git a/kolla/docker/aodh/aodh-base/Dockerfile.j2 b/kolla/docker/aodh/aodh-base/Dockerfile.j2
new file mode 100644
index 000000000..519537468
--- /dev/null
+++ b/kolla/docker/aodh/aodh-base/Dockerfile.j2
@@ -0,0 +1,38 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block aodh_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='aodh') }}
+
+{% set aodh_base_packages = [
+] %}
+
+{{ macros.install_packages(aodh_base_packages | customizable("packages")) }}
+
+ADD aodh-base-archive /aodh-base-source
+
+{% set aodh_base_pip_packages = [
+    '/aodh',
+] %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+COPY aodh_sudoers /etc/sudoers.d/kolla_aodh_sudoers
+
+RUN ln -s aodh-base-source/* aodh \
+    && {{ macros.install_pip(aodh_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/aodh \
+    && cp /aodh/aodh/api/api-paste.ini /etc/aodh/ \
+    && chmod 644 /etc/aodh/api-paste.ini \
+    && chmod 750 /etc/sudoers.d \
+    && chmod 640 /etc/sudoers.d/kolla_aodh_sudoers \
+    && touch /usr/local/bin/kolla_aodh_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_aodh_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block aodh_base_footer %}{% endblock %}
diff --git a/kolla/docker/aodh/aodh-base/aodh_sudoers b/kolla/docker/aodh/aodh-base/aodh_sudoers
new file mode 100644
index 000000000..2ec268c9d
--- /dev/null
+++ b/kolla/docker/aodh/aodh-base/aodh_sudoers
@@ -0,0 +1 @@
+%kolla ALL=(root) NOPASSWD: /usr/bin/chown -R aodh\: /var/lib/aodh/, /bin/chown -R aodh\: /var/lib/aodh/
diff --git a/kolla/docker/aodh/aodh-base/extend_start.sh b/kolla/docker/aodh/aodh-base/extend_start.sh
new file mode 100755
index 000000000..f3b1d2d49
--- /dev/null
+++ b/kolla/docker/aodh/aodh-base/extend_start.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+# Create log dir for Aodh logs
+AODH_LOG_DIR="/var/log/kolla/aodh"
+if [[ ! -d "${AODH_LOG_DIR}" ]]; then
+    mkdir -p ${AODH_LOG_DIR}
+fi
+if [[ $(stat -c %U:%G ${AODH_LOG_DIR}) != "aodh:kolla" ]]; then
+    chown aodh:kolla ${AODH_LOG_DIR}
+fi
+if [[ $(stat -c %a ${AODH_LOG_DIR}) != "755" ]]; then
+    chmod 755 ${AODH_LOG_DIR}
+fi
+
+. /usr/local/bin/kolla_aodh_extend_start
diff --git a/kolla/docker/aodh/aodh-evaluator/Dockerfile.j2 b/kolla/docker/aodh/aodh-evaluator/Dockerfile.j2
new file mode 100644
index 000000000..3d1f6a8b4
--- /dev/null
+++ b/kolla/docker/aodh/aodh-evaluator/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}aodh-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block aodh_evaluator_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block aodh_evaluator_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER aodh
diff --git a/kolla/docker/aodh/aodh-expirer/Dockerfile.j2 b/kolla/docker/aodh/aodh-expirer/Dockerfile.j2
new file mode 100644
index 000000000..9c426f82c
--- /dev/null
+++ b/kolla/docker/aodh/aodh-expirer/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}aodh-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block aodh_expirer_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block aodh_expirer_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER aodh
diff --git a/kolla/docker/aodh/aodh-listener/Dockerfile.j2 b/kolla/docker/aodh/aodh-listener/Dockerfile.j2
new file mode 100644
index 000000000..a6f4f3c0e
--- /dev/null
+++ b/kolla/docker/aodh/aodh-listener/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}aodh-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block aodh_listener_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block aodh_listener_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER aodh
diff --git a/kolla/docker/aodh/aodh-notifier/Dockerfile.j2 b/kolla/docker/aodh/aodh-notifier/Dockerfile.j2
new file mode 100644
index 000000000..c49f37441
--- /dev/null
+++ b/kolla/docker/aodh/aodh-notifier/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}aodh-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block aodh_notifier_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block aodh_notifier_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER aodh
diff --git a/kolla/docker/barbican/barbican-api/Dockerfile.j2 b/kolla/docker/barbican/barbican-api/Dockerfile.j2
new file mode 100644
index 000000000..e78f3ea63
--- /dev/null
+++ b/kolla/docker/barbican/barbican-api/Dockerfile.j2
@@ -0,0 +1,19 @@
+FROM {{ namespace }}/{{ image_prefix }}barbican-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block barbican_api_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+COPY extend_start.sh /usr/local/bin/kolla_barbican_extend_start
+
+RUN chmod 644 /usr/local/bin/kolla_barbican_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block barbican_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER barbican
diff --git a/kolla/docker/barbican/barbican-api/extend_start.sh b/kolla/docker/barbican/barbican-api/extend_start.sh
new file mode 100755
index 000000000..c541d0343
--- /dev/null
+++ b/kolla/docker/barbican/barbican-api/extend_start.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    barbican-db-manage upgrade
+    exit 0
+fi
diff --git a/kolla/docker/barbican/barbican-base/Dockerfile.j2 b/kolla/docker/barbican/barbican-base/Dockerfile.j2
new file mode 100644
index 000000000..89c44ef9a
--- /dev/null
+++ b/kolla/docker/barbican/barbican-base/Dockerfile.j2
@@ -0,0 +1,36 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block barbican_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='barbican', groups='nfast,hsmusers') }}
+
+{{ macros.install_packages(barbican_base_packages | customizable("packages")) }}
+
+{% set barbican_base_pip_packages = [
+    '/barbican',
+    'pastedeploy',
+    'python-barbicanclient',
+] %}
+
+ADD barbican-base-archive /barbican-base-source
+
+COPY barbican_sudoers /etc/sudoers.d/kolla_barbican_sudoers
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN ln -s barbican-base-source/* barbican \
+    && {{ macros.install_pip(barbican_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/barbican \
+    && cp -r /barbican/etc/barbican/* /etc/barbican/ \
+    && chmod 750 /etc/sudoers.d \
+    && chmod 640 /etc/sudoers.d/kolla_barbican_sudoers \
+    && touch /usr/local/bin/kolla_barbican_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_barbican_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block barbican_base_footer %}{% endblock %}
diff --git a/kolla/docker/barbican/barbican-base/barbican_sudoers b/kolla/docker/barbican/barbican-base/barbican_sudoers
new file mode 100644
index 000000000..26ae4710e
--- /dev/null
+++ b/kolla/docker/barbican/barbican-base/barbican_sudoers
@@ -0,0 +1 @@
+%kolla ALL=(root) NOPASSWD: /usr/bin/chown -R barbican\: /var/lib/barbican/, /bin/chown -R barbican\: /var/lib/barbican/
diff --git a/kolla/docker/barbican/barbican-base/extend_start.sh b/kolla/docker/barbican/barbican-base/extend_start.sh
new file mode 100755
index 000000000..16b41ad09
--- /dev/null
+++ b/kolla/docker/barbican/barbican-base/extend_start.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+# Create log dir for Barbican logs
+LOG_DIR="/var/log/kolla/barbican"
+if [[ ! -d "${LOG_DIR}" ]]; then
+    mkdir -p ${LOG_DIR}
+fi
+if [[ $(stat -c %U:%G ${LOG_DIR}) != "barbican:kolla" ]]; then
+    chown barbican:kolla ${LOG_DIR}
+fi
+if [[ $(stat -c %a ${LOG_DIR}) != "755" ]]; then
+    chmod 755 ${LOG_DIR}
+fi
+
+. /usr/local/bin/kolla_barbican_extend_start
diff --git a/kolla/docker/barbican/barbican-keystone-listener/Dockerfile.j2 b/kolla/docker/barbican/barbican-keystone-listener/Dockerfile.j2
new file mode 100644
index 000000000..3329aed1b
--- /dev/null
+++ b/kolla/docker/barbican/barbican-keystone-listener/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}barbican-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block barbican_keystone_listener_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block barbican_keystone_listener_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER barbican
diff --git a/kolla/docker/barbican/barbican-worker/Dockerfile.j2 b/kolla/docker/barbican/barbican-worker/Dockerfile.j2
new file mode 100644
index 000000000..9cba55b6b
--- /dev/null
+++ b/kolla/docker/barbican/barbican-worker/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}barbican-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block barbican_worker_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block barbican_worker_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER barbican
diff --git a/kolla/docker/base/Dockerfile.j2 b/kolla/docker/base/Dockerfile.j2
new file mode 100644
index 000000000..0e2f3c1ab
--- /dev/null
+++ b/kolla/docker/base/Dockerfile.j2
@@ -0,0 +1,346 @@
+FROM {{ base_image }}:{{ base_distro_tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+RUN . /etc/os-release;\
+    if [ "${PRETTY_NAME#{{ supported_distro_name }}}" = "$PRETTY_NAME" ]; then \
+        echo "Only releases \"{{ supported_distro_name }}\" are supported on {{ base_distro }}"; false; \
+    fi
+
+# We use curl in this dockerfile so let configure it before first use
+COPY curlrc /root/.curlrc
+
+{% block base_lang %}
+# NOTE(yoctozepto): use a UTF-8 (Unicode) locale like standard image installs do
+# fixes issues arising from ascii fallback usage
+ENV LANG en_US.UTF-8
+{% endblock %}
+
+LABEL kolla_version="{{ kolla_version }}"
+
+{% import "macros.j2" as macros with context %}
+{% block base_header %}{% endblock %}
+
+ENV KOLLA_BASE_DISTRO={{ base_distro }} \
+    KOLLA_BASE_ARCH={{ base_arch }}
+
+#### Customize PS1 to be used with bash shell
+COPY kolla_bashrc /tmp/
+RUN cat /tmp/kolla_bashrc >> /etc/skel/.bashrc \
+    && cat /tmp/kolla_bashrc >> /root/.bashrc
+
+# PS1 var when used /bin/sh shell
+ENV PS1="$(tput bold)($(printenv KOLLA_SERVICE_NAME))$(tput sgr0)[$(id -un)@$(hostname -s) $(pwd)]$ "
+
+{% if base_package_type == 'rpm' %}
+# For RPM Variants, enable the correct repositories - this should all be done
+# in the base image so repos are consistent throughout the system.  This also
+# enables to provide repo overrides at a later date in a simple fashion if we
+# desire such functionality.  I think we will :)
+
+ENV KOLLA_RPM_OVS_VERSION=3.5 \
+    KOLLA_RPM_OVN_VERSION=26.03
+
+RUN cat /tmp/kolla_bashrc >> /etc/bashrc \
+    && sed -i 's|^\(override_install_langs=.*\)|# \1|' /etc/dnf/dnf.conf
+
+{% block base_dnf_conf %}
+{% block base_yum_conf %}
+
+COPY dnf.conf /etc/dnf/dnf.conf
+
+{% endblock %}
+{% endblock %}
+
+#### BEGIN REPO ENABLEMENT
+{% set base_yum_url_packages = [
+] %}
+
+{% set base_yum_repo_keys = [
+] %}
+
+{% block base_centos_repo_overrides_post_copy %}{% endblock %}
+
+# Install what is needed for en_US.UTF-8
+{% block base_centos_distro_sync_and_languages %}
+
+{% set base_centos_language_packages = [
+    'langpacks-en',
+    'glibc-all-langpacks'
+] %}
+
+# NOTE(hrw): this macro file drops all languages other than C.UTF-8 so horizon fails
+# https://bugzilla.redhat.com/show_bug.cgi?id=1729770
+RUN rm -f /etc/rpm/macros.image-language-conf \
+    && {{ macros.install_packages(base_centos_language_packages | customizable("centos_language_packages"), chain=True, clean=False) }} \
+    && {{ macros.rpm_security_update(clean_package_cache) }}
+
+{% endblock %}
+
+{{ macros.install_packages(base_yum_url_packages | customizable("yum_url_packages")) }}
+
+{% for key in base_yum_repo_keys | customizable('yum_repo_keys') %}
+{%- if loop.first %}RUN {% else %}    && {% endif -%}
+    rpm --import {{ key }}
+{%- if not loop.last %} \{% endif %}
+{% endfor -%}
+
+{% for cmd in rpm_setup %}
+{{ cmd }}
+{% endfor %}
+
+{% block base_centos_repo_overrides_post_rpm %}{% endblock %}
+
+{% block base_centos_gpg_key_import %}
+{% endblock %}
+
+{% set base_centos_yum_repo_keys = [
+] %}
+
+{% set base_centos_yum_repo_packages = [
+    'centos-release-ceph-squid',
+    'centos-release-nfv-openvswitch',
+    'epel-release',
+] %}
+
+# We need 'dnf-plugins-core' for 'dnf config-manager'
+{% set base_centos_yum_repo_packages = base_centos_yum_repo_packages + [
+    'dnf-plugins-core'
+] %}
+
+RUN {{ macros.install_packages(base_centos_yum_repo_packages | customizable("centos_yum_repo_packages"), chain=True, clean=False) }}
+
+{%- for key in base_centos_yum_repo_keys | customizable('centos_yum_repo_keys') %} && rpm --import {{ key }} {% endfor %} \
+{% block base_centos_repo_overrides_post_yum %}{% endblock -%}
+    && {{ macros.rpm_security_update(clean_package_cache) }}
+
+#### END REPO ENABLEMENT
+
+{# We are back to the basic if conditional here which is:
+    if base_package_type == 'rpm' #}
+
+{% block base_redhat_binary_versionlock %}{% endblock %}
+
+{# NOTE(hrw): CentOS Stream 9 has curl-minimal, Rocky Linux 9 has curl so we do not install any #}
+{% set base_centos_packages = [
+        'ca-certificates',
+        'crypto-policies-scripts',
+        'dumb-init',
+        'findutils',
+        'hostname',
+        'iproute',
+        'iscsi-initiator-utils',
+        'lsof',
+        'lvm2',
+        'ncurses',
+        'openssl',
+        'procps-ng',
+        'python3',
+        'python3-pip',
+        'python3-pyyaml',
+        'socat',
+        'sudo',
+        'tar',
+        'util-linux',
+        'util-linux-user',
+        'which',
+        'patch'
+] %}
+
+# Install base packages
+{{ macros.enable_extra_repos(['epel']) }}
+{{ macros.install_packages(base_centos_packages | customizable("centos_packages") | customizable("centos_binary_packages") | customizable("centos_source_packages")) }}
+
+{# endif for base_package_type rpm #}
+{% elif base_package_type == 'deb' %}
+# This will prevent questions from being asked during the install
+ENV DEBIAN_FRONTEND noninteractive
+
+# Reducing disk footprint
+COPY dpkg_reducing_disk_footprint /etc/dpkg/dpkg.cfg.d/dpkg_reducing_disk_footprint
+
+{% block base_ubuntu_package_pre %}
+# curl and ca-certificates to fetch remote keys via http
+# gnupg to fetch keys directly from keyserver
+{% set base_ubuntu_package_pre_packages = [
+    'adduser',
+    'ca-certificates',
+    'curl',
+    'gnupg'
+] %}
+# ubuntu-cloud-keyring to install UCA packages
+{% if base_distro == 'ubuntu' %}
+{% set base_ubuntu_package_pre_packages = base_ubuntu_package_pre_packages + [
+    'ubuntu-cloud-keyring'
+] %}
+{% endif %}
+{{ macros.install_packages(base_ubuntu_package_pre_packages | customizable("base_ubuntu_package_pre_packages")) }}
+{% endblock %}
+
+# Customize PS1 bash shell
+# - enlarge 'system users' range so 'haproxy' package will not complain
+#   see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=939470
+# - enlarge 'system groups' range so 'hacluster' user added in
+#   https://review.opendev.org/c/openstack/kolla/+/802671
+#   can be in 'haclient' group with same high uid
+RUN cat /tmp/kolla_bashrc >> /etc/bash.bashrc \
+    && sed -i -e s/#*LAST_SYSTEM_UID=999/LAST_SYSTEM_UID=59999/g \
+              -e s/#*LAST_SYSTEM_GID=999/LAST_SYSTEM_GID=59999/g /etc/adduser.conf
+
+{# NOTE(mnasiadka): Ubuntu arm64 uses ports.ubuntu.com #}
+{% block base_ubuntu_package_sources_list %}
+{% if base_distro == "ubuntu" and base_arch == 'aarch64' %}
+COPY {{ base_distro }}.sources.arm64 /etc/apt/sources.list.d/{{ base_distro }}.sources
+{% else %}
+COPY {{ base_distro }}.sources /etc/apt/sources.list.d/
+{% endif %}
+COPY sources.list /etc/apt/sources.list.d/kolla-custom.list
+{% endblock %}
+
+{% block base_debian_after_sources_list %}{% endblock %}
+
+{# install Debian Openstack repos - they are not mirrored on CI #}
+{% if base_distro == 'debian' %}
+
+RUN apt update \
+ && apt install -y --no-install-recommends extrepo \
+ && extrepo enable openstack_{{ openstack_release_codename | lower }} \
+ && apt purge -y extrepo \
+ && apt --purge autoremove -y \
+ && apt clean
+
+{% endif %}
+
+{% block base_ubuntu_package_apt_preferences %}
+COPY apt_preferences.{{ base_distro }} /etc/apt/preferences
+COPY apt_preferences /etc/apt/preferences.d/kolla-custom
+{% endblock %}
+
+{% set base_apt_packages = [
+   'apt-utils',
+   'dumb-init',
+   'systemd-standalone-sysusers',
+   'gawk',
+   'iproute2',
+   'kmod',
+   'lsof',
+   'lvm2',
+   'netbase',
+   'open-iscsi',
+   'procps',
+   'python3',
+   'python3-pip',
+   'python3-yaml',
+   'socat',
+   'sudo',
+   'tgt',
+   'patch'
+] %}
+
+{% set base_apt_keys = [
+   {'name': 'erlang-ppa', 'keyid': 'F77F1EDA57EBB1CC'},
+   {'name': 'rabbitmq',   'keyid': '6B73A36E6026DFCA'},
+   {'name': 'haproxy',    'keyid': 'CFFB779AADC995E4F350A060505D97A41C61B9CD'},
+] %}
+
+{# NOTE(hrw): type field defaults to 'asc' which is used for single keys #}
+{% set base_remote_apt_keys = [
+   {'name': 'docker-ce', 'url': 'https://download.docker.com/linux/debian/gpg'},
+   {'name': 'fluentd', 'url': 'https://fluentd.cdn.cncf.io/GPG-KEY-fluent-package'},
+   {'name': 'grafana', 'url': 'https://rpm.grafana.com/gpg.key'},
+   {'name': 'mariadb', 'url': 'https://downloads.mariadb.com/MariaDB/mariadb-keyring-2019.gpg', 'type': 'gpg'},
+   {'name': 'opensearch', 'url': 'https://artifacts.opensearch.org/publickeys/opensearch-release.pgp'},
+   {'name': 'proxysql', 'url': 'https://repo.proxysql.com/ProxySQL/proxysql-3.0.x/repo_pub_key'},
+] %}
+
+{% block base_ubuntu_package_installation %}
+    {%- block base_ubuntu_package_key_installation %}
+        {% for key in base_apt_keys | customizable('apt_keys') %}
+            {%- if loop.first %}RUN mkdir -p /etc/kolla/apt-keys/{% endif %} \
+            && gpg --keyserver hkp://keyserver.ubuntu.com:80 \
+            {% if env.http_proxy %} --keyserver-options "http-proxy={{ env.http_proxy }}" {% endif %}\
+            --recv-keys {{ key.keyid }} \
+            && gpg --export {{ key.keyid }} >/etc/kolla/apt-keys/{{ key.name }}.gpg
+            {%- if not loop.last %} \
+            {% endif -%}
+        {% endfor %}
+        {% for key in base_remote_apt_keys | customizable('remote_apt_keys') %}
+            {%- if loop.first %} RUN mkdir -p /etc/kolla/apt-keys/ {% endif %} \
+            && curl {{ key.url }} -o /etc/kolla/apt-keys/{{ key.name }}.{{ key.type | default('asc') }}
+            {%- if not loop.last %} \
+            {% endif -%}
+        {% endfor %}
+    {% endblock %}
+RUN apt-get --error-on=any update \
+    && apt-get -y install locales \
+    && sed -e "s/# $LANG UTF-8/$LANG UTF-8/g" /etc/locale.gen -i \
+    && locale-gen "$LANG" \
+    && apt-get -y upgrade \
+    && apt-get -y dist-upgrade \
+    && {{ macros.install_packages(base_apt_packages | customizable('apt_packages'), True) }} \
+    # NOTE: python3-pip installs dependent tzdata package and blocks mount in docker - 2091161
+    && unlink /etc/localtime
+
+{% endblock %}
+
+{# endif base_package_type deb #}
+{% endif %}
+
+{# NOTE(SamYaple): Avoid uid/gid conflicts by creating each user/group up front. #}
+{# Specifics required such as homedir or shell are configured within the service specific image #}
+{%- for name, user in users | dictsort() %}
+{% if loop.first -%}RUN {% else %}    && {% endif -%}
+    groupadd --gid {{ user.gid }} {{ user.group }} \
+    && useradd -l -M --shell /usr/sbin/nologin --uid {{ user.uid }} --gid {{ user.gid }} {{ name }}
+        {%- if not loop.last %} \{% endif -%}
+{%- endfor %}
+
+{% if base_distro == 'centos' %}
+RUN sed -ri '/-session(\s+)optional(\s+)pam_systemd.so/d' /etc/pam.d/system-auth \
+    && sed -ri '/^[^#]/ s/systemd//g' /etc/nsswitch.conf
+{% endif %}
+
+COPY set_configs.py /usr/local/bin/kolla_set_configs
+COPY start.sh /usr/local/bin/kolla_start
+COPY copy_cacerts.sh /usr/local/bin/kolla_copy_cacerts
+COPY install_projects.sh /usr/local/bin/kolla_install_projects
+COPY kolla_patch.sh /usr/local/bin/kolla_patch
+COPY sudoers /etc/sudoers
+
+{% if use_dumb_init %}
+ENTRYPOINT ["dumb-init", "--single-child", "--"]
+{% endif %}
+
+{% if docker_healthchecks %}
+{% block healthcheck_installation %}
+
+COPY healthcheck_curl healthcheck_filemod healthcheck_listen healthcheck_port healthcheck_socket /usr/local/bin/
+RUN chmod 755 /usr/local/bin/healthcheck_*
+
+{% endblock %}
+{% endif %}
+
+RUN touch /usr/local/bin/kolla_extend_start \
+    && chmod 755 /usr/local/bin/kolla_start \
+                 /usr/local/bin/kolla_set_configs \
+                 /usr/local/bin/kolla_copy_cacerts \
+                 /usr/local/bin/kolla_install_projects \
+                 /usr/local/bin/kolla_patch \
+    && chmod 644 /usr/local/bin/kolla_extend_start \
+    && chmod 440 /etc/sudoers \
+    && mkdir -p /var/log/kolla \
+    && chown :kolla /var/log/kolla \
+    && chmod 2775 /var/log/kolla \
+    && rm -f /tmp/kolla_bashrc
+
+{% block base_pip_conf %}
+# the variables like PIP_INDEX_URL, PIP_EXTRA_INDEX_URL, PIP_TRUSTED_HOST etc. should be defined here.
+# ENV PIP_INDEX_URL=https://pypi.python.org/simple
+# ENV PIP_TRUSTED_HOST=pypi.python.org
+{% endblock %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block base_footer %}{% endblock %}
+CMD ["kolla_start"]
diff --git a/kolla/docker/base/apt_preferences b/kolla/docker/base/apt_preferences
new file mode 100644
index 000000000..dc5b993f1
--- /dev/null
+++ b/kolla/docker/base/apt_preferences
@@ -0,0 +1 @@
+# used for adding custom options by 'apt_preferences' option of kolla-build.conf
diff --git a/kolla/docker/base/apt_preferences.debian b/kolla/docker/base/apt_preferences.debian
new file mode 100644
index 000000000..08e21ff22
--- /dev/null
+++ b/kolla/docker/base/apt_preferences.debian
@@ -0,0 +1,4 @@
+# NOTE(hrw): we do not want backports unless requested
+Package: *
+Pin: release n=trixie-backports
+Pin-Priority: -1000
diff --git a/kolla/docker/base/apt_preferences.ubuntu b/kolla/docker/base/apt_preferences.ubuntu
new file mode 100644
index 000000000..7cc49b4ad
--- /dev/null
+++ b/kolla/docker/base/apt_preferences.ubuntu
@@ -0,0 +1,3 @@
+Package: *
+Pin: origin dlm.mariadb.com
+Pin-Priority: 1000
diff --git a/kolla/docker/base/ci-centos.repo b/kolla/docker/base/ci-centos.repo
new file mode 100644
index 000000000..4c08f1fea
--- /dev/null
+++ b/kolla/docker/base/ci-centos.repo
@@ -0,0 +1,75 @@
+[baseos]
+name=(OpenDev mirror) CentOS Stream $releasever - BaseOS
+baseurl=http://MIRROR/centos-stream/$stream/BaseOS/$basearch/os/
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
+gpgcheck=1
+repo_gpgcheck=0
+enabled=1
+
+[appstream]
+name=(OpenDev mirror) CentOS Stream $releasever - AppStream
+baseurl=http://MIRROR/centos-stream/$stream/AppStream/$basearch/os/
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
+gpgcheck=1
+repo_gpgcheck=0
+enabled=1
+
+[extras-common]
+name=(OpenDev mirror) CentOS Stream $releasever - Extras packages
+baseurl=http://MIRROR/centos-stream/SIGs/$stream/extras/$basearch/extras-common/
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Extras-SHA512
+gpgcheck=1
+repo_gpgcheck=0
+enabled=1
+
+[crb]
+name=(OpenDev mirror) CentOS Stream $releasever - CRB
+baseurl=http://MIRROR/centos-stream/$stream/CRB/$basearch/os/
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
+gpgcheck=1
+repo_gpgcheck=0
+enabled=0
+
+[highavailability]
+name=(OpenDev mirror) CentOS Stream $releasever - HighAvailability
+baseurl=http://MIRROR/centos-stream/$stream/HighAvailability/$basearch/os/
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
+gpgcheck=1
+repo_gpgcheck=0
+enabled=0
+
+[centos-ceph-reef]
+name=(OpenDev mirror) CentOS-$stream - Ceph Reef
+baseurl=http://MIRROR/centos-stream/SIGs/$stream/storage/$basearch/ceph-reef/
+gpgcheck=1
+enabled=0
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Storage
+
+[centos-nfv-openvswitch]
+name=(OpenDev mirror) CentOS Stream $releasever - NFV OpenvSwitch
+baseurl=http://MIRROR/centos-stream/SIGs/$stream/nfv/$basearch/openvswitch-2/
+gpgcheck=1
+enabled=0
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-NFV
+module_hotfixes=1
+
+[centos-opstools]
+name=(OpenDev mirror) CentOS Stream $releasever - OpsTools - collectd
+baseurl=http://MIRROR/centos-stream/SIGs/$stream/opstools/$basearch/collectd-5/
+gpgcheck=1
+enabled=0
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-OpsTools
+
+[centos-rabbitmq-38]
+name=(OpenDev mirror) CentOS-9 - RabbitMQ 38
+baseurl=http://MIRROR/centos-stream/SIGs/$stream/messaging/$basearch/rabbitmq-38
+gpgcheck=1
+enabled=0
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Messaging
+
+[epel]
+name=(OpenDev mirror) Extra Packages for Enterprise Linux $releasever - $basearch
+baseurl=http://MIRROR/epel/$releasever/Everything/$basearch/
+enabled=0
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$releasever
diff --git a/kolla/docker/base/copy_cacerts.sh b/kolla/docker/base/copy_cacerts.sh
new file mode 100644
index 000000000..213033c0c
--- /dev/null
+++ b/kolla/docker/base/copy_cacerts.sh
@@ -0,0 +1,48 @@
+#!/bin/bash
+
+# Copy custom CA certificates to system trusted CA certificates folder
+# and run CA update utility
+
+if [[ -e "/etc/debian_version" ]]; then
+    ca_dst_path="/usr/local/share/ca-certificates"
+    update_command="update-ca-certificates"
+elif [[ -e "/etc/redhat-release" ]]; then
+    ca_dst_path="/etc/pki/ca-trust/source/anchors"
+    update_command="update-ca-trust"
+else
+    echo "Unsupported OS"
+    exit 1
+fi
+
+# Initialize update_needed variable
+update_needed="false"
+
+# Remove old certificates
+if find /etc/ssl/certs/ \
+        /usr/local/share/ca-certificates/ \
+        /etc/pki/ca-trust/source/anchors/ \
+        -name 'kolla*' -exec rm -f {} + 2>/dev/null; then
+    update_needed="true"
+fi
+
+# Determine source path for CA certificates
+if grep -q '"source": "/var/lib/kolla/share/ca-certificates"' /etc/kolla/defaults/state; then
+    ca_src_path="/var/lib/kolla/share/ca-certificates"
+else
+    ca_src_path="/var/lib/kolla/config_files/ca-certificates"
+fi
+
+# Check if the source path exists and is not empty
+if [[ -d ${ca_src_path} && $(ls -A "${ca_src_path}" 2>/dev/null) ]]; then
+    # Copy certificates and update CA
+    for cert in "${ca_src_path}"/*; do
+        file=$(basename "${cert}")
+        cp ${cert} ${ca_dst_path}/kolla-customca-${file}
+        update_needed="true"
+    done
+fi
+
+# Run the update command if needed
+if [[ "${update_needed}" == "true" ]]; then
+    ${update_command}
+fi
diff --git a/kolla/docker/base/curlrc b/kolla/docker/base/curlrc
new file mode 100644
index 000000000..3b1ecea06
--- /dev/null
+++ b/kolla/docker/base/curlrc
@@ -0,0 +1,8 @@
+# curl default options
+--fail
+--location
+--retry 5
+--retry-all-errors
+--silent
+--show-error
+--write-out "curl (%{url_effective}): response: %{http_code}, time: %{time_total}, size: %{size_download}\n"
diff --git a/kolla/docker/base/debian.sources b/kolla/docker/base/debian.sources
new file mode 100644
index 000000000..28c61c81d
--- /dev/null
+++ b/kolla/docker/base/debian.sources
@@ -0,0 +1,13 @@
+Types: deb
+# http://snapshot.debian.org/archive/debian/20251020T000000Z
+URIs: http://deb.debian.org/debian
+Suites: trixie trixie-updates trixie-backports
+Components: main
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+
+Types: deb
+# http://snapshot.debian.org/archive/debian-security/20251020T000000Z
+URIs: http://deb.debian.org/debian-security
+Suites: trixie-security
+Components: main
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
diff --git a/kolla/docker/base/dnf.conf b/kolla/docker/base/dnf.conf
new file mode 100644
index 000000000..6ca687545
--- /dev/null
+++ b/kolla/docker/base/dnf.conf
@@ -0,0 +1,12 @@
+[main]
+keepcache=0
+logfile=/var/log/dnf.log
+exactarch=1
+obsoletes=1
+gpgcheck=1
+plugins=1
+installonly_limit=0
+skip_missing_names_on_install=False
+clean_requirements_on_remove=True
+tsflags=nodocs
+install_weak_deps=False
diff --git a/kolla/docker/base/dpkg_reducing_disk_footprint b/kolla/docker/base/dpkg_reducing_disk_footprint
new file mode 100644
index 000000000..87b8255f9
--- /dev/null
+++ b/kolla/docker/base/dpkg_reducing_disk_footprint
@@ -0,0 +1,9 @@
+path-exclude /usr/share/doc/*
+path-include /usr/share/doc/*/copyright
+path-exclude /usr/share/man/*
+path-exclude /usr/share/groff/*
+path-exclude /usr/share/info/*
+path-exclude /usr/share/lintian/*
+path-exclude /usr/share/linda/*
+path-exclude /usr/share/locale/*
+path-include /usr/share/locale/en*
diff --git a/kolla/docker/base/healthcheck_curl b/kolla/docker/base/healthcheck_curl
new file mode 100755
index 000000000..6df232fe8
--- /dev/null
+++ b/kolla/docker/base/healthcheck_curl
@@ -0,0 +1,12 @@
+#!/bin/bash
+: ${HEALTHCHECK_CURL_MAX_TIME:=10}
+: ${HEALTHCHECK_CURL_USER_AGENT:=curl-healthcheck}
+: ${HEALTHCHECK_CURL_WRITE_OUT:='\n%{http_code} %{remote_ip}:%{remote_port} %{time_total} seconds\n'}
+: ${HEALTHCHECK_CURL_OUTPUT:='/dev/null'}
+
+export NSS_SDB_USE_CACHE=no
+curl -q -g -k -s -S --fail -o "${HEALTHCHECK_CURL_OUTPUT}" \
+    --max-time "${HEALTHCHECK_CURL_MAX_TIME}" \
+    --user-agent "${HEALTHCHECK_CURL_USER_AGENT}" \
+    --write-out "${HEALTHCHECK_CURL_WRITE_OUT}" \
+    "$@" || exit 1
diff --git a/kolla/docker/base/healthcheck_filemod b/kolla/docker/base/healthcheck_filemod
new file mode 100755
index 000000000..007643d9b
--- /dev/null
+++ b/kolla/docker/base/healthcheck_filemod
@@ -0,0 +1,15 @@
+#!/bin/bash
+file_path=$1
+limit_seconds=$2
+
+# if the file doesn't exist, return 1
+if [ ! -f $file_path ]; then
+    echo "${file_path} does not exist for file modification check"
+    exit 1
+fi
+curr_time=$(date +%s)
+last_mod=$(stat -c '%Y' $file_path)
+limit_epoch=$(( curr_time-limit_seconds ))
+if [ ${limit_epoch} -gt ${last_mod} ]; then
+    exit 1
+fi
diff --git a/kolla/docker/base/healthcheck_listen b/kolla/docker/base/healthcheck_listen
new file mode 100755
index 000000000..70273339c
--- /dev/null
+++ b/kolla/docker/base/healthcheck_listen
@@ -0,0 +1,8 @@
+#!/bin/bash
+process=$1
+
+shift 1
+args=$@
+ports=${args// /|}
+pids=$(pgrep -d '|' -f $process)
+ss -lnp | grep -qE ":($ports).*,pid=($pids),"
diff --git a/kolla/docker/base/healthcheck_port b/kolla/docker/base/healthcheck_port
new file mode 100755
index 000000000..9531bd77a
--- /dev/null
+++ b/kolla/docker/base/healthcheck_port
@@ -0,0 +1,8 @@
+#!/bin/bash
+process=$1
+
+shift 1
+args=$@
+ports=${args// /|}
+pids=$(pgrep -d '|' -f $process)
+ss -ntp | grep -qE ":($ports).*,pid=($pids),"
diff --git a/kolla/docker/base/healthcheck_socket b/kolla/docker/base/healthcheck_socket
new file mode 100755
index 000000000..cd65bae69
--- /dev/null
+++ b/kolla/docker/base/healthcheck_socket
@@ -0,0 +1,10 @@
+#!/bin/bash
+process=$1
+socket=$2
+
+# lsof truncate command name to 15 characters and this behaviour
+# cannot be disabled
+if [ ${#process} -gt 15 ] ; then
+    process=${process:0:15}
+fi
+lsof -Fc -Ua $socket | grep -q "c$process"
diff --git a/kolla/docker/base/install_projects.sh b/kolla/docker/base/install_projects.sh
new file mode 100644
index 000000000..c3f7182b5
--- /dev/null
+++ b/kolla/docker/base/install_projects.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+# This script finds all projects in /dev-mode folder and
+# installs them using pip
+# The projects are mounted there when dev mode is enabled for them
+# in kolla-ansible
+
+VENV_PATH="/var/lib/kolla/venv"
+
+if [ -d "/dev-mode" ] && [ -d "$VENV_PATH" ]; then
+    for project in /dev-mode/*; do
+        pip install -U "$project"
+    done
+fi
diff --git a/kolla/docker/base/kolla_bashrc b/kolla/docker/base/kolla_bashrc
new file mode 100644
index 000000000..09b19cc06
--- /dev/null
+++ b/kolla/docker/base/kolla_bashrc
@@ -0,0 +1,5 @@
+#### Custom data added by Kolla
+_KBOLD="\[$(tput bold)\]"
+_KRESET="\[$(tput sgr0)\]"
+
+PS1="${_KBOLD}(${KOLLA_SERVICE_NAME})${_KRESET}[\u@\h \W]\\$ "
diff --git a/kolla/docker/base/kolla_patch.sh b/kolla/docker/base/kolla_patch.sh
new file mode 100755
index 000000000..b17a5b61d
--- /dev/null
+++ b/kolla/docker/base/kolla_patch.sh
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+# This script works as debian quilt patch.
+# So, patch files included in /patches/series
+# are applied and information what was applied
+# is stored in /etc/kolla/patched.
+#
+# No more, no less :)
+
+cd /
+
+# If exist /patches/series
+# let's try to apply patches
+if [ -e "/patches/series" ]; then
+    # If there is /patches/series.applied
+    # then it means previous run already applied
+    # some patches - from another intermediate container
+    #
+    # So, let's add patches again to /patches/series
+    # and let's script to handle it
+    if [ -e "/patches/series.applied" ]; then
+        grep -v '^#' /patches/series.applied > /tmp/series.tmp
+        grep -v '^#' /patches/series >> /tmp/series.tmp
+        rm -f /patches/series
+        mv /tmp/series.tmp /patches/series
+    fi
+    touch /etc/kolla/patched
+    for patchfile in $(grep -v '^#' /patches/series); do
+        # If patch is not applied, try to apply it, otherwise
+        # inform user that patchfile is already applied
+        if ! grep -q "$patchfile" /etc/kolla/patched; then
+            echo "[i] Applying /patches/${patchfile}"
+            patch -p0 --fuzz=0 --ignore-whitespace < /patches/${i}/${patchfile}
+            # If apply patch was successful inform user,
+            # otherwise fail build process and inform user
+            # to check/fix patch
+            if [ $? -eq 0 ]; then
+                echo "[i] Applied /patches/${patchfile}" >> /etc/kolla/patched
+            else
+                echo "[i] Patch /patches/${patchfile} failed, please fix your patchfiles."
+                exit 1
+            fi
+        else
+            echo "[i] /patches/${patchfile} already applied."
+        fi
+    done
+    # Ignore files which are commented and move
+    # to /patches/series.applied as /patch/series
+    # can be potentially replaced by another files
+    # from different intermediate container
+    grep -v '^#' /patches/series > /patches/series.applied
+    rm -f /patches/series
+else
+    echo "[i] No series file found, nothing to patch."
+fi
diff --git a/kolla/docker/base/set_configs.py b/kolla/docker/base/set_configs.py
new file mode 100644
index 000000000..4b025d55a
--- /dev/null
+++ b/kolla/docker/base/set_configs.py
@@ -0,0 +1,759 @@
+#!/usr/bin/env python3
+
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import argparse
+import glob
+import grp
+import json
+import logging
+import os
+import pwd
+import re
+import shutil
+import stat
+import sys
+import yaml
+
+
+# TODO(rhallisey): add docstring.
+logging.basicConfig(
+    format='%(asctime)s.%(msecs)03d %(levelname)s %(message)s',
+    level=logging.INFO,
+    datefmt='%Y-%m-%d %H:%M:%S'
+)
+LOG = logging.getLogger(__name__)
+LOG.setLevel(logging.INFO)
+
+KOLLA_DEFAULTS = "/etc/kolla/defaults"
+KOLLA_DEFAULTS_STATE = KOLLA_DEFAULTS + '/' + 'state'
+
+
+class ExitingException(Exception):
+    def __init__(self, message, exit_code=1):
+        super(ExitingException, self).__init__(message)
+        self.exit_code = exit_code
+
+
+class ImmutableConfig(ExitingException):
+    pass
+
+
+class InvalidConfig(ExitingException):
+    pass
+
+
+class MissingRequiredSource(ExitingException):
+    pass
+
+
+class UserNotFound(ExitingException):
+    pass
+
+
+class ConfigFileBadState(ExitingException):
+    pass
+
+
+class ConfigFileCommandDiffers(ExitingException):
+    pass
+
+
+class StateMismatch(ExitingException):
+    pass
+
+
+class ConfigFile(object):
+
+    def __init__(self, source, dest, owner=None, perm=None, optional=False,
+                 preserve_properties=False, merge=False):
+        self.source = source
+        self.dest = dest
+        self.owner = owner
+        self.perm = perm
+        self.optional = optional
+        self.merge = merge
+        self.preserve_properties = preserve_properties
+
+    def __str__(self):
+        return '<ConfigFile source:"{}" dest:"{}">'.format(self.source,
+                                                           self.dest)
+
+    def _copy_file(self, source, dest):
+        self._delete_path(dest)
+        # dest endswith / means copy the <source> to <dest> folder
+        LOG.info('Copying %s to %s', source, dest)
+        if self.merge and self.preserve_properties and os.path.islink(source):
+            link_target = os.readlink(source)
+            os.symlink(link_target, dest)
+        else:
+            shutil.copy(source, dest)
+            self._set_properties(source, dest)
+
+    def _merge_directories(self, source, dest):
+        if os.path.isdir(source):
+            if os.path.lexists(dest) and not os.path.isdir(dest):
+                self._delete_path(dest)
+            if not os.path.isdir(dest):
+                LOG.info('Creating directory %s', dest)
+                os.makedirs(dest)
+            self._set_properties(source, dest)
+
+            dir_content = os.listdir(source)
+            for to_copy in dir_content:
+                self._merge_directories(os.path.join(source, to_copy),
+                                        os.path.join(dest, to_copy))
+        else:
+            self._copy_file(source, dest)
+
+    def _delete_path(self, path):
+        if not os.path.lexists(path):
+            return
+        LOG.info('Deleting %s', path)
+        if os.path.isdir(path):
+            shutil.rmtree(path)
+        else:
+            os.remove(path)
+
+    def _create_parent_dirs(self, path):
+        parent_path = os.path.dirname(path)
+        if not os.path.exists(parent_path):
+            os.makedirs(parent_path)
+
+    def _set_properties(self, source, dest):
+        if self.preserve_properties:
+            self._set_properties_from_file(source, dest)
+        else:
+            self._set_properties_from_conf(dest)
+
+    def _set_properties_from_file(self, source, dest):
+        LOG.info('Copying permissions from %s onto %s', source, dest)
+        shutil.copystat(source, dest)
+        stat = os.stat(source)
+        os.chown(dest, stat.st_uid, stat.st_gid)
+
+    def _set_properties_from_conf(self, path):
+        config = {'permissions':
+                  [{'owner': self.owner, 'path': path, 'perm': self.perm}]}
+        handle_permissions(config)
+
+    def copy(self):
+
+        sources = glob.glob(self.source)
+
+        if not self.optional and not sources:
+            raise MissingRequiredSource('%s file is not found' % self.source)
+        # skip when there is no sources and optional
+        elif self.optional and not sources:
+            return
+
+        for source in sources:
+            dest = self.dest
+            # dest endswith / means copy the <source> into <dest> folder,
+            # otherwise means copy the source to dest
+            if dest.endswith(os.sep):
+                dest = os.path.join(dest, os.path.basename(source))
+            if not self.merge:
+                self._delete_path(dest)
+            self._create_parent_dirs(dest)
+            try:
+                self._merge_directories(source, dest)
+            except OSError:
+                # If a source is tried to merge with a read-only mount, it
+                # may throw an OSError. Because we don't print the source or
+                # dest anywhere, let's catch the exception and log a better
+                # message to help with tracking down the issue.
+                LOG.error('Unable to merge %s with %s', source, dest)
+                raise
+
+    def _cmp_file(self, source, dest):
+        # check exist
+        if (os.path.exists(source) and
+                not os.path.exists(dest)):
+            return False
+        if (os.path.exists(dest) and
+                not os.path.exists(source)):
+            return False
+        # check content
+        with open(source, 'rb') as f1, open(dest, 'rb') as f2:
+            if f1.read() != f2.read():
+                LOG.error('The content of source file(%s) and'
+                          ' dest file(%s) are not equal.', source, dest)
+                return False
+        # check perm
+        file_stat = os.stat(dest)
+        actual_perm = oct(file_stat.st_mode)[-4:]
+        if self.perm != actual_perm:
+            LOG.error('Dest file does not have expected perm: %s, actual: %s',
+                      self.perm, actual_perm)
+            return False
+        # check owner
+        desired_user, desired_group = user_group(self.owner)
+        actual_user = pwd.getpwuid(file_stat.st_uid)
+        if actual_user.pw_name != desired_user:
+            LOG.error('Dest file does not have expected user: %s,'
+                      ' actual: %s ', desired_user, actual_user.pw_name)
+            return False
+        actual_group = grp.getgrgid(file_stat.st_gid)
+        if actual_group.gr_name != desired_group:
+            LOG.error('Dest file does not have expected group: %s,'
+                      ' actual: %s ', desired_group, actual_group.gr_name)
+            return False
+        return True
+
+    def _cmp_dir(self, source, dest):
+        for root, dirs, files in os.walk(source):
+            for dir_ in dirs:
+                full_path = os.path.join(root, dir_)
+                dest_full_path = os.path.join(dest, os.path.relpath(source,
+                                                                    full_path))
+                dir_stat = os.stat(dest_full_path)
+                actual_perm = oct(dir_stat.st_mode)[-4:]
+                if self.perm != actual_perm:
+                    LOG.error('Dest dir does not have expected perm: %s,'
+                              ' actual %s', self.perm, actual_perm)
+                    return False
+            for file_ in files:
+                full_path = os.path.join(root, file_)
+                dest_full_path = os.path.join(dest, os.path.relpath(full_path,
+                                                                    source))
+                if not self._cmp_file(full_path, dest_full_path):
+                    return False
+        return True
+
+    def check(self):
+        bad_state_files = []
+        sources = glob.glob(self.source)
+
+        if not sources and not self.optional:
+            raise MissingRequiredSource('%s file is not found' % self.source)
+        elif self.optional and not sources:
+            return
+
+        for source in sources:
+            dest = self.dest
+            # dest endswith / means copy the <source> into <dest> folder,
+            # otherwise means copy the source to dest
+            if dest.endswith(os.sep):
+                dest = os.path.join(dest, os.path.basename(source))
+            if os.path.isdir(source):
+                if not self._cmp_dir(source, dest):
+                    bad_state_files.append(source)
+            elif not self._cmp_file(source, dest):
+                bad_state_files.append(source)
+        if len(bad_state_files) != 0:
+            msg = 'Following files are in bad state: %s' % bad_state_files
+            raise ConfigFileBadState(msg)
+
+
+def validate_config(config):
+    required_keys = {'source', 'dest'}
+    required_path_keys = {'path', 'owner', 'perm'}
+
+    if 'command' not in config:
+        raise InvalidConfig('Config is missing required "command" key')
+
+    # Validate config sections
+    for data in config.get('config_files', list()):
+        # Verify required keys exist.
+        if not set(data.keys()) >= required_keys:
+            message = 'Config is missing required keys: %s' % required_keys
+            raise InvalidConfig(message)
+        if ('owner' not in data or 'perm' not in data) \
+                and not data.get('preserve_properties', False):
+            raise InvalidConfig(
+                'Config needs preserve_properties or owner and perm')
+
+    for section in ('directories', 'files'):
+        for data in config.get(section, list()):
+            missing = required_path_keys - set(data.keys())
+            if missing:
+                raise InvalidConfig(
+                    '%s config is missing required keys: %s'
+                    % (section, missing))
+
+            for key in required_path_keys:
+                if data.get(key) is None:
+                    raise InvalidConfig(
+                        '%s config key "%s" must not be null'
+                        % (section, key))
+
+            if glob.has_magic(data['path']):
+                raise InvalidConfig(
+                    '%s config does not support glob paths: %s'
+                    % (section, data['path']))
+
+
+def validate_source(data):
+    source = data.get('source')
+
+    # Only check existence if no wildcard found
+    if '*' not in source:
+        if not os.path.exists(source):
+            if data.get('optional'):
+                LOG.info("%s does not exist, but is not required", source)
+                return False
+            else:
+                raise MissingRequiredSource(
+                    "The source to copy does not exist: %s" % source)
+
+    return True
+
+
+def load_config():
+    def load_from_file():
+        yaml_config_file = '/var/lib/kolla/config_files/config.yaml'
+        json_config_file = '/var/lib/kolla/config_files/config.json'
+
+        if os.path.exists(yaml_config_file):
+            config_file = yaml_config_file
+            LOG.info("Loading config file at %s", config_file)
+            try:
+                with open(config_file) as f:
+                    config = yaml.safe_load(f)
+
+                    if config is None:
+                        raise InvalidConfig(
+                            "Invalid yaml file found at %s: "
+                            "file is empty" % config_file)
+                    return config
+            except yaml.YAMLError:
+                raise InvalidConfig(
+                    "Invalid yaml file found at %s" % config_file)
+            except IOError as e:
+                raise InvalidConfig(
+                    "Could not read file %s: %r" % (config_file, e))
+        else:
+            config_file = json_config_file
+            LOG.info("Loading config file at %s", config_file)
+            try:
+                with open(config_file) as f:
+                    return json.load(f)
+            except ValueError:
+                raise InvalidConfig(
+                    "Invalid json file found at %s" % config_file)
+            except IOError as e:
+                raise InvalidConfig(
+                    "Could not read file %s: %r" % (config_file, e))
+
+    config = load_from_file()
+
+    LOG.info('Validating config file')
+    validate_config(config)
+    return config
+
+
+def copy_config(config):
+    if 'config_files' in config:
+        LOG.info('Copying service configuration files')
+        for data in config['config_files']:
+            config_file = ConfigFile(**data)
+            config_file.copy()
+    else:
+        LOG.debug('No files to copy found in config')
+
+    LOG.info('Writing out command to execute')
+    LOG.debug("Command is: %s", config['command'])
+    # The value from the 'command' key will be written to '/run_command'
+    cmd = '/run_command'
+    with open(cmd, 'w+') as f:
+        f.write(config['command'])
+    # Make sure the generated file is readable by all users
+    try:
+        os.chmod(cmd, 0o644)
+    except OSError:
+        LOG.exception('Failed to set permission of %s to 0o644', cmd)
+
+
+def create_directories(config):
+    if 'directories' not in config:
+        return
+    LOG.info('Creating directories')
+    for data in config['directories']:
+        path = data['path']
+        try:
+            os.makedirs(path, exist_ok=True)
+        except Exception:
+            raise OSError("Can't create destination directory (%s)" % (path))
+        handle_permissions({'permissions': [data]})
+
+
+def create_files(config):
+    if 'files' not in config:
+        return
+    LOG.info('Creating files')
+    for data in config['files']:
+        path = data['path']
+        if os.path.islink(path):
+            raise OSError(
+                "Path is a symbolic link, expected regular file (%s)" % path)
+        if os.path.isdir(path):
+            raise OSError(
+                "Path is a directory, expected file (%s)" % path)
+        parent = os.path.dirname(path)
+        if parent and not os.path.isdir(parent):
+            raise OSError(
+                "Parent directory does not exist (%s)" % parent)
+        if not os.path.exists(path):
+            with open(path, 'a'):
+                pass
+        handle_permissions({'permissions': [data]})
+
+
+def user_group(owner):
+    if ':' in owner:
+        user, group = owner.split(':', 1)
+        if not group:
+            group = user
+    else:
+        user, group = owner, owner
+    return user, group
+
+
+def handle_permissions(config):
+    for permission in config.get('permissions', list()):
+        path = permission.get('path')
+        owner = permission.get('owner')
+        recurse = permission.get('recurse', False)
+        perm = permission.get('perm')
+        exclude = permission.get('exclude', [])
+
+        desired_user, desired_group = user_group(owner)
+        uid = pwd.getpwnam(desired_user).pw_uid
+        gid = grp.getgrnam(desired_group).gr_gid
+
+        def set_perms(path, uid, gid, perm):
+            LOG.info('Setting permission for %s', path)
+            if not os.path.exists(path):
+                LOG.warning('%s does not exist', path)
+                return
+
+            try:
+                os.chown(path, uid, gid)
+            except OSError:
+                LOG.exception('Failed to change ownership of %s to %s:%s',
+                              path, uid, gid)
+
+            if perm:
+                # Accept valid UNIX permission notation
+                # (e.g. 644, 0600, 1777, 2755)
+                # or equivalent Python octal literals
+                # (e.g. 0o644, 0o1777, 0o2755).
+                if re.fullmatch(r'[0-7]{3,4}', perm):
+                    perm = int(perm, 8)
+                elif re.fullmatch(r'0o[0-7]{3,4}', perm):
+                    perm = int(perm, 0)
+                else:
+                    raise ValueError(
+                        f"Invalid permission '{perm}'. Expected a valid UNIX "
+                        "permission (e.g. 644, 0600, 2755) or a Python octal "
+                        "literal (e.g. 0o644, 0o0600, 0o2755)."
+                    )
+
+                # Ensure execute bit on directory if read bit is set
+                if os.path.isdir(path):
+                    if perm & stat.S_IRUSR:
+                        perm |= stat.S_IXUSR
+                    if perm & stat.S_IRGRP:
+                        perm |= stat.S_IXGRP
+                    if perm & stat.S_IROTH:
+                        perm |= stat.S_IXOTH
+
+                try:
+                    os.chmod(path, perm)
+                except OSError:
+                    LOG.exception('Failed to set permission of %s to %s',
+                                  path, perm)
+
+        def handle_exclusion(root, path_suffix):
+            full_path = os.path.join(root, path_suffix)
+            LOG.debug("Checking for exclusion: %s" % full_path)
+            if exclude:
+                for exclude_ in exclude:
+                    if not re.search(exclude_, full_path):
+                        set_perms(full_path, uid, gid, perm)
+            else:
+                set_perms(full_path, uid, gid, perm)
+
+        for dest in glob.glob(path):
+            set_perms(dest, uid, gid, perm)
+            if recurse and os.path.isdir(dest):
+                for root, dirs, files in os.walk(dest):
+                    for dir_ in dirs:
+                        handle_exclusion(root, dir_)
+                    for file_ in files:
+                        handle_exclusion(root, file_)
+
+
+def get_defaults_state():
+    """Retrieve the saved default configuration state from default state file.
+
+    This function creates the directory for Kolla defaults if it does not
+    exist, and then attempts to read the current configuration state from
+    a JSON file. If the file exists, it reads and returns the content.
+    If not, it returns an empty dictionary.
+
+    Simply said, when the container starts for the first time, the state file
+    doesn't exist, and it returns an empty dictionary.
+    However, if it has already been started before, it will contain the state
+    as it was when it first ran.
+
+    Returns:
+        dict: The configuration state stored in the Kolla defaults state file.
+
+    Example:
+        {
+            "/etc/cinder/cinder.conf": {
+                "source": "/etc/cinder/cinder.conf",
+                "preserve_properties": true,
+                "dest": null
+            },
+            "/etc/apache2/conf-enabled/cinder-wsgi.conf": {
+                "source": "/etc/apache2/conf-enabled/cinder-wsgi.conf",
+                "preserve_properties": true,
+                "dest": null
+            },
+            "/etc/cinder/cinder_audit_map.conf": {
+                "source": "/etc/cinder/cinder_audit_map.conf",
+                "preserve_properties": true,
+                "dest": "/etc/kolla/defaults/etc/cinder/cinder_audit_map.conf"
+            }
+        }
+
+        From above example:
+        /etc/cinder/cinder.conf didn't exist
+        /etc/apache2/conf-enabled/cinder-wsgi.conf didn't exist
+        /etc/cinder/cinder_audit_map.conf exists and saved
+    """
+    os.makedirs(KOLLA_DEFAULTS, exist_ok=True)
+    if os.path.exists(KOLLA_DEFAULTS_STATE):
+        with open(KOLLA_DEFAULTS_STATE, 'r') as f:
+            return json.load(f)
+    else:
+        return {}
+
+
+def set_defaults_state(state):
+    """Save the provided configuration state to the defaults state file.
+
+    This function writes the provided state (a dictionary) to a JSON file at
+    the specified Kolla defaults state location, ensuring that it is properly
+    formatted with indentation for readability.
+
+    Args:
+        state (dict): The configuration state to save to the Kolla defaults
+        state file.
+    """
+    with open(KOLLA_DEFAULTS_STATE, 'w') as f:
+        json.dump(state, f, indent=4)
+
+
+def remove_or_restore_configs(state):
+    """Remove or restore configuration files based on their current state.
+
+    This function iterates over the configuration files in the provided state.
+    If the destination is `None`, it removes the file or directory. Otherwise,
+    it swaps the source and destination, restoring the configuration file
+    by copying it back to its original location.
+
+    Args:
+        state (dict): The current default state of configuration files, mapping
+        file paths to their source and destination information.
+    """
+    for k, v in state.items():
+        if v['dest'] is None:
+            if os.path.exists(k):
+                if os.path.isfile(k):
+                    os.remove(k)
+                else:
+                    shutil.rmtree(k)
+        else:
+            v['source'], v['dest'] = v['dest'], v['source']
+            config_file = ConfigFile(**v)
+            config_file.copy()
+
+
+def backup_configs(config, state):
+    """Back up new configuration files and update the default state.
+
+    This function processes new configuration files provided in the
+    input `config`. For each file, it checks if the destination exists in the
+    current state. If not, it backs up the file by copying it to the default
+    directory. It then updates the state with the new configuration file's
+    information.
+
+    Args:
+        config (dict): The input configuration containing a list of config
+                       files.
+        state (dict): The current default state to be updated with the new
+                      config files.
+    """
+    if 'config_files' in config:
+        for data in config['config_files']:
+            if data['dest'] in state.keys():
+                continue
+            src = data['source']
+            if data['dest'].endswith('/'):
+                dst = data['dest'] + data['source'].split('/')[-1]
+            else:
+                dst = data['dest']
+            default = KOLLA_DEFAULTS + dst
+            if os.path.exists(src):
+                copy = {'source': dst, 'preserve_properties': True}
+                if os.path.exists(dst):
+                    copy['dest'] = default
+                    if dst not in state:
+                        config_file = ConfigFile(**copy)
+                        config_file.copy()
+                        state[dst] = copy
+                else:
+                    copy['dest'] = None
+                    if dst not in state:
+                        state[dst] = copy
+
+
+def handle_defaults(config):
+    """Handle the default config files by copying/removing them as needed.
+
+    This function loads the current default state and manages the configuration
+    files. It first processes existing configuration files in the default
+    state, either removing or restoring them based on their destination status.
+    It then backs up any new configuration files from the input config,
+    updating the default state accordingly.
+
+    Args:
+        config (dict): A dictionary containing the list of configuration files
+        to be handled.
+    """
+    state = get_defaults_state()
+    remove_or_restore_configs(state)
+    backup_configs(config, state)
+    set_defaults_state(state)
+
+
+def execute_config_strategy(config):
+    config_strategy = os.environ.get("KOLLA_CONFIG_STRATEGY")
+    LOG.info("Kolla config strategy set to: %s", config_strategy)
+    if config_strategy == "COPY_ALWAYS":
+        create_directories(config)
+        create_files(config)
+        handle_defaults(config)
+        copy_config(config)
+        handle_permissions(config)
+    elif config_strategy == "COPY_ONCE":
+        if os.path.exists('/configured'):
+            raise ImmutableConfig(
+                "The config strategy prevents copying new configs",
+                exit_code=0)
+        else:
+            create_directories(config)
+            create_files(config)
+            handle_defaults(config)
+            copy_config(config)
+            handle_permissions(config)
+            os.mknod('/configured')
+    else:
+        raise InvalidConfig('KOLLA_CONFIG_STRATEGY is not set properly')
+
+
+def execute_command_check(config):
+    cmd = config.get('command')
+    with open("/run_command", "r") as f:
+        cmd_running = f.read()
+    if cmd != cmd_running:
+        msg = "Running command differs. " + cmd + " != " + cmd_running
+        raise ConfigFileCommandDiffers(msg)
+
+
+def execute_config_check(config):
+    """Check configuration state consistency and validate config file entries.
+
+    This function compares the current config file destinations from the
+    provided config dictionary with those stored in the defaults state file.
+    If any destinations are found in the state file but not in the config,
+    a StateMismatch exception is raised. These missing files would otherwise
+    be restored or removed depending on their backup state.
+
+    After validating consistency, the function performs standard checks on
+    each declared configuration file, including content, permissions, and
+    ownership validation.
+
+    Args:
+        config (dict): The configuration dictionary containing 'config_files'
+        entries as expected by Kolla.
+
+    Raises:
+        StateMismatch: If there are entries in the defaults state not present
+        in the provided config.
+    """
+    state = get_defaults_state()
+
+    # Build a set of all current destination paths from the config
+    # If the destination is a directory, we append the
+    # basename of the source
+    current_dests = {
+        entry['dest'] if not entry['dest'].endswith('/') else
+        os.path.join(entry['dest'], os.path.basename(entry['source']))
+        for entry in config.get('config_files', [])
+        if entry.get('dest')
+    }
+
+    # Detect any paths that are present in the state file but
+    # missing from the config file.
+    # These would be either restored (if state[dest] has a backup)
+    # or removed (if dest is null)
+    removed_dests = [
+        path for path in state.keys()
+        if path not in current_dests
+    ]
+
+    if removed_dests:
+        raise StateMismatch(
+            f"The following config files are tracked in state but missing "
+            f"from the config file. "
+            f"They would be restored or removed: {sorted(removed_dests)}"
+        )
+
+    # Perform the regular content, permissions, and ownership
+    # checks on the declared files
+    for data in config.get('config_files', []):
+        config_file = ConfigFile(**data)
+        config_file.check()
+
+
+def main():
+    try:
+        parser = argparse.ArgumentParser()
+        parser.add_argument('--check',
+                            action='store_true',
+                            required=False,
+                            help='Check whether the configs changed')
+        args = parser.parse_args()
+        config = load_config()
+
+        if args.check:
+            execute_command_check(config)
+            execute_config_check(config)
+        else:
+            execute_config_strategy(config)
+    except ExitingException as e:
+        LOG.error("%s: %s", e.__class__.__name__, e)
+        return e.exit_code
+    except Exception:
+        LOG.exception('Unexpected error:')
+        return 2
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/kolla/docker/base/sources.list b/kolla/docker/base/sources.list
new file mode 100644
index 000000000..1acbbcb59
--- /dev/null
+++ b/kolla/docker/base/sources.list
@@ -0,0 +1 @@
+# used for adding custom repos by 'apt_sources_list' option of kolla-build.conf
diff --git a/kolla/docker/base/start.sh b/kolla/docker/base/start.sh
new file mode 100644
index 000000000..7ac505aea
--- /dev/null
+++ b/kolla/docker/base/start.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+set -o errexit
+set -o pipefail
+set -o nounset
+set -o xtrace
+
+# Processing /var/lib/kolla/config_files/config.json as root.  This is necessary
+# to permit certain files to be controlled by the root user which should
+# not be writable by the dropped-privileged user, especially /run_command
+sudo -E kolla_set_configs
+CMD=$(cat /run_command)
+ARGS=""
+
+# Install/remove custom CA certificates
+sudo kolla_copy_cacerts
+
+# Install projects that are in /dev-mode
+sudo kolla_install_projects
+
+if [[ ! "${!KOLLA_SKIP_EXTEND_START[@]}" ]]; then
+    # Run additional commands if present
+    . kolla_extend_start
+fi
+
+echo "Running command: '${CMD}${ARGS:+ $ARGS}'"
+exec ${CMD} ${ARGS}
diff --git a/kolla/docker/base/sudoers b/kolla/docker/base/sudoers
new file mode 100644
index 000000000..eb31bc98b
--- /dev/null
+++ b/kolla/docker/base/sudoers
@@ -0,0 +1,26 @@
+# The idea here is a container service adds their UID to the kolla group
+# via usermod -a -G kolla <uid>.  Then the kolla_start may run
+# kolla_set_configs via sudo as the root user which is necessary to protect
+# the immutability of the container
+
+# anyone in the kolla group may sudo -E (set the environment)
+Defaults: %kolla setenv
+
+Defaults secure_path="/var/lib/kolla/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+
+# root may run any commands via sudo as the network seervice user.  This is
+# neededfor database migrations of existing services which have not been
+# converted to run as a non-root user, but instead do that via sudo -E glance
+root ALL=(ALL) ALL
+
+# anyone in the kolla group may run /usr/local/bin/kolla_set_configs as the
+# root user via sudo without password confirmation
+%kolla ALL=(root) NOPASSWD: /usr/local/bin/kolla_set_configs
+
+# Copy custom CA certificates to containers
+%kolla ALL=(root) NOPASSWD: /usr/local/bin/kolla_copy_cacerts
+
+# Install projects in dev-mode
+%kolla ALL=(root) NOPASSWD: /usr/local/bin/kolla_install_projects
+
+#includedir /etc/sudoers.d
diff --git a/kolla/docker/base/ubuntu.sources b/kolla/docker/base/ubuntu.sources
new file mode 100644
index 000000000..f8f609cee
--- /dev/null
+++ b/kolla/docker/base/ubuntu.sources
@@ -0,0 +1,24 @@
+Types: deb
+URIs: http://archive.ubuntu.com/ubuntu/
+Suites: noble noble-updates noble-backports
+Components: main universe
+Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+
+## Ubuntu security updates. Aside from URIs and Suites,
+## this should mirror your choices in the previous section.
+Types: deb
+URIs: http://security.ubuntu.com/ubuntu/
+Suites: noble-security
+Components: main universe
+Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+
+## Ubuntu Cloud Archive
+Types: deb
+URIs: http://ubuntu-cloud.archive.canonical.com/ubuntu
+Suites: noble-updates/gazpacho
+Components: main
+Signed-By: /usr/share/keyrings/ubuntu-cloud-keyring.gpg
+
+# NOTE(hrw): extra repositories are added into image when they are needed as
+# separate files in /etc/apt/sources.list.d/ directory. For that purpose they
+# are defined in kolla/template/repos.yaml file.
diff --git a/kolla/docker/base/ubuntu.sources.arm64 b/kolla/docker/base/ubuntu.sources.arm64
new file mode 100644
index 000000000..751af7ccf
--- /dev/null
+++ b/kolla/docker/base/ubuntu.sources.arm64
@@ -0,0 +1,24 @@
+Types: deb
+URIs: http://ports.ubuntu.com/ubuntu-ports/
+Suites: noble noble-updates noble-backports
+Components: main universe
+Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+
+## Ubuntu security updates. Aside from URIs and Suites,
+## this should mirror your choices in the previous section.
+Types: deb
+URIs: http://ports.ubuntu.com/ubuntu-ports/
+Suites: noble-security
+Components: main universe
+Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+
+## Ubuntu Cloud Archive
+Types: deb
+URIs: http://ubuntu-cloud.archive.canonical.com/ubuntu
+Suites: noble-updates/gazpacho
+Components: main
+Signed-By: /usr/share/keyrings/ubuntu-cloud-keyring.gpg
+
+# NOTE(hrw): extra repositories are added into image when they are needed as
+# separate files in /etc/apt/sources.list.d/ directory. For that purpose they
+# are defined in kolla/template/repos.yaml file.
diff --git a/kolla/docker/bifrost/bifrost-base/Dockerfile.j2 b/kolla/docker/bifrost/bifrost-base/Dockerfile.j2
new file mode 100644
index 000000000..3e82a9fd3
--- /dev/null
+++ b/kolla/docker/bifrost/bifrost-base/Dockerfile.j2
@@ -0,0 +1,76 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block bifrost_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set venv_path='/var/lib/kolla/venv' %}
+
+{{ macros.configure_user(name='bifrost') }}
+
+{% set bifrost_base_packages = [
+    'cpio'
+] %}
+
+{% if base_package_type == 'rpm' %}
+
+{# NOTE(mgoddard): EPEL required for nginx #}
+{{ macros.enable_extra_repos(['epel']) }}
+{% endif %}
+
+{{ macros.install_packages(bifrost_base_packages | customizable("packages")) }}
+
+ENV VENV {{ venv_path }}
+
+{% set bifrost_base_pip_packages = [
+    '/bifrost'
+] %}
+
+ADD bifrost-base-archive /bifrost-base-source
+COPY build_arg.yml /tmp/build_arg.yml
+
+RUN mkdir -p /requirements \
+    && curl -o /requirements/upper-constraints.txt ${UPPER_CONSTRAINTS_FILE:-https://releases.openstack.org/constraints/upper/{{ openstack_release }}} \
+    && python3 -m venv --system-site-packages {{ venv_path }} \
+    && ln -s bifrost-base-source/* bifrost \
+    && {{ macros.install_pip(['pip', 'wheel', 'setuptools']) }} \
+    && {{ macros.install_pip(bifrost_base_pip_packages | customizable("pip_packages")) }}
+
+WORKDIR /bifrost
+
+{# ANSIBLE_GATHER_TIMEOUT is a workaround for https://github.com/ansible/ansible/issues/43884 #}
+ENV ANSIBLE_GATHER_TIMEOUT=30
+
+{% block bifrost_ansible_install %}
+{%- if base_package_type == 'deb' %}
+RUN apt-get --error-on=any update && \
+{%- else %}
+RUN echo " " && \
+{%- endif %}
+    bash -c '$VENV/bin/pip install "ansible>=12,<14" && \
+    $VENV/bin/ansible-galaxy collection install -r /bifrost/ansible-collections-requirements.yml && \
+    $VENV/bin/ansible-playbook -vvvv -i /bifrost/playbooks/inventory/target \
+    /bifrost/playbooks/install.yaml \
+    -e upper_constraints_file="/requirements/upper-constraints.txt" \
+    -e git_branch={{ openstack_branch_slashed }} \
+    -e ipa_upstream_release={{ openstack_branch }} \
+    -e @/tmp/build_arg.yml && \
+{%- if base_package_type == 'deb' %}
+    apt-get clean && rm -rf /var/lib/apt/lists/*'
+{%- else %}
+    dnf clean all && rm -rf /var/dnf/cache'
+{%- endif %}
+{% endblock %}
+
+COPY bifrost_sudoers /etc/sudoers.d/kolla_bifrost_sudoers
+
+RUN chmod 750 /etc/sudoers.d \
+    && chmod 440 /etc/sudoers.d/kolla_bifrost_sudoers \
+    && chown -R bifrost:bifrost /bifrost
+
+{{ macros.kolla_patch_sources() }}
+
+{% block bifrost_base_footer %}{% endblock %}
diff --git a/kolla/docker/bifrost/bifrost-base/bifrost_sudoers b/kolla/docker/bifrost/bifrost-base/bifrost_sudoers
new file mode 100644
index 000000000..6c343a956
--- /dev/null
+++ b/kolla/docker/bifrost/bifrost-base/bifrost_sudoers
@@ -0,0 +1 @@
+bifrost ALL=(ALL) NOPASSWD:ALL
diff --git a/kolla/docker/bifrost/bifrost-base/build_arg.yml b/kolla/docker/bifrost/bifrost-base/build_arg.yml
new file mode 100644
index 000000000..8c810f133
--- /dev/null
+++ b/kolla/docker/bifrost/bifrost-base/build_arg.yml
@@ -0,0 +1,7 @@
+---
+skip_bootstrap: true
+skip_start: true
+install_dib: true
+create_image_via_dib: false
+ansible_python_interpreter: /var/lib/kolla/venv/bin/python
+internal_ip: "127.0.0.1"
diff --git a/kolla/docker/bifrost/bifrost-deploy/Dockerfile.j2 b/kolla/docker/bifrost/bifrost-deploy/Dockerfile.j2
new file mode 100644
index 000000000..04fc733fc
--- /dev/null
+++ b/kolla/docker/bifrost/bifrost-deploy/Dockerfile.j2
@@ -0,0 +1,35 @@
+FROM {{ namespace }}/{{ image_prefix }}bifrost-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block bifrost_deploy_header %}{% endblock %}
+
+ENV container docker
+
+{% import "macros.j2" as macros with context %}
+
+RUN rm -f $(find /lib/systemd/system/sysinit.target.wants/ ! -name systemd-tmpfiles-setup.service -type l); \
+    rm -f /lib/systemd/system/multi-user.target.wants/*; \
+    rm -f /etc/systemd/system/*.wants/*; \
+    rm -f /lib/systemd/system/local-fs.target.wants/*; \
+    rm -f /lib/systemd/system/sockets.target.wants/*udev*; \
+    rm -f /lib/systemd/system/sockets.target.wants/*initctl*; \
+    rm -f /lib/systemd/system/basic.target.wants/*; \
+    rm -f /lib/systemd/system/anaconda.target.wants/*;
+
+{% set bifrost_deploy_packages = [
+    'e2fsprogs',
+    'systemd-sysv',
+] %}
+
+{{ macros.install_packages(bifrost_deploy_packages | customizable("packages")) }}
+
+# Clear any customisation by Kolla to entrypoint & command
+ENTRYPOINT []
+CMD [ "/sbin/init" ]
+
+{{ macros.kolla_patch_sources() }}
+
+{% block bifrost_deploy_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/blazar/blazar-api/Dockerfile.j2 b/kolla/docker/blazar/blazar-api/Dockerfile.j2
new file mode 100644
index 000000000..70d6ba22a
--- /dev/null
+++ b/kolla/docker/blazar/blazar-api/Dockerfile.j2
@@ -0,0 +1,18 @@
+FROM {{ namespace }}/{{ image_prefix }}blazar-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block blazar_api_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+COPY extend_start.sh /usr/local/bin/kolla_blazar_extend_start
+RUN chmod 644 /usr/local/bin/kolla_blazar_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block blazar_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER blazar
diff --git a/kolla/docker/blazar/blazar-api/extend_start.sh b/kolla/docker/blazar/blazar-api/extend_start.sh
new file mode 100644
index 000000000..ff4f2b801
--- /dev/null
+++ b/kolla/docker/blazar/blazar-api/extend_start.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    blazar-db-manage --config-file /etc/blazar/blazar.conf upgrade head
+    exit 0
+fi
diff --git a/kolla/docker/blazar/blazar-base/Dockerfile.j2 b/kolla/docker/blazar/blazar-base/Dockerfile.j2
new file mode 100644
index 000000000..433842e41
--- /dev/null
+++ b/kolla/docker/blazar/blazar-base/Dockerfile.j2
@@ -0,0 +1,29 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block blazar_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='blazar') }}
+
+ADD blazar-base-archive /blazar-base-source
+
+{% set blazar_base_pip_packages = [
+    '/blazar'
+] %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN ln -s blazar-base-source/* blazar \
+    && {{ macros.install_pip(blazar_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/blazar \
+    && cp -r /blazar/etc/blazar/* /etc/blazar \
+    && touch /usr/local/bin/kolla_blazar_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_blazar_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block blazar_base_footer %}{% endblock %}
diff --git a/kolla/docker/blazar/blazar-base/extend_start.sh b/kolla/docker/blazar/blazar-base/extend_start.sh
new file mode 100644
index 000000000..a96a4c113
--- /dev/null
+++ b/kolla/docker/blazar/blazar-base/extend_start.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/blazar" ]]; then
+    mkdir -p /var/log/kolla/blazar
+fi
+if [[ $(stat -c %a /var/log/kolla/blazar) != "755" ]]; then
+    chmod 755 /var/log/kolla/blazar
+fi
+
+. /usr/local/bin/kolla_blazar_extend_start
diff --git a/kolla/docker/blazar/blazar-manager/Dockerfile.j2 b/kolla/docker/blazar/blazar-manager/Dockerfile.j2
new file mode 100644
index 000000000..5cde3db3b
--- /dev/null
+++ b/kolla/docker/blazar/blazar-manager/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}blazar-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block blazar_manager_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block blazar_manager_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER blazar
diff --git a/kolla/docker/ceilometer/ceilometer-base/Dockerfile.j2 b/kolla/docker/ceilometer/ceilometer-base/Dockerfile.j2
new file mode 100644
index 000000000..18bd7600a
--- /dev/null
+++ b/kolla/docker/ceilometer/ceilometer-base/Dockerfile.j2
@@ -0,0 +1,43 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block ceilometer_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='ceilometer') }}
+
+{% set ceilometer_base_pip_packages = [
+    '/ceilometer'
+] %}
+
+{% set ceilometer_base_plugins_pip_packages = [
+    '/plugins/*'
+] %}
+
+ADD ceilometer-base-archive /ceilometer-base-source
+ADD plugins-archive /
+
+COPY ceilometer_sudoers /etc/sudoers.d/kolla_ceilometer_sudoers
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+# NOTE(egonzalez): Remove ceilometer from constraint or will fail.
+RUN ln -s ceilometer-base-source/* ceilometer \
+    && {{ macros.upper_constraints_remove("ceilometer") }} \
+    && {{ macros.install_pip(ceilometer_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/ceilometer \
+    && cp -r /ceilometer/etc/ceilometer/* /etc/ceilometer/ \
+    && sed -i 's|^exec_dirs.*|exec_dirs=/var/lib/kolla/venv/bin,/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/bin,/usr/local/sbin|g' /etc/ceilometer/rootwrap.conf \
+    && if [ "$(ls /plugins)" ]; then \
+        {{ macros.install_pip(ceilometer_base_plugins_pip_packages) }}; \
+    fi \
+    && chmod 750 /etc/sudoers.d \
+    && chmod 440 /etc/sudoers.d/kolla_ceilometer_sudoers \
+    && touch /usr/local/bin/kolla_ceilometer_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_ceilometer_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block ceilometer_base_footer %}{% endblock %}
diff --git a/kolla/docker/ceilometer/ceilometer-base/ceilometer_sudoers b/kolla/docker/ceilometer/ceilometer-base/ceilometer_sudoers
new file mode 100644
index 000000000..dd861bb58
--- /dev/null
+++ b/kolla/docker/ceilometer/ceilometer-base/ceilometer_sudoers
@@ -0,0 +1 @@
+%kolla ALL=(root) NOPASSWD: /usr/bin/chown -R ceilometer\: /var/lib/ceilometer/, /bin/chown -R ceilometer\: /var/lib/ceilometer/
diff --git a/kolla/docker/ceilometer/ceilometer-base/extend_start.sh b/kolla/docker/ceilometer/ceilometer-base/extend_start.sh
new file mode 100644
index 000000000..4d3fe6b61
--- /dev/null
+++ b/kolla/docker/ceilometer/ceilometer-base/extend_start.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+CEILOMETER_LOG_DIR=/var/log/kolla/ceilometer
+
+if [[ ! -d "${CEILOMETER_LOG_DIR}" ]]; then
+    mkdir -p "${CEILOMETER_LOG_DIR}"
+fi
+if [[ $(stat -c %U:%G "${CEILOMETER_LOG_DIR}") != "ceilometer:kolla" ]]; then
+    chown ceilometer:kolla "${CEILOMETER_LOG_DIR}"
+fi
+if [[ $(stat -c %a "${CEILOMETER_LOG_DIR}") != "755" ]]; then
+    chmod 755 "${CEILOMETER_LOG_DIR}"
+fi
+
+. /usr/local/bin/kolla_ceilometer_extend_start
diff --git a/kolla/docker/ceilometer/ceilometer-central/Dockerfile.j2 b/kolla/docker/ceilometer/ceilometer-central/Dockerfile.j2
new file mode 100644
index 000000000..df96d8ed3
--- /dev/null
+++ b/kolla/docker/ceilometer/ceilometer-central/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}ceilometer-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block ceilometer_central_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block ceilometer_central_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER ceilometer
diff --git a/kolla/docker/ceilometer/ceilometer-compute/Dockerfile.j2 b/kolla/docker/ceilometer/ceilometer-compute/Dockerfile.j2
new file mode 100644
index 000000000..879c4fb01
--- /dev/null
+++ b/kolla/docker/ceilometer/ceilometer-compute/Dockerfile.j2
@@ -0,0 +1,34 @@
+FROM {{ namespace }}/{{ image_prefix }}ceilometer-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block ceilometer_compute_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+    {% set ceilometer_compute_packages = [
+        'python3-libvirt'
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set ceilometer_compute_packages = [
+        'python3-libvirt'
+    ] %}
+{% endif %}
+
+{{ macros.install_packages(ceilometer_compute_packages | customizable("packages")) }}
+
+# NOTE(jeffrey4l): just for back compatibility
+{% set ceilometer_compute_pip_packages = [] %}
+
+RUN {{ macros.install_pip(ceilometer_compute_pip_packages | customizable("pip_packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block ceilometer_compute_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+# NOTE(huikang): non-root user does not work with libvirt.sock.
+#                Need configuration in nova-libvirt container to allow
+#                USER ceilometer to access libvirt.sock
diff --git a/kolla/docker/ceilometer/ceilometer-ipmi/Dockerfile.j2 b/kolla/docker/ceilometer/ceilometer-ipmi/Dockerfile.j2
new file mode 100644
index 000000000..a767dc842
--- /dev/null
+++ b/kolla/docker/ceilometer/ceilometer-ipmi/Dockerfile.j2
@@ -0,0 +1,27 @@
+FROM {{ namespace }}/{{ image_prefix }}ceilometer-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block ceilometer_ipmi_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+    {% set ceilometer_ipmi_packages = [
+        'ipmitool'
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set ceilometer_ipmi_packages = [
+        'ipmitool'
+    ] %}
+{% endif %}
+
+{{ macros.install_packages(ceilometer_ipmi_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block ceilometer_ipmi_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER ceilometer
diff --git a/kolla/docker/ceilometer/ceilometer-notification/Dockerfile.j2 b/kolla/docker/ceilometer/ceilometer-notification/Dockerfile.j2
new file mode 100644
index 000000000..1fc03ffc4
--- /dev/null
+++ b/kolla/docker/ceilometer/ceilometer-notification/Dockerfile.j2
@@ -0,0 +1,18 @@
+FROM {{ namespace }}/{{ image_prefix }}ceilometer-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block ceilometer_notification_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+COPY extend_start.sh /usr/local/bin/kolla_ceilometer_extend_start
+RUN chmod 644 /usr/local/bin/kolla_ceilometer_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block ceilometer_notification_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER ceilometer
diff --git a/kolla/docker/ceilometer/ceilometer-notification/extend_start.sh b/kolla/docker/ceilometer/ceilometer-notification/extend_start.sh
new file mode 100644
index 000000000..0abeeb1e1
--- /dev/null
+++ b/kolla/docker/ceilometer/ceilometer-notification/extend_start.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    if [[ "${CEILOMETER_DATABASE_TYPE}" == "gnocchi" ]]; then
+        ceilometer-upgrade ${CEILOMETER_UPGRADE_PARAMS}
+    fi
+    sudo chown -R ceilometer: /var/lib/ceilometer/
+    exit 0
+fi
diff --git a/kolla/docker/cinder/cinder-api/Dockerfile.j2 b/kolla/docker/cinder/cinder-api/Dockerfile.j2
new file mode 100644
index 000000000..b82fba6d3
--- /dev/null
+++ b/kolla/docker/cinder/cinder-api/Dockerfile.j2
@@ -0,0 +1,22 @@
+FROM {{ namespace }}/{{ image_prefix }}cinder-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block cinder_api_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set cinder_api_packages = [
+] %}
+
+{{ macros.install_packages(cinder_api_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_cinder_extend_start
+
+RUN chmod 644 /usr/local/bin/kolla_cinder_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block cinder_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/cinder/cinder-api/extend_start.sh b/kolla/docker/cinder/cinder-api/extend_start.sh
new file mode 100644
index 000000000..94b0fe875
--- /dev/null
+++ b/kolla/docker/cinder/cinder-api/extend_start.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+set -o errexit
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    cinder-manage db sync
+    exit 0
+fi
+
+if [[ "${!KOLLA_OSM[@]}" ]]; then
+    cinder-manage db online_data_migrations
+    exit 0
+fi
diff --git a/kolla/docker/cinder/cinder-backup/Dockerfile.j2 b/kolla/docker/cinder/cinder-backup/Dockerfile.j2
new file mode 100644
index 000000000..15be355dd
--- /dev/null
+++ b/kolla/docker/cinder/cinder-backup/Dockerfile.j2
@@ -0,0 +1,33 @@
+FROM {{ namespace }}/{{ image_prefix }}cinder-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block cinder_backup_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+    {% set cinder_backup_packages = [
+        'device-mapper-multipath',
+        'lsscsi',
+        'nfs-utils',
+        'sysfsutils'
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set cinder_backup_packages = [
+        'lsscsi',
+        'multipath-tools',
+        'nfs-common',
+        'sysfsutils'
+    ] %}
+{% endif %}
+
+{{ macros.install_packages(cinder_backup_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block cinder_backup_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER cinder
diff --git a/kolla/docker/cinder/cinder-base/Dockerfile.j2 b/kolla/docker/cinder/cinder-base/Dockerfile.j2
new file mode 100644
index 000000000..bd25d9b18
--- /dev/null
+++ b/kolla/docker/cinder/cinder-base/Dockerfile.j2
@@ -0,0 +1,60 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block cinder_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='cinder') }}
+
+{% if base_package_type == 'rpm' %}
+
+{{ macros.enable_extra_repos(['ceph', 'epel']) }}
+
+    {% set cinder_base_packages = [
+        'ceph-common',
+        'cryptsetup',
+        'lvm2',
+        'nvme-cli',
+        'qemu-img',
+        'systemd-udev'
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set cinder_base_packages = [
+        'ceph-common',
+        'cryptsetup',
+        'lvm2',
+        'nvme-cli',
+        'python3-cephfs',
+        'python3-rados',
+        'python3-rbd',
+        'qemu-utils'
+    ] %}
+{% endif %}
+{{ macros.install_packages(cinder_base_packages | customizable("packages")) }}
+
+{% set cinder_base_pip_packages = [
+    '/cinder'
+] %}
+
+ADD cinder-base-archive /cinder-base-source
+
+COPY cinder_sudoers /etc/sudoers.d/kolla_cinder_sudoers
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN ln -s cinder-base-source/* cinder \
+    && {{ macros.install_pip(cinder_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/cinder \
+    && cp -r /cinder/etc/cinder/* /etc/cinder/ \
+    && cp /var/lib/kolla/venv/etc/pycadf/cinder_api_audit_map.conf /etc/cinder/ \
+    && sed -i 's|^exec_dirs.*|exec_dirs=/var/lib/kolla/venv/bin,/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/bin,/usr/local/sbin|g' /etc/cinder/rootwrap.conf \
+    && chmod 750 /etc/sudoers.d \
+    && chmod 440 /etc/sudoers.d/kolla_cinder_sudoers \
+    && touch /usr/local/bin/kolla_cinder_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_cinder_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block cinder_base_footer %}{% endblock %}
diff --git a/kolla/docker/cinder/cinder-base/cinder_sudoers b/kolla/docker/cinder/cinder-base/cinder_sudoers
new file mode 100644
index 000000000..3750f31a0
--- /dev/null
+++ b/kolla/docker/cinder/cinder-base/cinder_sudoers
@@ -0,0 +1 @@
+cinder ALL = (root) NOPASSWD: /var/lib/kolla/venv/bin/cinder-rootwrap /etc/cinder/rootwrap.conf *
diff --git a/kolla/docker/cinder/cinder-base/extend_start.sh b/kolla/docker/cinder/cinder-base/extend_start.sh
new file mode 100644
index 000000000..ddf1469c9
--- /dev/null
+++ b/kolla/docker/cinder/cinder-base/extend_start.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/cinder" ]]; then
+    mkdir -p /var/log/kolla/cinder
+fi
+if [[ $(stat -c %U:%G /var/log/kolla/cinder) != "cinder:kolla" ]]; then
+    chown -R cinder:kolla /var/log/kolla/cinder
+fi
+if [[ $(stat -c %a /var/log/kolla/cinder) != "755" ]]; then
+    chmod 755 /var/log/kolla/cinder
+fi
+
+. /usr/local/bin/kolla_cinder_extend_start
diff --git a/kolla/docker/cinder/cinder-scheduler/Dockerfile.j2 b/kolla/docker/cinder/cinder-scheduler/Dockerfile.j2
new file mode 100644
index 000000000..c43792dcc
--- /dev/null
+++ b/kolla/docker/cinder/cinder-scheduler/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}cinder-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block cinder_scheduler_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block cinder_scheduler_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER cinder
diff --git a/kolla/docker/cinder/cinder-volume/Dockerfile.j2 b/kolla/docker/cinder/cinder-volume/Dockerfile.j2
new file mode 100644
index 000000000..0e4f38a6e
--- /dev/null
+++ b/kolla/docker/cinder/cinder-volume/Dockerfile.j2
@@ -0,0 +1,58 @@
+FROM {{ namespace }}/{{ image_prefix }}cinder-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block cinder_volume_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+    {% set cinder_volume_packages = [
+        'lsscsi',
+        'device-mapper-multipath',
+        'nfs-utils',
+        'nvmetcli',
+        'sysfsutils',
+        'targetcli'
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set cinder_volume_packages = [
+        'lsscsi',
+        'multipath-tools',
+        'nfs-common',
+        'sysfsutils',
+        'targetcli-fb',
+        'thin-provisioning-tools',
+        'tgt'
+    ] %}
+{% endif %}
+
+{{ macros.install_packages(cinder_volume_packages | customizable("packages")) }}
+
+{% if base_package_type == 'rpm' %}
+
+{% block cinder_volume_redhat_setup %}
+{% endblock %}
+
+{% elif base_package_type == 'deb' %}
+
+{% block cinder_volume_ubuntu_setup %}
+RUN sed -i '1 i include /var/lib/cinder/volumes/*' /etc/tgt/targets.conf
+{% endblock %}
+
+{% endif %}
+
+COPY cinder_sudoers /etc/sudoers.d/kolla_cinder_volume_sudoers
+COPY extend_start.sh /usr/local/bin/kolla_cinder_extend_start
+
+RUN chmod 750 /etc/sudoers.d \
+    && chmod 440 /etc/sudoers.d/kolla_cinder_volume_sudoers \
+    && chmod 644 /usr/local/bin/kolla_cinder_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block cinder_volume_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER cinder
diff --git a/kolla/docker/cinder/cinder-volume/cinder_sudoers b/kolla/docker/cinder/cinder-volume/cinder_sudoers
new file mode 100644
index 000000000..f3bec8b13
--- /dev/null
+++ b/kolla/docker/cinder/cinder-volume/cinder_sudoers
@@ -0,0 +1,5 @@
+cinder ALL = (root) NOPASSWD: /var/lib/kolla/venv/bin/cinder-rootwrap /etc/cinder/rootwrap.conf *
+%kolla ALL=(root) NOPASSWD: /bin/chown -R cinder\:kolla /var/lib/cinder, /usr/bin/chown -R cinder\:kolla /var/lib/cinder
+%kolla ALL=(root) NOPASSWD: /bin/chmod 2775 /var/lib/cinder, /usr/bin/chmod 2775 /var/lib/cinder
+%kolla ALL=(root) NOPASSWD: /bin/chown -R cinder\:kolla /etc/iscsi, /usr/bin/chown -R cinder\:kolla /etc/iscsi
+%kolla ALL=(root) NOPASSWD: /bin/chmod 2775 /etc/iscsi, /usr/bin/chmod 2775 /etc/iscsi
diff --git a/kolla/docker/cinder/cinder-volume/extend_start.sh b/kolla/docker/cinder/cinder-volume/extend_start.sh
new file mode 100644
index 000000000..67e866143
--- /dev/null
+++ b/kolla/docker/cinder/cinder-volume/extend_start.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+if [[ $(stat -c %U:%G /var/lib/cinder) != "cinder:kolla" ]]; then
+    sudo chown -R cinder:kolla /var/lib/cinder
+fi
+if [[ $(stat -c %a /var/lib/cinder) != "2775" ]]; then
+    sudo chmod 2775 /var/lib/cinder
+fi
+if [[ $(stat -c %U:%G /etc/iscsi) != "cinder:kolla" ]]; then
+    sudo chown -R cinder:kolla /etc/iscsi
+fi
+if [[ $(stat -c %a /etc/iscsi) != "2775" ]]; then
+    sudo chmod 2775 /etc/iscsi
+fi
diff --git a/kolla/docker/cloudkitty/cloudkitty-api/Dockerfile.j2 b/kolla/docker/cloudkitty/cloudkitty-api/Dockerfile.j2
new file mode 100644
index 000000000..fd3d124f3
--- /dev/null
+++ b/kolla/docker/cloudkitty/cloudkitty-api/Dockerfile.j2
@@ -0,0 +1,21 @@
+FROM {{ namespace }}/{{ image_prefix }}cloudkitty-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block cloudkitty_api_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set cloudkitty_api_packages = [
+] %}
+
+{{ macros.install_packages(cloudkitty_api_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_cloudkitty_extend_start
+RUN chmod 644 /usr/local/bin/kolla_cloudkitty_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block cloudkitty_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/cloudkitty/cloudkitty-api/extend_start.sh b/kolla/docker/cloudkitty/cloudkitty-api/extend_start.sh
new file mode 100644
index 000000000..26d4a8c36
--- /dev/null
+++ b/kolla/docker/cloudkitty/cloudkitty-api/extend_start.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    cloudkitty-dbsync upgrade
+    cloudkitty-storage-init
+    exit 0
+fi
diff --git a/kolla/docker/cloudkitty/cloudkitty-base/Dockerfile.j2 b/kolla/docker/cloudkitty/cloudkitty-base/Dockerfile.j2
new file mode 100644
index 000000000..b545d4adf
--- /dev/null
+++ b/kolla/docker/cloudkitty/cloudkitty-base/Dockerfile.j2
@@ -0,0 +1,29 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block cloudkitty_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='cloudkitty') }}
+
+{% set cloudkitty_base_pip_packages = [
+    '/cloudkitty'
+] %}
+
+ADD cloudkitty-base-archive /cloudkitty-base-source
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN ln -s cloudkitty-base-source/* cloudkitty \
+    && {{ macros.install_pip(cloudkitty_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/cloudkitty  \
+    && cp -r /cloudkitty/etc/cloudkitty/* /etc/cloudkitty/ \
+    && touch /usr/local/bin/kolla_cloudkitty_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_cloudkitty_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block cloudkitty_base_footer %}{% endblock %}
diff --git a/kolla/docker/cloudkitty/cloudkitty-base/extend_start.sh b/kolla/docker/cloudkitty/cloudkitty-base/extend_start.sh
new file mode 100644
index 000000000..cf49f9caf
--- /dev/null
+++ b/kolla/docker/cloudkitty/cloudkitty-base/extend_start.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/cloudkitty" ]]; then
+    mkdir -p /var/log/kolla/cloudkitty
+fi
+if [[ $(stat -c %a /var/log/kolla/cloudkitty) != "755" ]]; then
+    chmod 755 /var/log/kolla/cloudkitty
+fi
+
+. /usr/local/bin/kolla_cloudkitty_extend_start
diff --git a/kolla/docker/cloudkitty/cloudkitty-processor/Dockerfile.j2 b/kolla/docker/cloudkitty/cloudkitty-processor/Dockerfile.j2
new file mode 100644
index 000000000..33f30fd33
--- /dev/null
+++ b/kolla/docker/cloudkitty/cloudkitty-processor/Dockerfile.j2
@@ -0,0 +1,20 @@
+FROM {{ namespace }}/{{ image_prefix }}cloudkitty-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block cloudkitty_processor_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set cloudkitty_processor_packages = [
+] %}
+
+{{ macros.install_packages(cloudkitty_processor_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block cloudkitty_processor_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER cloudkitty
diff --git a/kolla/docker/collectd/Dockerfile.j2 b/kolla/docker/collectd/Dockerfile.j2
new file mode 100644
index 000000000..32ded377e
--- /dev/null
+++ b/kolla/docker/collectd/Dockerfile.j2
@@ -0,0 +1,81 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block collectd_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='collectd') }}
+
+{% set collectd_packages = [
+    'collectd'
+] %}
+
+{% if base_package_type == 'rpm' %}
+
+{{ macros.enable_extra_repos(['opstools']) }}
+
+  {% set collectd_packages = collectd_packages + [
+      'collectd-amqp',
+      'collectd-amqp1',
+      'collectd-apache',
+      'collectd-bind',
+      'collectd-ceph',
+      'collectd-chrony',
+      'collectd-connectivity',
+      'collectd-curl',
+      'collectd-curl_json',
+      'collectd-curl_xml',
+      'collectd-dbi',
+      'collectd-disk',
+      'collectd-dns',
+      'collectd-ipmi',
+      'collectd-logparser',
+      'collectd-mcelog',
+      'collectd-mysql',
+      'collectd-netlink',
+      'collectd-openldap',
+      'collectd-ovs-events',
+      'collectd-ovs-stats',
+      'collectd-ping',
+      'collectd-procevent',
+      'collectd-python',
+      'collectd-sensors',
+      'collectd-smart',
+      'collectd-snmp',
+      'collectd-snmp-agent',
+      'collectd-sysevent',
+      'collectd-utils',
+      'collectd-virt',
+      'collectd-write_http',
+      'collectd-write_kafka',
+      'collectd-write_prometheus',
+  ] %}
+
+  {% if base_arch =='x86_64' %}
+      {% set collectd_packages = collectd_packages + [
+        'collectd-hugepages',
+        'collectd-pcie-errors',
+        'collectd-pmu',
+        'collectd-rdt',
+        'collectd-turbostat'
+      ] %}
+  {% endif %}
+
+{% endif %}
+
+{{ macros.install_packages(collectd_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start \
+    && chown -R collectd /var/lib/collectd \
+    && chown -R collectd /var/run/
+
+{{ macros.kolla_patch_sources() }}
+
+{% block collectd_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER collectd
diff --git a/kolla/docker/collectd/extend_start.sh b/kolla/docker/collectd/extend_start.sh
new file mode 100644
index 000000000..80ef63db3
--- /dev/null
+++ b/kolla/docker/collectd/extend_start.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/collectd" ]]; then
+    mkdir -p /var/log/kolla/collectd
+fi
+if [[ $(stat -c %a /var/log/kolla/collectd) != "755" ]]; then
+    chmod 755 /var/log/kolla/collectd
+fi
diff --git a/kolla/docker/cron/Dockerfile.j2 b/kolla/docker/cron/Dockerfile.j2
new file mode 100644
index 000000000..d3a9213ac
--- /dev/null
+++ b/kolla/docker/cron/Dockerfile.j2
@@ -0,0 +1,35 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block cron_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+    {% set cron_packages = [
+        'cronie',
+        'logrotate'
+    ] %}
+
+# NOTE(hrw): In RHEL 9 family it is done by systemd timer, we want cron to
+# handle it.
+COPY logrotate /etc/cron.daily/logrotate
+
+{% elif base_package_type == 'deb' %}
+    {% set cron_packages = [
+        'cron',
+        'logrotate'
+    ] %}
+{% endif %}
+
+{{ macros.install_packages(cron_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block cron_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/cron/extend_start.sh b/kolla/docker/cron/extend_start.sh
new file mode 100644
index 000000000..3476302e1
--- /dev/null
+++ b/kolla/docker/cron/extend_start.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+CRON_LOGROTATE_CURRENT_PATH="$(find /etc/cron* -name logrotate)"
+CRON_LOGROTATE_CURRENT_SCHEDULE=$(echo "${CRON_LOGROTATE_CURRENT_PATH}" | sed -r 's/(.*)(hourly|daily|weekly|monthly)(.*)/\2/g')
+
+if [ -z $CRON_LOGROTATE_CURRENT_PATH ]; then
+    echo "logrotate is not handled by cron"
+else
+    # Pass only for hourly|daily|weekly|monthly
+    if [[ "${KOLLA_LOGROTATE_SCHEDULE:-undefined}" =~ hourly|daily|weekly|monthly ]]; then
+
+        CRON_LOGROTATE_DESIRED_PATH="/etc/cron.${KOLLA_LOGROTATE_SCHEDULE}/logrotate"
+
+        if [[ "${CRON_LOGROTATE_CURRENT_PATH}" != "${CRON_LOGROTATE_DESIRED_PATH}" ]]; then
+            mv ${CRON_LOGROTATE_CURRENT_PATH} ${CRON_LOGROTATE_DESIRED_PATH}
+            CRON_LOGROTATE_CURRENT_SCHEDULE="${KOLLA_LOGROTATE_SCHEDULE}"
+        fi
+    fi
+
+    echo "[i] Cron schedule for logrotate is currently set to: ${CRON_LOGROTATE_CURRENT_SCHEDULE}."
+fi
diff --git a/kolla/docker/cron/logrotate b/kolla/docker/cron/logrotate
new file mode 100755
index 000000000..1ac157001
--- /dev/null
+++ b/kolla/docker/cron/logrotate
@@ -0,0 +1,18 @@
+#!/bin/sh
+
+# skip in favour of systemd timer
+if [ -d /run/systemd/system ]; then
+    exit 0
+fi
+
+# this cronjob persists removals (but not purges)
+if [ ! -x /usr/sbin/logrotate ]; then
+    exit 0
+fi
+
+/usr/sbin/logrotate /etc/logrotate.conf
+EXITVALUE=$?
+if [ $EXITVALUE != 0 ]; then
+    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
+fi
+exit $EXITVALUE
diff --git a/kolla/docker/cyborg/cyborg-agent/Dockerfile.j2 b/kolla/docker/cyborg/cyborg-agent/Dockerfile.j2
new file mode 100644
index 000000000..dfc1adc0b
--- /dev/null
+++ b/kolla/docker/cyborg/cyborg-agent/Dockerfile.j2
@@ -0,0 +1,22 @@
+FROM {{ namespace }}/{{ image_prefix }}cyborg-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block cyborg_agent_header %}{% endblock %}
+{% import "macros.j2" as macros with context %}
+
+{% set cyborg_agent_packages = [
+    'pciutils',
+] %}
+
+{{ macros.install_packages(cyborg_agent_packages | customizable("packages")) }}
+
+{% set cyborg_agent_pip_packages = [ ] %}
+
+RUN {{ macros.install_pip(cyborg_agent_pip_packages | customizable("pip_packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block cyborg_agent_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/cyborg/cyborg-api/Dockerfile.j2 b/kolla/docker/cyborg/cyborg-api/Dockerfile.j2
new file mode 100644
index 000000000..d67cdeb28
--- /dev/null
+++ b/kolla/docker/cyborg/cyborg-api/Dockerfile.j2
@@ -0,0 +1,19 @@
+FROM {{ namespace }}/{{ image_prefix }}cyborg-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block cyborg_api_header %}{% endblock %}
+{% import "macros.j2" as macros with context %}
+
+{% set cyborg_api_packages = [
+] %}
+{{ macros.install_packages(cyborg_api_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_cyborg_extend_start
+RUN chmod 644 /usr/local/bin/kolla_cyborg_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block cyborg_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/cyborg/cyborg-api/extend_start.sh b/kolla/docker/cyborg/cyborg-api/extend_start.sh
new file mode 100644
index 000000000..b1c7af7af
--- /dev/null
+++ b/kolla/docker/cyborg/cyborg-api/extend_start.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    cyborg-dbsync upgrade
+    exit 0
+fi
diff --git a/kolla/docker/cyborg/cyborg-base/Dockerfile.j2 b/kolla/docker/cyborg/cyborg-base/Dockerfile.j2
new file mode 100644
index 000000000..c3f3e602a
--- /dev/null
+++ b/kolla/docker/cyborg/cyborg-base/Dockerfile.j2
@@ -0,0 +1,31 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block cyborg_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='cyborg') }}
+
+ADD cyborg-base-archive /cyborg-base-source
+
+{% set cyborg_base_pip_packages = [
+    '/cyborg'
+] %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+COPY cyborg_sudoers /etc/sudoers.d/kolla_cyborg_sudoers
+
+RUN ln -s cyborg-base-source/* cyborg \
+    && {{ macros.install_pip(cyborg_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/cyborg/ \
+    && cp -r /cyborg/etc/cyborg/* /etc/cyborg/ \
+    && chmod 750 /etc/sudoers.d \
+    && touch /usr/local/bin/kolla_cyborg_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_cyborg_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block cyborg_footer %}{% endblock %}
diff --git a/kolla/docker/cyborg/cyborg-base/cyborg_sudoers b/kolla/docker/cyborg/cyborg-base/cyborg_sudoers
new file mode 100644
index 000000000..63440026d
--- /dev/null
+++ b/kolla/docker/cyborg/cyborg-base/cyborg_sudoers
@@ -0,0 +1 @@
+%kolla ALL=(root) NOPASSWD: /usr/bin/chown -R cyborg\: /var/lib/cyborg/, /bin/chown -R cyborg\: /var/lib/cyborg/
diff --git a/kolla/docker/cyborg/cyborg-base/extend_start.sh b/kolla/docker/cyborg/cyborg-base/extend_start.sh
new file mode 100755
index 000000000..10a58c626
--- /dev/null
+++ b/kolla/docker/cyborg/cyborg-base/extend_start.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+# Create log dir for Cyborg logs
+CYBORG_LOG_DIR="/var/log/kolla/cyborg"
+if [[ ! -d "${CYBORG_LOG_DIR}" ]]; then
+    mkdir -p ${CYBORG_LOG_DIR}
+fi
+if [[ $(stat -c %U:%G ${CYBORG_LOG_DIR}) != "cyborg:kolla" ]]; then
+    chown cyborg:kolla ${CYBORG_LOG_DIR}
+fi
+if [[ $(stat -c %a ${CYBORG_LOG_DIR}) != "755" ]]; then
+    chmod 755 ${CYBORG_LOG_DIR}
+fi
+
+. /usr/local/bin/kolla_cyborg_extend_start
diff --git a/kolla/docker/cyborg/cyborg-conductor/Dockerfile.j2 b/kolla/docker/cyborg/cyborg-conductor/Dockerfile.j2
new file mode 100644
index 000000000..d17d1cacd
--- /dev/null
+++ b/kolla/docker/cyborg/cyborg-conductor/Dockerfile.j2
@@ -0,0 +1,13 @@
+FROM {{ namespace }}/{{ image_prefix }}cyborg-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block cyborg_conductor_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block cyborg_conductor_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/designate/designate-api/Dockerfile.j2 b/kolla/docker/designate/designate-api/Dockerfile.j2
new file mode 100644
index 000000000..6ca9ac180
--- /dev/null
+++ b/kolla/docker/designate/designate-api/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}designate-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block designate_api_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block designate_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER designate
diff --git a/kolla/docker/designate/designate-backend-bind9/Dockerfile.j2 b/kolla/docker/designate/designate-backend-bind9/Dockerfile.j2
new file mode 100644
index 000000000..cf1277aeb
--- /dev/null
+++ b/kolla/docker/designate/designate-backend-bind9/Dockerfile.j2
@@ -0,0 +1,31 @@
+FROM {{ namespace }}/{{ image_prefix }}designate-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block designate_backend_bind9_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+   {% set designate_backend_bind9_packages = ['bind'] %}
+
+{{ macros.install_packages(designate_backend_bind9_packages | customizable("packages")) }}
+
+{% elif base_package_type == 'deb' %}
+   {% set designate_backend_bind9_packages = ['bind9'] %}
+
+{{ macros.install_packages(designate_backend_bind9_packages | customizable("packages")) }}
+
+{% endif %}
+
+{% set designate_backend_bind_name = 'bind' if base_package_type == 'deb' else 'named' %}
+
+RUN mkdir -p /var/lib/kolla/ /var/lib/{{ designate_backend_bind_name }}/ /run/{{ designate_backend_bind_name }} \
+     && chown -R root: /var/lib/{{ designate_backend_bind_name }} /run/{{ designate_backend_bind_name }} \
+     && chmod 755 /run/{{ designate_backend_bind_name }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block designate_backend_bind9_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/designate/designate-base/Dockerfile.j2 b/kolla/docker/designate/designate-base/Dockerfile.j2
new file mode 100644
index 000000000..26a0beca1
--- /dev/null
+++ b/kolla/docker/designate/designate-base/Dockerfile.j2
@@ -0,0 +1,33 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block designate_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='designate') }}
+
+{% set designate_base_pip_packages = [
+    '/designate'
+] %}
+
+ADD designate-base-archive /designate-base-source
+
+COPY designate_sudoers /etc/sudoers.d/kolla_designate_sudoers
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN ln -s designate-base-source/* designate \
+    && {{ macros.install_pip(designate_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/designate \
+    && cp -r /designate/etc/designate/* /etc/designate/ \
+    && sed -i 's|^exec_dirs.*|exec_dirs=/var/lib/kolla/venv/bin,/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/bin,/usr/local/sbin|g' /etc/designate/rootwrap.conf \
+    && chmod 750 /etc/sudoers.d \
+    && chmod 640 /etc/sudoers.d/kolla_designate_sudoers \
+    && touch /usr/local/bin/kolla_designate_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_designate_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block designate_base_footer %}{% endblock %}
diff --git a/kolla/docker/designate/designate-base/designate_sudoers b/kolla/docker/designate/designate-base/designate_sudoers
new file mode 100644
index 000000000..d06679fe2
--- /dev/null
+++ b/kolla/docker/designate/designate-base/designate_sudoers
@@ -0,0 +1 @@
+%kolla ALL=(root) NOPASSWD: /var/lib/kolla/venv/bin/designate-rootwrap /etc/designate/rootwrap.conf *
diff --git a/kolla/docker/designate/designate-base/extend_start.sh b/kolla/docker/designate/designate-base/extend_start.sh
new file mode 100644
index 000000000..66b376c30
--- /dev/null
+++ b/kolla/docker/designate/designate-base/extend_start.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/designate" ]]; then
+    mkdir -p /var/log/kolla/designate
+fi
+if [[ $(stat -c %a /var/log/kolla/designate) != "755" ]]; then
+    chmod 755 /var/log/kolla/designate
+fi
+
+. /usr/local/bin/kolla_designate_extend_start
diff --git a/kolla/docker/designate/designate-central/Dockerfile.j2 b/kolla/docker/designate/designate-central/Dockerfile.j2
new file mode 100644
index 000000000..81c3c901f
--- /dev/null
+++ b/kolla/docker/designate/designate-central/Dockerfile.j2
@@ -0,0 +1,18 @@
+FROM {{ namespace }}/{{ image_prefix }}designate-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block designate_central_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+COPY extend_start.sh /usr/local/bin/kolla_designate_extend_start
+RUN chmod 644 /usr/local/bin/kolla_designate_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block designate_central_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER designate
diff --git a/kolla/docker/designate/designate-central/extend_start.sh b/kolla/docker/designate/designate-central/extend_start.sh
new file mode 100644
index 000000000..8e90f55fc
--- /dev/null
+++ b/kolla/docker/designate/designate-central/extend_start.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+if [[ ! -f "/var/log/kolla/designate/designate-manage.log" ]]; then
+    touch /var/log/kolla/designate/designate-manage.log
+    chmod 644 /var/log/kolla/designate/designate-manage.log
+fi
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    designate-manage database sync
+    exit 0
+fi
diff --git a/kolla/docker/designate/designate-mdns/Dockerfile.j2 b/kolla/docker/designate/designate-mdns/Dockerfile.j2
new file mode 100644
index 000000000..dd2e6df75
--- /dev/null
+++ b/kolla/docker/designate/designate-mdns/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}designate-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block designate_mdns_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block designate_mdns_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER designate
diff --git a/kolla/docker/designate/designate-producer/Dockerfile.j2 b/kolla/docker/designate/designate-producer/Dockerfile.j2
new file mode 100644
index 000000000..bd1ce4e1d
--- /dev/null
+++ b/kolla/docker/designate/designate-producer/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}designate-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block designate_producer_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block designate_producer_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER designate
diff --git a/kolla/docker/designate/designate-sink/Dockerfile.j2 b/kolla/docker/designate/designate-sink/Dockerfile.j2
new file mode 100644
index 000000000..8b8e50adf
--- /dev/null
+++ b/kolla/docker/designate/designate-sink/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}designate-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block designate_sink_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block designate_sink_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER designate
diff --git a/kolla/docker/designate/designate-worker/Dockerfile.j2 b/kolla/docker/designate/designate-worker/Dockerfile.j2
new file mode 100644
index 000000000..b4e190df6
--- /dev/null
+++ b/kolla/docker/designate/designate-worker/Dockerfile.j2
@@ -0,0 +1,27 @@
+FROM {{ namespace }}/{{ image_prefix }}designate-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block designate_worker_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+# The bind9 package here is only to provide the rndc binary.
+{% if base_package_type == 'rpm' %}
+    {% set designate_worker_packages = [
+        'bind'
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set designate_worker_packages = [
+        'bind9'
+    ] %}
+{% endif %}
+{{ macros.install_packages(designate_worker_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block designate_worker_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER designate
diff --git a/kolla/docker/dnsmasq/Dockerfile.j2 b/kolla/docker/dnsmasq/Dockerfile.j2
new file mode 100644
index 000000000..882613be7
--- /dev/null
+++ b/kolla/docker/dnsmasq/Dockerfile.j2
@@ -0,0 +1,19 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block dnsmasq_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set dnsmasq_packages = ['dnsmasq'] %}
+{{ macros.install_packages(dnsmasq_packages| customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
+
+{% block dnsmasq_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/dnsmasq/extend_start.sh b/kolla/docker/dnsmasq/extend_start.sh
new file mode 100644
index 000000000..0c9734fa1
--- /dev/null
+++ b/kolla/docker/dnsmasq/extend_start.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+
+DNSMASQ_PIDFILE=${DNSMASQ_PIDFILE:-/run/ironic/dnsmasq.pid}
+DNSMASQ_PIDFILE_DIR="$(dirname $DNSMASQ_PIDFILE)"
+
+if [[ ! -d "/var/log/kolla/ironic" ]]; then
+    mkdir -p /var/log/kolla/ironic
+fi
+if [[ $(stat -c %a /var/log/kolla/ironic) != "755" ]]; then
+    chmod 755 /var/log/kolla/ironic
+fi
+if [[ ! -r "/var/log/kolla/ironic/dnsmasq.log" ]]; then
+    touch /var/log/kolla/ironic/dnsmasq.log
+    chown ironic:ironic /var/log/kolla/ironic/dnsmasq.log
+fi
+
+if [[ ! -d "$DNSMASQ_PIDFILE_DIR" ]]; then
+    mkdir -p "$DNSMASQ_PIDFILE_DIR"
+fi
+
+# NOTE(wszumski): This writes the PID of dnsmasq out to a file. The PIDFILE can be used in
+# another container to send a signal to dnsmasq to reload its config (providing that the two
+# containers share a PID namespace). The concrete use case is for the Ironic PXE filter to
+# clean up stale host entries on startup as documented in:
+#
+# https://docs.openstack.org/ironic/latest/admin/inspection/pxe_filter.html
+#
+# We cannot use the pid-file option in dnsmasq, since it will only write the PIDFILE if you
+# run dnsmasq in its non-forking mode i.e you do use the --no-daemon or --keep-in-foreground
+# options.
+echo $$ > "$DNSMASQ_PIDFILE"
diff --git a/kolla/docker/etcd/Dockerfile.j2 b/kolla/docker/etcd/Dockerfile.j2
new file mode 100644
index 000000000..aafcd8666
--- /dev/null
+++ b/kolla/docker/etcd/Dockerfile.j2
@@ -0,0 +1,31 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block etcd_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='etcd') }}
+
+{% block etcd_install %}
+ADD etcd-archive /etcd-source
+
+RUN ln -s etcd-source/* etcd \
+    && cp /etcd/etcd /etcd/etcdctl /usr/bin
+{% endblock %}
+
+COPY etcd_sudoers /etc/sudoers.d/kolla_etcd_sudoers
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN chmod 644 /usr/local/bin/kolla_extend_start \
+    && chmod 750 /etc/sudoers.d \
+    && chmod 440 /etc/sudoers.d/kolla_etcd_sudoers
+
+{{ macros.kolla_patch_sources() }}
+
+{% block etcd_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER etcd
diff --git a/kolla/docker/etcd/etcd_sudoers b/kolla/docker/etcd/etcd_sudoers
new file mode 100644
index 000000000..d3e244be0
--- /dev/null
+++ b/kolla/docker/etcd/etcd_sudoers
@@ -0,0 +1 @@
+%kolla ALL=(root) NOPASSWD: /usr/bin/chown etcd\: /var/lib/etcd/, /bin/chown etcd\: /var/lib/etcd/
diff --git a/kolla/docker/etcd/extend_start.sh b/kolla/docker/etcd/extend_start.sh
new file mode 100644
index 000000000..c54023299
--- /dev/null
+++ b/kolla/docker/etcd/extend_start.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+# Create log directory, with appropriate permissions
+if [[ ! -d "/var/log/kolla/etcd" ]]; then
+    mkdir -p /var/log/kolla/etcd
+fi
+if [[ $(stat -c %a /var/log/kolla/etcd) != "755" ]]; then
+    chmod 755 /var/log/kolla/etcd
+fi
+
+if [[ $(stat -c %U /var/lib/etcd/) != "etcd" ]]; then
+    sudo chown etcd: /var/lib/etcd/
+fi
diff --git a/kolla/docker/fluentd/Dockerfile.j2 b/kolla/docker/fluentd/Dockerfile.j2
new file mode 100644
index 000000000..c63e1b990
--- /dev/null
+++ b/kolla/docker/fluentd/Dockerfile.j2
@@ -0,0 +1,62 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+
+{% set fluentd_user = 'fluentd' %}
+
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" fluentd_binary="fluentd" fluentd_user="{{ fluentd_user }}"
+{% endblock %}
+
+{% block fluentd_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.enable_extra_repos(['fluentd']) }}
+
+{% if base_package_type == 'rpm' %}
+
+    {% set fluentd_packages = [
+        'gcc-c++',
+        'make',
+        'fluent-package',
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+
+    {% set fluentd_packages = [
+        'g++',
+        'make',
+        'fluent-package',
+    ] %}
+
+{% endif %}
+
+{{ macros.configure_user(name=fluentd_user, groups='mysql') }}
+
+COPY fluentd_sudoers /etc/sudoers.d/kolla_fluentd_sudoers
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+{{ macros.install_packages(fluentd_packages | customizable("packages")) }} \
+    && chmod 440 /etc/sudoers.d/kolla_fluentd_sudoers \
+    && mkdir -p /etc/{{ fluentd_user }} \
+    && mkdir -p /var/run/{{ fluentd_user }} \
+    && chown -R {{ fluentd_user }}: /var/run/{{ fluentd_user }} \
+    && chmod 644 /usr/local/bin/kolla_extend_start
+
+{% block fluentd_plugins_install %}
+
+{% set fluentd_plugins = [
+    'fluent-plugin-grok-parser',
+    'fluent-plugin-prometheus',
+    'fluent-plugin-rewrite-tag-filter',
+] %}
+
+{{ macros.install_fluent_plugins(fluentd_plugins | customizable("plugins")) }}
+
+{% endblock %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block fluentd_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER {{ fluentd_user }}
diff --git a/kolla/docker/fluentd/extend_start.sh b/kolla/docker/fluentd/extend_start.sh
new file mode 100644
index 000000000..6b304b92c
--- /dev/null
+++ b/kolla/docker/fluentd/extend_start.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+# Give processes executed with the "kolla" group the permission to create files
+# and sub-directories in the /var/log/kolla directory.
+#
+# Also set the setgid permission on the /var/log/kolla directory so that new
+# files and sub-directories in that directory inherit its group id ("kolla").
+
+if [ ! -d /var/log/kolla ]; then
+    mkdir -p /var/log/kolla
+fi
+if [[ $(stat -c %U:%G /var/log/kolla) != "fluentd:kolla" ]]; then
+    sudo chown fluentd:kolla /var/log/kolla
+fi
+if [[ $(stat -c %a /var/log/kolla) != "2775" ]]; then
+    sudo chmod 2775 /var/log/kolla
+fi
+if [[ (-d /var/lib/fluentd) && ($(stat -c %U:%G /var/lib/fluentd) != "fluentd:kolla") ]]; then
+    sudo chown fluentd:kolla /var/lib/fluentd
+fi
diff --git a/kolla/docker/fluentd/fluentd_sudoers b/kolla/docker/fluentd/fluentd_sudoers
new file mode 100644
index 000000000..25ca93f5a
--- /dev/null
+++ b/kolla/docker/fluentd/fluentd_sudoers
@@ -0,0 +1,8 @@
+%kolla ALL=(root) NOPASSWD: /bin/chown fluentd\:kolla /var/log/kolla, /usr/bin/chown fluentd\:kolla /var/log/kolla
+%kolla ALL=(root) NOPASSWD: /bin/chown td-agent\:kolla /var/log/kolla, /usr/bin/chown td-agent\:kolla /var/log/kolla
+%kolla ALL=(root) NOPASSWD: /bin/chown fluentd\:kolla /var/lib/fluentd, /usr/bin/chown fluentd\:kolla /var/lib/fluentd
+%kolla ALL=(root) NOPASSWD: /bin/chown td-agent\:kolla /var/lib/td-agent, /usr/bin/chown td-agent\:kolla /var/lib/td-agent
+%kolla ALL=(root) NOPASSWD: /bin/chown fluentd\:kolla /var/lib/td-agent, /usr/bin/chown fluentd\:kolla /var/lib/td-agent
+%kolla ALL=(root) NOPASSWD: /bin/chmod 2775 /var/log/kolla, /usr/bin/chmod 2775 /var/log/kolla
+%kolla ALL=(root) NOPASSWD: /bin/chmod 2775 /var/lib/fluentd, /usr/bin/chmod 2775 /var/lib/fluentd
+%kolla ALL=(root) NOPASSWD: /bin/chmod 2775 /var/lib/td-agent, /usr/bin/chmod 2775 /var/lib/td-agent
diff --git a/kolla/docker/glance/glance-api/Dockerfile.j2 b/kolla/docker/glance/glance-api/Dockerfile.j2
new file mode 100644
index 000000000..e3efbfef3
--- /dev/null
+++ b/kolla/docker/glance/glance-api/Dockerfile.j2
@@ -0,0 +1,38 @@
+FROM {{ namespace }}/{{ image_prefix }}glance-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block glance_api_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+    {% set glance_api_packages = [
+        'lsscsi',
+        'device-mapper-multipath',
+        'nvme-cli',
+        'qemu-img',
+        'systemd-udev'
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set glance_api_packages = [
+        'lsscsi',
+        'multipath-tools',
+        'nfs-common',
+        'nvme-cli',
+        'qemu-utils'
+    ] %}
+{% endif %}
+
+{{ macros.install_packages(glance_api_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_glance_extend_start
+RUN chmod 644 /usr/local/bin/kolla_glance_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block glance_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER glance
diff --git a/kolla/docker/glance/glance-api/extend_start.sh b/kolla/docker/glance/glance-api/extend_start.sh
new file mode 100644
index 000000000..3363539a5
--- /dev/null
+++ b/kolla/docker/glance/glance-api/extend_start.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    glance-manage db_sync
+    glance-manage db_load_metadefs
+    exit 0
+fi
+
+# Migrate database and exit if KOLLA_UPGRADE variable is set. This catches all cases
+# of the KOLLA_UPGRADE variable being set, including empty.
+if [[ "${!KOLLA_UPGRADE[@]}" ]]; then
+    if [[ "${!GLANCE_DB_EXPAND[@]}" ]]; then
+        echo "Expanding database"
+        glance-manage db expand
+    fi
+    if [[ "${!GLANCE_DB_MIGRATE[@]}" ]]; then
+        echo "Migrating database"
+        glance-manage db migrate
+    fi
+    if [[ "${!GLANCE_DB_CONTRACT[@]}" ]]; then
+        echo "Contracting database"
+        glance-manage db contract
+    fi
+    exit 0
+fi
diff --git a/kolla/docker/glance/glance-base/Dockerfile.j2 b/kolla/docker/glance/glance-base/Dockerfile.j2
new file mode 100644
index 000000000..885cc4353
--- /dev/null
+++ b/kolla/docker/glance/glance-base/Dockerfile.j2
@@ -0,0 +1,54 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block glance_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='glance') }}
+
+{% if base_package_type == 'rpm' %}
+
+{{ macros.enable_extra_repos(['ceph', 'epel']) }}
+
+    {% set glance_base_packages = [
+        'python3-rados',
+        'python3-rbd'
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set glance_base_packages = [
+        'python3-rados',
+        'python3-rbd'
+    ] %}
+{% endif %}
+
+{{ macros.install_packages(glance_base_packages | customizable("packages")) }}
+
+ADD glance-base-archive /glance-base-source
+
+{% set glance_base_pip_packages = [
+    '/glance',
+    'glance_store[cinder,vmware,swift,s3]'
+] %}
+
+# add missing rootwrap config present in glance_store repo
+COPY etc/glance /etc/glance
+COPY glance_sudoers /etc/sudoers.d/kolla_glance_sudoers
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN ln -s glance-base-source/* glance \
+    && {{ macros.install_pip(glance_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/glance \
+    && cp -r /glance/etc/* /etc/glance/ \
+    && cp /var/lib/kolla/venv/etc/pycadf/glance_api_audit_map.conf /etc/glance/ \
+    && sed -i 's|^exec_dirs.*|exec_dirs=/var/lib/kolla/venv/bin,/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/bin,/usr/local/sbin|g' /etc/glance/rootwrap.conf \
+    && chmod 750 /etc/sudoers.d \
+    && chmod 440 /etc/sudoers.d/kolla_glance_sudoers \
+    && touch /usr/local/bin/kolla_glance_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_glance_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block glance_base_footer %}{% endblock %}
diff --git a/kolla/docker/glance/glance-base/etc/glance/rootwrap.conf b/kolla/docker/glance/glance-base/etc/glance/rootwrap.conf
new file mode 100644
index 000000000..56e7529af
--- /dev/null
+++ b/kolla/docker/glance/glance-base/etc/glance/rootwrap.conf
@@ -0,0 +1,27 @@
+# Configuration for glance-rootwrap
+# This file should be owned by (and only-writable by) the root user
+
+[DEFAULT]
+# List of directories to load filter definitions from (separated by ',').
+# These directories MUST all be only writeable by root !
+filters_path=/etc/glance/rootwrap.d,/usr/share/glance/rootwrap
+
+# List of directories to search executables in, in case filters do not
+# explicitly specify a full path (separated by ',')
+# If not specified, defaults to system PATH environment variable.
+# These directories MUST all be only writeable by root !
+exec_dirs=/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/bin,/usr/local/sbin
+
+# Enable logging to syslog
+# Default value is False
+use_syslog=False
+
+# Which syslog facility to use.
+# Valid values include auth, authpriv, syslog, local0, local1...
+# Default value is 'syslog'
+syslog_log_facility=syslog
+
+# Which messages to log.
+# INFO means log all usage
+# ERROR means only log unsuccessful attempts
+syslog_log_level=ERROR
diff --git a/kolla/docker/glance/glance-base/etc/glance/rootwrap.d/glance_cinder_store.filters b/kolla/docker/glance/glance-base/etc/glance/rootwrap.d/glance_cinder_store.filters
new file mode 100644
index 000000000..46c389b7e
--- /dev/null
+++ b/kolla/docker/glance/glance-base/etc/glance/rootwrap.d/glance_cinder_store.filters
@@ -0,0 +1,12 @@
+# glance-rootwrap command filters for glance cinder store
+# This file should be owned by (and only-writable by) the root user
+
+[Filters]
+# cinder store driver
+disk_chown: RegExpFilter, chown, root, chown, \d+, /dev/(?!.*/\.\.).*
+
+# os-brick library commands
+# os_brick.privileged.run_as_root oslo.privsep context
+# This line ties the superuser privs with the config files, context name,
+# and (implicitly) the actual python code invoked.
+privsep-rootwrap: RegExpFilter, privsep-helper, root, privsep-helper, --config-file, /etc/(?!\.\.).*, --privsep_context, os_brick.privileged.default, --privsep_sock_path, /tmp/.*
diff --git a/kolla/docker/glance/glance-base/extend_start.sh b/kolla/docker/glance/glance-base/extend_start.sh
new file mode 100644
index 000000000..4f5f5ecaf
--- /dev/null
+++ b/kolla/docker/glance/glance-base/extend_start.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/glance" ]]; then
+    mkdir -p /var/log/kolla/glance
+fi
+if [[ $(stat -c %a /var/log/kolla/glance) != "755" ]]; then
+    chmod 755 /var/log/kolla/glance
+fi
+
+. /usr/local/bin/kolla_glance_extend_start
diff --git a/kolla/docker/glance/glance-base/glance_sudoers b/kolla/docker/glance/glance-base/glance_sudoers
new file mode 100644
index 000000000..9af870983
--- /dev/null
+++ b/kolla/docker/glance/glance-base/glance_sudoers
@@ -0,0 +1 @@
+glance ALL = (root) NOPASSWD: /var/lib/kolla/venv/bin/glance-rootwrap /etc/glance/rootwrap.conf *
diff --git a/kolla/docker/gnocchi/gnocchi-api/Dockerfile.j2 b/kolla/docker/gnocchi/gnocchi-api/Dockerfile.j2
new file mode 100644
index 000000000..c0cc2cc33
--- /dev/null
+++ b/kolla/docker/gnocchi/gnocchi-api/Dockerfile.j2
@@ -0,0 +1,16 @@
+FROM {{ namespace }}/{{ image_prefix }}gnocchi-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block gnocchi_api_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+COPY extend_start.sh /usr/local/bin/kolla_gnocchi_extend_start
+RUN chmod 644 /usr/local/bin/kolla_gnocchi_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block gnocchi_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/gnocchi/gnocchi-api/extend_start.sh b/kolla/docker/gnocchi/gnocchi-api/extend_start.sh
new file mode 100644
index 000000000..dda0461c6
--- /dev/null
+++ b/kolla/docker/gnocchi/gnocchi-api/extend_start.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    sudo -H -u gnocchi gnocchi-upgrade --log-file /var/log/kolla/gnocchi/gnocchi-upgrade.log
+    exit 0
+fi
diff --git a/kolla/docker/gnocchi/gnocchi-base/Dockerfile.j2 b/kolla/docker/gnocchi/gnocchi-base/Dockerfile.j2
new file mode 100644
index 000000000..91199ac39
--- /dev/null
+++ b/kolla/docker/gnocchi/gnocchi-base/Dockerfile.j2
@@ -0,0 +1,56 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block gnocchi_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='gnocchi') }}
+
+{% if base_package_type == 'rpm' %}
+
+{{ macros.enable_extra_repos(['ceph', 'epel']) }}
+
+    {% set gnocchi_base_packages = [
+        'librados2-devel',
+        'python3-rados',
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+
+    {% set gnocchi_base_packages = [
+        'librados-dev',
+        'python3-rados',
+    ] %}
+
+
+{% endif %}
+
+{{ macros.install_packages(gnocchi_base_packages | customizable("packages")) }}
+
+ADD gnocchi-base-archive /gnocchi-base-source
+
+{% set gnocchi_base_pip_packages = [
+    'gnocchiclient',
+    '/gnocchi[keystone,mysql,file,ceph,s3]'
+] %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+COPY gnocchi_sudoers /etc/sudoers.d/kolla_gnocchi_sudoers
+
+RUN {{ macros.upper_constraints_version_change("Werkzeug", "3.0.1", "2.2.3") }}
+
+RUN ln -s gnocchi-base-source/* gnocchi \
+    && {{ macros.install_pip(gnocchi_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/gnocchi \
+    && cp /var/lib/kolla/venv/etc/pycadf/gnocchi_api_audit_map.conf /etc/gnocchi/ \
+    && chmod 750 /etc/sudoers.d \
+    && chmod 640 /etc/sudoers.d/kolla_gnocchi_sudoers \
+    && touch /usr/local/bin/kolla_gnocchi_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_gnocchi_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block gnocchi_base_footer %}{% endblock %}
diff --git a/kolla/docker/gnocchi/gnocchi-base/extend_start.sh b/kolla/docker/gnocchi/gnocchi-base/extend_start.sh
new file mode 100644
index 000000000..adc05b1b3
--- /dev/null
+++ b/kolla/docker/gnocchi/gnocchi-base/extend_start.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+# Create log dir for Gnocchi logs
+GNOCCHI_LOG_DIR="/var/log/kolla/gnocchi"
+if [[ ! -d "${GNOCCHI_LOG_DIR}" ]]; then
+    mkdir -p ${GNOCCHI_LOG_DIR}
+fi
+if [[ $(stat -c %U:%G ${GNOCCHI_LOG_DIR}) != "gnocchi:kolla" ]]; then
+    chown gnocchi:kolla ${GNOCCHI_LOG_DIR}
+fi
+if [[ $(stat -c %a ${GNOCCHI_LOG_DIR}) != "755" ]]; then
+    chmod 755 ${GNOCCHI_LOG_DIR}
+fi
+
+. /usr/local/bin/kolla_gnocchi_extend_start
diff --git a/kolla/docker/gnocchi/gnocchi-base/gnocchi_sudoers b/kolla/docker/gnocchi/gnocchi-base/gnocchi_sudoers
new file mode 100644
index 000000000..c2a01d709
--- /dev/null
+++ b/kolla/docker/gnocchi/gnocchi-base/gnocchi_sudoers
@@ -0,0 +1 @@
+%kolla ALL=(root) NOPASSWD: /usr/bin/chown -R gnocchi\: /var/lib/gnocchi/, /bin/chown -R gnocchi\: /var/lib/gnocchi/
diff --git a/kolla/docker/gnocchi/gnocchi-metricd/Dockerfile.j2 b/kolla/docker/gnocchi/gnocchi-metricd/Dockerfile.j2
new file mode 100644
index 000000000..fe9978fa2
--- /dev/null
+++ b/kolla/docker/gnocchi/gnocchi-metricd/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}gnocchi-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block gnocchi_metricd_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block gnocchi_metricd_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER gnocchi
diff --git a/kolla/docker/gnocchi/gnocchi-statsd/Dockerfile.j2 b/kolla/docker/gnocchi/gnocchi-statsd/Dockerfile.j2
new file mode 100644
index 000000000..8f1574946
--- /dev/null
+++ b/kolla/docker/gnocchi/gnocchi-statsd/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}gnocchi-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block gnocchi_statsd_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block gnocchi_statsd_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER gnocchi
diff --git a/kolla/docker/grafana/Dockerfile.j2 b/kolla/docker/grafana/Dockerfile.j2
new file mode 100644
index 000000000..e401d91b6
--- /dev/null
+++ b/kolla/docker/grafana/Dockerfile.j2
@@ -0,0 +1,42 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block grafana_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.enable_extra_repos(['grafana']) }}
+
+{% set grafana_packages = ['grafana'] %}
+
+{{ macros.configure_user(name='grafana', homedir='/usr/share/grafana') }}
+
+{{ macros.install_packages(grafana_packages | customizable("packages")) }}
+
+WORKDIR /usr/share/grafana
+
+COPY grafana_sudoers /etc/sudoers.d/kolla_grafana_sudoers
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+{% block grafana_plugins_install %}
+
+{% set grafana_default_plugins = ['grafana-opensearch-datasource']  %}
+{% set grafana_plugins =  grafana_default_plugins | customizable("plugins") %}
+
+{% if grafana_plugins | length > 0 %}
+RUN {{ (['grafana-cli plugins install %s'] * grafana_plugins | length ) | join(' && ') | format(*grafana_plugins) }}
+{% endif %}
+{% endblock %}
+
+RUN chmod 750 /etc/sudoers.d \
+    && chmod 440 /etc/sudoers.d/kolla_grafana_sudoers \
+    && chmod 644 /usr/local/bin/kolla_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block grafana_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER grafana
diff --git a/kolla/docker/grafana/extend_start.sh b/kolla/docker/grafana/extend_start.sh
new file mode 100644
index 000000000..5ed4dc56d
--- /dev/null
+++ b/kolla/docker/grafana/extend_start.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/grafana" ]]; then
+    mkdir -p /var/log/kolla/grafana
+fi
+if [[ $(stat -c %a /var/log/kolla/grafana) != "755" ]]; then
+    chmod 755 /var/log/kolla/grafana
+fi
diff --git a/kolla/docker/grafana/grafana_sudoers b/kolla/docker/grafana/grafana_sudoers
new file mode 100644
index 000000000..386829969
--- /dev/null
+++ b/kolla/docker/grafana/grafana_sudoers
@@ -0,0 +1 @@
+%kolla ALL=(root) NOPASSWD: /usr/bin/chown -R grafana\: /var/lib/grafana/, /bin/chown -R grafana\: /var/lib/grafana/
diff --git a/kolla/docker/hacluster/hacluster-base/Dockerfile.j2 b/kolla/docker/hacluster/hacluster-base/Dockerfile.j2
new file mode 100644
index 000000000..045f21e1e
--- /dev/null
+++ b/kolla/docker/hacluster/hacluster-base/Dockerfile.j2
@@ -0,0 +1,22 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block hacluster_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type =='rpm' %}
+
+{{ macros.enable_extra_repos(['hacluster']) }}
+
+{% endif %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN chmod 644 /usr/local/bin/kolla_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block hacluster_base_footer %}{% endblock %}
diff --git a/kolla/docker/hacluster/hacluster-base/extend_start.sh b/kolla/docker/hacluster/hacluster-base/extend_start.sh
new file mode 100644
index 000000000..c0e9301d0
--- /dev/null
+++ b/kolla/docker/hacluster/hacluster-base/extend_start.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/hacluster" ]]; then
+    mkdir -p /var/log/kolla/hacluster
+fi
+if [[ $(stat -c %a /var/log/kolla/hacluster) != "755" ]]; then
+    chmod 755 /var/log/kolla/hacluster
+fi
diff --git a/kolla/docker/hacluster/hacluster-corosync/Dockerfile.j2 b/kolla/docker/hacluster/hacluster-corosync/Dockerfile.j2
new file mode 100644
index 000000000..74d47c380
--- /dev/null
+++ b/kolla/docker/hacluster/hacluster-corosync/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}hacluster-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block hacluster_corosync_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set hacluster_corosync_packages = ['corosync'] %}
+{{ macros.install_packages(hacluster_corosync_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block hacluster_corosync_footer %}{% endblock %}
diff --git a/kolla/docker/hacluster/hacluster-pacemaker-remote/Dockerfile.j2 b/kolla/docker/hacluster/hacluster-pacemaker-remote/Dockerfile.j2
new file mode 100644
index 000000000..64c381e1f
--- /dev/null
+++ b/kolla/docker/hacluster/hacluster-pacemaker-remote/Dockerfile.j2
@@ -0,0 +1,21 @@
+FROM {{ namespace }}/{{ image_prefix }}hacluster-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block hacluster_pacemaker_remote_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set hacluster_pacemaker_remote_packages = ['pacemaker-remote'] %}
+{% if base_package_type == 'deb' %}
+    {% set hacluster_pacemaker_remote_packages = hacluster_pacemaker_remote_packages + [
+        'pacemaker-cli-utils'
+    ] %}
+{% endif %}
+
+{{ macros.install_packages(hacluster_pacemaker_remote_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block hacluster_pacemaker_remote_footer %}{% endblock %}
diff --git a/kolla/docker/hacluster/hacluster-pacemaker/Dockerfile.j2 b/kolla/docker/hacluster/hacluster-pacemaker/Dockerfile.j2
new file mode 100644
index 000000000..33eeb3144
--- /dev/null
+++ b/kolla/docker/hacluster/hacluster-pacemaker/Dockerfile.j2
@@ -0,0 +1,21 @@
+FROM {{ namespace }}/{{ image_prefix }}hacluster-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block hacluster_pacemaker_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set hacluster_pacemaker_packages = ['pacemaker'] %}
+{% if base_package_type == 'deb' %}
+    {% set hacluster_pacemaker_packages = hacluster_pacemaker_packages + [
+        'pacemaker-cli-utils'
+    ] %}
+{% endif %}
+
+{{ macros.install_packages(hacluster_pacemaker_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block hacluster_pacemaker_footer %}{% endblock %}
diff --git a/kolla/docker/hacluster/hacluster-pcs/Dockerfile.j2 b/kolla/docker/hacluster/hacluster-pcs/Dockerfile.j2
new file mode 100644
index 000000000..a146d0d4b
--- /dev/null
+++ b/kolla/docker/hacluster/hacluster-pcs/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}hacluster-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block hacluster_pcs_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set hacluster_pcs_packages = ['pcs','crmsh'] %}
+{{ macros.install_packages(hacluster_pcs_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block hacluster_pcs_footer %}{% endblock %}
diff --git a/kolla/docker/haproxy/haproxy-ssh/Dockerfile.j2 b/kolla/docker/haproxy/haproxy-ssh/Dockerfile.j2
new file mode 100644
index 000000000..a674cc75e
--- /dev/null
+++ b/kolla/docker/haproxy/haproxy-ssh/Dockerfile.j2
@@ -0,0 +1,42 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block haproxy_ssh_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='haproxy', shell='/bin/bash') }}
+
+{% if base_package_type == 'rpm' %}
+    {% set haproxy_ssh_packages = [
+        'openssh-server',
+        'openssh-clients',
+        'rsync',
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+    {% set haproxy_ssh_packages = [
+        'openssh-server',
+        'openssh-client',
+        'rsync',
+    ] %}
+
+RUN mkdir -p /var/run/sshd \
+    && chmod 0755 /var/run/sshd
+
+{% endif %}
+
+{{ macros.install_packages(haproxy_ssh_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start \
+    && sed -ri 's/session(\s+)required(\s+)pam_loginuid.so/session\1optional\2pam_loginuid.so/' /etc/pam.d/sshd
+
+COPY update-loadbalancer-cert.sh /usr/bin/update-loadbalancer-cert
+
+{{ macros.kolla_patch_sources() }}
+
+{% block haproxy_ssh_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/haproxy/haproxy-ssh/extend_start.sh b/kolla/docker/haproxy/haproxy-ssh/extend_start.sh
new file mode 100644
index 000000000..4b2239100
--- /dev/null
+++ b/kolla/docker/haproxy/haproxy-ssh/extend_start.sh
@@ -0,0 +1,37 @@
+#!/bin/bash
+
+SSH_HOST_KEY_TYPES=( "rsa" "ecdsa" "ed25519" )
+
+for key_type in ${SSH_HOST_KEY_TYPES[@]}; do
+    KEY_PATH=/etc/ssh/ssh_host_${key_type}_key
+    if [[ ! -f "${KEY_PATH}" ]]; then
+        ssh-keygen -q -t ${key_type} -f ${KEY_PATH} -N ""
+    fi
+done
+
+mkdir -p /var/lib/haproxy/.ssh
+
+if [[ $(stat -c %U:%G /var/lib/haproxy/.ssh) != "haproxy:haproxy" ]]; then
+    chown haproxy: /var/lib/haproxy/.ssh
+fi
+
+FOLDERS_LEGO="/etc/letsencrypt /etc/letsencrypt/backups"
+USERGROUP="haproxy:haproxy"
+
+for folder in ${FOLDERS_LEGO}; do
+    mkdir -p ${folder}
+
+    if [[ $(stat -c %U:%G ${folder}) != "${USERGROUP}" ]]; then
+        chown ${USERGROUP} ${folder}
+    fi
+
+    if [[ "${folder}" == "/etc/letsencrypt" ]]; then
+        if [[ $(stat -c %a ${folder}) != "751" ]]; then
+            chmod 751 ${folder}
+        fi
+    else
+        if [[ $(stat -c %a ${folder}) != "755" ]]; then
+            chmod 755 ${folder}
+        fi
+    fi
+done
diff --git a/kolla/docker/haproxy/haproxy-ssh/update-loadbalancer-cert.sh b/kolla/docker/haproxy/haproxy-ssh/update-loadbalancer-cert.sh
new file mode 100755
index 000000000..7e4122c65
--- /dev/null
+++ b/kolla/docker/haproxy/haproxy-ssh/update-loadbalancer-cert.sh
@@ -0,0 +1,125 @@
+#!/bin/bash
+
+function log_info {
+    local message="${1}"
+
+    echo "$(date '+%Y/%m/%d %H:%M:%S') [INFO] ${message}"
+}
+
+function log_error {
+    local message="${1}"
+
+    echo "$(date '+%Y/%m/%d %H:%M:%S') [ERROR] ${message}"
+}
+
+function haproxy_transaction_start {
+    local cert_input=${1}
+    local cert_dest=${2}
+
+    local transaction_result=""
+    local transaction_grep_check=""
+
+    transaction_grep_check="Transaction (created|updated) for certificate $(echo $cert_dest | sed -e 's|/|\\/|g')!"
+    transaction_result=$(echo -e "set ssl cert ${cert_dest} <<\n$(cat ${cert_input})\n" | socat unix-connect:/var/lib/kolla/haproxy/haproxy.sock -)
+    if echo "${transaction_result}" | grep -Pq "${transaction_grep_check}"; then
+        log_info "[${cert_dest} - update] Transaction ${cert_input} -> ${cert_dest} started."
+    else
+        log_error "[${cert_dest} - update] Transaction ${cert_input} -> ${cert_dest} failed, please check if haproxy admin socket is running and ${cert_input} is not corrupted."
+        exit 1
+    fi
+
+    local cert_input_sha1=""
+    local cert_dest_sha1=""
+
+    cert_input_sha1=$(openssl x509 -noout -fingerprint -sha1 -inform pem -in ${cert_input} | awk -F '=' '{print $2}' | sed -e 's/://g')
+    cert_dest_sha1=$(echo "show ssl cert *${cert_dest}" | socat unix-connect:/var/lib/kolla/haproxy/haproxy.sock - | awk -F 'SHA1 FingerPrint: ' '{print $2}' | sed '/^$/d')
+    if [ "${cert_input_sha1}" = "${cert_dest_sha1}" ]; then
+        log_info "[${cert_dest} - update] Transaction ${cert_input} -> ${cert_dest} successful."
+    else
+        log_error "[${cert_dest} - update] Transaction ${cert_input} -> ${cert_dest} failed, SHA1 fingerprint of ${cert_input} is not the same as uploaded one."
+        exit 1
+    fi
+}
+
+function haproxy_upload_to_memory {
+    local cert_input=${1}
+    local cert_dest=${2}
+
+    local cert_upload_output=""
+
+    cert_upload_output=$(echo "commit ssl cert ${cert_dest}" | socat unix-connect:/var/lib/kolla/haproxy/haproxy.sock -)
+    if echo "${cert_upload_output}" | grep -q "Success!"; then
+        log_info "[${cert_dest} - update] Certificate ${cert_input} uploaded to haproxy memory."
+    else
+        log_error "[${cert_dest} - update] Certificate ${cert_input} upload to haproxy memory failed, please check if haproxy admin socket is running and ${cert_input} is not corrupted."
+        exit 1
+    fi
+}
+
+function haproxy_write_to_disk {
+    local cert_input=${1}
+    local cert_haproxy_path=${2}
+
+    local cert_backup_suffix=""
+    local cert_backup_path=""
+    local cert_backup_name=""
+
+    cert_backup_suffix="-$(date +%Y-%m-%d-%H-%M-%S).pem"
+    cert_backup_path=$(echo "${cert_input}" | awk -v suffix="$cert_backup_suffix" -F '.pem' '{print $1suffix}')
+    cert_backup_name=$(echo ${cert_backup_path} | awk -F '/' '{print $NF}')
+    mkdir -p /etc/letsencrypt/backups
+    log_info "[${cert_haproxy_path} - update] Backuping currently loaded ${cert_haproxy_path} -> /etc/letsencrypt/backups/${cert_backup_name}"
+    cp -a ${cert_haproxy_path} /etc/letsencrypt/backups/${cert_backup_name}
+    cp -a ${cert_input} ${cert_haproxy_path}
+    rm -f ${cert_input}
+}
+
+
+# Parser
+
+INTERNAL_SET="false"
+EXTERNAL_SET="false"
+
+VALID_ARGS=$(getopt -o ie --long internal,external -- "$@")
+if [[ $? -ne 0 ]]; then
+    exit 1;
+fi
+
+eval set -- "$VALID_ARGS"
+while [ : ]; do
+    case "$1" in
+        -i | --internal)
+            CERT_TYPE="internal"
+            INTERNAL_SET="true"
+            shift
+            ;;
+        -e | --external)
+            CERT_TYPE="external"
+            EXTERNAL_SET="true"
+            shift
+            ;;
+        --) shift;
+            break
+            ;;
+    esac
+done
+
+if [ "${INTERNAL_SET}" = "true" ] || [ "${EXTERNAL_SET}" = "true" ]; then
+    if [ "${INTERNAL_SET}" = "${EXTERNAL_SET}" ]; then
+        echo "[e] Only --internal or --external parameter is allowed at a time"
+        exit 1
+    fi
+    if [ "${INTERNAL_SET}" = "true" ]; then
+        HAPROXY_CERT_INCOMING_PATH="/var/lib/haproxy/haproxy-internal.pem"
+        HAPROXY_CERT_PATH="/etc/haproxy/certificates/haproxy-internal.pem"
+    else
+        HAPROXY_CERT_INCOMING_PATH="/var/lib/haproxy/haproxy.pem"
+        HAPROXY_CERT_PATH="/etc/haproxy/certificates/haproxy.pem"
+    fi
+fi
+
+# Main
+
+haproxy_transaction_start ${HAPROXY_CERT_INCOMING_PATH} ${HAPROXY_CERT_PATH}
+haproxy_upload_to_memory ${HAPROXY_CERT_INCOMING_PATH} ${HAPROXY_CERT_PATH}
+haproxy_write_to_disk ${HAPROXY_CERT_INCOMING_PATH} ${HAPROXY_CERT_PATH}
diff --git a/kolla/docker/haproxy/haproxy/Dockerfile.j2 b/kolla/docker/haproxy/haproxy/Dockerfile.j2
new file mode 100644
index 000000000..36c7ca943
--- /dev/null
+++ b/kolla/docker/haproxy/haproxy/Dockerfile.j2
@@ -0,0 +1,26 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block haproxy_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='haproxy') }}
+
+{% set haproxy_packages = [
+    'haproxy'
+] %}
+{{ macros.install_packages(haproxy_packages | customizable("packages")) }}
+
+COPY ensure_latest_config.sh /usr/local/bin/kolla_ensure_haproxy_latest_config
+
+RUN mkdir -p /var/lib/kolla/haproxy \
+    && chown -R haproxy: /var/lib /run \
+    && chmod 755 /usr/local/bin/kolla_ensure_haproxy_latest_config
+
+{{ macros.kolla_patch_sources() }}
+
+{% block haproxy_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/haproxy/haproxy/ensure_latest_config.sh b/kolla/docker/haproxy/haproxy/ensure_latest_config.sh
new file mode 100644
index 000000000..4b84f3aed
--- /dev/null
+++ b/kolla/docker/haproxy/haproxy/ensure_latest_config.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -o errexit
+
+CURRENT_CONFIG_HASH=$(sha1sum /etc/haproxy/haproxy.cfg | cut -f1 -d' ')
+NEW_CONFIG_HASH=$(sha1sum /var/lib/kolla/config_files/haproxy.cfg | cut -f1 -d' ')
+
+if [[ $CURRENT_CONFIG_HASH != $NEW_CONFIG_HASH ]]; then
+    changed=changed
+    python /usr/local/bin/kolla_set_configs
+    kill -USR2 $(pgrep -f /usr/sbin/haproxy-systemd-wrapper)
+fi
+
+echo $changed
diff --git a/kolla/docker/heat/heat-api-cfn/Dockerfile.j2 b/kolla/docker/heat/heat-api-cfn/Dockerfile.j2
new file mode 100644
index 000000000..db3030c8d
--- /dev/null
+++ b/kolla/docker/heat/heat-api-cfn/Dockerfile.j2
@@ -0,0 +1,13 @@
+FROM {{ namespace }}/{{ image_prefix }}heat-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block heat_api_cfn_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block heat_api_cfn_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/heat/heat-api/Dockerfile.j2 b/kolla/docker/heat/heat-api/Dockerfile.j2
new file mode 100644
index 000000000..af2471279
--- /dev/null
+++ b/kolla/docker/heat/heat-api/Dockerfile.j2
@@ -0,0 +1,16 @@
+FROM {{ namespace }}/{{ image_prefix }}heat-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block heat_api_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+COPY extend_start.sh /usr/local/bin/kolla_heat_extend_start
+RUN chmod 644 /usr/local/bin/kolla_heat_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block heat_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/heat/heat-api/extend_start.sh b/kolla/docker/heat/heat-api/extend_start.sh
new file mode 100644
index 000000000..ddf4f81f4
--- /dev/null
+++ b/kolla/docker/heat/heat-api/extend_start.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    heat-manage db_sync
+
+    EXISTING_DOMAINS=$(openstack domain list -f value -c Name)
+
+    if ! echo "$EXISTING_DOMAINS" | grep '^heat_user_domain$' &>/dev/null; then
+        openstack domain create heat_user_domain
+        openstack user create --domain heat_user_domain heat_domain_admin --password ${HEAT_DOMAIN_ADMIN_PASSWORD}
+        openstack role add --domain heat_user_domain --user-domain heat_user_domain --user heat_domain_admin admin
+    fi
+
+    exit 0
+fi
diff --git a/kolla/docker/heat/heat-base/Dockerfile.j2 b/kolla/docker/heat/heat-base/Dockerfile.j2
new file mode 100644
index 000000000..a06ea6f0d
--- /dev/null
+++ b/kolla/docker/heat/heat-base/Dockerfile.j2
@@ -0,0 +1,41 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block heat_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='heat') }}
+
+{% if base_package_type == 'rpm' %}
+
+{{ macros.enable_extra_repos(['openvswitch']) }}
+
+{% endif %}
+
+{% set heat_base_packages = [
+] %}
+
+{{ macros.install_packages(heat_base_packages | customizable("packages")) }}
+
+ADD heat-base-archive /heat-base-source
+
+{% set heat_base_pip_packages = [
+    '/heat'
+] %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN ln -s heat-base-source/* heat \
+    && {{ macros.install_pip(heat_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/heat \
+    && cp -r /heat/etc/heat/* /etc/heat/ \
+    && cp /var/lib/kolla/venv/etc/pycadf/heat_api_audit_map.conf /etc/heat/ \
+    && touch /usr/local/bin/kolla_heat_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_heat_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block heat_base_footer %}{% endblock %}
diff --git a/kolla/docker/heat/heat-base/extend_start.sh b/kolla/docker/heat/heat-base/extend_start.sh
new file mode 100644
index 000000000..1c1e86b8e
--- /dev/null
+++ b/kolla/docker/heat/heat-base/extend_start.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/heat" ]]; then
+    mkdir -p /var/log/kolla/heat
+fi
+if [[ $(stat -c %U:%G /var/log/kolla/heat) != "heat:kolla" ]]; then
+    chown -R heat:kolla /var/log/kolla/heat
+fi
+if [[ $(stat -c %a /var/log/kolla/heat) != "755" ]]; then
+    chmod 755 /var/log/kolla/heat
+fi
+
+. /usr/local/bin/kolla_heat_extend_start
diff --git a/kolla/docker/heat/heat-engine/Dockerfile.j2 b/kolla/docker/heat/heat-engine/Dockerfile.j2
new file mode 100644
index 000000000..86c943582
--- /dev/null
+++ b/kolla/docker/heat/heat-engine/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}heat-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block heat_engine_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block heat_engine_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER heat
diff --git a/kolla/docker/horizon/Dockerfile.j2 b/kolla/docker/horizon/Dockerfile.j2
new file mode 100644
index 000000000..73dc65dd1
--- /dev/null
+++ b/kolla/docker/horizon/Dockerfile.j2
@@ -0,0 +1,74 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block horizon_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='horizon') }}
+
+{% if base_package_type == 'rpm' %}
+
+    {% set horizon_packages = [
+        'gettext'
+    ] %}
+
+{{ macros.install_packages(horizon_packages | customizable("packages")) }}
+{% elif base_package_type == 'deb' %}
+
+    {% set horizon_packages = [
+        'gettext',
+        'locales',
+        'tzdata'
+    ] %}
+
+{{ macros.install_packages(horizon_packages | customizable("packages")) }}
+
+{% endif %}
+
+ADD horizon-archive /horizon-source
+ADD plugins-archive /
+
+{% set horizon_pip_packages = [
+    '/horizon',
+    'django_redis'
+] %}
+
+{% set horizon_plugins_pip_packages = [
+    '/plugins/*'
+] %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+# NOTE(hrw): to install horizon from unpacked sources we cannot have it in upper-constraints.txt
+# NOTE(kevko): This dance with local settings python paths below is needed
+# because we are using different distros with different python version and we need to
+# know to which path symlink should point to.
+RUN ln -s horizon-source/* horizon \
+    && {{ macros.upper_constraints_remove("horizon") }} \
+    && {{ macros.install_pip(horizon_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/openstack-dashboard \
+    && cp -r /horizon/openstack_dashboard/conf/* /etc/openstack-dashboard/ \
+    && cp /horizon/openstack_dashboard/local/local_settings.py.example /etc/openstack-dashboard/local_settings.py \
+    && local_settings=$(python -c 'import os;import openstack_dashboard;settings=os.path.dirname(openstack_dashboard.__file__) + "/local/local_settings.py";print(settings);') \
+    && rm -f $local_settings \
+    && ln -s /etc/openstack-dashboard/local_settings.py $local_settings \
+    && mkdir -p /etc/openstack-dashboard/local_settings.d \
+    && local_settings_d=$(python -c 'import os;import openstack_dashboard;settings_d=os.path.dirname(openstack_dashboard.__file__) + "/local/local_settings.d";print(settings_d);') \
+    && rm -rf $local_settings_d \
+    && ln -s /etc/openstack-dashboard/local_settings.d $local_settings_d \
+    && cp /horizon/manage.py /var/lib/kolla/venv/bin/manage.py \
+    && if [ "$(ls /plugins)" ]; then \
+           {{ macros.install_pip(horizon_plugins_pip_packages) }}; \
+       fi \
+    && for locale in  /var/lib/kolla/venv/lib/python3/site-packages/*/locale; do \
+           (cd ${locale%/*} && /var/lib/kolla/venv/bin/django-admin compilemessages) \
+       done \
+    && chmod 644 /usr/local/bin/kolla_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block horizon_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/horizon/extend_start.sh b/kolla/docker/horizon/extend_start.sh
new file mode 100644
index 000000000..d1198adb4
--- /dev/null
+++ b/kolla/docker/horizon/extend_start.sh
@@ -0,0 +1,248 @@
+#!/bin/bash
+
+set -o errexit
+
+FORCE_GENERATE="${FORCE_GENERATE:-no}"
+HASH_PATH=/var/lib/kolla/.settings.md5sum.txt
+
+SITE_PACKAGES="/var/lib/kolla/venv/lib/python3/site-packages"
+
+MANAGE_PY="/var/lib/kolla/venv/bin/python /var/lib/kolla/venv/bin/manage.py"
+
+if [[ ! -f ${SITE_PACKAGES}/openstack_dashboard/local/local_settings.py ]]; then
+    ln -s /etc/openstack-dashboard/local_settings \
+        ${SITE_PACKAGES}/openstack_dashboard/local/local_settings.py
+fi
+
+if [[ -f /etc/openstack-dashboard/custom_local_settings ]]; then
+    CUSTOM_SETTINGS_FILE="${SITE_PACKAGES}/openstack_dashboard/local/custom_local_settings.py"
+
+    if [[ ! -L ${CUSTOM_SETTINGS_FILE} ]]; then
+        ln -s /etc/openstack-dashboard/custom_local_settings ${CUSTOM_SETTINGS_FILE}
+    fi
+fi
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    $MANAGE_PY migrate --noinput
+    exit 0
+fi
+
+function config_dashboard {
+    ENABLE=$1
+    SRC=$2
+    DEST=$3
+    if [[ ! -f ${SRC} ]]; then
+        echo "WARNING: ${SRC} is required"
+    elif [[ "${ENABLE}" == "yes" ]] && [[ ! -f "${DEST}" ]]; then
+        cp -a "${SRC}" "${DEST}"
+        FORCE_GENERATE="yes"
+    elif [[ "${ENABLE}" != "yes" ]] && [[ -f "${DEST}" ]]; then
+        # remove pyc pyo files too
+        rm -f "${DEST}" "${DEST}c" "${DEST}o"
+        FORCE_GENERATE="yes"
+    fi
+}
+
+function config_blazar_dashboard {
+    for file in ${SITE_PACKAGES}/blazar_dashboard/enabled/_*[^__].py; do
+        config_dashboard "${ENABLE_BLAZAR:-no}" \
+            "${SITE_PACKAGES}/blazar_dashboard/enabled/${file##*/}" \
+            "${SITE_PACKAGES}/openstack_dashboard/local/enabled/${file##*/}"
+    done
+}
+
+function config_cloudkitty_dashboard {
+    for file in ${SITE_PACKAGES}/cloudkittydashboard/enabled/_*[^__].py; do
+        config_dashboard "${ENABLE_CLOUDKITTY:-no}" \
+            "${SITE_PACKAGES}/cloudkittydashboard/enabled/${file##*/}" \
+            "${SITE_PACKAGES}/openstack_dashboard/local/enabled/${file##*/}"
+    done
+}
+
+function config_designate_dashboard {
+    for file in ${SITE_PACKAGES}/designatedashboard/enabled/_*[^__].py; do
+        config_dashboard "${ENABLE_DESIGNATE:-no}" \
+            "${SITE_PACKAGES}/designatedashboard/enabled/${file##*/}" \
+            "${SITE_PACKAGES}/openstack_dashboard/local/enabled/${file##*/}"
+    done
+}
+
+function config_fwaas_dashboard {
+    for file in ${SITE_PACKAGES}/neutron_fwaas_dashboard/enabled/_*[^__].py; do
+        config_dashboard "${ENABLE_FWAAS:-no}" \
+            "${SITE_PACKAGES}/neutron_fwaas_dashboard/enabled/${file##*/}" \
+            "${SITE_PACKAGES}/openstack_dashboard/local/enabled/${file##*/}"
+    done
+}
+
+function config_heat_dashboard {
+    for file in ${SITE_PACKAGES}/heat_dashboard/enabled/_*[^__].py; do
+        config_dashboard "${ENABLE_HEAT:-no}" \
+            "${SITE_PACKAGES}/heat_dashboard/enabled/${file##*/}" \
+            "${SITE_PACKAGES}/openstack_dashboard/local/enabled/${file##*/}"
+    done
+
+    config_dashboard "${ENABLE_HEAT:-no}" \
+        "${SITE_PACKAGES}/heat_dashboard/conf/heat_policy.yaml" \
+        "/etc/openstack-dashboard/heat_policy.yaml"
+    config_dashboard "${ENABLE_HEAT:-no}" \
+        "${SITE_PACKAGES}/heat_dashboard/conf/default_policies/heat.yaml" \
+        "/etc/openstack-dashboard/default_policies/heat.yaml"
+}
+
+function config_ironic_dashboard {
+    for file in ${SITE_PACKAGES}/ironic_ui/enabled/_*[^__].py; do
+        config_dashboard "${ENABLE_IRONIC:-no}" \
+            "${SITE_PACKAGES}/ironic_ui/enabled/${file##*/}" \
+            "${SITE_PACKAGES}/openstack_dashboard/local/enabled/${file##*/}"
+    done
+}
+
+function config_magnum_dashboard {
+    for file in ${SITE_PACKAGES}/magnum_ui/enabled/_*[^__].py; do
+        config_dashboard "${ENABLE_MAGNUM:-no}" \
+            "${SITE_PACKAGES}/magnum_ui/enabled/${file##*/}" \
+            "${SITE_PACKAGES}/openstack_dashboard/local/enabled/${file##*/}"
+    done
+}
+
+function config_manila_ui {
+    for file in ${SITE_PACKAGES}/manila_ui/local/enabled/_*[^__].py; do
+        config_dashboard "${ENABLE_MANILA:-no}" \
+            "${SITE_PACKAGES}/manila_ui/local/enabled/${file##*/}" \
+            "${SITE_PACKAGES}/openstack_dashboard/local/enabled/${file##*/}"
+    done
+
+    config_dashboard "${ENABLE_MANILA:-no}" \
+        "${SITE_PACKAGES}/manila_ui/conf/manila_policy.yaml" \
+        "/etc/openstack-dashboard/manila_policy.yaml"
+    config_dashboard "${ENABLE_MANILA:-no}" \
+        "${SITE_PACKAGES}/manila_ui/conf/default_policies/manila.yaml" \
+        "/etc/openstack-dashboard/default_policies/manila.yaml"
+}
+
+function config_masakari_dashboard {
+    for file in ${SITE_PACKAGES}/masakaridashboard/local/enabled/_*[^__].py; do
+        config_dashboard "${ENABLE_MASAKARI:-no}" \
+            "${SITE_PACKAGES}/masakaridashboard/local/enabled/${file##*/}" \
+            "${SITE_PACKAGES}/openstack_dashboard/local/enabled/${file##*/}"
+    done
+    config_dashboard "${ENABLE_MASAKARI:-no}"\
+        "${SITE_PACKAGES}/masakaridashboard/conf/masakari_policy.yaml" \
+        "/etc/openstack-dashboard/masakari_policy.yaml"
+    config_dashboard "${ENABLE_MASAKARI:-no}"\
+        "${SITE_PACKAGES}/masakaridashboard/local/local_settings.d/_50_masakari.py" \
+        "${SITE_PACKAGES}/openstack_dashboard/local/local_settings.d/_50_masakari.py"
+}
+
+function config_mistral_dashboard {
+    config_dashboard "${ENABLE_MISTRAL:-no}" \
+        "${SITE_PACKAGES}/mistraldashboard/enabled/_50_mistral.py" \
+        "${SITE_PACKAGES}/openstack_dashboard/local/enabled/_50_mistral.py"
+}
+
+function config_neutron_vpnaas_dashboard {
+    config_dashboard "${ENABLE_NEUTRON_VPNAAS:-no}" \
+        "${SITE_PACKAGES}/neutron_vpnaas_dashboard/enabled/_7100_project_vpn_panel.py" \
+        "${SITE_PACKAGES}/openstack_dashboard/local/enabled/_7100_project_vpn_panel.py"
+}
+
+function config_octavia_dashboard {
+    config_dashboard "${ENABLE_OCTAVIA:-no}" \
+        "${SITE_PACKAGES}/octavia_dashboard/enabled/_1482_project_load_balancer_panel.py" \
+        "${SITE_PACKAGES}/openstack_dashboard/local/enabled/_1482_project_load_balancer_panel.py"
+}
+
+
+function config_tacker_dashboard {
+    for file in ${SITE_PACKAGES}/tacker_horizon/enabled/_*[^__].py; do
+        config_dashboard "${ENABLE_TACKER:-no}" \
+            "${SITE_PACKAGES}/tacker_horizon/enabled/${file##*/}" \
+            "${SITE_PACKAGES}/openstack_dashboard/local/enabled/${file##*/}"
+    done
+}
+
+function config_trove_dashboard {
+    for file in ${SITE_PACKAGES}/trove_dashboard/enabled/_*[^__].py; do
+        config_dashboard "${ENABLE_TROVE:-no}" \
+            "${SITE_PACKAGES}/trove_dashboard/enabled/${file##*/}" \
+            "${SITE_PACKAGES}/openstack_dashboard/local/enabled/${file##*/}"
+    done
+}
+
+function config_watcher_dashboard {
+    for file in ${SITE_PACKAGES}/watcher_dashboard/local/enabled/_*[^__].py; do
+        config_dashboard "${ENABLE_WATCHER:-no}" \
+            "${SITE_PACKAGES}/watcher_dashboard/local/enabled/${file##*/}" \
+            "${SITE_PACKAGES}/openstack_dashboard/local/enabled/${file##*/}"
+    done
+
+    config_dashboard "${ENABLE_WATCHER:-no}" \
+            "${SITE_PACKAGES}/watcher_dashboard/conf/watcher_policy.json" \
+            "/etc/openstack-dashboard/watcher_policy.json"
+}
+
+# Regenerate the compressed javascript and css if any configuration files have
+# changed.  Use a static modification date when generating the tarball
+# so that we only trigger on content changes.
+function settings_bundle {
+    # NOTE(yoctozepto): We ignore errors here (|| true) to make it work with
+    # `set -o pipefail` (files might be missing - no problem).
+    tar -cf- --mtime=1970-01-01 \
+        /etc/openstack-dashboard/local_settings \
+        /etc/openstack-dashboard/custom_local_settings \
+        /etc/openstack-dashboard/local_settings.d \
+        /etc/openstack-dashboard/themes 2> /dev/null || true
+}
+
+function settings_changed {
+    changed=1
+
+    if [[ ! -f $HASH_PATH  ]] || ! settings_bundle | md5sum -c --status $HASH_PATH || [[ $FORCE_GENERATE == yes ]]; then
+        changed=0
+    fi
+
+    return ${changed}
+}
+
+config_blazar_dashboard
+config_cloudkitty_dashboard
+config_designate_dashboard
+config_fwaas_dashboard
+config_heat_dashboard
+config_ironic_dashboard
+config_magnum_dashboard
+config_manila_ui
+config_masakari_dashboard
+config_mistral_dashboard
+config_neutron_vpnaas_dashboard
+config_octavia_dashboard
+config_tacker_dashboard
+config_trove_dashboard
+config_watcher_dashboard
+
+if settings_changed; then
+    ${MANAGE_PY} collectstatic --noinput --clear
+    ${MANAGE_PY} compress --force
+    settings_bundle | md5sum > $HASH_PATH
+fi
+
+# NOTE(sbezverk) since Horizon is now storing logs in its own location, /var/log/horizon
+# needs to be created if it does not exist
+if [[ ! -d "/var/log/kolla/horizon" ]]; then
+    mkdir -p /var/log/kolla/horizon
+fi
+
+if [[ $(stat -c %U:%G /var/log/kolla/horizon) != "horizon:kolla" ]]; then
+    chown -R horizon:kolla /var/log/kolla/horizon
+fi
+
+if [[ $(stat -c %a /var/log/kolla/horizon) != "755" ]]; then
+    chmod 755 /var/log/kolla/horizon
+fi
+
+if [[ -f ${SITE_PACKAGES}/openstack_dashboard/local/.secret_key_store ]] && [[ $(stat -c %U ${SITE_PACKAGES}/openstack_dashboard/local/.secret_key_store) != "horizon" ]]; then
+    chown horizon ${SITE_PACKAGES}/openstack_dashboard/local/.secret_key_store
+fi
diff --git a/kolla/docker/httpd/Dockerfile.j2 b/kolla/docker/httpd/Dockerfile.j2
new file mode 100644
index 000000000..ec5637283
--- /dev/null
+++ b/kolla/docker/httpd/Dockerfile.j2
@@ -0,0 +1,42 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block apache_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+{{ macros.enable_extra_repos(['epel']) }}
+    {% set apache_packages = [
+        'httpd',
+        'mod_ssl',
+        'mod_auth_mellon',
+        'mod_auth_openidc',
+        'mod_proxy_uwsgi'
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set apache_packages = [
+        'apache2',
+        'ca-certificates',
+        'libapache2-mod-auth-mellon',
+        'libapache2-mod-auth-openidc'
+    ] %}
+{% endif %}
+
+{{ macros.install_packages(apache_packages | customizable("packages")) }}
+
+{% if base_package_type == 'rpm' %}
+RUN sed -i -r 's,^(Listen 80),#\1,' /etc/httpd/conf/httpd.conf \
+    && sed -i -r 's,^(Listen 443),#\1,' /etc/httpd/conf.d/ssl.conf
+{% elif base_package_type == 'deb' %}
+RUN echo > /etc/apache2/ports.conf
+{% endif %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+COPY httpd_setup.sh /usr/local/bin/kolla_httpd_setup
+RUN chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_httpd_setup
+USER root
+
+{% block apache_footer %}{% endblock %}
diff --git a/kolla/docker/httpd/extend_start.sh b/kolla/docker/httpd/extend_start.sh
new file mode 100644
index 000000000..d47af64b9
--- /dev/null
+++ b/kolla/docker/httpd/extend_start.sh
@@ -0,0 +1 @@
+. /usr/local/bin/kolla_httpd_setup
diff --git a/kolla/docker/httpd/httpd_setup.sh b/kolla/docker/httpd/httpd_setup.sh
new file mode 100644
index 000000000..35f7b5b1e
--- /dev/null
+++ b/kolla/docker/httpd/httpd_setup.sh
@@ -0,0 +1,51 @@
+#!/bin/bash
+
+# This script performs setup necessary to run the Apache httpd web server.
+# It should be sourced rather than executed as environment variables are set.
+
+# Assume the service runs on top of Apache httpd when user is root.
+if [[ "$(whoami)" == 'root' ]]; then
+    # NOTE(pbourke): httpd will not clean up after itself in some cases which
+    # results in the container not being able to restart. (bug #1489676, 1557036)
+    if [[ "${KOLLA_BASE_DISTRO}" =~ debian|ubuntu ]]; then
+        # NOTE(yoctozepto): APACHE_CONFDIR has to be set to pass the next step
+        # under the `set -o nounset` regime
+        APACHE_CONFDIR=
+        # Loading Apache2 ENV variables
+        . /etc/apache2/envvars
+        install -d /var/run/apache2/
+        rm -rf /var/run/apache2/*
+    else
+        rm -rf /var/run/httpd/* /run/httpd/* /tmp/httpd*
+        # NOTE(mmalchuk): This added to make Rocky/Centos similar to Ubuntu/Debian
+        # to provide /server-status handler for local monitoring of the Apache.
+        # The module already loaded in the /etc/httpd/conf.modules.d/00-base.conf.
+        cat << EOF >/etc/httpd/conf.modules.d/99-server-status.conf
+<Location "/server-status">
+    SetHandler server-status
+    Require local
+</Location>
+EOF
+    fi
+
+    # CentOS/Rocky have an issue with mod_ssl which produces an invalid Apache
+    # configuration in /etc/httpd/conf.d/ssl.conf. This causes the following error
+    # on startup:
+    #   SSLCertificateFile: file '/etc/pki/tls/certs/localhost.crt' does not exist or is empty
+    # Work around this by generating certificates manually.
+    # NOTE(mnasiadka): in EL9 upgrade jobs gencerts is failing on wrong permissions to dhparams.pem
+    if [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]] && [[ ! -e /etc/pki/tls/certs/localhost.crt ]]; then
+        rm -f /tmp/dhparams.pem
+        /usr/libexec/httpd-ssl-gencerts
+    fi
+fi
+
+# The default system locale with unicode support
+LANG=C.UTF-8
+
+# Override the default locale if configured
+if [[ "${KOLLA_BASE_DISTRO}" =~ debian|ubuntu ]]; then
+    [ -f /etc/default/locale ] && . /etc/default/locale
+else
+    [ -f /etc/locale.conf ] && . /etc/locale.conf
+fi
diff --git a/kolla/docker/ironic/ironic-api/Dockerfile.j2 b/kolla/docker/ironic/ironic-api/Dockerfile.j2
new file mode 100644
index 000000000..1c10d0372
--- /dev/null
+++ b/kolla/docker/ironic/ironic-api/Dockerfile.j2
@@ -0,0 +1,20 @@
+FROM {{ namespace }}/{{ image_prefix }}ironic-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block ironic_api_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set ironic_api_packages = [
+] %}
+{{ macros.install_packages(ironic_api_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_ironic_extend_start
+RUN chmod 644 /usr/local/bin/kolla_ironic_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block ironic_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/ironic/ironic-api/extend_start.sh b/kolla/docker/ironic/ironic-api/extend_start.sh
new file mode 100644
index 000000000..ce2f7fb3e
--- /dev/null
+++ b/kolla/docker/ironic/ironic-api/extend_start.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    ironic-dbsync upgrade
+    ironic-dbsync online_data_migrations
+    exit 0
+fi
+
+if [[ "${!KOLLA_UPGRADE[@]}" ]]; then
+    ironic-dbsync upgrade
+    exit 0
+fi
+
+if [[ "${!KOLLA_OSM[@]}" ]]; then
+    ironic-dbsync online_data_migrations
+    exit 0
+fi
diff --git a/kolla/docker/ironic/ironic-base/Dockerfile.j2 b/kolla/docker/ironic/ironic-base/Dockerfile.j2
new file mode 100644
index 000000000..e2f7871f6
--- /dev/null
+++ b/kolla/docker/ironic/ironic-base/Dockerfile.j2
@@ -0,0 +1,32 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block ironic_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='ironic', shell='/bin/bash') }}
+
+ADD ironic-base-archive /ironic-base-source
+ADD ironic_sudoers /etc/sudoers.d/kolla_ironic_sudoers
+
+{% set ironic_base_pip_packages = [
+    '/ironic'
+] %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN ln -s ironic-base-source/* ironic \
+    && {{ macros.install_pip(ironic_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/ironic \
+    && cp /var/lib/kolla/venv/etc/pycadf/ironic_api_audit_map.conf /etc/ironic/ \
+    && chmod 750 /etc/sudoers.d \
+    && chmod 440 /etc/sudoers.d/kolla_ironic_sudoers \
+    && touch /usr/local/bin/kolla_ironic_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_ironic_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block ironic_base_footer %}{% endblock %}
diff --git a/kolla/docker/ironic/ironic-base/extend_start.sh b/kolla/docker/ironic/ironic-base/extend_start.sh
new file mode 100644
index 000000000..dc6b05caa
--- /dev/null
+++ b/kolla/docker/ironic/ironic-base/extend_start.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+LOG_PATH=/var/log/kolla/ironic
+METRICS_PATH=/var/lib/ironic-metrics
+
+if [[ ! -d "${LOG_PATH}" ]]; then
+    mkdir -p "${LOG_PATH}"
+fi
+if [[ ! -d "${METRICS_PATH}" ]]; then
+    sudo mkdir -p "${METRICS_PATH}"
+fi
+if [[ $(stat -c %a "${LOG_PATH}") != "755" ]]; then
+    chmod 755 "${LOG_PATH}"
+fi
+if [[ $(stat -c %U:%G "${METRICS_PATH}") != "ironic:ironic" ]]; then
+    sudo chown ironic:ironic "${METRICS_PATH}"
+fi
+if [[ $(stat -c %a "${METRICS_PATH}") != "2775" ]]; then
+    sudo chmod 2775 "${METRICS_PATH}"
+fi
+
+. /usr/local/bin/kolla_ironic_extend_start
diff --git a/kolla/docker/ironic/ironic-base/ironic_sudoers b/kolla/docker/ironic/ironic-base/ironic_sudoers
new file mode 100644
index 000000000..9b9deed4d
--- /dev/null
+++ b/kolla/docker/ironic/ironic-base/ironic_sudoers
@@ -0,0 +1,3 @@
+ironic ALL = (root) NOPASSWD: /bin/mkdir -p /var/lib/ironic-metrics, /usr/bin/mkdir -p /var/lib/ironic-metrics
+ironic ALL = (root) NOPASSWD: /bin/chown ironic\:ironic /var/lib/ironic-metrics, /usr/bin/chown ironic\:ironic /var/lib/ironic-metrics
+ironic ALL = (root) NOPASSWD: /bin/chmod 2755 /var/lib/ironic-metrics, /usr/bin/chmod 2775 /var/lib/ironic-metrics
diff --git a/kolla/docker/ironic/ironic-conductor/Dockerfile.j2 b/kolla/docker/ironic/ironic-conductor/Dockerfile.j2
new file mode 100644
index 000000000..bce981fb0
--- /dev/null
+++ b/kolla/docker/ironic/ironic-conductor/Dockerfile.j2
@@ -0,0 +1,76 @@
+FROM {{ namespace }}/{{ image_prefix }}ironic-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block ironic_conductor_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+    {% set ironic_conductor_packages = [
+        'dosfstools',
+        'e2fsprogs',
+        'fuse',
+        'gdisk',
+        'ipmitool',
+        'mtools',
+        'openssh-clients',
+        'parted',
+        'psmisc',
+        'python3-systemd',
+        'qemu-img',
+        'systemd-udev',
+        'util-linux',
+        'xfsprogs',
+        'xorriso'
+    ] %}
+    {% if base_arch in ['x86_64'] %}
+        {% set ironic_conductor_packages = ironic_conductor_packages + [
+            'syslinux'
+        ] %}
+    {% endif %}
+{% elif base_package_type == 'deb' %}
+    {% set ironic_conductor_packages = [
+        'bsdmainutils',
+        'dosfstools',
+        'e2fsprogs',
+        'gdisk',
+        'genisoimage',
+        'ipmitool',
+        'isolinux',
+        'mtools',
+        'openssh-client',
+        'parted',
+        'psmisc',
+        'python3-systemd',
+        'qemu-utils',
+        'shellinabox',
+        'udev',
+        'xfsprogs',
+    ] %}
+{% endif %}
+
+{% set ironic_conductor_pip_packages = [
+    '-r /ironic/driver-requirements.txt',
+    'ironic-staging-drivers',
+] %}
+
+{% set ironic_conductor_plugins_pip_packages = [
+'/plugins/*'
+] %}
+
+ADD plugins-archive /
+RUN {{ macros.install_pip(ironic_conductor_pip_packages | customizable("pip_packages")) }} \
+    && if [ "$(ls /plugins)" ]; then \
+        {{ macros.install_pip(ironic_conductor_plugins_pip_packages) }}; \
+    fi
+
+{{ macros.install_packages(ironic_conductor_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block ironic_conductor_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER ironic
diff --git a/kolla/docker/ironic/ironic-prometheus-exporter/Dockerfile.j2 b/kolla/docker/ironic/ironic-prometheus-exporter/Dockerfile.j2
new file mode 100644
index 000000000..2ac448dfd
--- /dev/null
+++ b/kolla/docker/ironic/ironic-prometheus-exporter/Dockerfile.j2
@@ -0,0 +1,17 @@
+FROM {{ namespace }}/{{ image_prefix }}ironic-conductor:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+USER root
+
+{% block ironic_prometheus_exporter_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+ENV IRONIC_CONFIG /etc/ironic/ironic.conf
+
+{{ macros.kolla_patch_sources() }}
+
+{% block ironic_prometheus_exporter_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/ironic/ironic-pxe-filter/Dockerfile.j2 b/kolla/docker/ironic/ironic-pxe-filter/Dockerfile.j2
new file mode 100644
index 000000000..5b593e9f0
--- /dev/null
+++ b/kolla/docker/ironic/ironic-pxe-filter/Dockerfile.j2
@@ -0,0 +1,24 @@
+FROM {{ namespace }}/{{ image_prefix }}ironic-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block ironic_pxe_filter_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set ironic_pxe_filter_packages = [] %}
+
+{% set ironic_pxe_filter_pip_packages = [] %}
+
+RUN {{ macros.install_pip(ironic_pxe_filter_pip_packages | customizable("pip_packages")) }}
+
+{{ macros.install_packages(ironic_pxe_filter_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+COPY extend_start.sh /usr/local/bin/kolla_ironic_extend_start
+RUN chmod 644 /usr/local/bin/kolla_ironic_extend_start
+
+{% block ironic_pxe_filter_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/ironic/ironic-pxe-filter/extend_start.sh b/kolla/docker/ironic/ironic-pxe-filter/extend_start.sh
new file mode 100644
index 000000000..c7a807c8d
--- /dev/null
+++ b/kolla/docker/ironic/ironic-pxe-filter/extend_start.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+IRONIC_DHCP_HOSTS_DIR=${IRONIC_DHCP_HOSTS_DIR:-/etc/dnsmasq/dhcp-hostsdir}
+DNSMASQ_PIDFILE=${DNSMASQ_PIDFILE:-/run/ironic/dnsmasq.pid}
+
+# NOTE(wszumski): This container must be in same process namespace as dnsmasq
+rm -f $IRONIC_DHCP_HOSTS_DIR/* && kill -HUP $(cat "$DNSMASQ_PIDFILE") || true
diff --git a/kolla/docker/ironic/ironic-pxe/Dockerfile.j2 b/kolla/docker/ironic/ironic-pxe/Dockerfile.j2
new file mode 100644
index 000000000..0475a5b05
--- /dev/null
+++ b/kolla/docker/ironic/ironic-pxe/Dockerfile.j2
@@ -0,0 +1,55 @@
+FROM {{ namespace }}/{{ image_prefix }}ironic-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block ironic_pxe_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+    {% set ironic_pxe_packages = [
+        'dosfstools',
+        'grub2-tools',
+        'grub2-efi-*64',
+        'grub2-efi-aa64-modules',
+        'ipxe-bootimgs',
+        'ipxe-bootimgs-aarch64',
+        'mtools',
+        'shim-*64',
+        'syslinux-tftpboot',
+        'tftp-server',
+    ] %}
+
+{{ macros.install_packages(ironic_pxe_packages | customizable("packages")) }}
+{% elif base_package_type == 'deb' %}
+    {% set ironic_pxe_packages = [
+        'dosfstools',
+        'grub-efi-*64-signed',
+        'ipxe',
+        'mtools',
+        'pxelinux',
+        'shim-signed',
+        'syslinux-common',
+        'tftpd-hpa'
+    ] %}
+
+    {% if base_arch == 'x86_64' %}
+        {% set ironic_pxe_packages = ironic_pxe_packages + [
+            'syslinux'
+        ] %}
+    {% endif %}
+
+{{ macros.install_packages(ironic_pxe_packages | customizable("packages")) }}
+{% endif %}
+
+ENV TFTPBOOT_PATH=/tftpboot \
+    HTTPBOOT_PATH=/httpboot
+COPY tftp-map-file-template /map-file-template
+COPY extend_start.sh /usr/local/bin/kolla_ironic_extend_start
+RUN chmod 644 /usr/local/bin/kolla_ironic_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block ironic_pxe_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/ironic/ironic-pxe/extend_start.sh b/kolla/docker/ironic/ironic-pxe/extend_start.sh
new file mode 100644
index 000000000..06a8312b4
--- /dev/null
+++ b/kolla/docker/ironic/ironic-pxe/extend_start.sh
@@ -0,0 +1,103 @@
+#!/bin/bash
+
+
+# For x86 legacy BIOS boot mode
+function prepare_pxe_pxelinux {
+    if [[ "${KOLLA_BASE_DISTRO}" =~ debian|ubuntu ]]; then
+        cp /usr/lib/PXELINUX/pxelinux.0 \
+           /usr/lib/syslinux/modules/bios/{chain.c32,ldlinux.c32} \
+           ${TFTPBOOT_PATH}/
+    elif [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]]; then
+        if [[ "${TFTPBOOT_PATH}" != /tftpboot ]]; then
+            cp /tftpboot/{pxelinux.0,chain.c32,ldlinux.c32} \
+               ${TFTPBOOT_PATH}/
+        fi
+    fi
+}
+
+# For UEFI boot mode
+function prepare_pxe_grub {
+    if [[ "${KOLLA_BASE_DISTRO}" =~ debian|ubuntu  ]]; then
+        shim_src_file="/usr/lib/shim/shim*64.efi.signed"
+        grub_src_file="/usr/lib/grub/*-efi-signed/grubnet*64.efi.signed"
+    elif [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]]; then
+        shim_src_file="/boot/efi/EFI/${KOLLA_BASE_DISTRO}/shim*64.efi"
+        grub_src_file="/boot/efi/EFI/${KOLLA_BASE_DISTRO}/grub*64.efi"
+    fi
+
+    if [[ "${KOLLA_BASE_ARCH}" == "x86_64" ]]; then
+        shim_dst_file="bootx64.efi"
+        grub_dst_file="grubx64.efi"
+    elif [[ "${KOLLA_BASE_ARCH}" == "aarch64" ]]; then
+        shim_dst_file="bootaa64.efi"
+        grub_dst_file="grubaa64.efi"
+    fi
+
+    cp $shim_src_file ${TFTPBOOT_PATH}/$shim_dst_file
+    cp $grub_src_file ${TFTPBOOT_PATH}/$grub_dst_file
+}
+
+function prepare_ipxe {
+    # NOTE(mgoddard): Ironic uses snponly.efi as the default for
+    # uefi_ipxe_bootfile_name since Xena. In Wallaby and earlier releases it
+    # was ipxe.efi. Ensure that both exist, using symlinks where the files are
+    # named differently to allow the original names to be used in ironic.conf.
+    if [[ "${KOLLA_BASE_DISTRO}" =~ debian|ubuntu ]]; then
+        # NOTE(m-anson): ipxe-arm64.efi is not symlinked from /boot to
+        # /usr/lib/ipxe by the Ubuntu ipxe package, so fix that here.
+        if [[ -e /boot/ipxe-arm64.efi ]]; then
+            ln -s /boot/ipxe-arm64.efi /usr/lib/ipxe/
+        fi
+        cp /usr/lib/ipxe/{undionly.kpxe,ipxe*.efi,snponly.efi} ${TFTPBOOT_PATH}/
+    elif [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]]; then
+        cp /usr/share/ipxe/{undionly.kpxe,ipxe-snponly-x86_64.efi} ${TFTPBOOT_PATH}/
+        cp /usr/share/ipxe/arm64-efi/snponly.efi ${TFTPBOOT_PATH}/ipxe-snponly-aarch64.efi
+        if [[ ! -e ${TFTPBOOT_PATH}/snponly.efi ]]; then
+            ln -s ${TFTPBOOT_PATH}/ipxe-snponly-${KOLLA_BASE_ARCH}.efi ${TFTPBOOT_PATH}/snponly.efi
+        fi
+    fi
+}
+
+function prepare_esp_image {
+    # NOTE(bbezak): based on https://docs.openstack.org/ironic/2024.2/install/configure-esp.html
+    # ESP image needs to be provided for UEFI boot with virtual media:
+    # https://docs.openstack.org/ironic/2024.2/admin/drivers/redfish.html#virtual-media-boot
+    if [[ "${KOLLA_BASE_DISTRO}" =~ debian|ubuntu ]]; then
+        shim_src_file="/usr/lib/shim/shim*64.efi.signed"
+        grub_src_file="/usr/lib/grub/*-efi-signed/grubnet*64.efi.signed"
+    elif [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]]; then
+        shim_src_file="/boot/efi/EFI/${KOLLA_BASE_DISTRO}/shim*64.efi"
+        grub_src_file="/boot/efi/EFI/${KOLLA_BASE_DISTRO}/grub*64.efi"
+    fi
+
+    if [[ "${KOLLA_BASE_ARCH}" == "x86_64" ]]; then
+        shim_dst_file="bootx64.efi"
+        grub_dst_file="grubx64.efi"
+    elif [[ "${KOLLA_BASE_ARCH}" == "aarch64" ]]; then
+        shim_dst_file="bootaa64.efi"
+        grub_dst_file="grubaa64.efi"
+    fi
+
+    DEST=${HTTPBOOT_PATH}/esp.img
+    dd if=/dev/zero of=$DEST bs=4096 count=2048
+    mkfs.msdos -F 12 -n ESP_IMAGE $DEST
+    mmd -i $DEST EFI EFI/BOOT
+    mcopy -i $DEST -v $shim_src_file ::EFI/BOOT/$shim_dst_file
+    mcopy -i $DEST -v $grub_src_file ::EFI/BOOT/$grub_dst_file
+    mdir -i $DEST ::EFI/BOOT
+}
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    mkdir -p ${TFTPBOOT_PATH} ${HTTPBOOT_PATH}
+    chown ironic: ${TFTPBOOT_PATH} ${HTTPBOOT_PATH}
+    prepare_pxe_pxelinux
+    prepare_pxe_grub
+    prepare_ipxe
+    prepare_esp_image
+    exit 0
+fi
+
+# Template out a TFTP map file, using the TFTPBOOT_PATH variable.
+envsubst < /map-file-template > /map-file
diff --git a/kolla/docker/ironic/ironic-pxe/tftp-map-file-template b/kolla/docker/ironic/ironic-pxe/tftp-map-file-template
new file mode 100644
index 000000000..5d3243a7e
--- /dev/null
+++ b/kolla/docker/ironic/ironic-pxe/tftp-map-file-template
@@ -0,0 +1,4 @@
+re ^(${TFTPBOOT_PATH}/) ${TFTPBOOT_PATH}/\2
+re ^${TFTPBOOT_PATH}/ ${TFTPBOOT_PATH}/
+re ^(^/) ${TFTPBOOT_PATH}/\1
+re ^([^/]) ${TFTPBOOT_PATH}/\1
diff --git a/kolla/docker/iscsid/Dockerfile.j2 b/kolla/docker/iscsid/Dockerfile.j2
new file mode 100644
index 000000000..a1e4bba61
--- /dev/null
+++ b/kolla/docker/iscsid/Dockerfile.j2
@@ -0,0 +1,36 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block iscsid_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+    {% set iscsid_packages = [
+        'iscsi-initiator-utils',
+        'python3-rtslib',
+        'targetcli'
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+    {% set iscsid_packages = [
+        'open-iscsi',
+        'python3-rtslib-fb',
+        'targetcli-fb'
+    ] %}
+
+{% endif %}
+
+{{ macros.install_packages(iscsid_packages | customizable("packages"))  }}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+# NOTE(hrw): CentOS Stream 9 lacks initiatorname.iscsi file
+RUN chmod 644 /usr/local/bin/kolla_extend_start \
+    && rm -f /etc/iscsi/initiatorname.iscsi
+
+{{ macros.kolla_patch_sources() }}
+
+{% block iscsid_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/iscsid/extend_start.sh b/kolla/docker/iscsid/extend_start.sh
new file mode 100644
index 000000000..78f2317d2
--- /dev/null
+++ b/kolla/docker/iscsid/extend_start.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# check if unique iSCSI initiator name already exists
+if [[ ! -f /etc/iscsi/initiatorname.iscsi ]]; then
+    echo "Generating new iSCSI initiator name"
+    echo InitiatorName=$(/sbin/iscsi-iname) > /etc/iscsi/initiatorname.iscsi
+fi
diff --git a/kolla/docker/keepalived/Dockerfile.j2 b/kolla/docker/keepalived/Dockerfile.j2
new file mode 100644
index 000000000..2dcdeccd7
--- /dev/null
+++ b/kolla/docker/keepalived/Dockerfile.j2
@@ -0,0 +1,34 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block keepalived_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.enable_extra_repos(['mariadb']) }}
+
+{% if base_package_type == 'rpm' %}
+    {% set keepalived_packages = [
+        'keepalived',
+        'MariaDB-client'
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set keepalived_packages = [
+        'keepalived',
+        'mariadb-client'
+    ] %}
+{% endif %}
+{{ macros.install_packages(keepalived_packages | customizable("packages")) }}
+
+COPY check_alive.sh /
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start \
+    && chmod 755 /check_alive.sh
+
+{{ macros.kolla_patch_sources() }}
+
+{% block keepalived_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/keepalived/check_alive.sh b/kolla/docker/keepalived/check_alive.sh
new file mode 100644
index 000000000..857131123
--- /dev/null
+++ b/kolla/docker/keepalived/check_alive.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+
+# This will return 0 when it successfully passes all checks for all daemons
+# Failures return 1
+
+declare -A check_results
+final_result=0
+
+if [ -d "/checks" ]; then
+    CHECKS=$(find /checks -type f)
+fi
+
+if [ "${CHECKS}" ]; then
+    # Store results
+    for check in ${CHECKS}; do
+        # Run check but do not print stderr
+        # as single check can be executed manually to see the result
+        ${check} 2>/dev/null
+        check_results[${check}]=$?
+    done
+
+    # Print results and save the final result
+    for i in "${!check_results[@]}"; do
+        if [ "${check_results[$i]}" == "0" ]; then
+            echo "Keepalived check script ${i} succeeded."
+        else
+            final_result=1
+            echo "Keepalived check script ${i} failed."
+        fi
+    done
+
+    exit ${final_result}
+fi
diff --git a/kolla/docker/keepalived/extend_start.sh b/kolla/docker/keepalived/extend_start.sh
new file mode 100644
index 000000000..889da64fd
--- /dev/null
+++ b/kolla/docker/keepalived/extend_start.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# Workaround for bug #1485079
+if [ -f /run/keepalived.pid ]; then
+    rm /run/keepalived.pid
+fi
diff --git a/kolla/docker/kerbside/kerbside-api/Dockerfile.j2 b/kolla/docker/kerbside/kerbside-api/Dockerfile.j2
new file mode 100644
index 000000000..6ea99eb7a
--- /dev/null
+++ b/kolla/docker/kerbside/kerbside-api/Dockerfile.j2
@@ -0,0 +1,9 @@
+FROM {{ namespace }}/{{ image_prefix }}kerbside-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
+
+USER kerbside
diff --git a/kolla/docker/kerbside/kerbside-api/extend_start.sh b/kolla/docker/kerbside/kerbside-api/extend_start.sh
new file mode 100644
index 000000000..92ef80a22
--- /dev/null
+++ b/kolla/docker/kerbside/kerbside-api/extend_start.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+# Make the log directory
+mkdir -p /var/log/kolla/kerbside
diff --git a/kolla/docker/kerbside/kerbside-base/Dockerfile.j2 b/kolla/docker/kerbside/kerbside-base/Dockerfile.j2
new file mode 100644
index 000000000..77f881399
--- /dev/null
+++ b/kolla/docker/kerbside/kerbside-base/Dockerfile.j2
@@ -0,0 +1,38 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block kerbside_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='kerbside', groups='kerbside') }}
+
+{% if base_package_type == 'rpm' %}
+    {% set kerbside_packages = [
+        'mariadb-devel',
+        'pkgconfig'
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set kerbside_packages = [
+        'libmariadb-dev-compat',
+        'pkg-config'
+    ] %}
+{% endif %}
+
+{{ macros.install_packages(kerbside_packages | customizable("packages")) }}
+
+{% set kerbside_pip_packages = [
+    '/kerbside'
+] %}
+
+ADD kerbside-base-archive /kerbside-source
+RUN ln -s kerbside-source/* kerbside \
+    && if [ "$(ls /plugins)" ]; then \
+           {{ macros.install_pip(kerbside_plugins_pip_packages) }}; \
+       fi \
+    && {{ macros.install_pip(kerbside_pip_packages | customizable("pip_packages"), false) }} \
+    && rm -f /etc/machine-id
+
+{% block kerbside_base_footer %}{% endblock %}
diff --git a/kolla/docker/kerbside/kerbside-proxy/Dockerfile.j2 b/kolla/docker/kerbside/kerbside-proxy/Dockerfile.j2
new file mode 100644
index 000000000..6ea99eb7a
--- /dev/null
+++ b/kolla/docker/kerbside/kerbside-proxy/Dockerfile.j2
@@ -0,0 +1,9 @@
+FROM {{ namespace }}/{{ image_prefix }}kerbside-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
+
+USER kerbside
diff --git a/kolla/docker/kerbside/kerbside-proxy/extend_start.sh b/kolla/docker/kerbside/kerbside-proxy/extend_start.sh
new file mode 100644
index 000000000..92ef80a22
--- /dev/null
+++ b/kolla/docker/kerbside/kerbside-proxy/extend_start.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+# Make the log directory
+mkdir -p /var/log/kolla/kerbside
diff --git a/kolla/docker/keystone/keystone-base/Dockerfile.j2 b/kolla/docker/keystone/keystone-base/Dockerfile.j2
new file mode 100644
index 000000000..faa424fa7
--- /dev/null
+++ b/kolla/docker/keystone/keystone-base/Dockerfile.j2
@@ -0,0 +1,45 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block keystone_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='keystone') }}
+
+{% if base_package_type == 'rpm' %}
+
+{{ macros.enable_extra_repos(['epel']) }}
+
+    {% set keystone_base_packages = [
+        'cyrus-sasl-devel',
+        'openldap-devel',
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+    {% set keystone_base_packages = [
+        'libldap-common',
+        'libldap2-dev',
+        'libsasl2-dev',
+    ] %}
+{% endif %}
+{{ macros.install_packages(keystone_base_packages | customizable("packages")) }}
+
+{% block keystone_source_install %}
+ADD keystone-base-archive /keystone-base-source
+
+{% set keystone_base_pip_packages = [
+    '/keystone[ldap]',
+] %}
+
+RUN ln -s keystone-base-source/* keystone \
+    && {{ macros.install_pip(keystone_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/keystone \
+    && cp -r /keystone/etc/* /etc/keystone/
+{% endblock %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block keystone_base_footer %}{% endblock %}
diff --git a/kolla/docker/keystone/keystone-fernet/Dockerfile.j2 b/kolla/docker/keystone/keystone-fernet/Dockerfile.j2
new file mode 100644
index 000000000..da32ddb86
--- /dev/null
+++ b/kolla/docker/keystone/keystone-fernet/Dockerfile.j2
@@ -0,0 +1,34 @@
+FROM {{ namespace }}/{{ image_prefix }}keystone-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block keystone_fernet_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+    {% set keystone_fernet_packages = [
+        'cronie',
+        'openssh-clients',
+        'rsync'
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set keystone_fernet_packages = [
+        'cron',
+        'openssh-client',
+        'rsync'
+    ] %}
+{% endif %}
+{{ macros.install_packages(keystone_fernet_packages | customizable("packages")) }}
+
+COPY fetch_fernet_tokens.py /usr/bin/
+COPY keystone_bootstrap.sh /usr/local/bin/kolla_keystone_bootstrap
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start \
+    && chmod 755 /usr/local/bin/kolla_keystone_bootstrap /usr/bin/fetch_fernet_tokens.py
+
+{{ macros.kolla_patch_sources() }}
+
+{% block keystone_fernet_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/keystone/keystone-fernet/extend_start.sh b/kolla/docker/keystone/keystone-fernet/extend_start.sh
new file mode 100644
index 000000000..cf356949f
--- /dev/null
+++ b/kolla/docker/keystone/keystone-fernet/extend_start.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+FERNET_SYNC=/usr/bin/fernet-node-sync.sh
+FERNET_TOKEN_DIR="/etc/keystone/fernet-keys"
+
+if [[ -f "${FERNET_SYNC}" ]]; then
+    ${FERNET_SYNC}
+fi
+
+if [[ $(stat -c %U:%G ${FERNET_TOKEN_DIR}) != "keystone:keystone" ]]; then
+    chown keystone:keystone ${FERNET_TOKEN_DIR}
+fi
diff --git a/kolla/docker/keystone/keystone-fernet/fetch_fernet_tokens.py b/kolla/docker/keystone/keystone-fernet/fetch_fernet_tokens.py
new file mode 100644
index 000000000..c57943630
--- /dev/null
+++ b/kolla/docker/keystone/keystone-fernet/fetch_fernet_tokens.py
@@ -0,0 +1,83 @@
+#!/usr/bin/python
+
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Basically this module will fetch the fernet tokens and compare them to the
+# required time constrains to determine whether the host needs to resync with
+# other nodes in the cluster.
+import argparse
+from datetime import datetime
+from datetime import timedelta
+import json
+import os
+import sys
+
+# Adding nosec since this fails bandit B105, 'Possible hardcoded password'.
+TOKEN_PATH = '/etc/keystone/fernet-keys'  # nosec
+
+
+def json_exit(msg=None, failed=False, changed=False):
+    if type(msg) is not dict:
+        msg = {'msg': str(msg)}
+    msg.update({'failed': failed, 'changed': changed})
+    print(json.dumps(msg))
+    sys.exit()
+
+
+def has_file(filename_path):
+    if not os.path.exists(filename_path):
+        return False
+    return True
+
+
+def num_tokens():
+    _, _, files = next(os.walk(TOKEN_PATH))
+    return len(files)
+
+
+def tokens_populated(expected):
+    return num_tokens() >= int(expected)
+
+
+def token_stale(seconds, filename='0'):
+    max_token_age = datetime.now() - timedelta(seconds=int(seconds))
+    filename_path = os.path.join(TOKEN_PATH, filename)
+
+    if not has_file(filename_path):
+        return True
+    modified_date = datetime.fromtimestamp(os.path.getmtime(filename_path))
+    return modified_date < max_token_age
+
+
+def main():
+    parser = argparse.ArgumentParser(description='''Checks to see if a fernet
+        token no older than a desired time.''')
+    parser.add_argument('-t', '--time',
+                        help='Time in seconds for a token rotation',
+                        required=True)
+    parser.add_argument('-f', '--filename',
+                        help='Filename of token to check',
+                        default='0')
+    parser.add_argument('-n', '--number',
+                        help='Minimum number of tokens that should exist',
+                        required=True)
+    args = parser.parse_args()
+
+    json_exit({
+        'populated': tokens_populated(args.number),
+        'update_required': token_stale(args.time, args.filename),
+    })
+
+
+if __name__ == '__main__':
+    main()
diff --git a/kolla/docker/keystone/keystone-fernet/keystone_bootstrap.sh b/kolla/docker/keystone/keystone-fernet/keystone_bootstrap.sh
new file mode 100644
index 000000000..d361767bb
--- /dev/null
+++ b/kolla/docker/keystone/keystone-fernet/keystone_bootstrap.sh
@@ -0,0 +1,43 @@
+#!/bin/bash
+
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -x
+
+USERNAME=$1
+GROUP=$2
+
+function fail_json {
+    echo '{"failed": true, "msg": "'$1'", "changed": true}'
+    exit 1
+}
+
+function exit_json {
+    echo '{"failed": false, "changed": '"${changed}"'}'
+}
+
+changed="false"
+keystone_bootstrap=$(keystone-manage --config-file /etc/keystone/keystone.conf fernet_setup --keystone-user ${USERNAME} --keystone-group ${GROUP} 2>&1)
+if [[ $? != 0 ]]; then
+    fail_json "${keystone_bootstrap}"
+fi
+
+changed=$(echo "${keystone_bootstrap}" | awk '
+    /Key repository is already initialized/ {count++}
+    END {
+        if (count == 1) changed="true"; else changed="false"
+        print changed
+    }'
+)
+
+exit_json
diff --git a/kolla/docker/keystone/keystone-ssh/Dockerfile.j2 b/kolla/docker/keystone/keystone-ssh/Dockerfile.j2
new file mode 100644
index 000000000..af290bd5f
--- /dev/null
+++ b/kolla/docker/keystone/keystone-ssh/Dockerfile.j2
@@ -0,0 +1,38 @@
+FROM {{ namespace }}/{{ image_prefix }}keystone-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block keystone_ssh_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='keystone', shell='/bin/bash') }}
+
+{% if base_package_type == 'rpm' %}
+    {% set keystone_ssh_packages = [
+        'openssh-server',
+        'rsync'
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+    {% set keystone_ssh_packages = [
+        'openssh-server',
+        'rsync'
+    ] %}
+
+RUN mkdir -p /var/run/sshd \
+    && chmod 0755 /var/run/sshd
+
+{% endif %}
+{{ macros.install_packages(keystone_ssh_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN sed -ri 's/session(\s+)required(\s+)pam_loginuid.so/session\1optional\2pam_loginuid.so/' /etc/pam.d/sshd \
+    && chmod 644 /usr/local/bin/kolla_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block keystone_ssh_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/keystone/keystone-ssh/extend_start.sh b/kolla/docker/keystone/keystone-ssh/extend_start.sh
new file mode 100644
index 000000000..559cd65a9
--- /dev/null
+++ b/kolla/docker/keystone/keystone-ssh/extend_start.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+# NOTE(mnasiadka): CentOS 10 does not support dsa
+SSH_HOST_KEY_TYPES=( "rsa" "ecdsa" "ed25519" )
+
+for key_type in ${SSH_HOST_KEY_TYPES[@]}; do
+    KEY_PATH=/etc/ssh/ssh_host_${key_type}_key
+    if [[ ! -f "${KEY_PATH}" ]]; then
+        ssh-keygen -q -t ${key_type} -f ${KEY_PATH} -N ""
+    fi
+done
+
+mkdir -p /var/lib/keystone/.ssh
+
+if [[ $(stat -c %U:%G /var/lib/keystone/.ssh) != "keystone:keystone" ]]; then
+    sudo chown keystone: /var/lib/keystone/.ssh
+fi
diff --git a/kolla/docker/keystone/keystone/Dockerfile.j2 b/kolla/docker/keystone/keystone/Dockerfile.j2
new file mode 100644
index 000000000..742626c05
--- /dev/null
+++ b/kolla/docker/keystone/keystone/Dockerfile.j2
@@ -0,0 +1,45 @@
+FROM {{ namespace }}/{{ image_prefix }}keystone-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block keystone_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+    {% set keystone_packages = [
+        'krb5-devel',
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set keystone_packages = [
+        'libkrb5-dev',
+    ] %}
+{% endif %}
+{{ macros.install_packages(keystone_packages | customizable("packages")) }}
+
+{% set keystone_pip_packages = [
+    'requests-kerberos',
+] %}
+
+RUN {{ macros.install_pip(keystone_pip_packages | customizable("pip_packages")) }}
+
+ADD plugins-archive /
+
+{% set keystone_plugins_pip_packages = [
+    '/plugins/*',
+] %}
+
+COPY keystone_bootstrap.sh /usr/local/bin/kolla_keystone_bootstrap
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN chmod 644 /usr/local/bin/kolla_extend_start \
+    && chmod 755 /usr/local/bin/kolla_keystone_bootstrap \
+    && if [ "$(ls /plugins)" ]; then \
+        {{ macros.install_pip(keystone_plugins_pip_packages) }}; \
+    fi
+
+{{ macros.kolla_patch_sources() }}
+
+{% block keystone_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/keystone/keystone/extend_start.sh b/kolla/docker/keystone/keystone/extend_start.sh
new file mode 100644
index 000000000..b45c94d0d
--- /dev/null
+++ b/kolla/docker/keystone/keystone/extend_start.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+
+# Create log dir for Keystone logs
+KEYSTONE_LOG_DIR="/var/log/kolla/keystone"
+if [[ ! -d "${KEYSTONE_LOG_DIR}" ]]; then
+    mkdir -p ${KEYSTONE_LOG_DIR}
+fi
+if [[ $(stat -c %U:%G ${KEYSTONE_LOG_DIR}) != "keystone:kolla" ]]; then
+    chown keystone:kolla ${KEYSTONE_LOG_DIR}
+fi
+if [ ! -f "${KEYSTONE_LOG_DIR}/keystone.log" ]; then
+    touch ${KEYSTONE_LOG_DIR}/keystone.log
+fi
+if [[ $(stat -c %U:%G ${KEYSTONE_LOG_DIR}/keystone.log) != "keystone:keystone" ]]; then
+    chown keystone:keystone ${KEYSTONE_LOG_DIR}/keystone.log
+fi
+if [[ $(stat -c %a ${KEYSTONE_LOG_DIR}) != "755" ]]; then
+    chmod 755 ${KEYSTONE_LOG_DIR}
+fi
+
+EXTRA_KEYSTONE_MANAGE_ARGS=${EXTRA_KEYSTONE_MANAGE_ARGS-}
+# Upgrade and exit if KOLLA_UPGRADE variable is set. This catches all cases
+# of the KOLLA_UPGRADE variable being set, including empty.
+if [[ "${!KOLLA_UPGRADE[@]}" ]]; then
+    # TODO(duonghq): check doctor result here
+    # TODO: find reason why doctor failed in gate
+    # sudo -H -u keystone keystone-manage doctor
+    sudo -H -u keystone keystone-manage ${EXTRA_KEYSTONE_MANAGE_ARGS} db_sync --expand
+    sudo -H -u keystone keystone-manage ${EXTRA_KEYSTONE_MANAGE_ARGS} db_sync --migrate
+    exit 0
+fi
+
+# Contract database and exit if KOLLA_FINISH_UPGRADE variable is set.
+# This catches all cases of the KOLLA_FINISH_UPGRADE variable being set,
+# including empty.
+if [[ "${!KOLLA_FINISH_UPGRADE[@]}" ]]; then
+    sudo -H -u keystone keystone-manage ${EXTRA_KEYSTONE_MANAGE_ARGS} db_sync --contract
+    exit 0
+fi
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    sudo -H -u keystone keystone-manage ${EXTRA_KEYSTONE_MANAGE_ARGS} db_sync
+    exit 0
+fi
diff --git a/kolla/docker/keystone/keystone/keystone_bootstrap.sh b/kolla/docker/keystone/keystone/keystone_bootstrap.sh
new file mode 100644
index 000000000..1b04d99b6
--- /dev/null
+++ b/kolla/docker/keystone/keystone/keystone_bootstrap.sh
@@ -0,0 +1,66 @@
+#!/bin/bash
+
+set -o pipefail
+
+# NOTE(SamYaple): Kolla needs to wraps `keystone-manage bootstrap` to ensure
+# any change is reported correctly for idempotency. This script will exit with
+# valid json that can be parsed with information about if the task has failed
+# and if anything changed.
+
+USERNAME=$1
+PASSWORD=$2
+if [ -z "$PASSWORD" ]; then
+    # Avoid having the password always come in via CLI (which makes
+    # it show up in things like ara)
+    PASSWORD="$OS_BOOTSTRAP_PASSWORD"
+fi
+PROJECT=$3
+ROLE=$4
+if [ $# -ge 8 ]; then
+    # ignored ADMIN_URL compat mode
+    # ADMIN_URL=$5
+    INTERNAL_URL=$6
+    PUBLIC_URL=$7
+    REGION=$8
+else
+    # no ADMIN_URL modern mode
+    INTERNAL_URL=$5
+    PUBLIC_URL=$6
+    REGION=$7
+fi
+
+function fail_json {
+    echo '{"failed": true, "msg": "'$1'", "changed": true}'
+    exit 1
+}
+
+function exit_json {
+    echo '{"failed": false, "changed": '"${changed}"'}'
+}
+
+changed="false"
+# NOTE(mgoddard): pipe through cat -v to remove unprintable control characters
+# which prevent JSON decoding.
+# NOTE(yoctozepto): also apply sed to escape double quotation marks
+# and backslashes
+keystone_bootstrap=$(keystone-manage bootstrap --bootstrap-username "${USERNAME}" --bootstrap-password "${PASSWORD}" --bootstrap-project-name "${PROJECT}" --bootstrap-role-name "${ROLE}" --bootstrap-internal-url "${INTERNAL_URL}" --bootstrap-public-url "${PUBLIC_URL}" --bootstrap-service-name "keystone" --bootstrap-region-id "${REGION}" 2>&1 | cat -v | sed 's/\\/\\\\/g' | sed 's/"/\\"/g')
+if [[ $? != 0 ]]; then
+    fail_json "${keystone_bootstrap}"
+fi
+
+changed=$(echo "${keystone_bootstrap}" | awk '
+    /Domain default already exists, skipping creation./ ||
+    /Project '"${PROJECT}"' already exists, skipping creation./ ||
+    /User '"${USERNAME}"' already exists, skipping creation./ ||
+    /Role '"${ROLE}"' exists, skipping creation./ ||
+    /User '"${USERNAME}"' already has '"${ROLE}"' on '"${PROJECT}"'./ ||
+    /Region '"${REGION}"' exists, skipping creation./ ||
+    /Skipping internal endpoint as already created/ ||
+    /Skipping public endpoint as already created/ {count++}
+    END {
+        if (count == 9) changed="false"; else changed="true"
+        print changed
+    }'
+)
+
+exit_json
diff --git a/kolla/docker/kolla-toolbox/Dockerfile.j2 b/kolla/docker/kolla-toolbox/Dockerfile.j2
new file mode 100644
index 000000000..eac78905d
--- /dev/null
+++ b/kolla/docker/kolla-toolbox/Dockerfile.j2
@@ -0,0 +1,129 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block kolla_toolbox_header %}{% endblock %}
+
+{% set venv_path='/opt/ansible' %}
+{% set os_client_config= venv_path + '/lib/python3/site-packages/os_client_config/defaults.json' %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='ansible') }}
+{{ macros.configure_user(name='rabbitmq') }}
+
+{{ macros.enable_extra_repos(['erlang', 'rabbitmq']) }}
+
+{% block rabbitmq_apt_preferences %}
+{% if base_package_type == 'deb' %}
+COPY apt_preferences_rabbitmq.{{ base_distro }} /etc/apt/preferences.d/rabbitmq
+{% endif %}
+{% endblock %}
+
+{% if base_package_type == 'rpm' %}
+
+{{ macros.enable_extra_repos(['crb', 'epel', 'openvswitch']) }}
+
+    {% set kolla_toolbox_packages = [
+        'erlang-27.*',
+        'gcc',
+        'gdisk',
+        'git',
+        'jq',
+        'libffi-devel',
+        'libxml2-devel',
+        'libxslt-devel',
+        'make',
+        'openssh-clients',
+        'openssl-devel',
+        'openvswitch${KOLLA_RPM_OVS_VERSION}',
+        'python3',
+        'python3-devel',
+        'rabbitmq-server-4.2.*'
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+    {% set kolla_toolbox_packages = [
+        'build-essential',
+        'ca-certificates',
+        'gdisk',
+        'git',
+        'jq',
+        'libffi-dev',
+        'libssl-dev',
+        'libxslt1-dev',
+        'openvswitch-switch',
+        'python3-dev',
+        'python3-venv',
+        'rabbitmq-server',
+     ] %}
+{% endif %}
+{{ macros.install_packages(kolla_toolbox_packages | customizable("packages")) }}
+
+{% block kolla_toolbox_pip_conf %}
+ENV UPPER_CONSTRAINTS_FILE=/requirements/upper-constraints.txt
+{% endblock %}
+
+{% block kolla_toolbox_upper_constraints %}
+ADD kolla-toolbox-archive /kolla-toolbox-source
+
+RUN case "$UPPER_CONSTRAINTS_FILE" in \
+        http*) mkdir -p /requirements && curl -LO $UPPER_CONSTRAINTS_FILE /requirements/upper-constraints.txt ;; \
+        *)      ln -s kolla-toolbox-source/* /requirements ;; \
+    esac \
+    && {{ macros.upper_constraints_remove("openstacksdk") }} \
+    && python3 -m venv --system-site-packages {{ venv_path }} \
+    && KOLLA_DISTRO_PYTHON_VERSION=$(/usr/bin/python3 -c "import sys; print('{}.{}'.format(sys.version_info.major, sys.version_info.minor))") \
+    && cd {{ venv_path }}/lib \
+    && ln -s python${KOLLA_DISTRO_PYTHON_VERSION} {{ venv_path }}/lib/python3
+{% endblock %}
+
+ENV PATH {{ venv_path }}/bin:$PATH
+
+{% set kolla_toolbox_pip_packages = [
+        'ansible-core==2.20.*',
+        'ansible-runner',
+        'cmd2',
+        'openstacksdk',
+        'os-client-config',
+        'pbr',
+        'pymysql',
+        'python-ironicclient',
+        'python-openstackclient',
+        'pytz',
+        'pyudev',
+    ] %}
+
+RUN {{ macros.install_pip(['pip', 'wheel', 'setuptools']) }} \
+    && {{ macros.install_pip((kolla_toolbox_pip_packages | customizable("pip_packages"))) }} \
+    && mkdir -p /etc/ansible /usr/share/ansible \
+    && echo 'localhost ansible_connection=local ansible_python_interpreter={{ venv_path }}/bin/python' > /etc/ansible/hosts \
+    && sed -i 's|  "identity_api_version": "2.0",|  "identity_api_version": "3",|' {{ os_client_config }}
+
+{% block kolla_toolbox_collections_install %}
+COPY requirements.yml /var/lib/ansible/
+RUN fail=1; for i in $(seq 1 5); do if \
+ansible-galaxy collection install --timeout 120 -p /usr/share/ansible/collections -r /var/lib/ansible/requirements.yml \
+; then fail=0; break; fi; echo "Collection download failed, retrying"; sleep 5; done; \
+if [ "$fail" -eq 1 ]; then exit 1; fi
+
+ENV ANSIBLE_LIBRARY /usr/share/ansible:$ANSIBLE_LIBRARY
+{% endblock %}
+
+COPY ansible.cfg /etc/ansible/ansible.cfg
+COPY ansible_sudoers /etc/sudoers.d/kolla_ansible_sudoers
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+COPY kolla_toolbox.sh /usr/local/bin/kolla_toolbox
+
+RUN chmod 644 /etc/ansible/ansible.cfg \
+              /usr/local/bin/kolla_extend_start \
+    && chmod 755 /usr/local/bin/kolla_toolbox \
+    && chmod 440 /etc/sudoers.d/kolla_ansible_sudoers
+
+{{ macros.kolla_patch_sources() }}
+
+{% block kolla_toolbox_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER ansible
diff --git a/kolla/docker/kolla-toolbox/ansible.cfg b/kolla/docker/kolla-toolbox/ansible.cfg
new file mode 100644
index 000000000..ec505f4a4
--- /dev/null
+++ b/kolla/docker/kolla-toolbox/ansible.cfg
@@ -0,0 +1,4 @@
+[defaults]
+inject_facts_as_vars = False
+log_path = /var/log/kolla/ansible.log
+remote_tmp = /tmp
diff --git a/kolla/docker/kolla-toolbox/ansible_sudoers b/kolla/docker/kolla-toolbox/ansible_sudoers
new file mode 100644
index 000000000..5a3f109b4
--- /dev/null
+++ b/kolla/docker/kolla-toolbox/ansible_sudoers
@@ -0,0 +1,3 @@
+Defaults secure_path="/opt/ansible/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+
+ansible ALL=(root) NOPASSWD: /opt/ansible/bin/ansible localhost -m find_disks -a *, /usr/local/bin/ansible localhost -m find_disks -a *
diff --git a/kolla/docker/kolla-toolbox/apt_preferences_rabbitmq.debian b/kolla/docker/kolla-toolbox/apt_preferences_rabbitmq.debian
new file mode 120000
index 000000000..f1cc84d9b
--- /dev/null
+++ b/kolla/docker/kolla-toolbox/apt_preferences_rabbitmq.debian
@@ -0,0 +1 @@
+../rabbitmq/apt_preferences_rabbitmq.debian
\ No newline at end of file
diff --git a/kolla/docker/kolla-toolbox/apt_preferences_rabbitmq.ubuntu b/kolla/docker/kolla-toolbox/apt_preferences_rabbitmq.ubuntu
new file mode 120000
index 000000000..977ded074
--- /dev/null
+++ b/kolla/docker/kolla-toolbox/apt_preferences_rabbitmq.ubuntu
@@ -0,0 +1 @@
+../rabbitmq/apt_preferences_rabbitmq.ubuntu
\ No newline at end of file
diff --git a/kolla/docker/kolla-toolbox/extend_start.sh b/kolla/docker/kolla-toolbox/extend_start.sh
new file mode 100644
index 000000000..198587145
--- /dev/null
+++ b/kolla/docker/kolla-toolbox/extend_start.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+if [[ ! -f "/var/log/kolla/ansible.log" ]]; then
+    touch /var/log/kolla/ansible.log
+fi
+
+if [[ $(stat -c %U:%G /var/log/kolla/ansible.log) != "ansible:kolla" ]]; then
+    chown -R ansible:kolla /var/log/kolla/ansible.log
+fi
+
+if [[ $(stat -c %a /var/log/kolla/ansible.log) != "664" ]]; then
+    chmod 664 /var/log/kolla/ansible.log
+fi
diff --git a/kolla/docker/kolla-toolbox/kolla_toolbox.sh b/kolla/docker/kolla-toolbox/kolla_toolbox.sh
new file mode 100644
index 000000000..5dfd65338
--- /dev/null
+++ b/kolla/docker/kolla-toolbox/kolla_toolbox.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+catch_term() {
+    exit 0
+}
+
+catch_quit() {
+    exit 0
+}
+
+trap catch_term SIGTERM
+trap catch_quit SIGQUIT
+
+while :; do
+    sleep 1
+done
diff --git a/kolla/docker/kolla-toolbox/requirements.yml b/kolla/docker/kolla-toolbox/requirements.yml
new file mode 100644
index 000000000..83c795142
--- /dev/null
+++ b/kolla/docker/kolla-toolbox/requirements.yml
@@ -0,0 +1,14 @@
+---
+collections:
+  - name: ansible.posix
+    version: '<3'
+  - name: community.general
+    version: '<13'
+  - name: community.mysql
+    version: '<5'
+  - name: community.rabbitmq
+    version: '<2'
+  - name: openstack.cloud
+    version: '<3'
+  - name: openvswitch.openvswitch
+    version: '<3'
diff --git a/kolla/docker/letsencrypt/letsencrypt-base/Dockerfile.j2 b/kolla/docker/letsencrypt/letsencrypt-base/Dockerfile.j2
new file mode 100644
index 000000000..8e9e60db9
--- /dev/null
+++ b/kolla/docker/letsencrypt/letsencrypt-base/Dockerfile.j2
@@ -0,0 +1,14 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block letsencrypt_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block letsencrypt_base_footer %}{% endblock %}
diff --git a/kolla/docker/letsencrypt/letsencrypt-base/extend_start.sh b/kolla/docker/letsencrypt/letsencrypt-base/extend_start.sh
new file mode 100644
index 000000000..0300f0b44
--- /dev/null
+++ b/kolla/docker/letsencrypt/letsencrypt-base/extend_start.sh
@@ -0,0 +1,69 @@
+#!/bin/bash
+
+# Logs
+
+if [[ ! -d "/var/log/kolla/letsencrypt" ]]; then
+    mkdir -p /var/log/kolla/letsencrypt
+fi
+if [[ $(stat -c %a /var/log/kolla/letsencrypt) != "755" ]]; then
+    chmod 755 /var/log/kolla/letsencrypt
+fi
+
+# Structure for lego and webserver
+
+FOLDERS_LEGO="/etc/letsencrypt /etc/letsencrypt/lego /etc/letsencrypt/lego/internal /etc/letsencrypt/lego/external"
+FOLDERS_WEBSERVER="/etc/letsencrypt/http-01 /etc/letsencrypt/http-01/.well-known /etc/letsencrypt/http-01/.well-known/acme-challenge"
+
+if [[ "${KOLLA_BASE_DISTRO}" =~ debian|ubuntu ]]; then
+    USER="www-data"
+    GROUP="www-data"
+    USERGROUP_WEBSERVER="${USER}:${GROUP}"
+    USERGROUP="haproxy:haproxy"
+else
+    USER="apache"
+    GROUP="apache"
+    USERGROUP_WEBSERVER="${USER}:${GROUP}"
+    USERGROUP="haproxy:haproxy"
+fi
+
+for folder in ${FOLDERS_LEGO}; do
+    if [[ ! -d "${folder}" ]]; then
+        mkdir -p ${folder}
+    fi
+
+    if [[ $(stat -c %U:%G ${folder}) != "${USERGROUP}" ]]; then
+        if getent passwd ${USER} 2 > /dev/null; then
+            chown ${USERGROUP} ${folder}
+        fi
+    fi
+
+    if [[ "${folder}" == "/etc/letsencrypt" ]]; then
+        if [[ $(stat -c %a ${folder}) != "751" ]]; then
+            chmod 751 ${folder}
+        fi
+    else
+        if [[ $(stat -c %a ${folder}) != "755" ]]; then
+            chmod 755 ${folder}
+        fi
+    fi
+done
+
+for folder in ${FOLDERS_WEBSERVER}; do
+    if [[ ! -d "${folder}" ]]; then
+        mkdir -p ${folder}
+    fi
+
+    if [[ $(stat -c %U:%G ${folder}) != "${USERGROUP_WEBSERVER}" ]]; then
+        if getent passwd ${USER} 2 > /dev/null; then
+            chown ${USERGROUP_WEBSERVER} ${folder}
+        fi
+    fi
+
+    if [[ $(stat -c %a ${folder}) != "755" ]]; then
+        chmod 755 ${folder}
+    fi
+done
+
+if [ -e /usr/local/bin/kolla_letsencrypt_extend_start ]; then
+    . /usr/local/bin/kolla_letsencrypt_extend_start
+fi
diff --git a/kolla/docker/letsencrypt/letsencrypt-lego/Dockerfile.j2 b/kolla/docker/letsencrypt/letsencrypt-lego/Dockerfile.j2
new file mode 100755
index 000000000..b7cda214e
--- /dev/null
+++ b/kolla/docker/letsencrypt/letsencrypt-lego/Dockerfile.j2
@@ -0,0 +1,41 @@
+FROM {{ namespace }}/{{ image_prefix }}letsencrypt-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block letsencrypt_lego_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='letsencrypt', shell='/bin/bash') }}
+
+{% if base_package_type == 'rpm' %}
+    {% set letsencrypt_lego_packages = [
+        'openssh-clients',
+        'cronie',
+        'rsync'
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set letsencrypt_lego_packages = [
+        'openssh-client',
+        'cron',
+        'rsync'
+    ] %}
+{% endif %}
+{{ macros.install_packages(letsencrypt_lego_packages | customizable("packages")) }}
+
+{% block letsencrypt_lego_install %}
+ADD letsencrypt-lego-archive /lego-source
+
+RUN cp -r /lego-source/lego /opt/
+{% endblock %}
+
+COPY letsencrypt-certificates.sh /usr/bin/letsencrypt-certificates
+COPY sync-and-update-certificate.sh /usr/bin/sync-and-update-certificate
+
+RUN chmod +x /usr/bin/letsencrypt-certificates /usr/bin/sync-and-update-certificate
+
+{{ macros.kolla_patch_sources() }}
+
+{% block letsencrypt_lego_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/letsencrypt/letsencrypt-lego/letsencrypt-certificates.sh b/kolla/docker/letsencrypt/letsencrypt-lego/letsencrypt-certificates.sh
new file mode 100755
index 000000000..83bdede87
--- /dev/null
+++ b/kolla/docker/letsencrypt/letsencrypt-lego/letsencrypt-certificates.sh
@@ -0,0 +1,226 @@
+#!/bin/bash
+
+function log_info {
+    local message="${1}"
+
+    echo "$(date '+%Y/%m/%d %H:%M:%S') [INFO] ${message}"
+}
+
+function log_error {
+    local message="${1}"
+
+    echo "$(date '+%Y/%m/%d %H:%M:%S') [ERROR] ${message}"
+}
+
+function obtain_or_renew_certificate {
+    local certificate_fqdns="${1}"
+    local certificate_type="${2}"
+    local listen_port="${3}"
+    local valid_days="${4}"
+    local acme_url="${5}"
+    local mail="${6}"
+    local letsencrypt_ssh_port="${7}"
+    local eab="${8}"
+    local hmac="${9}"
+    local key_id="${10}"
+    local letsencrypt_key_type="${11:-}"
+
+    certificate_domain_opts=$(echo ${certificate_fqdns} | sed -r -e 's/^/,/g' -e 's/,/--domains=/g' -e 's/--/ --/g')
+    certificate_fqdn=$(echo ${certificate_fqdns} | awk -F ',' '{print $1}')
+    certificate_fqdns=$(echo ${certificate_fqdns} | sed -r 's/,/\ /g')
+
+    if [ -d "/etc/letsencrypt/lego/${certificate_type}/certificates" ]; then
+        garbage_count=$(find /etc/letsencrypt/lego/${certificate_type}/certificates/ -type f | grep -v "${certificate_fqdn}" | wc -l)
+        if [ ${garbage_count} -ne 0 ]; then
+            log_info "[${certificate_fqdn} - cron] Cleaning up garbage in certificates directory."
+            find /etc/letsencrypt/lego/${certificate_type}/certificates/ -type f | grep -v "${certificate_fqdn}" | xargs rm -f
+        fi
+    fi
+
+    if [ -e "/etc/letsencrypt/lego/${certificate_type}/certificates/${certificate_fqdn}.pem" ]; then
+        certificate_current_fqdns=$(openssl x509 -text -in /etc/letsencrypt/lego/${certificate_type}/certificates/${certificate_fqdn}.pem \
+                                    | grep DNS: \
+                                    | sed -r -e 's/\ *DNS://g'  -e 's/^/,/g' -e 's/$/,/g')
+
+        local domains_add=""
+        for i in ${certificate_fqdns}; do
+            if ! echo "${certificate_current_fqdns}" | grep -q ",${i},"; then
+                domains_add="${domains_add} ${i}"
+            fi
+        done
+        domains_add=$(echo "${domains_add}" | sed -r -e 's/^\ //g' -e 's/\ /, /g')
+
+        if [ "${domains_add}" != "" ]; then
+            log_info "[${certificate_fqdn} - cron] Domains ${domains_add} will be added to certificate."
+            rm -f /etc/letsencrypt/lego/${certificate_type}/certificates/*
+        fi
+    fi
+
+    [ ! -e "/etc/letsencrypt/lego/${certificate_type}/certificates/${certificate_fqdn}.pem" ] && local lego_action="run" || local lego_action="renew"
+
+    if [ "${eab}" = "true" ]; then
+        if [ "${hmac}" != "NONE" ] && [ "${key_id}" != "NONE" ]; then
+            eab_opts="--eab --hmac ${hmac} --kid ${key_id}"
+        else
+            eab_opts=""
+            log_error "External Account Binding requires EAB key ID and EAB HMAC key."
+            exit 1
+        fi
+    fi
+
+    log_info "[${certificate_fqdn} - cron] Obtaining certificate for domains ${certificate_fqdns}."
+    mapfile -t cmd_output < <(/opt/lego --email="${mail}" \
+                                        $( [ -n "${letsencrypt_key_type}" ] && echo "--key-type ${letsencrypt_key_type}" ) \
+                                        ${certificate_domain_opts} \
+                                        --server "${acme_url}" \
+                                        --path "/etc/letsencrypt/lego/${certificate_type}/" \
+                                        --http.webroot "/etc/letsencrypt/http-01" \
+                                        --http.port ${listen_port} \
+                                        --cert.timeout ${valid_days} \
+                                        --accept-tos \
+                                        --http \
+                                        ${eab_opts} \
+                                        --pem ${lego_action} \
+                                        --${lego_action}-hook="/usr/bin/sync-and-update-certificate --${certificate_type} --fqdn ${certificate_fqdn} --haproxies-ssh ${letsencrypt_ssh_port}" 2>&1)
+
+    # Fix LOG formatting as some output has no same format
+    #
+    # Example:
+    #
+    # 2023/10/31 11:52:26 No key found for account michal.arbet@ultimum.io. Generating a P256 key.
+    # 2023/10/31 11:52:26 Saved key to /etc/letsencrypt/lego/external/accounts/acme-v02.api.letsencrypt.org/michal.arbet@ultimum.io/keys/michal.arbet@ultimum.io.key
+    # 2023/10/31 11:52:27 [INFO] acme: Registering account for michal.arbet@ultimum.io
+    # !!!! HEADS UP !!!!
+
+    for i in "${cmd_output[@]}"; do
+        if [ "${i}" == "" ]; then
+            continue
+        fi
+        if ! echo "${i}" | grep -q '\[INFO\]'; then
+            if [ "$(echo "${i}" | awk -F ' ' '{print $1}')" == "$(date +%Y/%m/%d)" ]; then
+                echo "${i}" | awk '{out = ""; for (i = 3; i <= NF; i++) {out = out " " $i}; print $1" "$2" [INFO]"out}'
+            else
+                dt=$(date '+%Y/%m/%d %H:%M:%S')
+                echo "${i}" | awk -v dt="$dt" '{print dt" [INFO] "$0}'
+            fi
+        else
+            echo "${i}"
+        fi
+    done
+}
+
+
+# Parser
+
+INTERNAL_SET="false"
+EXTERNAL_SET="false"
+EXTERNAL_ACCOUNT_BINDING="false"
+HMAC="NONE"
+KEY_ID="NONE"
+LOG_FILE="/var/log/kolla/letsencrypt/lesencrypt-lego.log"
+
+
+VALID_ARGS=$(getopt -o ief:p:d:m:a:v:h:k: --long internal,external,fqdns:,port:,days:,mail:,acme:,vips:,haproxies-ssh:,eab,kid:,hmac:,key-type: -- "$@")
+if [[ $? -ne 0 ]]; then
+    exit 1;
+fi
+
+eval set -- "$VALID_ARGS"
+while [ : ]; do
+    case "$1" in
+        -i | --internal)
+            CERT_TYPE="internal"
+            INTERNAL_SET="true"
+            shift
+            ;;
+        -e | --external)
+            CERT_TYPE="external"
+            EXTERNAL_SET="true"
+            shift
+            ;;
+        -f | --fqdns)
+            FQDNS="${2}"
+            shift 2
+            ;;
+        -p | --port)
+            PORT="${2}"
+            shift 2
+            ;;
+        -d | --days)
+            DAYS="${2}"
+            shift 2
+            ;;
+        -m | --mail)
+            MAIL="${2}"
+            shift 2
+            ;;
+        -a | --acme)
+            ACME="${2}"
+            shift 2
+            ;;
+        -v | --vips)
+            VIPS="${2}"
+            shift 2
+            ;;
+        -h | --haproxies-ssh)
+            LETSENCRYPT_SSH_PORT="${2}"
+            shift 2
+            ;;
+        --eab)
+            EXTERNAL_ACCOUNT_BINDING="true"
+            shift
+            ;;
+        --hmac)
+            HMAC="${2}"
+            shift 2
+            ;;
+        --kid)
+            KEY_ID="${2}"
+            shift 2
+            ;;
+        -k | --key-type)
+            LETSENCRYPT_KEY_TYPE="${2}"
+            shift 2
+            ;;
+        --) shift;
+            break
+            ;;
+    esac
+done
+
+FQDN=$(echo "${FQDNS}" | awk -F ',' '{print $1}')
+
+if [ "${INTERNAL_SET}" = "true" ] || [ "${EXTERNAL_SET}" = "true" ]; then
+    if [ "${INTERNAL_SET}" = "${EXTERNAL_SET}" ]; then
+        log_error "[${FQDN} - cron] Only --internal or --external parameter is allowed at a time."
+        exit 1
+    fi
+
+    LETSENCRYPT_VIP_ADDRESSES="$(echo ${VIPS} | sed -e 's/,/|/g')"
+    if [ "${INTERNAL_SET}" = "true" ]; then
+        LETSENCRYPT_INTERNAL_FQDNS="${FQDNS}"
+    fi
+
+    if [ "${EXTERNAL_SET}" = "true" ]; then
+        LETSENCRYPT_EXTERNAL_FQDNS="${FQDNS}"
+    fi
+
+    if /usr/sbin/ip a | egrep -q "${LETSENCRYPT_VIP_ADDRESSES}"; then
+        log_info "[${FQDN} - cron] This Letsencrypt-lego host is active..."
+        if [ "${LETSENCRYPT_INTERNAL_FQDNS}" != "" ]; then
+            log_info "[${FQDN} - cron] Processing domains ${LETSENCRYPT_INTERNAL_FQDNS}"
+            obtain_or_renew_certificate ${LETSENCRYPT_INTERNAL_FQDNS} internal ${PORT} ${DAYS} ${ACME} ${MAIL} ${LETSENCRYPT_SSH_PORT} ${EXTERNAL_ACCOUNT_BINDING} ${HMAC} ${KEY_ID} ${LETSENCRYPT_KEY_TYPE}
+        fi
+
+        if [ "${LETSENCRYPT_EXTERNAL_FQDNS}" != "" ]; then
+            log_info "[${FQDN} - cron] Processing domains ${LETSENCRYPT_EXTERNAL_FQDNS}"
+            obtain_or_renew_certificate ${LETSENCRYPT_EXTERNAL_FQDNS} external ${PORT} ${DAYS} ${ACME} ${MAIL} ${LETSENCRYPT_SSH_PORT} ${EXTERNAL_ACCOUNT_BINDING} ${HMAC} ${KEY_ID} ${LETSENCRYPT_KEY_TYPE}
+        fi
+    else
+        log_info "[${FQDN} - cron] This Letsencrypt-lego host is passive, nothing to do..."
+    fi
+fi
+
+if [ -d "/etc/letsencrypt/lego" ]; then
+    chown -R haproxy:haproxy /etc/letsencrypt/lego
+fi
diff --git a/kolla/docker/letsencrypt/letsencrypt-lego/sync-and-update-certificate.sh b/kolla/docker/letsencrypt/letsencrypt-lego/sync-and-update-certificate.sh
new file mode 100644
index 000000000..e1e421c46
--- /dev/null
+++ b/kolla/docker/letsencrypt/letsencrypt-lego/sync-and-update-certificate.sh
@@ -0,0 +1,93 @@
+#!/bin/bash
+
+function log_info {
+    local message="${1}"
+
+    echo "$(date '+%Y/%m/%d %H:%M:%S') [INFO] ${message}"
+}
+
+function log_error {
+    local message="${1}"
+
+    echo "$(date '+%Y/%m/%d %H:%M:%S') [ERROR] ${message}"
+}
+
+
+# Parser
+
+INTERNAL_SET="false"
+EXTERNAL_SET="false"
+LOG_FILE="/var/log/kolla/letsencrypt/lesencrypt-lego.log"
+
+
+VALID_ARGS=$(getopt -o ief:l: --long internal,external,fqdn:,haproxies-ssh: -- "$@")
+if [[ $? -ne 0 ]]; then
+    exit 1;
+fi
+
+eval set -- "$VALID_ARGS"
+while [ : ]; do
+    case "$1" in
+        -i | --internal)
+            CERT_TYPE="internal"
+            INTERNAL_SET="true"
+            shift
+            ;;
+        -e | --external)
+            CERT_TYPE="external"
+            EXTERNAL_SET="true"
+            shift
+            ;;
+        -f | --fqdn)
+            FQDN="${2}"
+            shift 2
+            ;;
+        -l | --haproxies-ssh)
+            HAPROXIES_SSH_HOSTS_PORT="${2}"
+            shift 2
+            ;;
+        --) shift;
+            break
+            ;;
+    esac
+done
+
+if [ "${INTERNAL_SET}" = "true" ] || [ "${EXTERNAL_SET}" = "true" ]; then
+    if [ "${INTERNAL_SET}" = "${EXTERNAL_SET}" ]; then
+        log_error "[${FQDN} - hook] Only --internal or --external parameter is allowed at a time"
+        exit 1
+    fi
+
+    HAPROXIES_SSH_HOSTS_PORT=$(echo ${HAPROXIES_SSH_HOSTS_PORT} | sed -e 's/,/ /g')
+
+    for i in ${HAPROXIES_SSH_HOSTS_PORT}; do
+
+        server=$(echo $i | awk -F ':' '{print $1}')
+        port=$(echo $i | awk -F ':' '{print $2}')
+
+        if ! /usr/sbin/ip a | grep -q "${server}"; then
+
+            log_info "[${FQDN} - hook] Rsync lego data /etc/letsencrypt/lego/ to server ${server} and port ${port}"
+            rsync -a -e "ssh -p ${port} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o IdentityFile=/var/lib/letsencrypt/.ssh/id_rsa" /etc/letsencrypt/lego/ haproxy@${server}:/etc/letsencrypt/lego/ --delete >/dev/null 2>&1
+            if [ "$?" -eq 0 ]; then
+                log_info "[${FQDN} - hook] Rsync Successful."
+            fi
+
+        else
+            log_info "[${FQDN} - hook] Rsync lego data /etc/letsencrypt/lego/ to server ${server} and port ${port} not needed."
+        fi
+
+        if [ "${INTERNAL_SET}" = "true" ]; then
+            internal_cert_path=$(find /etc/letsencrypt/lego/internal/ -name '*.pem')
+            sed -i '/^$/d' ${internal_cert_path}
+            rsync -av -e "ssh -p ${port} -o StrictHostKeyChecking=no -o IdentityFile=/var/lib/letsencrypt/.ssh/id_rsa" ${internal_cert_path} haproxy@${server}:/var/lib/haproxy/haproxy-internal.pem --delete >/dev/null 2>&1
+            ssh -p ${port} -i /var/lib/letsencrypt/.ssh/id_rsa -o StrictHostKeyChecking=no haproxy@${server} "/usr/bin/update-loadbalancer-cert --internal"
+        else
+            external_cert_path=$(find /etc/letsencrypt/lego/external/ -name '*.pem')
+            sed -i '/^$/d' ${external_cert_path}
+            rsync -av -e "ssh -p ${port} -o StrictHostKeyChecking=no -o IdentityFile=/var/lib/letsencrypt/.ssh/id_rsa" ${external_cert_path} haproxy@${server}:/var/lib/haproxy/haproxy.pem --delete >/dev/null 2>&1
+            ssh -p ${port} -i /var/lib/letsencrypt/.ssh/id_rsa -o StrictHostKeyChecking=no haproxy@${server} "/usr/bin/update-loadbalancer-cert --external"
+        fi
+
+    done
+fi
diff --git a/kolla/docker/macros.j2 b/kolla/docker/macros.j2
new file mode 100644
index 000000000..34d67335c
--- /dev/null
+++ b/kolla/docker/macros.j2
@@ -0,0 +1,97 @@
+{% macro install_packages(packages, chain=False, clean=clean_package_cache) -%}
+{% if packages is defined and packages|length > 0 -%}
+    {% if not chain -%} RUN {% endif -%}
+    {%- if base_package_type == 'rpm' -%}
+        {{ distro_package_manager }} -y install {{ packages | join(' ') }}
+        {%- if clean %} \
+    && {{ distro_package_manager }} clean all && rm -rf /var/cache/{{ distro_package_manager }}{% endif -%}
+    {%- elif base_package_type == 'deb' -%}
+        {#-
+          debian_package_install is a utility method to build up an appropriate
+          set of commands to install packages in a debian-based environment that
+          may include URL links to a .deb package
+        -#}
+        {{ debian_package_install(packages, clean) }}
+    {%- endif %}
+{%- endif %}
+{%- endmacro %}
+
+{# Be Extra vigilant about introducing any extra whitespace at the
+   end of the macro for chaining purposes -#}
+{% macro rpm_security_update(cleanup) -%}
+    {{ distro_package_manager }} -y distro-sync --security --sec-severity=Important --sec-severity=Critical
+    {%- if cleanup %} \
+    && {{ distro_package_manager }} clean all && rm -rf /var/cache/{{ distro_package_manager }}{% endif -%}
+{%- endmacro %}
+
+{% macro sed(file='', expressions=[]) -%}
+{% if file != '' and expressions|length >0 %}
+    RUN {% for expression in expressions %} sed -i "{{ file }}" -e "{{ expression }}" {% if not loop.last %} && {% endif %} {% endfor %}
+{% else %}
+    RUN echo "file and expressions must be set to use the sed macro"; /bin/false
+{% endif %}
+{%- endmacro %}
+
+{% macro install_pip(packages, constraints=true, python_version='3') %}
+{%- if packages is sequence and packages|length > 0 -%}
+    python{{ python_version }} -m pip --no-cache-dir install --upgrade{{ ' ' }}
+    {%- if constraints %}-c /requirements/upper-constraints.txt {% endif -%}
+    {{ packages | join(' ') }}
+{%- else -%}
+    true
+{%- endif -%}
+{% endmacro %}
+
+{% macro configure_user(name, groups=None, shell=None, homedir=None) %}
+{%- if name not in users %}
+{{ raise_error("Failed to find configuration for '" + name + "' user. Try specifying '" + name + "-user' config section.") }}
+{%- endif %}
+{% set user=users[name] %}
+{%- if not homedir %}
+{% set homedir='/var/lib/' + name %}
+{%- endif %}
+RUN usermod --append --home {{ homedir }} --groups kolla {{ name }} \
+    {%- if groups %}
+    && usermod --append --groups {{ groups }} {{ name }} \
+    {%- endif %}
+    {%- if shell %}
+    && chsh --shell {{ shell }} {{ name }} \
+    {%- endif %}
+    && mkdir -p {{ homedir }} \
+    && chown -R {{ user.uid }}:{{ user.gid }} {{ homedir }}
+{% endmacro %}
+
+{% macro install_fluent_plugins(plugins, chain=False) -%}
+{% if plugins is defined and plugins|length > 0 -%}
+    {% if not chain -%} RUN {% endif -%}
+    ulimit -n 1024 && fluent-gem install {{ plugins | join(' ') }}
+{%- endif %}
+{%- endmacro %}
+
+{% macro enable_extra_repos(repos) %}
+
+{{ handle_repos(repos, 'enable') }}
+
+{% endmacro %}
+
+{% macro disable_extra_repos(repos) %}
+
+{{ handle_repos(repos, 'disable') }}
+
+{% endmacro %}
+
+{% macro upper_constraints_remove(package_name) -%}
+sed -e "/^{{ package_name }}===/d" -i requirements/upper-constraints.txt
+{%- endmacro %}
+
+{# NOTE(hrw): we change to "==" to allow for "21.*" syntax #}
+{% macro upper_constraints_version_change(package_name, from, to) -%}
+sed -e "s/^{{package_name}}==={{ from }}/{{package_name}}=={{ to }}/g" -i requirements/upper-constraints.txt
+{%- endmacro %}
+
+{% macro kolla_patch_sources() -%}
+{% if patches_path %}
+    COPY patches /patches
+    RUN kolla_patch
+{% endif %}
+{%- endmacro %}
diff --git a/kolla/docker/magnum/magnum-api/Dockerfile.j2 b/kolla/docker/magnum/magnum-api/Dockerfile.j2
new file mode 100644
index 000000000..304b54e20
--- /dev/null
+++ b/kolla/docker/magnum/magnum-api/Dockerfile.j2
@@ -0,0 +1,18 @@
+FROM {{ namespace }}/{{ image_prefix }}magnum-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block magnum_api_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+COPY extend_start.sh /usr/local/bin/kolla_magnum_extend_start
+RUN chmod 644 /usr/local/bin/kolla_magnum_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block magnum_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER magnum
diff --git a/kolla/docker/magnum/magnum-api/extend_start.sh b/kolla/docker/magnum/magnum-api/extend_start.sh
new file mode 100644
index 000000000..0f92f6e7b
--- /dev/null
+++ b/kolla/docker/magnum/magnum-api/extend_start.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    magnum-db-manage upgrade
+    exit 0
+fi
diff --git a/kolla/docker/magnum/magnum-base/Dockerfile.j2 b/kolla/docker/magnum/magnum-base/Dockerfile.j2
new file mode 100644
index 000000000..ac17b94b4
--- /dev/null
+++ b/kolla/docker/magnum/magnum-base/Dockerfile.j2
@@ -0,0 +1,31 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block magnum_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='magnum') }}
+
+ADD magnum-base-archive /magnum-base-source
+
+{% set magnum_base_pip_packages = [
+    '/magnum[osprofiler]',
+    'magnum-cluster-api'
+] %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN ln -s magnum-base-source/* magnum \
+    && {{ macros.install_pip(magnum_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/magnum \
+    && cp -r /magnum/etc/magnum/* /etc/magnum \
+    && mv /etc/magnum/keystone_auth_default_policy.sample /etc/magnum/keystone_auth_default_policy.json \
+    && touch /usr/local/bin/kolla_magnum_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_magnum_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block magnum_base_footer %}{% endblock %}
diff --git a/kolla/docker/magnum/magnum-base/extend_start.sh b/kolla/docker/magnum/magnum-base/extend_start.sh
new file mode 100644
index 000000000..2e58c9776
--- /dev/null
+++ b/kolla/docker/magnum/magnum-base/extend_start.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/magnum" ]]; then
+    mkdir -p /var/log/kolla/magnum
+fi
+if [[ $(stat -c %a /var/log/kolla/magnum) != "755" ]]; then
+    chmod 755 /var/log/kolla/magnum
+fi
+
+. /usr/local/bin/kolla_magnum_extend_start
diff --git a/kolla/docker/magnum/magnum-conductor/Dockerfile.j2 b/kolla/docker/magnum/magnum-conductor/Dockerfile.j2
new file mode 100644
index 000000000..6e2df8fed
--- /dev/null
+++ b/kolla/docker/magnum/magnum-conductor/Dockerfile.j2
@@ -0,0 +1,18 @@
+FROM {{ namespace }}/{{ image_prefix }}magnum-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block magnum_conductor_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+ADD plugins-archive /
+RUN cp /plugins/linux-{{ debian_arch }}/helm /usr/local/bin/helm
+
+{{ macros.kolla_patch_sources() }}
+
+{% block magnum_conductor_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER magnum
diff --git a/kolla/docker/manila/manila-api/Dockerfile.j2 b/kolla/docker/manila/manila-api/Dockerfile.j2
new file mode 100644
index 000000000..d7b75d388
--- /dev/null
+++ b/kolla/docker/manila/manila-api/Dockerfile.j2
@@ -0,0 +1,23 @@
+FROM {{ namespace }}/{{ image_prefix }}manila-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block manila_api_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set manila_api_packages = [
+] %}
+{{ macros.install_packages(manila_api_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_manila_extend_start
+
+RUN chmod 644 /usr/local/bin/kolla_manila_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block manila_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER manila
diff --git a/kolla/docker/manila/manila-api/extend_start.sh b/kolla/docker/manila/manila-api/extend_start.sh
new file mode 100644
index 000000000..bea77dbba
--- /dev/null
+++ b/kolla/docker/manila/manila-api/extend_start.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+set -o errexit
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    manila-manage db sync
+    exit 0
+fi
diff --git a/kolla/docker/manila/manila-base/Dockerfile.j2 b/kolla/docker/manila/manila-base/Dockerfile.j2
new file mode 100644
index 000000000..a236a20df
--- /dev/null
+++ b/kolla/docker/manila/manila-base/Dockerfile.j2
@@ -0,0 +1,48 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block manila_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='manila') }}
+
+{% if base_package_type == 'rpm' %}
+
+{{ macros.enable_extra_repos(['openvswitch']) }}
+
+    {% set manila_base_packages = ['openvswitch${KOLLA_RPM_OVS_VERSION}'] %}
+
+{% elif base_package_type == 'deb' %}
+
+    {% set manila_base_packages = ['openvswitch-switch'] %}
+
+{% endif %}
+
+{{ macros.install_packages(manila_base_packages | customizable("packages")) }}
+
+ADD manila-base-archive /manila-base-source
+
+{% set manila_base_pip_packages = [
+    '/manila'
+] %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+COPY manila_sudoers /etc/sudoers.d/kolla_manila_sudoers
+
+RUN ln -s manila-base-source/* manila \
+    && {{ macros.install_pip(manila_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/manila /var/cache/manila \
+    && cp -r /manila/etc/manila/* /etc/manila/ \
+    && chown -R manila: /var/cache/manila \
+    && sed -i 's|^exec_dirs.*|exec_dirs=/var/lib/kolla/venv/bin,/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/bin,/usr/local/sbin|g' /etc/manila/rootwrap.conf \
+    && chmod 750 /etc/sudoers.d \
+    && chmod 440 /etc/sudoers.d/kolla_manila_sudoers \
+    && touch /usr/local/bin/kolla_manila_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_manila_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block manila_base_footer %}{% endblock %}
diff --git a/kolla/docker/manila/manila-base/extend_start.sh b/kolla/docker/manila/manila-base/extend_start.sh
new file mode 100644
index 000000000..c018416a3
--- /dev/null
+++ b/kolla/docker/manila/manila-base/extend_start.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/manila" ]]; then
+    mkdir -p /var/log/kolla/manila
+fi
+if [[ $(stat -c %a /var/log/kolla/manila) != "755" ]]; then
+    chmod 755 /var/log/kolla/manila
+fi
+
+. /usr/local/bin/kolla_manila_extend_start
diff --git a/kolla/docker/manila/manila-base/manila_sudoers b/kolla/docker/manila/manila-base/manila_sudoers
new file mode 100644
index 000000000..623e6789b
--- /dev/null
+++ b/kolla/docker/manila/manila-base/manila_sudoers
@@ -0,0 +1 @@
+manila ALL = (root) NOPASSWD: /var/lib/kolla/venv/bin/manila-rootwrap /etc/manila/rootwrap.conf *
diff --git a/kolla/docker/manila/manila-data/Dockerfile.j2 b/kolla/docker/manila/manila-data/Dockerfile.j2
new file mode 100644
index 000000000..06e1d9dc9
--- /dev/null
+++ b/kolla/docker/manila/manila-data/Dockerfile.j2
@@ -0,0 +1,31 @@
+FROM {{ namespace }}/{{ image_prefix }}manila-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block manila_data_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+
+    {% set manila_data_packages = [
+        'nfs-utils'
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+
+    {% set manila_data_packages = [
+        'nfs-common'
+    ] %}
+
+{% endif %}
+
+{{ macros.install_packages(manila_data_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block manila_data_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER manila
diff --git a/kolla/docker/manila/manila-scheduler/Dockerfile.j2 b/kolla/docker/manila/manila-scheduler/Dockerfile.j2
new file mode 100644
index 000000000..12f7860f4
--- /dev/null
+++ b/kolla/docker/manila/manila-scheduler/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}manila-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block manila_scheduler_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block manila_scheduler_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER manila
diff --git a/kolla/docker/manila/manila-share/Dockerfile.j2 b/kolla/docker/manila/manila-share/Dockerfile.j2
new file mode 100644
index 000000000..161b6865a
--- /dev/null
+++ b/kolla/docker/manila/manila-share/Dockerfile.j2
@@ -0,0 +1,34 @@
+FROM {{ namespace }}/{{ image_prefix }}manila-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block manila_share_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+    {% set manila_share_packages = [
+        'ceph-common',
+        'sqlite',
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set manila_share_packages = [
+        'ceph-common',
+        'glusterfs-client',
+        'python3-cephfs',
+        'python3-rados',
+        'python3-rbd',
+        'sqlite3'
+    ] %}
+
+{% endif %}
+
+{{ macros.install_packages(manila_share_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block manila_share_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER manila
diff --git a/kolla/docker/mariadb-server/Dockerfile.j2 b/kolla/docker/mariadb-server/Dockerfile.j2
new file mode 100644
index 000000000..612b37330
--- /dev/null
+++ b/kolla/docker/mariadb-server/Dockerfile.j2
@@ -0,0 +1,96 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block mariadb_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='mysql') }}
+
+{% if base_package_type == 'rpm' %}
+
+{# NOTE(mgoddard): EPEL required for pv package #}
+{{ macros.enable_extra_repos(['epel', 'mariadb']) }}
+
+    {% set mariadb_packages = [
+        'expect',
+        'mariadb',
+        'mariadb-backup',
+        'mariadb-server',
+        'pv',
+        'rsync',
+        'tar'
+    ] %}
+
+{# NOTE(yoctozepto): this is to ensure Kolla Ansible can configure MariaDB to find it #}
+RUN ln -s /usr/lib64/galera-4 /usr/lib64/galera
+
+{% elif base_package_type == 'deb' %}
+{{ macros.enable_extra_repos(['mariadb']) }}
+    {% set mariadb_packages = [
+        'expect',
+        'mariadb-backup',
+        'mariadb-client',
+        'mariadb-server',
+        'pv',
+        'rsync',
+        'tar'
+    ] %}
+{% endif %}
+
+{{ macros.install_packages(mariadb_packages | customizable("packages")) }}
+
+{% block mariadb_healthcheck %}
+ENV MARIADB_VERSION=11.4
+ADD plugins-archive /
+RUN install -m 755 /plugins/mariadb-server-plugin-mariadb-docker-archive*/$MARIADB_VERSION/healthcheck.sh /usr/bin/healthcheck.sh
+{% endblock %}
+
+COPY mariadb_sudoers /etc/sudoers.d/kolla_mariadb_sudoers
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+COPY security_reset.expect /usr/local/bin/kolla_security_reset
+COPY backup.sh /usr/local/bin/kolla_mariadb_backup.sh
+COPY backup_replica.sh /usr/local/bin/kolla_mariadb_backup_replica.sh
+
+RUN chmod 644 /usr/local/bin/kolla_extend_start \
+    && chmod 755 /usr/local/bin/kolla_security_reset \
+                 /usr/local/bin/kolla_mariadb_backup.sh \
+                 /usr/local/bin/kolla_mariadb_backup_replica.sh \
+    && chmod 750 /etc/sudoers.d \
+    && chmod 440 /etc/sudoers.d/kolla_mariadb_sudoers \
+    && rm -rf /var/lib/mysql/*
+
+{% if base_package_type == 'deb' %}
+RUN mkdir -p /var/run/mysqld && chown mysql /var/run/mysqld && chmod 755 /var/run/mysqld
+{% endif %}
+
+{% if docker_healthchecks %}
+{% block healthcheck_installation %}
+
+COPY healthcheck_mariadb /usr/local/bin/healthcheck_mariadb
+RUN chmod 755 /usr/local/bin/healthcheck_mariadb
+
+{% endblock %}
+{% endif %}
+
+{% if use_dumb_init %}
+{% block mariadb_entrypoint %}
+# NOTE(mgoddard): Override the dumb-init arguments to avoid passing
+# --single-child. This does not play well with mysqld_safe, which ignores
+# SIGTERM, meaning Docker needs to forcibly kill the container to stop it.
+# Without --single-child, the TERM signal is sent to all subprocesses,
+# including mysqld.
+
+ENTRYPOINT ["dumb-init", "--"]
+CMD ["kolla_start"]
+{% endblock %}
+{% endif %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block mariadb_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER mysql
diff --git a/kolla/docker/mariadb-server/backup.sh b/kolla/docker/mariadb-server/backup.sh
new file mode 100644
index 000000000..be63cd938
--- /dev/null
+++ b/kolla/docker/mariadb-server/backup.sh
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+
+set -eu
+set -o pipefail
+
+# Execute a full backup
+backup_full() {
+    echo "Taking a full backup"
+    LAST_FULL_DATE=$(date +%d-%m-%Y-%s)
+    BACKUP_FILE="mysqlbackup-${LAST_FULL_DATE}.qp.xbc.xbs.gz"
+    BACKUP_PATH="$BACKUP_DIR/full-${LAST_FULL_DATE}"
+    mkdir -p "$BACKUP_PATH"
+
+    mariabackup \
+        --defaults-file=/etc/mysql/my.cnf \
+        --backup \
+        --stream=xbstream \
+        --history=$LAST_FULL_DATE | gzip > \
+        "$BACKUP_PATH/$BACKUP_FILE"
+
+    echo "$BACKUP_PATH/$BACKUP_FILE" > "$BACKUP_DIR/last_full_file"
+}
+
+# Execute an incremental backup
+backup_incremental() {
+    echo "Taking an incremental backup"
+
+    if [ ! -r "$BACKUP_DIR/last_full_file" ]; then
+        echo "Error: No full backup file found."
+        exit 1
+    fi
+
+    FULL_BACKUP_FILE=$(cat "$BACKUP_DIR/last_full_file")
+    LAST_FULL_DATE=$(basename "$(dirname "$FULL_BACKUP_FILE")" | sed 's/^full-//')
+    NOW=$(date +%H-%M-%S-%d-%m-%Y)
+    INCR_DIR="$BACKUP_DIR/incr-${NOW}-since-${LAST_FULL_DATE}"
+    mkdir -p "$INCR_DIR"
+
+    TMP_BASEDIR=$(mktemp -d)
+    echo "Decompressing full backup to temp dir: $TMP_BASEDIR"
+    gunzip -c "$FULL_BACKUP_FILE" | mbstream -x -C "$TMP_BASEDIR"
+
+    mariabackup \
+        --defaults-file=/etc/mysql/my.cnf \
+        --backup \
+        --stream=xbstream \
+        --incremental-basedir="$TMP_BASEDIR" \
+        --history="incr-${NOW}" | gzip > \
+        "$INCR_DIR/incremental-${NOW}-mysqlbackup-${LAST_FULL_DATE}.qp.xbc.xbs.gz"
+
+    rm -rf "$TMP_BASEDIR"
+}
+
+BACKUP_DIR=/backup/
+cd "$BACKUP_DIR"
+
+if [ -n "${BACKUP_TYPE:-}" ]; then
+    case "$BACKUP_TYPE" in
+        "full")
+            backup_full
+            ;;
+        "incremental")
+            backup_incremental
+            ;;
+        *)
+            echo "Only full or incremental options are supported."
+            exit 1
+            ;;
+    esac
+else
+    echo "You need to specify either full or incremental backup options."
+    exit 1
+fi
diff --git a/kolla/docker/mariadb-server/backup_replica.sh b/kolla/docker/mariadb-server/backup_replica.sh
new file mode 100644
index 000000000..fe10bc61b
--- /dev/null
+++ b/kolla/docker/mariadb-server/backup_replica.sh
@@ -0,0 +1,149 @@
+#!/usr/bin/env bash
+
+set -eu
+set -o pipefail
+
+BACKUP_DIR=/backup/
+DEFAULT_MY_CNF="/etc/mysql/my.cnf"
+REPLICA_MY_CNF="$(mktemp)"
+RETRY_INTERVAL=5  # Interval between retries (in seconds)
+MAX_RETRIES=12    # Max retries (12 retries * 5 seconds = 60 seconds)
+VERIFY_DB_SERVER_CERT="${VERIFY_DB_SERVER_CERT:=FALSE}"
+
+# Cleanup function to remove the REPLICA_MY_CNF file
+cleanup() {
+    rm -f "${REPLICA_MY_CNF}"
+}
+
+# Set trap to ensure cleanup occurs on exit or error
+trap cleanup EXIT
+
+cd "${BACKUP_DIR}"
+
+# Execute a full backup
+backup_full() {
+    echo "Taking a full backup"
+    LAST_FULL_DATE=$(date +%d-%m-%Y-%s)
+    BACKUP_FILE="backup-full-${LAST_FULL_DATE}.mbs.gz"
+    BACKUP_PATH="${BACKUP_DIR}/full-${LAST_FULL_DATE}"
+    mkdir -p "${BACKUP_PATH}"
+
+    mariabackup \
+        --defaults-file="${REPLICA_MY_CNF}" \
+        --backup \
+        --stream=mbstream \
+        --history="${LAST_FULL_DATE}" \
+        | gzip > "${BACKUP_PATH}/${BACKUP_FILE}"
+
+    echo "${BACKUP_PATH}/${BACKUP_FILE}" > "${BACKUP_DIR}/last_full_file"
+}
+
+# Execute an incremental backup
+backup_incremental() {
+    if [ ! -r "${BACKUP_DIR}/last_full_file" ]; then
+        echo "Error: No full backup file found."
+        exit 1
+    fi
+
+    FULL_BACKUP_FILE=$(cat "${BACKUP_DIR}/last_full_file")
+    LAST_FULL_DATE=$(basename "$(dirname "${FULL_BACKUP_FILE}")" | sed 's/^full-//')
+    NOW=$(date +%H-%M-%S-%d-%m-%Y)
+    INCR_DIR="${BACKUP_DIR}/incr-${NOW}-since-${LAST_FULL_DATE}"
+    mkdir -p "${INCR_DIR}"
+
+    # Temp dir for full base restore
+    TMP_BASEDIR=$(mktemp -d)
+
+    echo "Decompressing full backup to temp dir: ${TMP_BASEDIR}"
+    gunzip -c "${FULL_BACKUP_FILE}" | mbstream -x -C "${TMP_BASEDIR}"
+
+    mariabackup \
+        --defaults-file="${REPLICA_MY_CNF}" \
+        --backup \
+        --stream=mbstream \
+        --incremental-basedir="${TMP_BASEDIR}" \
+        --history="incr-${NOW}" \
+        | gzip > "${INCR_DIR}/backup-incremental-${NOW}.mbs.gz"
+
+    rm -rf "${TMP_BASEDIR}"
+}
+
+# Retry logic for database queries
+retry_mysql_query() {
+    local query="$1"
+    local result=""
+    local attempt=1
+
+    while [ ${attempt} -le ${MAX_RETRIES} ]; do
+        result=$(mariadb --ssl-verify-server-cert="${VERIFY_DB_SERVER_CERT}" -h "${HOST}" -u "${USER}" -p"${PASS}" -s -N -e "${query}" 2>/dev/null || true)
+        if [ -n "${result}" ]; then
+            echo "${result}"
+            return 0
+        fi
+        echo "Attempt ${attempt}/${MAX_RETRIES} failed. Retrying in ${RETRY_INTERVAL} seconds..."
+        sleep "${RETRY_INTERVAL}"
+        attempt=$((attempt + 1))
+    done
+
+    echo "Error: Failed to execute the query after ${MAX_RETRIES} attempts."
+    return 1
+}
+
+get_and_set_replica_server() {
+    HOST="$(grep '^host' "${DEFAULT_MY_CNF}" | awk -F '=' '{print $2}' | xargs)"
+    USER="$(grep '^user' "${DEFAULT_MY_CNF}" | awk -F '=' '{print $2}' | xargs)"
+    PASS="$(grep '^password' "${DEFAULT_MY_CNF}" | awk -F '=' '{print $2}' | xargs)"
+
+    ALL_HOSTS_SELECT="SELECT REGEXP_REPLACE(VARIABLE_VALUE, ':[0-9]*','') FROM information_schema.GLOBAL_STATUS WHERE VARIABLE_NAME = 'wsrep_incoming_addresses';"
+    ALL_HOSTS=$(retry_mysql_query "${ALL_HOSTS_SELECT}")
+    if [ -z "${ALL_HOSTS}" ]; then
+        echo "Backup failed due to inability to fetch a list of servers."
+        exit 1
+    fi
+
+    ACTIVE_HOST_SELECT='SELECT @@hostname;'
+    ACTIVE_HOST=$(retry_mysql_query "${ACTIVE_HOST_SELECT}" | xargs getent hosts | awk '{print $1}')
+    if [ -z "${ACTIVE_HOST}" ]; then
+        echo "Backup failed due to inability to fetch active host."
+        exit 1
+    fi
+
+    # Multinode
+    if echo "${ALL_HOSTS}" | grep -q ','; then
+        for server in $(echo "${ALL_HOSTS}" | tr ',' '\n'); do
+            if [[ "${server}" != "${ACTIVE_HOST}" ]]; then
+                REPLICA_HOST="${server}"
+                break
+            fi
+        done
+    # Single node
+    else
+        REPLICA_HOST="${ALL_HOSTS}"
+    fi
+    if [ -z "${REPLICA_HOST}" ]; then
+        echo "Backup failed due to inability to determine replica host."
+        exit 1
+    fi
+
+    cp "${DEFAULT_MY_CNF}" "${REPLICA_MY_CNF}"
+    sed -i "s/${HOST}/${REPLICA_HOST}/g" "${REPLICA_MY_CNF}"
+}
+
+if [ -n "${BACKUP_TYPE}" ]; then
+    get_and_set_replica_server
+    case "${BACKUP_TYPE}" in
+        "full")
+            backup_full
+            ;;
+        "incremental")
+            backup_incremental
+            ;;
+        *)
+            echo "Only full or incremental options are supported."
+            exit 1
+            ;;
+    esac
+else
+    echo "You need to specify either full or incremental backup options."
+    exit 1
+fi
diff --git a/kolla/docker/mariadb-server/extend_start.sh b/kolla/docker/mariadb-server/extend_start.sh
new file mode 100644
index 000000000..f14c85949
--- /dev/null
+++ b/kolla/docker/mariadb-server/extend_start.sh
@@ -0,0 +1,61 @@
+#!/bin/bash
+
+: ${MARIADB_LOG_DIR:=/var/log/kolla/mariadb}
+
+function bootstrap_db {
+    mariadbd-safe --wsrep-new-cluster --skip-networking --wsrep-on=OFF --pid-file=/var/lib/mysql/mariadb.pid &
+    # Wait for the mariadb server to be "Ready" before starting the security reset with a max timeout
+    # NOTE(huikang): the location of mysql's socket file varies depending on the OS distributions.
+    # Querying the cluster status has to be executed after the existence of mysql.sock and mariadb.pid.
+    TIMEOUT=${DB_MAX_TIMEOUT:-60}
+    while [[ ! -S /var/lib/mysql/mysql.sock ]] && \
+          [[ ! -S /var/run/mysqld/mysqld.sock ]] || \
+          [[ ! -f /var/lib/mysql/mariadb.pid ]]; do
+        if [[ ${TIMEOUT} -gt 0 ]]; then
+            let TIMEOUT-=1
+            sleep 1
+        else
+            exit 1
+        fi
+    done
+
+    sudo -E kolla_security_reset
+
+    set +o xtrace
+    mariadb -u root --password="${DB_ROOT_PASSWORD}" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY '${DB_ROOT_PASSWORD}' WITH GRANT OPTION;"
+    mariadb -u root --password="${DB_ROOT_PASSWORD}" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '${DB_ROOT_PASSWORD}' WITH GRANT OPTION;"
+    mariadb-admin -uroot -p"${DB_ROOT_PASSWORD}" shutdown
+    set -o xtrace
+}
+
+# Create log directory, with appropriate permissions
+if [[ ! -d "${MARIADB_LOG_DIR}" ]]; then
+    mkdir -p ${MARIADB_LOG_DIR}
+fi
+if [[ $(stat -c %a ${MARIADB_LOG_DIR}) != "755" ]]; then
+    chmod 755 ${MARIADB_LOG_DIR}
+fi
+
+# This catches all cases of the BOOTSTRAP variable being set, including empty
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    mariadb-install-db 2>&1 | tee -a ${MARIADB_LOG_DIR}/mariadb-bootstrap.log
+    bootstrap_db 2>&1 | tee -a ${MARIADB_LOG_DIR}/mariadb-bootstrap.log
+    exit 0
+fi
+
+# This catches all cases of the KOLLA_UPGRADE variable being set, including empty
+if [[ "${!KOLLA_UPGRADE[@]}" ]]; then
+    # The mariadb-upgrade command treats any directories under /var/lib/mysql as
+    # databases. Somehow we can end up with a .pki directory, which causes the
+    # command to fail with this error:
+    # Incorrect database name '#mysql50#.pki' when selecting the database
+    # There doesn't seem to be anything in the directory, so remove it.
+    rm -rf /var/lib/mysql/.pki
+
+    mariadb-upgrade --host=${DB_HOST} --port=${DB_PORT} --user=root --password="${DB_ROOT_PASSWORD}" 2>&1 | tee -a ${MARIADB_LOG_DIR}/mariadb-upgrade.log
+    exit 0
+fi
+
+if [[ "${!BOOTSTRAP_ARGS[@]}" ]]; then
+    ARGS="${BOOTSTRAP_ARGS}"
+fi
diff --git a/kolla/docker/mariadb-server/healthcheck_mariadb b/kolla/docker/mariadb-server/healthcheck_mariadb
new file mode 100755
index 000000000..0d9f59a95
--- /dev/null
+++ b/kolla/docker/mariadb-server/healthcheck_mariadb
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+set -e
+
+MYSQL_USERNAME="${MYSQL_USERNAME:=-haproxy}"
+MYSQL_TIMEOUT=10
+
+MYSQL_CMDLINE="mysql -sN --connect-timeout=${MYSQL_TIMEOUT} -u ${MYSQL_USERNAME}"
+
+WSREP_STATUS=$($MYSQL_CMDLINE -e "SHOW STATUS LIKE 'wsrep_local_state_comment';" | awk '{print $2}')
+
+if [[ "${WSREP_STATUS}" == "Synced" ]]
+then
+    echo "MariaDB Galera Cluster Node is synced."
+    exit 0
+else
+    echo "MariaDB Galera Cluster Node is NOT synced"
+    exit 1
+fi
diff --git a/kolla/docker/mariadb-server/mariadb_sudoers b/kolla/docker/mariadb-server/mariadb_sudoers
new file mode 100644
index 000000000..150534e16
--- /dev/null
+++ b/kolla/docker/mariadb-server/mariadb_sudoers
@@ -0,0 +1 @@
+%kolla ALL=(root) NOPASSWD: /usr/local/bin/kolla_security_reset
diff --git a/kolla/docker/mariadb-server/security_reset.expect b/kolla/docker/mariadb-server/security_reset.expect
new file mode 100644
index 000000000..06f1d5c8e
--- /dev/null
+++ b/kolla/docker/mariadb-server/security_reset.expect
@@ -0,0 +1,67 @@
+#!/usr/bin/expect -f
+
+if [catch {set timeout $env(DB_MAX_TIMEOUT)}] {set timeout 10}
+spawn mariadb-secure-installation
+expect {
+  timeout { send_user "\nFailed to get 'Enter current password for root (enter for none):' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Enter current password for root (enter for none):' prompt\n"; exit 1 }
+  "Enter current password for root (enter for none):"
+}
+send "\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Switch to unix_socket authentication [Y/n] ' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Switch to unix_socket authentication [Y/n]' prompt\n"; exit 1 }
+  "Switch to unix_socket authentication \\\[Y/n\\\] "
+}
+send "n\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Change the root password? [Y/n]' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Change the root password? [Y/n]' prompt\n"; exit 1 }
+  "Change the root password? \\\[Y/n\\\] "
+}
+send "y\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'New password:' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'New password:' prompt\n"; exit 1 }
+  "New password:"
+}
+send "$env(DB_ROOT_PASSWORD)\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Re-enter new password:' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Re-enter new password:' prompt\n"; exit 1 }
+  "Re-enter new password:"
+}
+send "$env(DB_ROOT_PASSWORD)\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Remove anonymous users?' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Remove anonymous users?' prompt\n"; exit 1 }
+  "Remove anonymous users?"
+}
+send "y\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Disallow root login remotely?' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Disallow root login remotely?' prompt\n"; exit 1 }
+  "Disallow root login remotely?"
+}
+send "n\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Remove test database and access to it?' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Remove test database and access to it?' prompt\n"; exit 1 }
+  "Remove test database and access to it?"
+}
+send "y\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Reload privilege tables now?' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Reload privilege tables now?' prompt\n"; exit 1 }
+  "Reload privilege tables now?"
+}
+send "y\r"
+expect eof
diff --git a/kolla/docker/masakari/masakari-api/Dockerfile.j2 b/kolla/docker/masakari/masakari-api/Dockerfile.j2
new file mode 100644
index 000000000..5285c6a36
--- /dev/null
+++ b/kolla/docker/masakari/masakari-api/Dockerfile.j2
@@ -0,0 +1,16 @@
+FROM {{ namespace }}/{{ image_prefix }}masakari-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block masakari_api_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+COPY extend_start.sh /usr/local/bin/kolla_masakari_extend_start
+RUN chmod 644 /usr/local/bin/kolla_masakari_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block masakari_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/masakari/masakari-api/extend_start.sh b/kolla/docker/masakari/masakari-api/extend_start.sh
new file mode 100755
index 000000000..549759f49
--- /dev/null
+++ b/kolla/docker/masakari/masakari-api/extend_start.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    masakari-manage db sync
+    exit 0
+fi
diff --git a/kolla/docker/masakari/masakari-base/Dockerfile.j2 b/kolla/docker/masakari/masakari-base/Dockerfile.j2
new file mode 100644
index 000000000..97e31247e
--- /dev/null
+++ b/kolla/docker/masakari/masakari-base/Dockerfile.j2
@@ -0,0 +1,43 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block masakari_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='masakari') }}
+
+{% if base_package_type == 'rpm' %}
+
+    {% set masakari_base_packages = [
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+
+    {% set masakari_base_packages = [
+    ] %}
+
+{% endif %}
+
+{{ macros.install_packages(masakari_base_packages | customizable("packages")) }}
+
+ADD masakari-base-archive /masakari-base-source
+
+{% set masakari_base_pip_packages = [
+    '/masakari'
+] %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN ln -s masakari-base-source/* masakari \
+    && {{ macros.install_pip(masakari_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/masakari \
+    && cp -r /masakari/etc/masakari/* /etc/masakari/ \
+    && touch /usr/local/bin/kolla_masakari_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_masakari_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block masakari_base_footer %}{% endblock %}
diff --git a/kolla/docker/masakari/masakari-base/extend_start.sh b/kolla/docker/masakari/masakari-base/extend_start.sh
new file mode 100755
index 000000000..4f13d3e8b
--- /dev/null
+++ b/kolla/docker/masakari/masakari-base/extend_start.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/masakari" ]]; then
+    mkdir -p /var/log/kolla/masakari
+fi
+if [[ $(stat -c %U:%G /var/log/kolla/masakari) != "masakari:kolla" ]]; then
+    chown -R masakari:kolla /var/log/kolla/masakari
+fi
+if [[ $(stat -c %a /var/log/kolla/masakari) != "755" ]]; then
+    chmod 755 /var/log/kolla/masakari
+fi
+
+. /usr/local/bin/kolla_masakari_extend_start
diff --git a/kolla/docker/masakari/masakari-engine/Dockerfile.j2 b/kolla/docker/masakari/masakari-engine/Dockerfile.j2
new file mode 100644
index 000000000..8dfb3175c
--- /dev/null
+++ b/kolla/docker/masakari/masakari-engine/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}masakari-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block masakari_engine_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block masakari_engine_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER masakari
diff --git a/kolla/docker/masakari/masakari-monitors/Dockerfile.j2 b/kolla/docker/masakari/masakari-monitors/Dockerfile.j2
new file mode 100644
index 000000000..92b8c3947
--- /dev/null
+++ b/kolla/docker/masakari/masakari-monitors/Dockerfile.j2
@@ -0,0 +1,55 @@
+FROM {{ namespace }}/{{ image_prefix }}masakari-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block masakari_monitors_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+
+{{ macros.enable_extra_repos(['hacluster']) }}
+
+    {% set masakari_monitors_packages = [
+        'cyrus-sasl-md5',
+        'cyrus-sasl-scram',
+        'python3-libvirt',
+        'pacemaker-cli',
+        'tcpdump',
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+
+    {% set masakari_monitors_packages = [
+        'libsasl2-modules-gssapi-mit',
+        'python3-libvirt',
+        'pacemaker-cli-utils',
+        'sasl2-bin',
+        'tcpdump',
+    ] %}
+
+{% endif %}
+
+{{ macros.install_packages(masakari_monitors_packages | customizable("packages")) }}
+
+ADD masakari-monitors-archive /masakari-monitors-source
+
+{% set masakari_monitors_pip_packages = [
+    '/masakari-monitors'
+] %}
+
+COPY masakari_monitors_sudoers /etc/sudoers.d/kolla_masakari_monitors_sudoers
+
+RUN ln -s masakari-monitors-source/* masakari-monitors \
+    && {{ macros.install_pip(masakari_monitors_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/masakari-monitors \
+    && chmod 750 /etc/sudoers.d \
+    && chmod 640 /etc/sudoers.d/kolla_masakari_monitors_sudoers
+
+{{ macros.kolla_patch_sources() }}
+
+{% block masakari_monitors_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER masakari
diff --git a/kolla/docker/masakari/masakari-monitors/masakari_monitors_sudoers b/kolla/docker/masakari/masakari-monitors/masakari_monitors_sudoers
new file mode 100644
index 000000000..be3867b5c
--- /dev/null
+++ b/kolla/docker/masakari/masakari-monitors/masakari_monitors_sudoers
@@ -0,0 +1,5 @@
+masakari ALL=(root) NOPASSWD: /var/lib/kolla/venv/bin/privsep-helper
+masakari ALL=(root) NOPASSWD: /usr/sbin/tcpdump *
+masakari ALL=(root) NOPASSWD: /usr/sbin/crm_mon -X
+masakari ALL=(root) NOPASSWD: /usr/sbin/crmadmin *
+masakari ALL=(root) NOPASSWD: /usr/sbin/cibadmin --query
diff --git a/kolla/docker/memcached/Dockerfile.j2 b/kolla/docker/memcached/Dockerfile.j2
new file mode 100644
index 000000000..dfe90b18e
--- /dev/null
+++ b/kolla/docker/memcached/Dockerfile.j2
@@ -0,0 +1,20 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block memcached_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='memcached', homedir='/run/memcache') }}
+
+{% set memcached_packages = ['memcached'] %}
+{{ macros.install_packages(memcached_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block memcached_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER memcached
diff --git a/kolla/docker/mistral/mistral-api/Dockerfile.j2 b/kolla/docker/mistral/mistral-api/Dockerfile.j2
new file mode 100644
index 000000000..be3e431e1
--- /dev/null
+++ b/kolla/docker/mistral/mistral-api/Dockerfile.j2
@@ -0,0 +1,20 @@
+FROM {{ namespace }}/{{ image_prefix }}mistral-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block mistral_api_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set mistral_api_packages = [
+] %}
+{{ macros.install_packages(mistral_api_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_mistral_extend_start
+RUN chmod 644 /usr/local/bin/kolla_mistral_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block mistral_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/mistral/mistral-api/extend_start.sh b/kolla/docker/mistral/mistral-api/extend_start.sh
new file mode 100644
index 000000000..113adb8a2
--- /dev/null
+++ b/kolla/docker/mistral/mistral-api/extend_start.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    mistral-db-manage --config-file /etc/mistral/mistral.conf upgrade head
+    mistral-db-manage --config-file /etc/mistral/mistral.conf populate
+    exit 0
+fi
diff --git a/kolla/docker/mistral/mistral-base/Dockerfile.j2 b/kolla/docker/mistral/mistral-base/Dockerfile.j2
new file mode 100644
index 000000000..1d72c1cac
--- /dev/null
+++ b/kolla/docker/mistral/mistral-base/Dockerfile.j2
@@ -0,0 +1,38 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block mistral_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='mistral') }}
+
+ADD mistral-base-archive /mistral-base-source
+ADD plugins-archive /
+
+{% set mistral_base_pip_packages = [
+    '/mistral',
+    'redis'
+] %}
+
+{% set mistral_base_plugins_pip_packages = [
+    '/plugins/*'
+] %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN ln -s mistral-base-source/* mistral \
+    && {{ macros.install_pip(mistral_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/mistral \
+    && cp -r /mistral/etc/* /etc/mistral/ \
+    && if [ "$(ls /plugins)" ]; then \
+        {{ macros.install_pip(mistral_base_plugins_pip_packages) }}; \
+       fi \
+    && touch /usr/local/bin/kolla_mistral_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_mistral_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block mistral_base_footer %}{% endblock %}
diff --git a/kolla/docker/mistral/mistral-base/extend_start.sh b/kolla/docker/mistral/mistral-base/extend_start.sh
new file mode 100644
index 000000000..ac2980d6c
--- /dev/null
+++ b/kolla/docker/mistral/mistral-base/extend_start.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/mistral" ]]; then
+    mkdir -p /var/log/kolla/mistral
+fi
+if [[ $(stat -c %a /var/log/kolla/mistral) != "755" ]]; then
+    chmod 755 /var/log/kolla/mistral
+fi
+
+. /usr/local/bin/kolla_mistral_extend_start
diff --git a/kolla/docker/mistral/mistral-engine/Dockerfile.j2 b/kolla/docker/mistral/mistral-engine/Dockerfile.j2
new file mode 100644
index 000000000..c5fd5eb0d
--- /dev/null
+++ b/kolla/docker/mistral/mistral-engine/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}mistral-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block mistral_engine_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block mistral_engine_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER mistral
diff --git a/kolla/docker/mistral/mistral-event-engine/Dockerfile.j2 b/kolla/docker/mistral/mistral-event-engine/Dockerfile.j2
new file mode 100644
index 000000000..2a05ecf76
--- /dev/null
+++ b/kolla/docker/mistral/mistral-event-engine/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}mistral-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block mistral_event_engine_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block mistral_event_engine_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER mistral
diff --git a/kolla/docker/mistral/mistral-executor/Dockerfile.j2 b/kolla/docker/mistral/mistral-executor/Dockerfile.j2
new file mode 100644
index 000000000..aeae9ed06
--- /dev/null
+++ b/kolla/docker/mistral/mistral-executor/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}mistral-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block mistral_executor_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block mistral_executor_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER mistral
diff --git a/kolla/docker/multipathd/Dockerfile.j2 b/kolla/docker/multipathd/Dockerfile.j2
new file mode 100644
index 000000000..1341c62a7
--- /dev/null
+++ b/kolla/docker/multipathd/Dockerfile.j2
@@ -0,0 +1,21 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block multipathd_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+    {% set multipathd_packages = ['device-mapper-multipath'] %}
+{% elif base_package_type == 'deb' %}
+    {% set multipathd_packages = ['multipath-tools'] %}
+{% endif %}
+
+{{ macros.install_packages(multipathd_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block multipathd_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/networking-baremetal/ironic-neutron-agent/Dockerfile.j2 b/kolla/docker/networking-baremetal/ironic-neutron-agent/Dockerfile.j2
new file mode 100644
index 000000000..a7ae6ccb4
--- /dev/null
+++ b/kolla/docker/networking-baremetal/ironic-neutron-agent/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}neutron-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block ironic_neutron_agent_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block ironic_neutron_agent_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER neutron
diff --git a/kolla/docker/neutron/neutron-base/Dockerfile.j2 b/kolla/docker/neutron/neutron-base/Dockerfile.j2
new file mode 100644
index 000000000..e91c1e6e6
--- /dev/null
+++ b/kolla/docker/neutron/neutron-base/Dockerfile.j2
@@ -0,0 +1,104 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block neutron_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.enable_extra_repos(['docker-ce']) }}
+{{ macros.configure_user(name='neutron') }}
+
+{% if base_package_type == 'rpm' %}
+
+{{ macros.enable_extra_repos(['openvswitch']) }}
+
+    {% set neutron_base_packages = [
+        'conntrack-tools',
+        'dnsmasq',
+        'dnsmasq-utils',
+        'docker-ce-cli',
+        'haproxy',
+        'iproute-tc',
+        'ipset',
+        'iptables',
+        'iputils',
+        'keepalived',
+        'net-tools',
+        'openvswitch${KOLLA_RPM_OVS_VERSION}',
+        'python3-openvswitch${KOLLA_RPM_OVS_VERSION}',
+        'radvd',
+        'uuid'
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+
+    {% set neutron_base_packages = [
+        'conntrack',
+        'dnsmasq',
+        'dnsmasq-utils',
+        'docker-ce-cli',
+        'haproxy',
+        'iproute2',
+        'ipset',
+        'iptables',
+        'iputils-arping',
+        'iputils-ping',
+        'keepalived',
+        'net-tools',
+        'openvswitch-switch',
+        'python3-openvswitch',
+        'radvd',
+        'uuid-runtime'
+    ] %}
+
+{% endif %}
+
+{{ macros.install_packages(neutron_base_packages | customizable("packages")) }}
+
+ADD neutron-base-archive /neutron-base-source
+ADD plugins-archive /
+
+{% set neutron_base_pip_packages = [
+    '/neutron',
+    'oslo-vmware',
+    'tap-as-a-service'
+] %}
+
+{% set neutron_base_plugins_pip_packages = [
+    '/plugins/*'
+] %}
+
+COPY neutron_sudoers /etc/sudoers.d/kolla_neutron_sudoers
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN mkdir -p /usr/local/lib/neutron-wrappers /usr/local/etc/neutron-wrappers
+COPY dnsmasq haproxy keepalived neutron-keepalived-state-change radvd copy-wrappers delete-wrappers /usr/local/lib/neutron-wrappers/
+RUN chmod +x /usr/local/lib/neutron-wrappers/copy-wrappers \
+    && chmod +x /usr/local/lib/neutron-wrappers/delete-wrappers
+
+RUN ln -s neutron-base-source/* neutron \
+    && {{ macros.upper_constraints_remove('networking-generic-switch') }} \
+    && {{ macros.install_pip(neutron_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/neutron \
+    && cp -r /neutron/etc/* /etc/neutron/ \
+    && cp -r /neutron/etc/neutron/* /etc/neutron/ \
+    && cp /var/lib/kolla/venv/etc/pycadf/neutron_api_audit_map.conf /etc/neutron/ \
+    && mv /etc/neutron/neutron/ /etc/neutron/plugins/ \
+    && sed -i 's|^exec_dirs.*|exec_dirs=/var/lib/kolla/venv/bin,/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/bin,/usr/local/sbin|g' /etc/neutron/rootwrap.conf \
+    && if [ "$(ls /plugins)" ]; then \
+        {{ macros.install_pip(neutron_base_plugins_pip_packages) }} \
+        && for neutron_plugins in $(ls /plugins); do \
+            if [ -d "/plugins/$neutron_plugins/etc/neutron/rootwrap.d" ]; then \
+                cp /plugins/$neutron_plugins/etc/neutron/rootwrap.d/* /etc/neutron/rootwrap.d; \
+            fi; \
+        done; \
+       fi \
+    && chmod 750 /etc/sudoers.d \
+    && chmod 440 /etc/sudoers.d/kolla_neutron_sudoers \
+    && touch /usr/local/bin/kolla_neutron_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_neutron_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block neutron_base_footer %}{% endblock %}
diff --git a/kolla/docker/neutron/neutron-base/copy-wrappers b/kolla/docker/neutron/neutron-base/copy-wrappers
new file mode 100644
index 000000000..e03bdfdf7
--- /dev/null
+++ b/kolla/docker/neutron/neutron-base/copy-wrappers
@@ -0,0 +1,9 @@
+#!/bin/bash
+for binary in dnsmasq haproxy keepalived neutron-keepalived-state-change radvd; do
+    cp /usr/local/lib/neutron-wrappers/${binary} /usr/local/bin/${binary}
+    chmod +x /usr/local/bin/${binary}
+done
+
+echo "KOLLA_IMAGE=${KOLLA_IMAGE}" > /usr/local/etc/neutron-wrappers/config
+echo "KOLLA_NAME=${KOLLA_NAME}" >> /usr/local/etc/neutron-wrappers/config
+echo "KOLLA_SERVICE_NAME=${KOLLA_SERVICE_NAME}" >> /usr/local/etc/neutron-wrappers/config
diff --git a/kolla/docker/neutron/neutron-base/delete-wrappers b/kolla/docker/neutron/neutron-base/delete-wrappers
new file mode 100644
index 000000000..239d977f2
--- /dev/null
+++ b/kolla/docker/neutron/neutron-base/delete-wrappers
@@ -0,0 +1,6 @@
+#!/bin/bash
+for binary in dnsmasq haproxy keepalived neutron-keepalived-state-change radvd; do
+    rm -f /usr/local/bin/${binary}
+done
+
+rm -f /usr/local/etc/neutron-wrappers/config
diff --git a/kolla/docker/neutron/neutron-base/dnsmasq b/kolla/docker/neutron/neutron-base/dnsmasq
new file mode 100644
index 000000000..44b73f0b2
--- /dev/null
+++ b/kolla/docker/neutron/neutron-base/dnsmasq
@@ -0,0 +1,45 @@
+#!/bin/bash
+
+source /usr/local/etc/neutron-wrappers/config
+
+ARGS="$@"
+
+# Extract the network namespace UUID from the command line args provided by
+# neutron. Typically of the form (with dnsmasq as an example):
+#
+# dnsmasq --no-hosts --no-resolv --except-interface=lo \
+#   --pid-file=/var/lib/neutron/dhcp/317716b8-919a-4a6f-8db1-78128ec3b100/pid  \
+#   --dhcp-hostsfile=/var/lib/neutron/dhcp/317716b8-919a-4a6f-8db1-78128ec3b100/host ...
+NETNS=$(ip netns identify)
+NAME=${KOLLA_NAME}_dnsmasq_${NETNS}
+
+if [[ -S "/var/run/docker.sock" ]]; then
+    CLI="docker"
+    CMD="ip netns exec ${NETNS} /usr/sbin/dnsmasq -k"
+elif [[ -S "/run/podman/podman.sock" ]]; then
+    CLI="nsenter --net=/run/netns/${NETNS} --preserve-credentials -m -t1 podman"
+    CMD="/usr/sbin/dnsmasq -k"
+else
+    echo "Could not detect a supported container runtime, exiting."
+    exit 1
+fi
+
+LIST=$($CLI ps -a --filter name=${SERVICE}_dnsmasq_ --format '{{.ID}}:{{.Names}}:{{.Status}}' | awk '{print $1}')
+
+# If the NAME is already taken by a container, give it an unique name
+printf "%s\n" "${LIST}" | grep -q "${NAME}$" && NAME="${NAME}_$(date +%Y-%m-%d-%H%M%S-%N)"
+
+echo "Starting a new child container ${NAME} using image ${KOLLA_IMAGE}"
+$CLI run --rm --detach \
+    -v /etc/kolla/${KOLLA_SERVICE_NAME}:/etc/neutron:ro \
+    -v /run/netns:/run/netns:shared \
+    -v neutron_metadata_socket:/var/lib/neutron/kolla/ \
+    -v kolla_logs:/var/log/kolla \
+    --net host \
+    --pid host \
+    --cgroupns host \
+    --privileged \
+    -u root \
+    --name $NAME \
+    ${KOLLA_IMAGE} \
+    $CMD $ARGS
diff --git a/kolla/docker/neutron/neutron-base/extend_start.sh b/kolla/docker/neutron/neutron-base/extend_start.sh
new file mode 100644
index 000000000..e2a2dfca4
--- /dev/null
+++ b/kolla/docker/neutron/neutron-base/extend_start.sh
@@ -0,0 +1,34 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/neutron" ]]; then
+    mkdir -p /var/log/kolla/neutron
+fi
+if [[ $(stat -c %a /var/log/kolla/neutron) != "755" ]]; then
+    chmod 755 /var/log/kolla/neutron
+fi
+
+# NOTE(hrw): from RHEL 9 release notes:
+# "Iptables-nft and ipset are now deprecated, which included the utilities,
+#  iptables, ip6tables, ebtables, and arptables. These are all replaced by the
+#  nftables framework."
+# so no need to even use u-a on RHEL 9 family as there is one provider
+# (and there is no u-a for ip6tables so script fails)
+
+if [[ ! ${KOLLA_BASE_DISTRO} =~ centos|rocky ]]; then
+    if /usr/bin/update-alternatives --display iptables; then
+        # NOTE(yoctozepto): Kolla-Ansible does not always set KOLLA_LEGACY_IPTABLES;
+        # the workaround below ensures it gets set to `false` in such cases to fix
+        # this code under `set -o nounset`.
+        KOLLA_LEGACY_IPTABLES=${KOLLA_LEGACY_IPTABLES-false}
+
+        if [[ $KOLLA_LEGACY_IPTABLES == "true" ]]; then
+            sudo /usr/bin/update-alternatives --set iptables /usr/sbin/iptables-legacy
+            sudo /usr/bin/update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
+        else
+            sudo /usr/bin/update-alternatives --auto iptables
+            sudo /usr/bin/update-alternatives --auto ip6tables
+        fi
+    fi
+fi
+
+. /usr/local/bin/kolla_neutron_extend_start
diff --git a/kolla/docker/neutron/neutron-base/haproxy b/kolla/docker/neutron/neutron-base/haproxy
new file mode 100644
index 000000000..43b9ef9d2
--- /dev/null
+++ b/kolla/docker/neutron/neutron-base/haproxy
@@ -0,0 +1,45 @@
+#!/bin/bash
+
+source /usr/local/etc/neutron-wrappers/config
+
+ARGS="$@"
+
+# Extract the network namespace UUID from the command line args provided by
+# neutron. Typically of the form (with dnsmasq as an example):
+#
+# dnsmasq --no-hosts --no-resolv --except-interface=lo \
+#   --pid-file=/var/lib/neutron/dhcp/317716b8-919a-4a6f-8db1-78128ec3b100/pid  \
+#   --dhcp-hostsfile=/var/lib/neutron/dhcp/317716b8-919a-4a6f-8db1-78128ec3b100/host ...
+NETNS=$(ip netns identify)
+NAME=${KOLLA_NAME}_haproxy_${NETNS}
+HAPROXY_CMD='$(if [ -f /usr/sbin/haproxy-systemd-wrapper ]; then echo "/usr/sbin/haproxy -Ds"; else echo "/usr/sbin/haproxy -Ws"; fi)'
+if [[ -S "/var/run/docker.sock" ]]; then
+    CLI="docker"
+    CMD="ip netns exec ${NETNS} "'$HAPROXY'
+elif [[ -S "/run/podman/podman.sock" ]]; then
+    CLI="nsenter --net=/run/netns/${NETNS} --preserve-credentials -m -t 1 podman"
+    CMD='$HAPROXY'
+else
+    echo "Could not detect a supported container runtime, exiting."
+    exit 1
+fi
+
+LIST=$($CLI ps -a --filter name=${KOLLA_NAME}_haproxy_ --format '{{.ID}}:{{.Names}}:{{.Status}}' | awk '{print $1}')
+
+# If the NAME is already taken by a container, give it an unique name
+printf "%s\n" "${LIST}" | grep -q "${NAME}$" && NAME="${NAME}_$(date +%Y-%m-%d-%H%M%S-%N)"
+
+echo "Starting a new child container ${NAME} using image ${KOLLA_IMAGE}"
+$CLI run --rm --detach \
+    -v /etc/kolla/${KOLLA_SERVICE_NAME}:/etc/neutron:ro \
+    -v /run/netns:/run/netns:shared \
+    -v neutron_metadata_socket:/var/lib/neutron/kolla \
+    -v kolla_logs:/var/log/kolla \
+    --net host \
+    --pid host \
+    --cgroupns host \
+    --privileged \
+    -u root \
+    --name $NAME \
+    ${KOLLA_IMAGE} \
+    /bin/bash -c "HAPROXY=\"$HAPROXY_CMD\"; exec $CMD $ARGS"
diff --git a/kolla/docker/neutron/neutron-base/keepalived b/kolla/docker/neutron/neutron-base/keepalived
new file mode 100644
index 000000000..6bb2b4d3d
--- /dev/null
+++ b/kolla/docker/neutron/neutron-base/keepalived
@@ -0,0 +1,47 @@
+#!/bin/bash
+
+source /usr/local/etc/neutron-wrappers/config
+
+ARGS="$@"
+
+# Extract the network namespace UUID from the command line args provided by
+# neutron. Typically of the form (with dnsmasq as an example):
+#
+# dnsmasq --no-hosts --no-resolv --except-interface=lo \
+#   --pid-file=/var/lib/neutron/dhcp/317716b8-919a-4a6f-8db1-78128ec3b100/pid  \
+#   --dhcp-hostsfile=/var/lib/neutron/dhcp/317716b8-919a-4a6f-8db1-78128ec3b100/host ...
+NETNS=$(ip netns identify)
+NAME=${KOLLA_NAME}_keepalived_${NETNS}
+
+if [[ -S "/var/run/docker.sock" ]]; then
+    CLI="docker"
+    CMD="ip netns exec ${NETNS} /usr/sbin/keepalived -n -l -D"
+elif [[ -S "/run/podman/podman.sock" ]]; then
+    CLI="nsenter --net=/run/netns/${NETNS} --preserve-credentials -m -t 1 podman"
+    CMD='/usr/sbin/keepalived -n -l -D'
+else
+    echo "Could not detect a supported container runtime, exiting."
+    exit 1
+fi
+
+LIST=$($CLI ps -a --filter name=${KOLLA_SERVICE}_keepalived_ --format '{{.ID}}:{{.Names}}:{{.Status}}' | awk '{print $1}')
+
+# If the NAME is already taken by a container, give it an unique name
+printf "%s\n" "${LIST}" | grep -q "${NAME}$" && NAME="${NAME}_$(date +%Y-%m-%d-%H%M%S-%N)"
+
+echo "Starting a new child container ${NAME} using image ${KOLLA_IMAGE}"
+$CLI run --rm --detach \
+    -v /etc/kolla/${KOLLA_SERVICE_NAME}:/etc/neutron:ro \
+    -v /lib/modules:/lib/modules:ro \
+    -v /sbin/modprobe:/sbin/modprobe:ro \
+    -v /run/netns:/run/netns:shared \
+    -v neutron_metadata_socket:/var/lib/neutron/kolla/ \
+    -v kolla_logs:/var/log/kolla \
+    --net host \
+    --pid host \
+    --cgroupns host \
+    --privileged \
+    -u root \
+    --name $NAME \
+    ${KOLLA_IMAGE} \
+    $CMD $ARGS
diff --git a/kolla/docker/neutron/neutron-base/neutron-keepalived-state-change b/kolla/docker/neutron/neutron-base/neutron-keepalived-state-change
new file mode 100644
index 000000000..0b30d88cf
--- /dev/null
+++ b/kolla/docker/neutron/neutron-base/neutron-keepalived-state-change
@@ -0,0 +1,40 @@
+#!/bin/bash
+
+source /usr/local/etc/neutron-wrappers/config
+
+ARGS="$@"
+
+# Extract the network namespace UUID from the command line args provided by
+# neutron. Typically of the form (with dnsmasq as an example):
+#
+# dnsmasq --no-hosts --no-resolv --except-interface=lo \
+#   --pid-file=/var/lib/neutron/dhcp/317716b8-919a-4a6f-8db1-78128ec3b100/pid  \
+#   --dhcp-hostsfile=/var/lib/neutron/dhcp/317716b8-919a-4a6f-8db1-78128ec3b100/host ...
+NETNS=$(ip netns identify)
+NAME=${KOLLA_NAME}_keepalived_${NETNS}
+if [[ -S "/var/run/docker.sock" ]]; then
+    CLI="docker exec --detach"
+    CMD="ip netns exec ${NETNS} /usr/bin/neutron-keepalived-state-change"
+elif [[ -S "/run/podman/podman.sock" ]]; then
+    CLI="nsenter --net=/run/netns/${NETNS} --preserve-credentials -m -t 1 podman exec"
+    CMD="/usr/bin/neutron-keepalived-state-change"
+else
+    echo "Could not detect a supported container runtime, exiting."
+    exit 1
+fi
+
+# The state change daemon only runs as a daemon for the moment so we need to
+# run it within an existing container with a sensibly matching lifetime.  The
+# related keepalived container seems an obvious choice.
+container_id=$($CLI ps --filter name=$NAME --format "{{.ID}}")
+
+if [[ -z $container_id ]];
+then
+    echo "WARNING: keepalived container is not running."
+    exit 0
+fi
+
+$CLI -u root \
+    --privileged \
+    $NAME \
+    $CMD $ARGS
diff --git a/kolla/docker/neutron/neutron-base/neutron_sudoers b/kolla/docker/neutron/neutron-base/neutron_sudoers
new file mode 100644
index 000000000..d0de94f0e
--- /dev/null
+++ b/kolla/docker/neutron/neutron-base/neutron_sudoers
@@ -0,0 +1,11 @@
+neutron ALL = (root) NOPASSWD: /var/lib/kolla/venv/bin/neutron-rootwrap /etc/neutron/rootwrap.conf *
+neutron ALL = (root) NOPASSWD: /var/lib/kolla/venv/bin/neutron-rootwrap-daemon /etc/neutron/rootwrap.conf
+neutron ALL = (root) NOPASSWD: /usr/bin/update-alternatives --set iptables /usr/sbin/iptables-legacy
+neutron ALL = (root) NOPASSWD: /usr/bin/update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
+neutron ALL = (root) NOPASSWD: /usr/bin/update-alternatives --auto iptables
+neutron ALL = (root) NOPASSWD: /usr/bin/update-alternatives --auto ip6tables
+neutron ALL = (root) NOPASSWD: /usr/sbin/update-alternatives --set iptables /usr/sbin/iptables-legacy
+neutron ALL = (root) NOPASSWD: /usr/sbin/update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
+neutron ALL = (root) NOPASSWD: /usr/sbin/update-alternatives --auto iptables
+neutron ALL = (root) NOPASSWD: /usr/sbin/update-alternatives --auto ip6tables
+neutron ALL = (root) NOPASSWD: /usr/local/lib/neutron-wrappers/copy-wrappers, /usr/local/lib/neutron-wrappers/delete-wrappers
diff --git a/kolla/docker/neutron/neutron-base/radvd b/kolla/docker/neutron/neutron-base/radvd
new file mode 100644
index 000000000..3f5dd1cfa
--- /dev/null
+++ b/kolla/docker/neutron/neutron-base/radvd
@@ -0,0 +1,42 @@
+#!/bin/bash
+
+source /usr/local/etc/neutron-wrappers/config
+
+ARGS="$@"
+# Extract the network namespace UUID from the command line args provided by
+# neutron. Typically of the form (with dnsmasq as an example):
+#
+# dnsmasq --no-hosts --no-resolv --except-interface=lo \
+#   --pid-file=/var/lib/neutron/dhcp/317716b8-919a-4a6f-8db1-78128ec3b100/pid  \
+#   --dhcp-hostsfile=/var/lib/neutron/dhcp/317716b8-919a-4a6f-8db1-78128ec3b100/host ...
+NETWORK_ID=$(echo $ARGS| awk '{if (match($0, /(\w{8}-\w{4}-\w{4}-\w{4}-\w{12})/,m)) print m[0] }')
+NAME=${KOLLA_NAME}_radvd_${NETWORK_ID}
+if [[ -S "/var/run/docker.sock" ]]; then
+    CLI="docker"
+    CMD="ip netns exec qrouter-${NETWORK_ID} /usr/sbin/radvd -n"
+elif [[ -S "/run/podman/podman.sock" ]]; then
+    CLI="nsenter --net=/run/netns/${NETNS} --preserve-credentials -m -t 1 podman"
+    CMD="/usr/sbin/radvd -n"
+else
+    echo "Could not detect a supported container runtime, exiting."
+    exit 1
+fi
+
+LIST=$($CLI ps -a --filter name=${KOLLA_NAME}_radvd_ --format '{{.ID}}:{{.Names}}:{{.Status}}' | awk '{print $1}')
+# If the NAME is already taken by a container, give it an unique name
+printf "%s\n" "${LIST}" | grep -q "${NAME}$" && NAME="${NAME}_$(date +%Y-%m-%d-%H%M%S-%N)"
+
+echo "Starting a new child container ${NAME} using image ${KOLLA_IMAGE}"
+$CLI run --rm --detach \
+     -v /etc/kolla/${KOLLA_SERVICE_NAME}:/etc/neutron:ro \
+     -v /run/netns:/run/netns:shared \
+     -v neutron_metadata_socket:/var/lib/neutron/kolla/ \
+     -v kolla_logs:/var/log/kolla \
+     --net host \
+     --pid host \
+     --cgroupns host \
+     --privileged \
+     -u root \
+     --name $NAME \
+     ${KOLLA_IMAGE} \
+     $CMD $ARGS
diff --git a/kolla/docker/neutron/neutron-bgp-dragent/Dockerfile.j2 b/kolla/docker/neutron/neutron-bgp-dragent/Dockerfile.j2
new file mode 100644
index 000000000..3ad2ab596
--- /dev/null
+++ b/kolla/docker/neutron/neutron-bgp-dragent/Dockerfile.j2
@@ -0,0 +1,24 @@
+FROM {{ namespace }}/{{ image_prefix }}neutron-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block neutron_bgp_dragent_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+ADD neutron-bgp-dragent-archive /neutron-bgp-dragent-source
+
+    {% set neutron_bgp_dragent_pip_packages = [
+        '/neutron_dynamic_routing'
+    ] %}
+
+RUN ln -s neutron-bgp-dragent-source/* neutron_dynamic_routing \
+    && {{ macros.install_pip(neutron_bgp_dragent_pip_packages | customizable("pip_packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block neutron_bgp_dragent_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER neutron
diff --git a/kolla/docker/neutron/neutron-dhcp-agent/Dockerfile.j2 b/kolla/docker/neutron/neutron-dhcp-agent/Dockerfile.j2
new file mode 100644
index 000000000..035433bf2
--- /dev/null
+++ b/kolla/docker/neutron/neutron-dhcp-agent/Dockerfile.j2
@@ -0,0 +1,22 @@
+FROM {{ namespace }}/{{ image_prefix }}neutron-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block neutron_dhcp_agent_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set neutron_dhcp_agent_packages = [
+] %}
+
+{{ macros.install_packages(neutron_dhcp_agent_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+{% block neutron_dhcp_agent_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER neutron
diff --git a/kolla/docker/neutron/neutron-dhcp-agent/extend_start.sh b/kolla/docker/neutron/neutron-dhcp-agent/extend_start.sh
new file mode 100644
index 000000000..edaad2a3a
--- /dev/null
+++ b/kolla/docker/neutron/neutron-dhcp-agent/extend_start.sh
@@ -0,0 +1,17 @@
+if [[ ! -d "/var/log/kolla/neutron" ]]; then
+    mkdir -p /var/log/kolla/neutron
+fi
+if [[ ! -f "/var/log/kolla/neutron/dnsmasq.log" ]]; then
+    touch /var/log/kolla/neutron/dnsmasq.log
+    chown neutron:kolla /var/log/kolla/neutron/dnsmasq.log
+fi
+
+if [[ "${KOLLA_NEUTRON_WRAPPERS:-false}" == "true" ]]; then
+    echo "Copying neutron agent wrappers to /usr/local/bin"
+    sudo -E /usr/local/lib/neutron-wrappers/copy-wrappers
+else
+    echo "Removing neutron agent wrappers from /usr/local/bin"
+    sudo -E /usr/local/lib/neutron-wrappers/delete-wrappers
+fi
+
+. /usr/local/bin/kolla_neutron_extend_start
diff --git a/kolla/docker/neutron/neutron-l3-agent/Dockerfile.j2 b/kolla/docker/neutron/neutron-l3-agent/Dockerfile.j2
new file mode 100644
index 000000000..ae0457c18
--- /dev/null
+++ b/kolla/docker/neutron/neutron-l3-agent/Dockerfile.j2
@@ -0,0 +1,32 @@
+FROM {{ namespace }}/{{ image_prefix }}neutron-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block neutron_l3_agent_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+   {% set neutron_l3_agent_packages = [
+      'libreswan',
+      'radvd'
+   ] %}
+{% elif base_package_type == 'deb' %}
+   {% set neutron_l3_agent_packages = [
+      'strongswan',
+      'radvd',
+      'libnetfilter-log1'
+   ] %}
+{% endif %}
+
+{{ macros.install_packages(neutron_l3_agent_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+{% block neutron_l3_agent_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER neutron
diff --git a/kolla/docker/neutron/neutron-l3-agent/extend_start.sh b/kolla/docker/neutron/neutron-l3-agent/extend_start.sh
new file mode 100644
index 000000000..f95c1eda2
--- /dev/null
+++ b/kolla/docker/neutron/neutron-l3-agent/extend_start.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+if [[ ! -d "/var/log/kolla/neutron" ]]; then
+    mkdir -p /var/log/kolla/neutron
+fi
+if [[ $(stat -c %a /var/log/kolla/neutron) != "755" ]]; then
+    chmod 755 /var/log/kolla/neutron
+fi
+
+# NOTE(hrw): from RHEL 9 release notes:
+# "Iptables-nft and ipset are now deprecated, which included the utilities,
+#  iptables, ip6tables, ebtables, and arptables. These are all replaced by the
+#  nftables framework."
+# so no need to even use u-a on RHEL 9 family as there is one provider
+# (and there is no u-a for ip6tables so script fails)
+if [[ ! ${KOLLA_BASE_DISTRO} =~ centos|rocky ]]; then
+    if /usr/bin/update-alternatives --display iptables; then
+        # NOTE(yoctozepto): Kolla-Ansible does not always set KOLLA_LEGACY_IPTABLES;
+        # the workaround below ensures it gets set to `false` in such cases to fix
+        # this code under `set -o nounset`.
+        KOLLA_LEGACY_IPTABLES=${KOLLA_LEGACY_IPTABLES-false}
+        if [[ $KOLLA_LEGACY_IPTABLES == "true" ]]; then
+            sudo /usr/bin/update-alternatives --set iptables /usr/sbin/iptables-legacy
+            sudo /usr/bin/update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
+        else
+            sudo /usr/bin/update-alternatives --auto iptables
+            sudo /usr/bin/update-alternatives --auto ip6tables
+        fi
+    fi
+fi
+
+if [[ "${KOLLA_NEUTRON_WRAPPERS:-false}" == "true" ]]; then
+    echo "Copying neutron agent wrappers to /usr/local/bin"
+    sudo -E /usr/local/lib/neutron-wrappers/copy-wrappers
+else
+    echo "Removing neutron agent wrappers from /usr/local/bin"
+    sudo -E /usr/local/lib/neutron-wrappers/delete-wrappers
+fi
+
+. /usr/local/bin/kolla_neutron_extend_start
diff --git a/kolla/docker/neutron/neutron-metadata-agent/Dockerfile.j2 b/kolla/docker/neutron/neutron-metadata-agent/Dockerfile.j2
new file mode 100644
index 000000000..3736f70c8
--- /dev/null
+++ b/kolla/docker/neutron/neutron-metadata-agent/Dockerfile.j2
@@ -0,0 +1,22 @@
+FROM {{ namespace }}/{{ image_prefix }}neutron-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block neutron_metadata_agent_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set neutron_metadata_agent_packages = [
+] %}
+
+{{ macros.install_packages(neutron_metadata_agent_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+{% block neutron_metadata_agent_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER neutron
diff --git a/kolla/docker/neutron/neutron-metadata-agent/extend_start.sh b/kolla/docker/neutron/neutron-metadata-agent/extend_start.sh
new file mode 100644
index 000000000..001898f68
--- /dev/null
+++ b/kolla/docker/neutron/neutron-metadata-agent/extend_start.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/neutron" ]]; then
+    mkdir -p /var/log/kolla/neutron
+fi
+if [[ $(stat -c %a /var/log/kolla/neutron) != "755" ]]; then
+    chmod 755 /var/log/kolla/neutron
+fi
+
+if [[ "${KOLLA_NEUTRON_WRAPPERS:-false}" == "true" ]]; then
+    echo "Copying neutron agent wrappers to /usr/local/bin"
+    sudo -E /usr/local/lib/neutron-wrappers/copy-wrappers
+else
+    echo "Removing neutron agent wrappers from /usr/local/bin"
+    sudo -E /usr/local/lib/neutron-wrappers/delete-wrappers
+fi
+
+. /usr/local/bin/kolla_neutron_extend_start
diff --git a/kolla/docker/neutron/neutron-metering-agent/Dockerfile.j2 b/kolla/docker/neutron/neutron-metering-agent/Dockerfile.j2
new file mode 100644
index 000000000..e9d7f74e0
--- /dev/null
+++ b/kolla/docker/neutron/neutron-metering-agent/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}neutron-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block neutron_metering_agent_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block neutron_metering_agent_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER neutron
diff --git a/kolla/docker/neutron/neutron-mlnx-agent/Dockerfile.j2 b/kolla/docker/neutron/neutron-mlnx-agent/Dockerfile.j2
new file mode 100644
index 000000000..4ee89c19a
--- /dev/null
+++ b/kolla/docker/neutron/neutron-mlnx-agent/Dockerfile.j2
@@ -0,0 +1,27 @@
+FROM {{ namespace }}/{{ image_prefix }}neutron-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block neutron_mlnx_agent_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set neutron_mlnx_agent_packages = [
+    'python3-libvirt',
+] %}
+
+{{ macros.install_packages(neutron_mlnx_agent_packages | customizable("packages")) }}
+
+{% set neutron_mlnx_agent_pip_packages = [
+    'networking-mlnx',
+] %}
+
+RUN {{ macros.install_pip(neutron_mlnx_agent_pip_packages | customizable("pip_packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block neutron_mlnx_agent_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER neutron
diff --git a/kolla/docker/neutron/neutron-openvswitch-agent/Dockerfile.j2 b/kolla/docker/neutron/neutron-openvswitch-agent/Dockerfile.j2
new file mode 100644
index 000000000..b9499e6f7
--- /dev/null
+++ b/kolla/docker/neutron/neutron-openvswitch-agent/Dockerfile.j2
@@ -0,0 +1,17 @@
+FROM {{ namespace }}/{{ image_prefix }}neutron-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block neutron_openvswitch_agent_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.install_packages(neutron_openvswitch_agent_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block neutron_openvswitch_agent_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER neutron
diff --git a/kolla/docker/neutron/neutron-ovn-agent/Dockerfile.j2 b/kolla/docker/neutron/neutron-ovn-agent/Dockerfile.j2
new file mode 100644
index 000000000..fe4e352ac
--- /dev/null
+++ b/kolla/docker/neutron/neutron-ovn-agent/Dockerfile.j2
@@ -0,0 +1,20 @@
+FROM {{ namespace }}/{{ image_prefix }}neutron-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block neutron_ovn_agent_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set neutron_ovn_agent_packages = [
+] %}
+
+{{ macros.install_packages(neutron_ovn_agent_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block neutron_ovn_agent_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER neutron
diff --git a/kolla/docker/neutron/neutron-ovn-vpn-agent/Dockerfile.j2 b/kolla/docker/neutron/neutron-ovn-vpn-agent/Dockerfile.j2
new file mode 100644
index 000000000..4fbaaa78f
--- /dev/null
+++ b/kolla/docker/neutron/neutron-ovn-vpn-agent/Dockerfile.j2
@@ -0,0 +1,31 @@
+FROM {{ namespace }}/{{ image_prefix }}neutron-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block neutron_ovn_vpn_agent_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+# Note: VPN is currently not working on RHEL 10 due to a known issue:
+# https://bugs.launchpad.net/neutron/+bug/2146308
+{% if base_package_type == 'rpm' %}
+   {% set neutron_ovn_vpn_agent_packages = [
+      'libreswan'
+   ] %}
+{% elif base_package_type == 'deb' %}
+   {% set neutron_ovn_vpn_agent_packages = [
+      'strongswan',
+      'strongswan-starter',
+      'strongswan-charon'
+   ] %}
+{% endif %}
+
+{{ macros.install_packages(neutron_ovn_vpn_agent_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block neutron_ovn_vpn_agent_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER neutron
diff --git a/kolla/docker/neutron/neutron-server/Dockerfile.j2 b/kolla/docker/neutron/neutron-server/Dockerfile.j2
new file mode 100644
index 000000000..bda0d3dcf
--- /dev/null
+++ b/kolla/docker/neutron/neutron-server/Dockerfile.j2
@@ -0,0 +1,33 @@
+FROM {{ namespace }}/{{ image_prefix }}neutron-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block neutron_server_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set neutron_server_pip_packages = [
+    'networking-hyperv'
+] %}
+
+{% set neutron_server_plugins_pip_packages = [
+    '/plugins/*'
+] %}
+
+ADD plugins-archive /
+
+COPY extend_start.sh /usr/local/bin/kolla_neutron_extend_start
+
+RUN {{ macros.install_pip(neutron_server_pip_packages | customizable("pip_packages")) }} \
+    && if [ "$(ls /plugins)" ]; then \
+           {{ macros.install_pip(neutron_server_plugins_pip_packages) }}; \
+       fi \
+    && chmod 644 /usr/local/bin/kolla_neutron_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block neutron_server_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER neutron
diff --git a/kolla/docker/neutron/neutron-server/extend_start.sh b/kolla/docker/neutron/neutron-server/extend_start.sh
new file mode 100644
index 000000000..630eb6e1f
--- /dev/null
+++ b/kolla/docker/neutron/neutron-server/extend_start.sh
@@ -0,0 +1,34 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    neutron-db-manage --subproject neutron upgrade head
+    if [[ "${!NEUTRON_BOOTSTRAP_SERVICES[@]}" ]]; then
+        for service in ${NEUTRON_BOOTSTRAP_SERVICES}; do
+            neutron-db-manage --subproject $service upgrade head
+        done
+    fi
+    exit 0
+fi
+
+# Migrate database and exit if KOLLA_UPGRADE variable is set. This catches all cases
+# of the KOLLA_UPGRADE variable being set, including empty.
+if [[ "${!KOLLA_UPGRADE[@]}" ]]; then
+    if [[ "${!NEUTRON_DB_EXPAND[@]}" ]]; then
+        DB_ACTION="--expand"
+        echo "Expanding database"
+    fi
+    if [[ "${!NEUTRON_DB_CONTRACT[@]}" ]]; then
+        DB_ACTION="--contract"
+        echo "Contracting database"
+    fi
+
+    neutron-db-manage --subproject neutron upgrade $DB_ACTION
+    if [[ "${!NEUTRON_ROLLING_UPGRADE_SERVICES[@]}" ]]; then
+        for service in ${NEUTRON_ROLLING_UPGRADE_SERVICES}; do
+            neutron-db-manage --subproject $service upgrade $DB_ACTION
+        done
+    fi
+    exit 0
+fi
diff --git a/kolla/docker/neutron/neutron-sriov-agent/Dockerfile.j2 b/kolla/docker/neutron/neutron-sriov-agent/Dockerfile.j2
new file mode 100644
index 000000000..c5d74fbb2
--- /dev/null
+++ b/kolla/docker/neutron/neutron-sriov-agent/Dockerfile.j2
@@ -0,0 +1,17 @@
+FROM {{ namespace }}/{{ image_prefix }}neutron-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block neutron_sriov_agent_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.install_packages(neutron_sriov_agent_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block neutron_sriov_agent_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER neutron
diff --git a/kolla/docker/nova/nova-api/Dockerfile.j2 b/kolla/docker/nova/nova-api/Dockerfile.j2
new file mode 100644
index 000000000..57846af79
--- /dev/null
+++ b/kolla/docker/nova/nova-api/Dockerfile.j2
@@ -0,0 +1,20 @@
+FROM {{ namespace }}/{{ image_prefix }}nova-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block nova_api_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set nova_api_packages = [
+] %}
+{{ macros.install_packages(nova_api_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_nova_extend_start
+RUN chmod 644 /usr/local/bin/kolla_nova_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block nova_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/nova/nova-api/extend_start.sh b/kolla/docker/nova/nova-api/extend_start.sh
new file mode 100644
index 000000000..ead6c252b
--- /dev/null
+++ b/kolla/docker/nova/nova-api/extend_start.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+# TODO(dszumski): When Nova Conductor in Kolla Ansible supports triggering DB
+# operations, we should review this script and remove any duplicate
+# operations. This is probably anything that isn't to do with the API.
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    nova-manage api_db sync
+    nova-manage db sync --local_cell
+    nova-manage db online_data_migrations
+    exit 0
+fi
+
+if [[ "${!KOLLA_UPGRADE[@]}" ]]; then
+    nova-manage api_db sync
+    nova-manage db sync --local_cell
+    exit 0
+fi
+
+if [[ "${!KOLLA_OSM[@]}" ]]; then
+    nova-manage db online_data_migrations
+    exit 0
+fi
+
+if [[ "${!KOLLA_UPGRADE_CHECK[@]}" ]]; then
+    nova-status upgrade check
+    exit $?
+fi
diff --git a/kolla/docker/nova/nova-base/Dockerfile.j2 b/kolla/docker/nova/nova-base/Dockerfile.j2
new file mode 100644
index 000000000..423a9760a
--- /dev/null
+++ b/kolla/docker/nova/nova-base/Dockerfile.j2
@@ -0,0 +1,86 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block nova_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='nova', groups='qemu') }}
+
+{% if base_package_type == 'rpm' %}
+
+{{ macros.enable_extra_repos(['openvswitch']) }}
+
+    {% set nova_base_packages = [
+            'openvswitch${KOLLA_RPM_OVS_VERSION}',
+            'python3-openvswitch${KOLLA_RPM_OVS_VERSION}'
+    ] %}
+    {% if base_arch == 'x86_64' %}
+        {% set nova_base_packages = nova_base_packages + [
+            'edk2-ovmf'
+        ] %}
+    {% elif base_arch == 'aarch64' %}
+        {% set nova_base_packages = nova_base_packages + [
+            'edk2-aarch64'
+        ] %}
+    {% endif %}
+
+{% elif base_package_type == 'deb' %}
+
+    {% set nova_base_packages = [
+        'dnsmasq',
+        'ebtables',
+        'iproute2',
+        'iptables',
+        'openssh-client',
+        'openvswitch-switch',
+        'python3-libvirt',
+        'python3-openvswitch'
+    ] %}
+    {% if base_arch == 'x86_64' %}
+        {% set nova_base_packages = nova_base_packages + [
+            'ovmf'
+        ] %}
+    {% elif base_arch == 'aarch64' %}
+        {% set nova_base_packages = nova_base_packages + [
+            'qemu-efi-aarch64',
+        ] %}
+    {% endif %}
+
+{% endif %}
+
+{{ macros.install_packages(nova_base_packages | customizable("packages")) }}
+
+ADD nova-base-archive /nova-base-source
+ADD plugins-archive /
+
+{% set nova_base_pip_packages = [
+    '/nova'
+] %}
+
+{% set nova_base_plugins_pip_packages = [
+    '/plugins/*'
+] %}
+
+COPY nova_sudoers /etc/sudoers.d/kolla_nova_sudoers
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN ln -s nova-base-source/* nova \
+    && {{ macros.install_pip(nova_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/nova/ \
+    && cp -r /nova/etc/nova/* /etc/nova/ \
+    && cp /var/lib/kolla/venv/etc/pycadf/nova_api_audit_map.conf /etc/nova/ \
+    && sed -i 's|^exec_dirs.*|exec_dirs=/var/lib/kolla/venv/bin,/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/bin,/usr/local/sbin|g' /etc/nova/rootwrap.conf \
+    && if [ "$(ls /plugins)" ]; then \
+        {{ macros.install_pip(nova_base_plugins_pip_packages) }}; \
+       fi \
+    && chmod 750 /etc/sudoers.d \
+    && chmod 440 /etc/sudoers.d/kolla_nova_sudoers \
+    && touch /usr/local/bin/kolla_nova_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_nova_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block nova_base_footer %}{% endblock %}
diff --git a/kolla/docker/nova/nova-base/extend_start.sh b/kolla/docker/nova/nova-base/extend_start.sh
new file mode 100644
index 000000000..eee0f16a1
--- /dev/null
+++ b/kolla/docker/nova/nova-base/extend_start.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/nova" ]]; then
+    mkdir -p /var/log/kolla/nova
+fi
+if [[ $(stat -c %a /var/log/kolla/nova) != "755" ]]; then
+    chmod 755 /var/log/kolla/nova
+fi
+
+. /usr/local/bin/kolla_nova_extend_start
diff --git a/kolla/docker/nova/nova-base/nova_sudoers b/kolla/docker/nova/nova-base/nova_sudoers
new file mode 100644
index 000000000..6d73da6d3
--- /dev/null
+++ b/kolla/docker/nova/nova-base/nova_sudoers
@@ -0,0 +1 @@
+nova ALL = (root) NOPASSWD: /var/lib/kolla/venv/bin/nova-rootwrap /etc/nova/rootwrap.conf *
diff --git a/kolla/docker/nova/nova-compute-ironic/Dockerfile.j2 b/kolla/docker/nova/nova-compute-ironic/Dockerfile.j2
new file mode 100644
index 000000000..3c455e2ec
--- /dev/null
+++ b/kolla/docker/nova/nova-compute-ironic/Dockerfile.j2
@@ -0,0 +1,23 @@
+FROM {{ namespace }}/{{ image_prefix }}nova-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block nova_compute_ironic_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set nova_compute_ironic_packages = [
+    'genisoimage',
+    'nvme-cli',
+    'xorriso'
+] %}
+
+{{ macros.install_packages(nova_compute_ironic_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block nova_compute_ironic_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER nova
diff --git a/kolla/docker/nova/nova-compute/Dockerfile.j2 b/kolla/docker/nova/nova-compute/Dockerfile.j2
new file mode 100644
index 000000000..8b3c1bcfe
--- /dev/null
+++ b/kolla/docker/nova/nova-compute/Dockerfile.j2
@@ -0,0 +1,112 @@
+FROM {{ namespace }}/{{ image_prefix }}nova-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block nova_compute_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+
+{{ macros.enable_extra_repos(['ceph', 'epel']) }}
+
+    {% set nova_compute_packages = [
+        'ceph-common',
+        'cyrus-sasl-md5',
+        'cyrus-sasl-scram',
+        'device-mapper-multipath',
+        'dosfstools',
+        'e2fsprogs',
+        'genisoimage',
+        'iscsi-initiator-utils',
+        'libosinfo',
+        'ndctl',
+        'nfs-utils',
+        'nvme-cli',
+        'parted',
+        'python3-libguestfs',
+        'python3-libvirt',
+        'python3-rtslib',
+        'qemu-img',
+        'qemu-kvm-block-rbd',
+        'rsync',
+        'sysfsutils',
+        'targetcli',
+        'xfsprogs'
+    ] %}
+
+    # NOTE(hrw): daxio is part of pmdk which is x86-64 only in CentOS 8
+    {% if base_arch == 'x86_64' %}
+        {% set nova_compute_packages = nova_compute_packages + [
+            'daxio'
+        ] %}
+    {% endif %}
+
+{{ macros.install_packages(nova_compute_packages | customizable("packages")) }}
+
+{% elif base_package_type == 'deb' %}
+
+    {% set nova_compute_packages = [
+        'ceph-common',
+        'dosfstools',
+        'e2fsprogs',
+        'genisoimage',
+        'libosinfo-bin',
+        'libsasl2-modules-gssapi-mit',
+        'multipath-tools',
+        'ndctl',
+        'nfs-common',
+        'nvme-cli',
+        'open-iscsi',
+        'parted',
+        'pmdk-tools',
+        'python3-cephfs',
+        'python3-guestfs',
+        'python3-libvirt',
+        'python3-rados',
+        'python3-rbd',
+        'python3-rtslib-fb',
+        'qemu-block-extra',
+        'qemu-utils',
+        'rsync',
+        'sasl2-bin',
+        'swtpm',
+        'swtpm-tools',
+        'sysfsutils',
+        'targetcli-fb',
+        'tpm2-tools',
+        'xfsprogs'
+    ] %}
+
+RUN mkdir -p /etc/ceph \
+    && {{ macros.install_packages(nova_compute_packages | customizable("packages"), chain=True) }}
+
+{% endif %}
+
+{% set nova_compute_pip_packages = [
+        'oslo-vmware'
+    ]
+%}
+
+{% set nova_compute_plugins_pip_packages = [
+    '/plugins/*'
+] %}
+
+ADD plugins-archive /
+
+COPY extend_start.sh /usr/local/bin/kolla_nova_extend_start
+
+RUN {{ macros.install_pip(nova_compute_pip_packages | customizable("pip_packages")) }} \
+    && if [ "$(ls /plugins)" ]; then \
+           {{ macros.install_pip(nova_compute_plugins_pip_packages) }}; \
+       fi \
+    && chmod 644 /usr/local/bin/kolla_nova_extend_start \
+    && rm -f /etc/machine-id
+
+{{ macros.kolla_patch_sources() }}
+
+{% block nova_compute_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER nova
diff --git a/kolla/docker/nova/nova-compute/extend_start.sh b/kolla/docker/nova/nova-compute/extend_start.sh
new file mode 100644
index 000000000..a458625ec
--- /dev/null
+++ b/kolla/docker/nova/nova-compute/extend_start.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+if [[ ! -d /var/lib/nova/instances ]]; then
+    mkdir -p /var/lib/nova/instances
+fi
diff --git a/kolla/docker/nova/nova-conductor/Dockerfile.j2 b/kolla/docker/nova/nova-conductor/Dockerfile.j2
new file mode 100644
index 000000000..b14000400
--- /dev/null
+++ b/kolla/docker/nova/nova-conductor/Dockerfile.j2
@@ -0,0 +1,18 @@
+FROM {{ namespace }}/{{ image_prefix }}nova-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block nova_conductor_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+COPY extend_start.sh /usr/local/bin/kolla_nova_extend_start
+RUN chmod 644 /usr/local/bin/kolla_nova_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block nova_conductor_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER nova
diff --git a/kolla/docker/nova/nova-conductor/extend_start.sh b/kolla/docker/nova/nova-conductor/extend_start.sh
new file mode 100644
index 000000000..72c9493f5
--- /dev/null
+++ b/kolla/docker/nova/nova-conductor/extend_start.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    nova-manage db sync --local_cell
+    nova-manage db online_data_migrations
+    exit 0
+fi
+
+if [[ "${!KOLLA_UPGRADE[@]}" ]]; then
+    nova-manage db sync --local_cell
+    exit 0
+fi
+
+if [[ "${!KOLLA_OSM[@]}" ]]; then
+    nova-manage db online_data_migrations
+    exit 0
+fi
diff --git a/kolla/docker/nova/nova-libvirt-spice/Dockerfile.j2 b/kolla/docker/nova/nova-libvirt-spice/Dockerfile.j2
new file mode 100644
index 000000000..4c7ded894
--- /dev/null
+++ b/kolla/docker/nova/nova-libvirt-spice/Dockerfile.j2
@@ -0,0 +1,120 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build_date }}"
+{% endblock %}
+
+{% block nova_libvirt_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='nova', groups='qemu') }}
+
+{% if base_package_type == 'rpm' %}
+
+    {% set nova_libvirt_extra_repos = ['ceph', 'crb', 'epel', 'openvswitch'] %}
+    {% if base_distro == 'rocky' %}
+        {#
+            The stock Rocky qemu-kvm has SPICE compiled out. To enable
+            Kerbside and the nova ``spice-direct`` console we therefore
+            layer the ligenix COPR in so that qemu-kvm and spice-server
+            are available with SPICE re-enabled. The repo definition
+            lives in kolla/template/repos.yaml so deployers can override
+            it like any other extra repo.
+        #}
+        {% set nova_libvirt_extra_repos = nova_libvirt_extra_repos + ['ligenix-qemu-spice'] %}
+    {% endif %}
+
+{{ macros.enable_extra_repos(nova_libvirt_extra_repos) }}
+
+    {% set nova_libvirt_packages = [
+        'ceph-common',
+        'cyrus-sasl-md5',
+        'cyrus-sasl-scram',
+        'libguestfs',
+        'libvirt-client',
+        'libvirt-daemon',
+        'libvirt-daemon-log',
+        'libvirt-daemon-config-nwfilter',
+        'libvirt-daemon-driver-nwfilter',
+        'libvirt-daemon-driver-nodedev',
+        'openvswitch${KOLLA_RPM_OVS_VERSION}',
+        'qemu-img',
+        'qemu-kvm',
+        'swtpm',
+    ] %}
+    {% if base_arch == 'x86_64' %}
+        {% set nova_libvirt_packages = nova_libvirt_packages + [
+            'edk2-ovmf'
+        ] %}
+    {% elif base_arch == 'aarch64' %}
+        {% set nova_libvirt_packages = nova_libvirt_packages + [
+            'edk2-aarch64'
+        ] %}
+    {% endif %}
+
+    {% if use_ligenix_qemu | default(false) and base_distro == 'rocky' %}
+        {% set nova_libvirt_packages = nova_libvirt_packages + [
+            'qemu-kvm-ui-spice',
+            'spice-server',
+        ] %}
+    {% endif %}
+
+{% elif base_package_type == 'deb' %}
+
+    {% set nova_libvirt_packages = [
+        'ceph-common',
+        'ebtables',
+        'libsasl2-modules-gssapi-mit',
+        'libvirt-clients',
+        'libvirt-daemon-system',
+        'mdevctl',
+        'openvswitch-switch',
+        'pm-utils',
+        'python3-cephfs',
+        'python3-rados',
+        'python3-rbd',
+        'qemu-block-extra',
+        'qemu-system',
+        'qemu-system-modules-spice',
+        'qemu-utils',
+        'sasl2-bin',
+        'swtpm',
+        'swtpm-tools',
+        'tpm2-tools',
+        'trousers'
+    ] %}
+
+    {% if base_arch == "aarch64" %}
+        {% set nova_libvirt_packages = nova_libvirt_packages + [
+            'qemu-efi-aarch64'
+        ] %}
+    {% elif base_arch == "x86_64" %}
+        {% set nova_libvirt_packages = nova_libvirt_packages + [
+            'ovmf',
+        ] %}
+    {% endif %}
+
+    {% if base_distro in ['debian'] %}
+        {% set nova_libvirt_packages = nova_libvirt_packages + [
+            'libvirt-daemon-log',
+            'usermode'
+        ] %}
+    {% endif %}
+{% endif %}
+
+{{ macros.install_packages(nova_libvirt_packages | customizable("packages")) }}
+
+{% if base_package_type == 'deb' %}
+
+RUN rm -f /etc/libvirt/qemu/networks/default.xml /etc/libvirt/qemu/networks/autostart/default.xml
+
+{% endif %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+COPY kolla_nova_libvirt_start.sh /usr/local/bin/kolla_nova_libvirt_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start && chmod 744 /usr/local/bin/kolla_nova_libvirt_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block nova_libvirt_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/nova/nova-libvirt-spice/extend_start.sh b/kolla/docker/nova/nova-libvirt-spice/extend_start.sh
new file mode 100644
index 000000000..cc41b480b
--- /dev/null
+++ b/kolla/docker/nova/nova-libvirt-spice/extend_start.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+if [[ ! -e "/var/log/kolla/libvirt/libvirtd.log" ]]; then
+    mkdir -p /var/log/kolla/libvirt
+    touch /var/log/kolla/libvirt/libvirtd.log
+    chmod 644 /var/log/kolla/libvirt/libvirtd.log
+fi
+if [[ $(stat -c %a /var/log/kolla/libvirt) != "755" ]]; then
+    chmod 755 /var/log/kolla/libvirt
+    chmod 644 /var/log/kolla/libvirt/libvirtd.log
+fi
diff --git a/kolla/docker/nova/nova-libvirt-spice/kolla_nova_libvirt_start.sh b/kolla/docker/nova/nova-libvirt-spice/kolla_nova_libvirt_start.sh
new file mode 100644
index 000000000..f06a63d9e
--- /dev/null
+++ b/kolla/docker/nova/nova-libvirt-spice/kolla_nova_libvirt_start.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+set -euo pipefail
+
+# NOTE(mikal): Start virtlogd as a sidecar. We need this for
+# nova instance console logs to rotate. Otherwise they will
+# consume unbounded amounts of disk.
+#
+# No exec here: libvirtd will be the "main" process.
+/usr/sbin/virtlogd &
+
+# Now hand over PID 1's direct child role to libvirtd.
+exec /usr/sbin/libvirtd --listen
diff --git a/kolla/docker/nova/nova-libvirt/Dockerfile.j2 b/kolla/docker/nova/nova-libvirt/Dockerfile.j2
new file mode 100644
index 000000000..fb82401b3
--- /dev/null
+++ b/kolla/docker/nova/nova-libvirt/Dockerfile.j2
@@ -0,0 +1,100 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block nova_libvirt_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='nova', groups='qemu') }}
+
+{% if base_package_type == 'rpm' %}
+
+{{ macros.enable_extra_repos(['ceph', 'crb', 'epel', 'openvswitch']) }}
+
+    {% set nova_libvirt_packages = [
+        'ceph-common',
+        'cyrus-sasl-md5',
+        'cyrus-sasl-scram',
+        'libguestfs',
+        'libvirt-client',
+        'libvirt-daemon',
+        'libvirt-daemon-log',
+        'libvirt-daemon-config-nwfilter',
+        'libvirt-daemon-driver-nwfilter',
+        'libvirt-daemon-driver-nodedev',
+        'openvswitch${KOLLA_RPM_OVS_VERSION}',
+        'qemu-img',
+        'qemu-kvm',
+        'swtpm',
+    ] %}
+    {% if base_arch == 'x86_64' %}
+        {% set nova_libvirt_packages = nova_libvirt_packages + [
+            'edk2-ovmf'
+        ] %}
+    {% elif base_arch == 'aarch64' %}
+        {% set nova_libvirt_packages = nova_libvirt_packages + [
+            'edk2-aarch64'
+        ] %}
+    {% endif %}
+
+{% elif base_package_type == 'deb' %}
+
+    {% set nova_libvirt_packages = [
+        'ceph-common',
+        'ebtables',
+        'libsasl2-modules-gssapi-mit',
+        'libvirt-clients',
+        'libvirt-daemon-system',
+        'mdevctl',
+        'openvswitch-switch',
+        'pm-utils',
+        'python3-cephfs',
+        'python3-rados',
+        'python3-rbd',
+        'qemu-block-extra',
+        'qemu-system',
+        'qemu-system-modules-spice',
+        'qemu-utils',
+        'sasl2-bin',
+        'swtpm',
+        'swtpm-tools',
+        'tpm2-tools',
+        'trousers'
+    ] %}
+
+    {% if base_arch == "aarch64" %}
+        {% set nova_libvirt_packages = nova_libvirt_packages + [
+            'qemu-efi-aarch64'
+        ] %}
+    {% elif base_arch == "x86_64" %}
+        {% set nova_libvirt_packages = nova_libvirt_packages + [
+            'ovmf',
+        ] %}
+    {% endif %}
+
+    {% if base_distro in ['debian'] %}
+        {% set nova_libvirt_packages = nova_libvirt_packages + [
+            'libvirt-daemon-log',
+            'usermode'
+        ] %}
+    {% endif %}
+{% endif %}
+
+{{ macros.install_packages(nova_libvirt_packages | customizable("packages")) }}
+
+{% if base_package_type == 'deb' %}
+
+RUN rm -f /etc/libvirt/qemu/networks/default.xml /etc/libvirt/qemu/networks/autostart/default.xml
+
+{% endif %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+COPY kolla_nova_libvirt_start.sh /usr/local/bin/kolla_nova_libvirt_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start && chmod 744 /usr/local/bin/kolla_nova_libvirt_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block nova_libvirt_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/nova/nova-libvirt/extend_start.sh b/kolla/docker/nova/nova-libvirt/extend_start.sh
new file mode 100644
index 000000000..cc41b480b
--- /dev/null
+++ b/kolla/docker/nova/nova-libvirt/extend_start.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+if [[ ! -e "/var/log/kolla/libvirt/libvirtd.log" ]]; then
+    mkdir -p /var/log/kolla/libvirt
+    touch /var/log/kolla/libvirt/libvirtd.log
+    chmod 644 /var/log/kolla/libvirt/libvirtd.log
+fi
+if [[ $(stat -c %a /var/log/kolla/libvirt) != "755" ]]; then
+    chmod 755 /var/log/kolla/libvirt
+    chmod 644 /var/log/kolla/libvirt/libvirtd.log
+fi
diff --git a/kolla/docker/nova/nova-libvirt/kolla_nova_libvirt_start.sh b/kolla/docker/nova/nova-libvirt/kolla_nova_libvirt_start.sh
new file mode 100644
index 000000000..f06a63d9e
--- /dev/null
+++ b/kolla/docker/nova/nova-libvirt/kolla_nova_libvirt_start.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+set -euo pipefail
+
+# NOTE(mikal): Start virtlogd as a sidecar. We need this for
+# nova instance console logs to rotate. Otherwise they will
+# consume unbounded amounts of disk.
+#
+# No exec here: libvirtd will be the "main" process.
+/usr/sbin/virtlogd &
+
+# Now hand over PID 1's direct child role to libvirtd.
+exec /usr/sbin/libvirtd --listen
diff --git a/kolla/docker/nova/nova-novncproxy/Dockerfile.j2 b/kolla/docker/nova/nova-novncproxy/Dockerfile.j2
new file mode 100644
index 000000000..4952ed734
--- /dev/null
+++ b/kolla/docker/nova/nova-novncproxy/Dockerfile.j2
@@ -0,0 +1,21 @@
+FROM {{ namespace }}/{{ image_prefix }}nova-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block nova_novncproxy_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set nova_novncproxy_packages = [
+    'novnc'
+] %}
+
+{{ macros.install_packages(nova_novncproxy_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block nova_novncproxy_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER nova
diff --git a/kolla/docker/nova/nova-scheduler/Dockerfile.j2 b/kolla/docker/nova/nova-scheduler/Dockerfile.j2
new file mode 100644
index 000000000..5b0b0b98e
--- /dev/null
+++ b/kolla/docker/nova/nova-scheduler/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}nova-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block nova_scheduler_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block nova_scheduler_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER nova
diff --git a/kolla/docker/nova/nova-serialproxy/Dockerfile.j2 b/kolla/docker/nova/nova-serialproxy/Dockerfile.j2
new file mode 100644
index 000000000..c63e925d5
--- /dev/null
+++ b/kolla/docker/nova/nova-serialproxy/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}nova-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block nova_serialproxy_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block nova_serialproxy_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER nova
diff --git a/kolla/docker/nova/nova-spicehtml5proxy/Dockerfile.j2 b/kolla/docker/nova/nova-spicehtml5proxy/Dockerfile.j2
new file mode 100644
index 000000000..f3a90b0c5
--- /dev/null
+++ b/kolla/docker/nova/nova-spicehtml5proxy/Dockerfile.j2
@@ -0,0 +1,33 @@
+FROM {{ namespace }}/{{ image_prefix }}nova-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block nova_spicehtml5proxy_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+
+    {% set nova_spicehtml5proxy_packages = [
+        'python3-numpy',
+        'spice-html5'
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+
+    {% set nova_spicehtml5proxy_packages = [
+        'spice-html5',
+        'websockify'
+    ] %}
+
+{% endif %}
+
+{{ macros.install_packages(nova_spicehtml5proxy_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block nova_spicehtml5proxy_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER nova
diff --git a/kolla/docker/nova/nova-ssh/Dockerfile.j2 b/kolla/docker/nova/nova-ssh/Dockerfile.j2
new file mode 100644
index 000000000..0d9e36b65
--- /dev/null
+++ b/kolla/docker/nova/nova-ssh/Dockerfile.j2
@@ -0,0 +1,34 @@
+FROM {{ namespace }}/{{ image_prefix }}nova-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block nova_ssh_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='nova', shell='/bin/bash') }}
+
+{% set nova_ssh_packages = [
+    'openssh-server',
+    'rsync'
+] %}
+
+{% if base_package_type == 'deb' %}
+
+RUN mkdir -p /var/run/sshd \
+    && chmod 0755 /var/run/sshd
+
+{% endif %}
+
+{{ macros.install_packages(nova_ssh_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN sed -ri 's/session(\s+)required(\s+)pam_loginuid.so/session\1optional\2pam_loginuid.so/' /etc/pam.d/sshd \
+    && chmod 644 /usr/local/bin/kolla_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block nova_ssh_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/nova/nova-ssh/extend_start.sh b/kolla/docker/nova/nova-ssh/extend_start.sh
new file mode 100644
index 000000000..b80114c0a
--- /dev/null
+++ b/kolla/docker/nova/nova-ssh/extend_start.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+SSH_HOST_KEY_TYPES=( "rsa" "ecdsa" "ed25519" )
+
+for key_type in ${SSH_HOST_KEY_TYPES[@]}; do
+    KEY_PATH=/etc/ssh/ssh_host_${key_type}_key
+    if [[ ! -f "${KEY_PATH}" ]]; then
+        ssh-keygen -q -t ${key_type} -f ${KEY_PATH} -N ""
+    fi
+done
+
+mkdir -p /var/lib/nova/.ssh
+
+if [[ $(stat -c %U:%G /var/lib/nova/.ssh) != "nova:nova" ]]; then
+    chown nova: /var/lib/nova/.ssh
+fi
diff --git a/kolla/docker/octavia/octavia-api/Dockerfile.j2 b/kolla/docker/octavia/octavia-api/Dockerfile.j2
new file mode 100644
index 000000000..ccb7bad11
--- /dev/null
+++ b/kolla/docker/octavia/octavia-api/Dockerfile.j2
@@ -0,0 +1,31 @@
+FROM {{ namespace }}/{{ image_prefix }}octavia-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block octavia_api_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set octavia_api_packages = [
+] %}
+
+{% set octavia_api_plugins_pip_packages = [
+    '/plugins/*'
+] %}
+
+ADD plugins-archive /
+
+COPY extend_start.sh /usr/local/bin/kolla_octavia_extend_start
+
+RUN if [ "$(ls /plugins)" ]; then \
+        {{ macros.install_pip(octavia_api_plugins_pip_packages) }} ; \
+    fi \
+    && chmod 644 /usr/local/bin/kolla_octavia_extend_start
+
+{{ macros.install_packages(octavia_api_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block octavia_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/octavia/octavia-api/extend_start.sh b/kolla/docker/octavia/octavia-api/extend_start.sh
new file mode 100644
index 000000000..b05d8abf1
--- /dev/null
+++ b/kolla/docker/octavia/octavia-api/extend_start.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    octavia-db-manage upgrade head
+    octavia-db-manage upgrade_persistence
+    exit 0
+fi
diff --git a/kolla/docker/octavia/octavia-base/Dockerfile.j2 b/kolla/docker/octavia/octavia-base/Dockerfile.j2
new file mode 100644
index 000000000..81a589a09
--- /dev/null
+++ b/kolla/docker/octavia/octavia-base/Dockerfile.j2
@@ -0,0 +1,48 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block octavia_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='octavia') }}
+
+{% if base_package_type == 'rpm' %}
+
+{{ macros.enable_extra_repos(['openvswitch']) }}
+
+    {% set octavia_base_packages = [
+        'python3-openvswitch${KOLLA_RPM_OVS_VERSION}'
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+
+    {% set octavia_base_packages = [
+        'python3-openvswitch'
+    ] %}
+
+{% endif %}
+
+{{ macros.install_packages(octavia_base_packages | customizable("packages")) }}
+
+ADD octavia-base-archive /octavia-base-source
+
+{% set octavia_base_pip_packages = [
+    '/octavia'
+] %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN ln -s /octavia-base-source/* octavia \
+    && {{ macros.install_pip(octavia_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/octavia \
+    && cp -r /octavia/etc/* /etc/octavia/ \
+    && cp /octavia/etc/audit/octavia_api_audit_map.conf.sample /etc/octavia/octavia_api_audit_map.conf \
+    && touch /usr/local/bin/kolla_octavia_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_octavia_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block octavia_base_footer %}{% endblock %}
diff --git a/kolla/docker/octavia/octavia-base/extend_start.sh b/kolla/docker/octavia/octavia-base/extend_start.sh
new file mode 100644
index 000000000..b27a88a31
--- /dev/null
+++ b/kolla/docker/octavia/octavia-base/extend_start.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+set -o errexit
+
+OCTAVIA_LOG_DIR=/var/log/kolla/octavia
+
+if [[ ! -d "${OCTAVIA_LOG_DIR}" ]]; then
+    mkdir -p ${OCTAVIA_LOG_DIR}
+fi
+if [[ $(stat -c %U:%G ${OCTAVIA_LOG_DIR}) != "octavia:kolla" ]]; then
+    chown -R octavia:kolla /var/log/kolla/octavia
+fi
+if [[ $(stat -c %a ${OCTAVIA_LOG_DIR}) != "755" ]]; then
+    chmod 755 ${OCTAVIA_LOG_DIR}
+fi
+
+. /usr/local/bin/kolla_octavia_extend_start
diff --git a/kolla/docker/octavia/octavia-driver-agent/Dockerfile.j2 b/kolla/docker/octavia/octavia-driver-agent/Dockerfile.j2
new file mode 100644
index 000000000..b3519922a
--- /dev/null
+++ b/kolla/docker/octavia/octavia-driver-agent/Dockerfile.j2
@@ -0,0 +1,29 @@
+FROM {{ namespace }}/{{ image_prefix }}octavia-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block octavia_driver_agent_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set octavia_driver_agent_packages = [
+] %}
+
+{% set octavia_driver_agent_plugins_pip_packages = [
+    '/plugins/*'
+] %}
+
+{{ macros.install_packages(octavia_driver_agent_packages | customizable("packages")) }}
+
+ADD plugins-archive /
+RUN if [ "$(ls /plugins)" ]; then \
+        {{ macros.install_pip(octavia_driver_agent_plugins_pip_packages) }} ; \
+    fi
+
+{{ macros.kolla_patch_sources() }}
+
+{% block octavia_driver_agent_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER octavia
diff --git a/kolla/docker/octavia/octavia-health-manager/Dockerfile.j2 b/kolla/docker/octavia/octavia-health-manager/Dockerfile.j2
new file mode 100644
index 000000000..1ffbe2050
--- /dev/null
+++ b/kolla/docker/octavia/octavia-health-manager/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}octavia-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block octavia_health_manager_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block octavia_health_manager_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER octavia
diff --git a/kolla/docker/octavia/octavia-housekeeping/Dockerfile.j2 b/kolla/docker/octavia/octavia-housekeeping/Dockerfile.j2
new file mode 100644
index 000000000..775797cca
--- /dev/null
+++ b/kolla/docker/octavia/octavia-housekeeping/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}octavia-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block octavia_housekeeping_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block octavia_housekeeping_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER octavia
diff --git a/kolla/docker/octavia/octavia-worker/Dockerfile.j2 b/kolla/docker/octavia/octavia-worker/Dockerfile.j2
new file mode 100644
index 000000000..85d4727b7
--- /dev/null
+++ b/kolla/docker/octavia/octavia-worker/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}octavia-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block octavia_worker_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block octavia_worker_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER octavia
diff --git a/kolla/docker/opensearch/opensearch-dashboards/Dockerfile.j2 b/kolla/docker/opensearch/opensearch-dashboards/Dockerfile.j2
new file mode 100644
index 000000000..3249b62d2
--- /dev/null
+++ b/kolla/docker/opensearch/opensearch-dashboards/Dockerfile.j2
@@ -0,0 +1,26 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block opensearch_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='opensearch-dashboards', shell='/bin/bash', homedir='/usr/share/opensearch-dashboards') }}
+{{ macros.enable_extra_repos(['opensearch-dashboards']) }}
+
+{% set opensearch_dashboards_packages = ['opensearch-dashboards'] %}
+
+{{ macros.install_packages(opensearch_dashboards_packages | customizable("packages")) }} \
+    && chown -R opensearch-dashboards:opensearch-dashboards /usr/share/opensearch-dashboards
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 755 /usr/local/bin/kolla_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block opensearch_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER opensearch-dashboards
diff --git a/kolla/docker/opensearch/opensearch-dashboards/extend_start.sh b/kolla/docker/opensearch/opensearch-dashboards/extend_start.sh
new file mode 100644
index 000000000..608bb34bf
--- /dev/null
+++ b/kolla/docker/opensearch/opensearch-dashboards/extend_start.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/opensearch-dashboards" ]]; then
+    mkdir -p /var/log/kolla/opensearch-dashboards
+fi
+if [[ $(stat -c %a /var/log/kolla/opensearch-dashboards) != "755" ]]; then
+    chmod 755 /var/log/kolla/opensearch-dashboards
+fi
+
+export DASHBOARDS_HOME=/usr/share/opensearch-dashboards
+
+PLUGIN_LIST=$($DASHBOARDS_HOME/bin/opensearch-dashboards-plugin list)
+if [[ "${OPENSEARCH_DASHBOARDS_SECURITY_PLUGIN:-True}" == "False" ]]; then
+    if [[ ${PLUGIN_LIST} =~ "securityDashboards" ]]; then
+        $DASHBOARDS_HOME/bin/opensearch-dashboards-plugin remove securityDashboards
+    fi
+fi
diff --git a/kolla/docker/opensearch/opensearch/Dockerfile.j2 b/kolla/docker/opensearch/opensearch/Dockerfile.j2
new file mode 100644
index 000000000..6ad8fb29a
--- /dev/null
+++ b/kolla/docker/opensearch/opensearch/Dockerfile.j2
@@ -0,0 +1,32 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block opensearch_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='opensearch', shell='/bin/bash', homedir='/usr/share/opensearch') }}
+{{ macros.enable_extra_repos(['opensearch']) }}
+
+    {% set opensearch_packages = [
+        'opensearch'
+    ] %}
+
+ENV OPENSEARCH_INITIAL_ADMIN_PASSWORD="Kolla24OpenSearch"
+
+{{ macros.install_packages(opensearch_packages | customizable("packages")) }} \
+    && chown -R opensearch:opensearch /usr/share/opensearch \
+    && rm -f /etc/opensearch/*.pem \
+    && rm -f /etc/opensearch/securityadmin_demo.sh
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 755 /usr/local/bin/kolla_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block opensearch_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER opensearch
diff --git a/kolla/docker/opensearch/opensearch/extend_start.sh b/kolla/docker/opensearch/opensearch/extend_start.sh
new file mode 100644
index 000000000..5855b1be2
--- /dev/null
+++ b/kolla/docker/opensearch/opensearch/extend_start.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/opensearch" ]]; then
+    mkdir -p /var/log/kolla/opensearch
+fi
+if [[ $(stat -c %a /var/log/kolla/opensearch) != "755" ]]; then
+    chmod 755 /var/log/kolla/opensearch
+fi
diff --git a/kolla/docker/openstack-base/Dockerfile.j2 b/kolla/docker/openstack-base/Dockerfile.j2
new file mode 100644
index 000000000..b8ed2e465
--- /dev/null
+++ b/kolla/docker/openstack-base/Dockerfile.j2
@@ -0,0 +1,213 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block openstack_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+
+{{ macros.enable_extra_repos(['crb', 'epel']) }}
+
+    {% set openstack_base_packages = [
+        'gcc',
+        'gcc-c++',
+        'git',
+        'httpd',
+        'iproute',
+        'libffi-devel',
+        'libxml2-devel',
+        'libxslt-devel',
+        'libyaml-devel',
+        'make',
+        'mod_ssl',
+        'openssl',
+        'openssl-devel',
+        'pcre2-devel',
+        'postgresql',
+        'postgresql-devel',
+        'postgresql-server-devel',
+        'python3-devel',
+        'sqlite-devel',
+        'uwsgi-plugin-python3',
+        'zip'
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+    {% set openstack_base_packages = [
+        'build-essential',
+        'ca-certificates',
+        'git',
+        'libffi-dev',
+        'libpcre2-dev',
+        'libpq-dev',
+        'libssl-dev',
+        'libxml2-dev',
+        'libxslt1-dev',
+        'libyaml-dev',
+        'libz-dev',
+        'pkg-config',
+        'python3-dev',
+        'python3-venv',
+        'uwsgi-plugin-python3',
+        'zip'
+    ] %}
+
+{% endif %}
+
+{{ macros.install_packages(openstack_base_packages | customizable("packages")) }}
+
+{% set openstack_base_pip_packages = [
+        'Mako',
+        'MarkupSafe',
+        'Paste',
+        'PasteDeploy',
+        'PyNaCl',
+        'PyYAML',
+        'Routes',
+        'SQLAlchemy',
+        'Tempita',
+        'WSME',
+        'WebOb',
+        'alembic',
+        'amqp',
+        'aodhclient',
+        'appdirs',
+        'automaton',
+        'bcrypt',
+        'cachetools',
+        'castellan',
+        'click',
+        'cliff',
+        'cmd2',
+        'contextlib2',
+        'cryptography',
+        'debtcollector',
+        'decorator',
+        'eventlet',
+        'fasteners',
+        'fluent-logger',
+        'funcsigs',
+        'futurist',
+        'gnocchiclient',
+        'greenlet',
+        'httplib2',
+        'iso8601',
+        'jinja2',
+        'jsonpatch',
+        'jsonpointer',
+        'jsonschema',
+        'keystoneauth1',
+        'keystonemiddleware',
+        'kombu',
+        'logutils',
+        'monotonic',
+        'netaddr',
+        'netifaces',
+        'os-brick',
+        'os-client-config',
+        'os-traits',
+        'os-win',
+        'oslo.concurrency',
+        'oslo.config',
+        'oslo.context',
+        'oslo.db',
+        'oslo.i18n',
+        'oslo.log',
+        'oslo.messaging',
+        'oslo.middleware',
+        'oslo.policy',
+        'oslo.privsep',
+        'oslo.reports',
+        'oslo.rootwrap',
+        'oslo.serialization',
+        'oslo.service',
+        'oslo.upgradecheck',
+        'oslo.utils',
+        'oslo.versionedobjects',
+        'oslo.vmware',
+        'osprofiler',
+        'paramiko',
+        'pbr',
+        'pecan',
+        'pika',
+        'prettytable',
+        'psutil',
+        'pycadf',
+        'pymysql',
+        'pyngus',
+        'pyparsing',
+        'pyroute2',
+        'python-barbicanclient',
+        'python-binary-memcached',
+        'python-cinderclient',
+        'python-cloudkittyclient',
+        'python-dateutil',
+        'python-designateclient',
+        'python-editor',
+        'python-glanceclient',
+        'python-heatclient',
+        'python-ironicclient',
+        'python-keystoneclient',
+        'python-magnumclient',
+        'python-manilaclient',
+        'python-memcached',
+        'python-mistralclient',
+        'python-neutronclient',
+        'python-novaclient',
+        'python-openstackclient',
+        'python-qpid-proton',
+        'python-swiftclient',
+        'python-troveclient',
+        'pytz',
+        'repoze.lru',
+        'requests',
+        'requestsexceptions',
+        'retrying',
+        'setproctitle',
+        'simplegeneric',
+        'simplejson',
+        'six',
+        'sqlparse',
+        'stevedore',
+        'tooz[consul,etcd,etcd3gw,redis,postgresql,mysql,zookeeper,memcached,ipc]',
+        'unicodecsv',
+        'uwsgi',
+        'warlock',
+        'wrapt'
+    ]
+%}
+
+ADD openstack-base-archive /openstack-base-source
+ADD plugins-archive /
+
+RUN ln -s openstack-base-source/* /requirements \
+
+{# NOTE(mnasiadka): Remove ovs from upper-constraints.txt because python3-openvswitch
+                    is usually newer than UC entry and older version would get installed
+                    in venv (see https://launchpad.net/bugs/1961874).
+#}
+    && {{ macros.upper_constraints_remove("ovs") }} \
+    && mkdir -p /var/lib/kolla \
+    && python3 -m venv --system-site-packages /var/lib/kolla/venv \
+    && KOLLA_DISTRO_PYTHON_VERSION=$(/usr/bin/python3 -c "import sys; print('{}.{}'.format(sys.version_info.major, sys.version_info.minor))") \
+    && ln -s python${KOLLA_DISTRO_PYTHON_VERSION} /var/lib/kolla/venv/lib/python3
+
+{# Block used for overriding global version constraints.
+
+   Overriding the package version using upper_constraints_remove(package_name) or
+   upper_constraints_version_change(package_name, from, to) at this location will
+   apply to all services.
+#}
+{% block openstack_base_override_upper_constraints %}{% endblock %}
+
+ENV PATH /var/lib/kolla/venv/bin:$PATH
+
+RUN {{ macros.install_pip(['pip', 'wheel', 'setuptools']) }} \
+    && {{ macros.install_pip(openstack_base_pip_packages | customizable("pip_packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block openstack_base_footer %}{% endblock %}
diff --git a/kolla/docker/openvswitch/openvswitch-base/Dockerfile.j2 b/kolla/docker/openvswitch/openvswitch-base/Dockerfile.j2
new file mode 100644
index 000000000..44d8df41c
--- /dev/null
+++ b/kolla/docker/openvswitch/openvswitch-base/Dockerfile.j2
@@ -0,0 +1,45 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block openvswitch_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% block ovs_install %}
+
+{% if base_package_type == 'rpm' %}
+
+{{ macros.enable_extra_repos(['openvswitch']) }}
+
+    {% set openvswitch_base_packages = [
+        'libibverbs',
+        'openvswitch${KOLLA_RPM_OVS_VERSION}',
+        'python3-openvswitch${KOLLA_RPM_OVS_VERSION}',
+        'tcpdump'
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set openvswitch_base_packages = [
+        'openvswitch-switch',
+        'python3-openvswitch',
+        'tcpdump'
+    ] %}
+{% endif %}
+
+{{ macros.install_packages(openvswitch_base_packages | customizable("packages")) }}
+
+{% endblock %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+COPY ovs_wrapper.sh /usr/local/bin/ovs_wrapper
+
+# NOTE(hrw): Upstream moved tcpdump to /usr/bin/ in 4.99 version (used in Debian)
+RUN if [ -e /usr/sbin/tcpdump ]; then mv /usr/sbin/tcpdump /usr/bin/tcpdump; fi \
+    && touch /usr/local/bin/kolla_openvswitch_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_openvswitch_extend_start \
+    && chmod 755 /usr/local/bin/ovs_wrapper
+
+{{ macros.kolla_patch_sources() }}
+
+{% block openvswitch_base_footer %}{% endblock %}
diff --git a/kolla/docker/openvswitch/openvswitch-base/extend_start.sh b/kolla/docker/openvswitch/openvswitch-base/extend_start.sh
new file mode 100644
index 000000000..1b0ed1300
--- /dev/null
+++ b/kolla/docker/openvswitch/openvswitch-base/extend_start.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/openvswitch" ]]; then
+    mkdir -p /var/log/kolla/openvswitch
+fi
+if [[ $(stat -c %a /var/log/kolla/openvswitch) != "755" ]]; then
+    chmod 755 /var/log/kolla/openvswitch
+fi
+
+chown -R openvswitch:openvswitch /var/log/kolla/openvswitch
+
+. /usr/local/bin/kolla_openvswitch_extend_start
diff --git a/kolla/docker/openvswitch/openvswitch-base/ovs_wrapper.sh b/kolla/docker/openvswitch/openvswitch-base/ovs_wrapper.sh
new file mode 100644
index 000000000..552c496ac
--- /dev/null
+++ b/kolla/docker/openvswitch/openvswitch-base/ovs_wrapper.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+catch_term() {
+    ovs-appctl -T1 -t /run/openvswitch/$1.$child.ctl exit
+    exit 0
+}
+
+catch_quit() {
+    ovs-appctl -T1 -t /run/openvswitch/$1.$child.ctl exit
+    exit 0
+}
+
+trap catch_term SIGTERM
+trap catch_quit SIGQUIT
+
+"$@" &
+
+child=$!
+wait "$child"
diff --git a/kolla/docker/openvswitch/openvswitch-db-server/Dockerfile.j2 b/kolla/docker/openvswitch/openvswitch-db-server/Dockerfile.j2
new file mode 100644
index 000000000..869dbabb6
--- /dev/null
+++ b/kolla/docker/openvswitch/openvswitch-db-server/Dockerfile.j2
@@ -0,0 +1,16 @@
+FROM {{ namespace }}/{{ image_prefix }}openvswitch-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block openvswitch_db_server_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+COPY extend_start.sh /usr/local/bin/kolla_openvswitch_extend_start
+RUN chmod 755 /usr/local/bin/kolla_openvswitch_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block openvswitch_db_server_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/openvswitch/openvswitch-db-server/extend_start.sh b/kolla/docker/openvswitch/openvswitch-db-server/extend_start.sh
new file mode 100644
index 000000000..d25038bdd
--- /dev/null
+++ b/kolla/docker/openvswitch/openvswitch-db-server/extend_start.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+mkdir -p "/run/openvswitch"
+if [[ ! -e "/var/lib/openvswitch/conf.db" ]]; then
+    ovsdb-tool create "/var/lib/openvswitch/conf.db"
+fi
+
+if [[ $(ovsdb-tool needs-conversion /var/lib/openvswitch/conf.db) == yes ]]; then
+    ovsdb-tool convert "/var/lib/openvswitch/conf.db"
+fi
+
+if [[ ! -r "/var/log/kolla/openvswitch/ovsdb-server.log" ]]; then
+    touch /var/log/kolla/openvswitch/ovsdb-server.log
+    chown openvswitch:openvswitch /var/log/kolla/openvswitch/ovsdb-server.log
+fi
diff --git a/kolla/docker/openvswitch/openvswitch-db-server/releasenotes/notes/drop-ovs-ensure-configured-7973d36969e157fa.yaml b/kolla/docker/openvswitch/openvswitch-db-server/releasenotes/notes/drop-ovs-ensure-configured-7973d36969e157fa.yaml
new file mode 100644
index 000000000..cc8daf1f4
--- /dev/null
+++ b/kolla/docker/openvswitch/openvswitch-db-server/releasenotes/notes/drop-ovs-ensure-configured-7973d36969e157fa.yaml
@@ -0,0 +1,5 @@
+---
+upgrade:
+  - |
+    ``openvswitch`` script ``ovs_ensure_configured.sh`` has been dropped after
+    being replaced with Ansible modules in ``kolla-ansible``.
diff --git a/kolla/docker/openvswitch/openvswitch-vswitchd/Dockerfile.j2 b/kolla/docker/openvswitch/openvswitch-vswitchd/Dockerfile.j2
new file mode 100644
index 000000000..fe6dd4347
--- /dev/null
+++ b/kolla/docker/openvswitch/openvswitch-vswitchd/Dockerfile.j2
@@ -0,0 +1,16 @@
+FROM {{ namespace }}/{{ image_prefix }}openvswitch-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block openvswitch_vswitchd_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+COPY extend_start.sh /usr/local/bin/kolla_openvswitch_extend_start
+RUN chmod 644 /usr/local/bin/kolla_openvswitch_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block openvswitch_vswitchd_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/openvswitch/openvswitch-vswitchd/extend_start.sh b/kolla/docker/openvswitch/openvswitch-vswitchd/extend_start.sh
new file mode 100644
index 000000000..fde542130
--- /dev/null
+++ b/kolla/docker/openvswitch/openvswitch-vswitchd/extend_start.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+if [[ ! -r "/var/log/kolla/openvswitch/ovs-vswitchd.log" ]]; then
+    touch /var/log/kolla/openvswitch/ovs-vswitchd.log
+    chown openvswitch:openvswitch /var/log/kolla/openvswitch/ovs-vswitchd.log
+fi
+
+modprobe openvswitch
diff --git a/kolla/docker/ovn/ovn-base/Dockerfile.j2 b/kolla/docker/ovn/ovn-base/Dockerfile.j2
new file mode 100644
index 000000000..3efd001a3
--- /dev/null
+++ b/kolla/docker/ovn/ovn-base/Dockerfile.j2
@@ -0,0 +1,29 @@
+FROM {{ namespace }}/{{ image_prefix }}openvswitch-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block ovn_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+    {% set ovn_base_packages = [
+        'ovn${KOLLA_RPM_OVN_VERSION}',
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+    {% set ovn_base_packages = [
+        'ovn-common',
+    ] %}
+
+{% endif %}
+{{ macros.install_packages(ovn_base_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN chmod 644 /usr/local/bin/kolla_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block ovn_base_footer %}{% endblock %}
diff --git a/kolla/docker/ovn/ovn-base/extend_start.sh b/kolla/docker/ovn/ovn-base/extend_start.sh
new file mode 100644
index 000000000..eae4ab9e1
--- /dev/null
+++ b/kolla/docker/ovn/ovn-base/extend_start.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+if [[ ! -d "/run/ovn" ]]; then
+    mkdir -p /run/ovn
+fi
+if [[ ! -d "/var/log/kolla/openvswitch" ]]; then
+    mkdir -p /var/log/kolla/openvswitch
+fi
+if [[ $(stat -c %a /var/log/kolla/openvswitch) != "755" ]]; then
+    chmod 755 /var/log/kolla/openvswitch
+fi
+
+. /usr/local/bin/kolla_ovn_extend_start
diff --git a/kolla/docker/ovn/ovn-controller/Dockerfile.j2 b/kolla/docker/ovn/ovn-controller/Dockerfile.j2
new file mode 100644
index 000000000..f95e61fee
--- /dev/null
+++ b/kolla/docker/ovn/ovn-controller/Dockerfile.j2
@@ -0,0 +1,29 @@
+FROM {{ namespace }}/{{ image_prefix }}ovn-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block ovn_controller_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+    {% set ovn_controller_packages = [
+        'ovn${KOLLA_RPM_OVN_VERSION}-host'
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+    {% set ovn_controller_packages = [
+        'ovn-host'
+    ] %}
+
+{% endif %}
+{{ macros.install_packages(ovn_controller_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_ovn_extend_start
+RUN chmod 644 /usr/local/bin/kolla_ovn_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block ovn_controller_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/ovn/ovn-controller/extend_start.sh b/kolla/docker/ovn/ovn-controller/extend_start.sh
new file mode 100644
index 000000000..8080ea7c8
--- /dev/null
+++ b/kolla/docker/ovn/ovn-controller/extend_start.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+if [[ ! -r "/var/log/kolla/openvswitch/ovn-controller.log" ]]; then
+    touch /var/log/kolla/openvswitch/ovn-controller.log
+    chown openvswitch:openvswitch /var/log/kolla/openvswitch/ovn-controller.log
+fi
diff --git a/kolla/docker/ovn/ovn-nb-db-server/Dockerfile.j2 b/kolla/docker/ovn/ovn-nb-db-server/Dockerfile.j2
new file mode 100644
index 000000000..ea6a53249
--- /dev/null
+++ b/kolla/docker/ovn/ovn-nb-db-server/Dockerfile.j2
@@ -0,0 +1,31 @@
+FROM {{ namespace }}/{{ image_prefix }}ovn-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block ovn_nb_db_server_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+    {% set ovn_nb_db_server_packages = [
+        'ovn${KOLLA_RPM_OVN_VERSION}-central',
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+    {% set ovn_nb_db_server_packages = [
+        'ovn-central',
+    ] %}
+
+{% endif %}
+{{ macros.install_packages(ovn_nb_db_server_packages | customizable("packages")) }}
+
+COPY start_nb_db_server.sh /usr/local/bin/start-nb-db-server
+RUN chmod 755 /usr/local/bin/start-nb-db-server
+COPY extend_start.sh /usr/local/bin/kolla_ovn_extend_start
+RUN chmod 644 /usr/local/bin/kolla_ovn_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block ovn_nb_db_server_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/ovn/ovn-nb-db-server/extend_start.sh b/kolla/docker/ovn/ovn-nb-db-server/extend_start.sh
new file mode 100644
index 000000000..4c0e742f5
--- /dev/null
+++ b/kolla/docker/ovn/ovn-nb-db-server/extend_start.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+if [[ ! -r "/var/log/kolla/openvswitch/ovn-nb-db.log" ]]; then
+    touch /var/log/kolla/openvswitch/ovn-nb-db.log
+    chown openvswitch:openvswitch /var/log/kolla/openvswitch/ovn-nb-db.log
+fi
diff --git a/kolla/docker/ovn/ovn-nb-db-server/start_nb_db_server.sh b/kolla/docker/ovn/ovn-nb-db-server/start_nb_db_server.sh
new file mode 100755
index 000000000..d08dd2890
--- /dev/null
+++ b/kolla/docker/ovn/ovn-nb-db-server/start_nb_db_server.sh
@@ -0,0 +1,28 @@
+#!/bin/bash
+
+# All the option passed to this script will be
+# passed to the ovn-ctl script. Please see the options
+# supported by ovn-ctl script -
+# https://github.com/ovn-org/ovn/blob/master/utilities/ovn-ctl
+args=$@
+
+# Use ovn-ctl script to start ovn NB db server as it
+# takes care of creating the db file from the schema
+# file if the db file is not present. It also takes care
+# of updating the db file if the schema file is updated.
+
+# Check for the presence of ovn-ctl script in two locations.
+# If latest OVN is used (post split from openvswitch),
+# then the new location for the ovn-ctl script is
+# is - /usr/share/ovn/scripts/ovn-ctl. Otherwise it is
+# /usr/share/openvswitch/scripts/ovn-ctl.
+
+if [[ -f "/usr/share/openvswitch/scripts/ovn-ctl" ]]; then
+    set /usr/share/openvswitch/scripts/ovn-ctl --no-monitor
+elif [[  -f "/usr/share/ovn/scripts/ovn-ctl" ]]; then
+    set /usr/share/ovn/scripts/ovn-ctl --no-monitor
+else
+    exit 1
+fi
+
+$@ $args run_nb_ovsdb
diff --git a/kolla/docker/ovn/ovn-northd/Dockerfile.j2 b/kolla/docker/ovn/ovn-northd/Dockerfile.j2
new file mode 100644
index 000000000..4a15e10eb
--- /dev/null
+++ b/kolla/docker/ovn/ovn-northd/Dockerfile.j2
@@ -0,0 +1,29 @@
+FROM {{ namespace }}/{{ image_prefix }}ovn-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block ovn_northd_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+    {% set ovn_northd_packages = [
+        'ovn${KOLLA_RPM_OVN_VERSION}-central',
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+    {% set ovn_northd_packages = [
+        'ovn-central',
+    ] %}
+
+{% endif %}
+{{ macros.install_packages(ovn_northd_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_ovn_extend_start
+RUN chmod 644 /usr/local/bin/kolla_ovn_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block ovn_northd_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/ovn/ovn-northd/extend_start.sh b/kolla/docker/ovn/ovn-northd/extend_start.sh
new file mode 100644
index 000000000..c832c5383
--- /dev/null
+++ b/kolla/docker/ovn/ovn-northd/extend_start.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+if [[ ! -r "/var/log/kolla/openvswitch/ovn-northd.log" ]]; then
+    touch /var/log/kolla/openvswitch/ovn-northd.log
+    chown openvswitch:openvswitch /var/log/kolla/openvswitch/ovn-northd.log
+fi
diff --git a/kolla/docker/ovn/ovn-sb-db-relay/Dockerfile.j2 b/kolla/docker/ovn/ovn-sb-db-relay/Dockerfile.j2
new file mode 100644
index 000000000..427b6f7f1
--- /dev/null
+++ b/kolla/docker/ovn/ovn-sb-db-relay/Dockerfile.j2
@@ -0,0 +1,18 @@
+FROM {{ namespace }}/{{ image_prefix }}ovn-sb-db-server:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block ovn_sb_db_server_header %}{% endblock %}
+
+{% block ovn_sb_db_relay_ovn_ctl %}
+{# TODO(mnasiadka): Switch to 25.03 branch when available, ideally rpm/deb packages will be
+                    available. #}
+RUN curl -o /usr/share/ovn/scripts/ovn-ctl https://raw.githubusercontent.com/ovn-org/ovn/refs/heads/main/utilities/ovn-ctl
+{% endblock %}
+
+COPY extend_start.sh /usr/local/bin/kolla_ovn_extend_start
+RUN chmod 644 /usr/local/bin/kolla_ovn_extend_start
+
+{% block ovn_sb_db_relay_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/ovn/ovn-sb-db-relay/extend_start.sh b/kolla/docker/ovn/ovn-sb-db-relay/extend_start.sh
new file mode 100644
index 000000000..04b6c5357
--- /dev/null
+++ b/kolla/docker/ovn/ovn-sb-db-relay/extend_start.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+if [[ ! -r "/var/log/kolla/openvswitch/ovn-sb-relay-${RELAY_ID}.log" ]]; then
+    touch /var/log/kolla/openvswitch/ovn-sb-relay-${RELAY_ID}.log
+    chown openvswitch:openvswitch /var/log/kolla/openvswitch/ovn-sb-relay-${RELAY_ID}.log
+fi
diff --git a/kolla/docker/ovn/ovn-sb-db-server/Dockerfile.j2 b/kolla/docker/ovn/ovn-sb-db-server/Dockerfile.j2
new file mode 100644
index 000000000..afceb8173
--- /dev/null
+++ b/kolla/docker/ovn/ovn-sb-db-server/Dockerfile.j2
@@ -0,0 +1,31 @@
+FROM {{ namespace }}/{{ image_prefix }}ovn-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block ovn_sb_db_server_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+    {% set ovn_sb_db_server_packages = [
+        'ovn${KOLLA_RPM_OVN_VERSION}-central',
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+    {% set ovn_sb_db_server_packages = [
+        'ovn-central',
+    ] %}
+
+{% endif %}
+{{ macros.install_packages(ovn_sb_db_server_packages | customizable("packages")) }}
+
+COPY start_sb_db_server.sh /usr/local/bin/start-sb-db-server
+RUN chmod 755 /usr/local/bin/start-sb-db-server
+COPY extend_start.sh /usr/local/bin/kolla_ovn_extend_start
+RUN chmod 644 /usr/local/bin/kolla_ovn_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block ovn_sb_db_server_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/ovn/ovn-sb-db-server/extend_start.sh b/kolla/docker/ovn/ovn-sb-db-server/extend_start.sh
new file mode 100644
index 000000000..07bcd1b45
--- /dev/null
+++ b/kolla/docker/ovn/ovn-sb-db-server/extend_start.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+if [[ ! -r "/var/log/kolla/openvswitch/ovn-sb-db.log" ]]; then
+    touch /var/log/kolla/openvswitch/ovn-sb-db.log
+    chown openvswitch:openvswitch /var/log/kolla/openvswitch/ovn-sb-db.log
+fi
diff --git a/kolla/docker/ovn/ovn-sb-db-server/start_sb_db_server.sh b/kolla/docker/ovn/ovn-sb-db-server/start_sb_db_server.sh
new file mode 100755
index 000000000..ef39b8d25
--- /dev/null
+++ b/kolla/docker/ovn/ovn-sb-db-server/start_sb_db_server.sh
@@ -0,0 +1,29 @@
+#!/bin/bash
+
+# All the option passed to this script will be
+# passed to the ovn-ctl script. Please see the options
+# supported by ovn-ctl script -
+# https://github.com/ovn-org/ovn/blob/master/utilities/ovn-ctl
+args=$@
+
+# Use ovn-ctl script to start ovn SB db server as it
+# takes care of creating the db file from the schema
+# file if the db file is not present. It also takes care
+# of updating the db file if the schema file is updated.
+
+# Check for the presence of ovn-ctl script in two locations.
+# If latest OVN is used (post split from openvswitch),
+# then the new location for the ovn-ctl script is
+# is - /usr/share/ovn/scripts/ovn-ctl. Otherwise it is
+# /usr/share/openvswitch/scripts/ovn-ctl.
+
+
+if [[ -f "/usr/share/openvswitch/scripts/ovn-ctl" ]]; then
+    set /usr/share/openvswitch/scripts/ovn-ctl --no-monitor
+elif [[  -f "/usr/share/ovn/scripts/ovn-ctl" ]]; then
+    set /usr/share/ovn/scripts/ovn-ctl --no-monitor
+else
+    exit 1
+fi
+
+$@ $args run_sb_ovsdb
diff --git a/kolla/docker/ovsdpdk/ovsdpdk-db/Dockerfile.j2 b/kolla/docker/ovsdpdk/ovsdpdk-db/Dockerfile.j2
new file mode 100644
index 000000000..2527fa0e6
--- /dev/null
+++ b/kolla/docker/ovsdpdk/ovsdpdk-db/Dockerfile.j2
@@ -0,0 +1,18 @@
+FROM {{ namespace }}/{{ image_prefix }}ovsdpdk:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block ovsdpdk_db_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+COPY extend_start.sh /usr/local/bin/kolla_ovsdpdk_extend_start
+COPY start_ovsdb_server.sh /usr/local/bin/start-ovsdb-server
+RUN chmod 644 /usr/local/bin/kolla_ovsdpdk_extend_start && \
+    chmod 755 /usr/local/bin/start-ovsdb-server
+
+{{ macros.kolla_patch_sources() }}
+
+{% block ovsdpdk_db_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/ovsdpdk/ovsdpdk-db/extend_start.sh b/kolla/docker/ovsdpdk/ovsdpdk-db/extend_start.sh
new file mode 100644
index 000000000..3883b50ed
--- /dev/null
+++ b/kolla/docker/ovsdpdk/ovsdpdk-db/extend_start.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+mkdir -p "/run/openvswitch"
+if [[ ! -e "/var/lib/openvswitch/conf.db" ]]; then
+    ovsdb-tool create "/var/lib/openvswitch/conf.db"
+fi
diff --git a/kolla/docker/ovsdpdk/ovsdpdk-db/start_ovsdb_server.sh b/kolla/docker/ovsdpdk/ovsdpdk-db/start_ovsdb_server.sh
new file mode 100755
index 000000000..5c92fba78
--- /dev/null
+++ b/kolla/docker/ovsdpdk/ovsdpdk-db/start_ovsdb_server.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+# NOTE: (sbezverk) ovs_bridge and ovs_ext_intf variables get initialized only when
+# this script is executed for kubernetes deployment. With Ansible deployment, only
+# ovsdb-server gets launched and then the following workflow step will create
+# an external bridge and plug an external interface. With Kubernetes we want to
+# leverage its dynamic nature of automatic scaling up and down. It means all
+# activities related to creating initial bridge, plugging external interface
+# must be done by DaemonSet launched container.
+
+ovsdb_ip=$1
+ovs_bridge=$2
+ovs_ext_intf=$3
+
+# NOTE: (sbezverk) The reason for introducing this script is to be able
+# to launch ovsdb-server and to create the initial external bridge in one step.
+# It is required in order to be able to use DaemonSet.
+
+if [ ! -e $ovs_bridge  ] && [ ! -e $ovs_ext_intf  ]; then
+# NOTE: (sbezverk) This part is executed only by kubernetes deployment.
+# Creating external bridge
+    /usr/sbin/ovsdb-server /var/lib/openvswitch/conf.db --remote=punix:/var/run/openvswitch/db.sock --run="ovs-vsctl --no-wait --db=unix:/var/run/openvswitch/db.sock add-br $ovs_bridge"
+# Plug the external interface into the external bridge.
+    /usr/sbin/ovsdb-server /var/lib/openvswitch/conf.db --remote=punix:/var/run/openvswitch/db.sock --run="ovs-vsctl --no-wait --db=unix:/var/run/openvswitch/db.sock add-port $ovs_bridge $ovs_ext_intf"
+# Run ovsdb server process
+    /usr/sbin/ovsdb-server /var/lib/openvswitch/conf.db -vconsole:emer -vsyslog:err -vfile:info --remote=punix:/var/run/openvswitch/db.sock --remote=ptcp:6640 --log-file=/var/log/kolla/openvswitch/ovsdb-server.log
+else
+# NOTE: (sbezverk) This part is executed only by kolla-ansible deployment.
+    /usr/sbin/ovsdb-server /var/lib/openvswitch/conf.db -vconsole:emer -vsyslog:err -vfile:info --remote=punix:/run/openvswitch/db.sock --remote=ptcp:6640:$ovsdb_ip --log-file=/var/log/kolla/openvswitch/ovsdb-server.log
+fi
diff --git a/kolla/docker/ovsdpdk/ovsdpdk-vswitchd/Dockerfile.j2 b/kolla/docker/ovsdpdk/ovsdpdk-vswitchd/Dockerfile.j2
new file mode 100644
index 000000000..059efd46b
--- /dev/null
+++ b/kolla/docker/ovsdpdk/ovsdpdk-vswitchd/Dockerfile.j2
@@ -0,0 +1,16 @@
+FROM {{ namespace }}/{{ image_prefix }}ovsdpdk:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block ovsdpdk_vswitchd_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+COPY extend_start.sh /usr/local/bin/kolla_ovsdpdk_extend_start
+RUN chmod 644 /usr/local/bin/kolla_ovsdpdk_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block ovsdpdk_vswitchd_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/ovsdpdk/ovsdpdk-vswitchd/extend_start.sh b/kolla/docker/ovsdpdk/ovsdpdk-vswitchd/extend_start.sh
new file mode 100644
index 000000000..cf9d733e8
--- /dev/null
+++ b/kolla/docker/ovsdpdk/ovsdpdk-vswitchd/extend_start.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# using userspace netdev datapath so do not loading ovs kernel module
+# chmod openvsitch run directory so libvirt can create vhost-user sockets.
+chmod 777 /var/run/openvswitch
+
diff --git a/kolla/docker/ovsdpdk/ovsdpdk/Dockerfile.j2 b/kolla/docker/ovsdpdk/ovsdpdk/Dockerfile.j2
new file mode 100644
index 000000000..eab4f5474
--- /dev/null
+++ b/kolla/docker/ovsdpdk/ovsdpdk/Dockerfile.j2
@@ -0,0 +1,40 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+{% block ovsdpdk_header %}{% endblock %}
+
+{% block ovsdpdk_install %}
+
+{% if base_package_type == 'rpm' %}
+
+#TODO(sean-k-mooney) create repo via open suse build system to package
+# for centos distro.
+
+RUN echo 'image not yet available for {{ base_distro }}' \
+    && /bin/false
+
+{% elif base_package_type == 'deb' %}
+
+{% set ovs_dpdk_packages = [
+    'crudini',
+    'libdpdk-dev',
+    'openvswitch-switch-dpdk'
+] %}
+
+{{ macros.install_packages(ovs_dpdk_packages | customizable("packages")) }}
+
+RUN update-alternatives --set ovs-vswitchd /usr/lib/openvswitch-switch-dpdk/ovs-vswitchd-dpdk
+
+{% endif %}
+
+{% endblock %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block ovsdpdk_footer %}{% endblock %}
diff --git a/kolla/docker/ovsdpdk/ovsdpdk/extend_start.sh b/kolla/docker/ovsdpdk/ovsdpdk/extend_start.sh
new file mode 100644
index 000000000..60ab0c088
--- /dev/null
+++ b/kolla/docker/ovsdpdk/ovsdpdk/extend_start.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/openvswitch" ]]; then
+    mkdir -p /var/log/kolla/openvswitch
+fi
+if [[ $(stat -c %a /var/log/kolla/openvswitch) != "755" ]]; then
+    chmod 755 /var/log/kolla/openvswitch
+fi
+
+. /usr/local/bin/kolla_ovsdpdk_extend_start
diff --git a/kolla/docker/placement/placement-api/Dockerfile.j2 b/kolla/docker/placement/placement-api/Dockerfile.j2
new file mode 100644
index 000000000..a13f65bdf
--- /dev/null
+++ b/kolla/docker/placement/placement-api/Dockerfile.j2
@@ -0,0 +1,19 @@
+FROM {{ namespace }}/{{ image_prefix }}placement-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block placement_api_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set placement_api_packages = [
+] %}
+{{ macros.install_packages(placement_api_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_placement_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block placement_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/placement/placement-api/extend_start.sh b/kolla/docker/placement/placement-api/extend_start.sh
new file mode 100644
index 000000000..e468cbcaf
--- /dev/null
+++ b/kolla/docker/placement/placement-api/extend_start.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    placement-manage db sync
+    placement-manage db online_data_migrations
+    exit 0
+fi
+
+# DB synchronisation. To be executed prior to upgrading services.
+if [[ "${!KOLLA_UPGRADE[@]}" ]]; then
+    placement-manage db sync
+    exit 0
+fi
+
+# Online data migrations. To be executed after upgrading services.
+if [[ "${!KOLLA_OSM[@]}" ]]; then
+    placement-manage db online_data_migrations
+    exit 0
+fi
diff --git a/kolla/docker/placement/placement-base/Dockerfile.j2 b/kolla/docker/placement/placement-base/Dockerfile.j2
new file mode 100644
index 000000000..6454da748
--- /dev/null
+++ b/kolla/docker/placement/placement-base/Dockerfile.j2
@@ -0,0 +1,44 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block placement_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='placement') }}
+
+{% if base_package_type == 'rpm' %}
+
+    {% set placement_base_packages = [
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+
+    {% set placement_base_packages = [
+    ] %}
+
+{% endif %}
+
+{{ macros.install_packages(placement_base_packages | customizable("packages")) }}
+
+ADD placement-base-archive /placement-base-source
+ADD plugins-archive /
+
+{% set placement_base_pip_packages = [
+    '/placement'
+] %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN ln -s placement-base-source/* placement \
+    && {{ macros.install_pip(placement_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/placement/ \
+    && cp -r /placement/etc/placement/* /etc/placement/ \
+    && touch /usr/local/bin/kolla_placement_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_placement_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block placement_base_footer %}{% endblock %}
diff --git a/kolla/docker/placement/placement-base/extend_start.sh b/kolla/docker/placement/placement-base/extend_start.sh
new file mode 100644
index 000000000..900ea8447
--- /dev/null
+++ b/kolla/docker/placement/placement-base/extend_start.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/placement" ]]; then
+    mkdir -p /var/log/kolla/placement
+    touch /var/log/kolla/placement/placement-api.log
+fi
+if [[ $(stat -c %U:%G /var/log/kolla/placement) != "placement:kolla" ]]; then
+    chown -R placement:kolla /var/log/kolla/placement
+fi
+if [[ $(stat -c %a /var/log/kolla/placement) != "755" ]]; then
+    chmod 755 /var/log/kolla/placement
+    chmod 644 /var/log/kolla/placement/placement-api.log
+fi
+
+. /usr/local/bin/kolla_placement_extend_start
diff --git a/kolla/docker/prometheus/prometheus-alertmanager/Dockerfile.j2 b/kolla/docker/prometheus/prometheus-alertmanager/Dockerfile.j2
new file mode 100644
index 000000000..8f2df0492
--- /dev/null
+++ b/kolla/docker/prometheus/prometheus-alertmanager/Dockerfile.j2
@@ -0,0 +1,21 @@
+FROM {{ namespace }}/{{ image_prefix }}prometheus-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block prometheus_alertmanager_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% block prometheus_alertmanager_install %}
+ADD prometheus-alertmanager-archive /prometheus-alertmanager-source
+RUN cp -r /prometheus-alertmanager-source/* /opt/ \
+    && ln -s /opt/alertmanager* /opt/prometheus_alertmanager
+{% endblock %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block prometheus_alertmanager_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER prometheus
diff --git a/kolla/docker/prometheus/prometheus-base/Dockerfile.j2 b/kolla/docker/prometheus/prometheus-base/Dockerfile.j2
new file mode 100644
index 000000000..123bd4ba3
--- /dev/null
+++ b/kolla/docker/prometheus/prometheus-base/Dockerfile.j2
@@ -0,0 +1,17 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block prometheus_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='prometheus') }}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block prometheus_base_footer %}{% endblock %}
diff --git a/kolla/docker/prometheus/prometheus-base/extend_start.sh b/kolla/docker/prometheus/prometheus-base/extend_start.sh
new file mode 100644
index 000000000..8613330c6
--- /dev/null
+++ b/kolla/docker/prometheus/prometheus-base/extend_start.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+# Create log directory, with appropriate permissions
+if [[ ! -d "/var/log/kolla/prometheus" ]]; then
+    mkdir -p /var/log/kolla/prometheus
+fi
+if [[ $(stat -c %a /var/log/kolla/prometheus) != "755" ]]; then
+    chmod 755 /var/log/kolla/prometheus
+fi
diff --git a/kolla/docker/prometheus/prometheus-blackbox-exporter/Dockerfile.j2 b/kolla/docker/prometheus/prometheus-blackbox-exporter/Dockerfile.j2
new file mode 100644
index 000000000..95018facf
--- /dev/null
+++ b/kolla/docker/prometheus/prometheus-blackbox-exporter/Dockerfile.j2
@@ -0,0 +1,36 @@
+FROM {{ namespace }}/{{ image_prefix }}prometheus-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block prometheus_blackbox_exporter_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+    {% set blackbox_packages = [
+        'libcap'
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set blackbox_packages = [
+        'libcap2-bin'
+    ] %}
+{% endif %}
+
+{{ macros.install_packages(blackbox_packages | customizable("packages")) }}
+
+{% block prometheus_blackbox_exporter_install %}
+ADD prometheus-blackbox-exporter-archive /prometheus-blackbox-exporter-source
+
+RUN ln -s /prometheus-blackbox-exporter-source/* prometheus-blackbox-exporter \
+    && mkdir -p /opt/blackbox_exporter/ \
+    && cp /prometheus-blackbox-exporter/blackbox_exporter /opt/blackbox_exporter/ \
+    && setcap cap_net_raw+ep /opt/blackbox_exporter/blackbox_exporter
+{% endblock %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block prometheus_blackbox_exporter_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER prometheus
diff --git a/kolla/docker/prometheus/prometheus-cadvisor/Dockerfile.j2 b/kolla/docker/prometheus/prometheus-cadvisor/Dockerfile.j2
new file mode 100644
index 000000000..884f4acd2
--- /dev/null
+++ b/kolla/docker/prometheus/prometheus-cadvisor/Dockerfile.j2
@@ -0,0 +1,20 @@
+FROM {{ namespace }}/{{ image_prefix }}prometheus-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block prometheus_cadvisor_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% block prometheus_cadvisor_install %}
+ADD prometheus-cadvisor-archive /prometheus-cadvisor-source
+
+RUN cp /prometheus-cadvisor-source /opt/cadvisor \
+    && chmod 0755 /opt/cadvisor
+{% endblock %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block prometheus_cadvisor_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/prometheus/prometheus-elasticsearch-exporter/Dockerfile.j2 b/kolla/docker/prometheus/prometheus-elasticsearch-exporter/Dockerfile.j2
new file mode 100644
index 000000000..63d09409c
--- /dev/null
+++ b/kolla/docker/prometheus/prometheus-elasticsearch-exporter/Dockerfile.j2
@@ -0,0 +1,23 @@
+FROM {{ namespace }}/{{ image_prefix }}prometheus-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block prometheus_elasticsearch_exporter_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% block prometheus_elasticsearch_exporter_install %}
+ADD prometheus-elasticsearch-exporter-archive /prometheus-elasticsearch-exporter-source
+
+RUN ln -s /prometheus-elasticsearch-exporter-source/* prometheus-elasticsearch-exporter \
+    && mkdir -p /opt/elasticsearch_exporter \
+    && cp /prometheus-elasticsearch-exporter/elasticsearch_exporter /opt/elasticsearch_exporter/
+{% endblock %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block prometheus_elasticsearch_exporter_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER prometheus
diff --git a/kolla/docker/prometheus/prometheus-libvirt-exporter/Dockerfile.j2 b/kolla/docker/prometheus/prometheus-libvirt-exporter/Dockerfile.j2
new file mode 100644
index 000000000..c32b2f8c7
--- /dev/null
+++ b/kolla/docker/prometheus/prometheus-libvirt-exporter/Dockerfile.j2
@@ -0,0 +1,25 @@
+FROM {{ namespace }}/{{ image_prefix }}prometheus-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% block prometheus_libvirt_exporter_header %}{% endblock %}
+
+{{ macros.install_packages(prometheus_libvirt_exporter_packages | customizable("packages")) }}
+
+{% block prometheus_libvirt_exporter_install %}
+ADD prometheus-libvirt-exporter-archive /prometheus-libvirt-exporter-source
+
+RUN ln -s /prometheus-libvirt-exporter-source/* prometheus-libvirt-exporter \
+    && cp /prometheus-libvirt-exporter/prometheus-libvirt-exporter /opt/libvirt-exporter
+
+{% endblock %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block prometheus_libvirt_exporter_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER root
diff --git a/kolla/docker/prometheus/prometheus-memcached-exporter/Dockerfile.j2 b/kolla/docker/prometheus/prometheus-memcached-exporter/Dockerfile.j2
new file mode 100644
index 000000000..cb50c2095
--- /dev/null
+++ b/kolla/docker/prometheus/prometheus-memcached-exporter/Dockerfile.j2
@@ -0,0 +1,23 @@
+FROM {{ namespace }}/{{ image_prefix }}prometheus-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block prometheus_memcached_exporter_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% block prometheus_memcached_exporter_install %}
+ADD prometheus-memcached-exporter-archive /prometheus-memcached-exporter-source
+
+RUN ln -s /prometheus-memcached-exporter-source/* prometheus-memcached-exporter \
+    && mkdir -p /opt/memcached_exporter/ \
+    && cp /prometheus-memcached-exporter/memcached_exporter /opt/memcached_exporter/
+{% endblock %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block prometheus_memcached_exporter_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER prometheus
diff --git a/kolla/docker/prometheus/prometheus-mtail/Dockerfile.j2 b/kolla/docker/prometheus/prometheus-mtail/Dockerfile.j2
new file mode 100644
index 000000000..a562bfd71
--- /dev/null
+++ b/kolla/docker/prometheus/prometheus-mtail/Dockerfile.j2
@@ -0,0 +1,25 @@
+FROM {{ namespace }}/{{ image_prefix }}prometheus-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block prometheus_mtail_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% block prometheus_mtail_install %}
+ADD prometheus-mtail-archive /prometheus-mtail-source
+
+RUN cp /prometheus-mtail-source/* /opt/
+{% endblock %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block prometheus_mtail_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+# NOTE(dszumski): We run as root so that mtail can scrape root owned logs
+# such as /var/log/secure which are mounted into the container as read only
+# for auditing purposes. Longer term we should use a more secure mechanism
+# for tailing these logs.
+USER root
diff --git a/kolla/docker/prometheus/prometheus-mysqld-exporter/Dockerfile.j2 b/kolla/docker/prometheus/prometheus-mysqld-exporter/Dockerfile.j2
new file mode 100644
index 000000000..f8d2abaa6
--- /dev/null
+++ b/kolla/docker/prometheus/prometheus-mysqld-exporter/Dockerfile.j2
@@ -0,0 +1,23 @@
+FROM {{ namespace }}/{{ image_prefix }}prometheus-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block mysqld_exporter_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% block mysqld_exporter_install %}
+ADD prometheus-mysqld-exporter-archive /prometheus-mysqld-exporter-source
+
+RUN ln -s /prometheus-mysqld-exporter-source/* prometheus-mysqld-exporter \ 
+    && mkdir -p /opt/mysqld_exporter \
+    && cp /prometheus-mysqld-exporter/mysqld_exporter /opt/mysqld_exporter/
+{% endblock %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block mysqld_exporter_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER prometheus
diff --git a/kolla/docker/prometheus/prometheus-node-exporter/Dockerfile.j2 b/kolla/docker/prometheus/prometheus-node-exporter/Dockerfile.j2
new file mode 100644
index 000000000..3250d3d7a
--- /dev/null
+++ b/kolla/docker/prometheus/prometheus-node-exporter/Dockerfile.j2
@@ -0,0 +1,23 @@
+FROM {{ namespace }}/{{ image_prefix }}prometheus-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block node_exporter_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% block node_exporter_install %}
+ADD prometheus-node-exporter-archive /prometheus-node-exporter-source
+
+RUN ln -s /prometheus-node-exporter-source/* prometheus-node-exporter \
+    && mkdir -p /opt/node_exporter/ \
+    && cp /prometheus-node-exporter/node_exporter /opt/node_exporter/
+{% endblock %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block node_exporter_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER prometheus
diff --git a/kolla/docker/prometheus/prometheus-openstack-exporter/Dockerfile.j2 b/kolla/docker/prometheus/prometheus-openstack-exporter/Dockerfile.j2
new file mode 100644
index 000000000..437f3a6cd
--- /dev/null
+++ b/kolla/docker/prometheus/prometheus-openstack-exporter/Dockerfile.j2
@@ -0,0 +1,22 @@
+FROM {{ namespace }}/{{ image_prefix }}prometheus-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block prometheus_openstack_exporter_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% block prometheus_openstack_exporter_install %}
+ADD prometheus-openstack-exporter-archive /prometheus-openstack-exporter-source
+
+RUN mkdir /opt/openstack-exporter \
+    && cp /prometheus-openstack-exporter-source/openstack-exporter /opt/openstack-exporter/
+{% endblock %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block prometheus_openstack_exporter_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER prometheus
diff --git a/kolla/docker/prometheus/prometheus-openstack-network-exporter/Dockerfile.j2 b/kolla/docker/prometheus/prometheus-openstack-network-exporter/Dockerfile.j2
new file mode 100644
index 000000000..3d4d9197b
--- /dev/null
+++ b/kolla/docker/prometheus/prometheus-openstack-network-exporter/Dockerfile.j2
@@ -0,0 +1,24 @@
+FROM {{ namespace }}/{{ image_prefix }}prometheus-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block prometheus_openstack_network_exporter_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% block prometheus_openstack_network_exporter_install %}
+ADD prometheus-openstack-network-exporter-archive /prometheus-openstack-network-exporter-source
+
+RUN mkdir /opt/openstack-network-exporter \
+    && cp /prometheus-openstack-network-exporter-source /opt/openstack-network-exporter/openstack-network-exporter \
+    && chmod 0755 /opt/openstack-network-exporter/openstack-network-exporter
+{% endblock %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block prometheus_openstack_network_exporter_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+# NOTE: OVN/OVS are running as root. Since we need to read sockets owned by
+# these services we don't switch to the Prometheus user here.
diff --git a/kolla/docker/prometheus/prometheus-server/Dockerfile.j2 b/kolla/docker/prometheus/prometheus-server/Dockerfile.j2
new file mode 100644
index 000000000..a3b227d7e
--- /dev/null
+++ b/kolla/docker/prometheus/prometheus-server/Dockerfile.j2
@@ -0,0 +1,24 @@
+FROM {{ namespace }}/{{ image_prefix }}prometheus-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block prometheus_server_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% block prometheus_server_install %}
+ADD prometheus-server-archive /prometheus-server-source
+
+RUN ln -s /prometheus-server-source/* prometheus-server \
+    && mkdir -p /opt/prometheus \
+    && cp -r /prometheus-server/* /opt/prometheus/ \
+    && mkdir -p /etc/prometheus /data
+{% endblock %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block prometheus_server_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER prometheus
diff --git a/kolla/docker/prometheus/prometheus-valkey-exporter/Dockerfile.j2 b/kolla/docker/prometheus/prometheus-valkey-exporter/Dockerfile.j2
new file mode 100644
index 000000000..c6cf79ac3
--- /dev/null
+++ b/kolla/docker/prometheus/prometheus-valkey-exporter/Dockerfile.j2
@@ -0,0 +1,25 @@
+FROM {{ namespace }}/{{ image_prefix }}prometheus-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% block prometheus_valkey_exporter_header %}{% endblock %}
+
+{{ macros.install_packages(prometheus_valkey_exporter_packages | customizable("packages")) }}
+
+{% block prometheus_valkey_exporter_install %}
+ADD prometheus-valkey-exporter-archive /prometheus-valkey-exporter-source
+
+RUN ln -s /prometheus-valkey-exporter-source/* prometheus-valkey-exporter \
+    && cp /prometheus-valkey-exporter/redis_exporter /opt/valkey-exporter
+
+{% endblock %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block prometheus_valkey_exporter_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER prometheus
diff --git a/kolla/docker/proxysql/Dockerfile.j2 b/kolla/docker/proxysql/Dockerfile.j2
new file mode 100644
index 000000000..a76dbcda8
--- /dev/null
+++ b/kolla/docker/proxysql/Dockerfile.j2
@@ -0,0 +1,43 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block proxysql_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.enable_extra_repos(['proxysql']) }}
+
+{% set proxysql_packages = [
+    'proxysql',
+] %}
+
+{% if base_package_type == 'rpm' %}
+    {% set proxysql_packages = proxysql_packages + [
+        'python3-PyYAML',
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set proxysql_packages = proxysql_packages + [
+        'python3-yaml',
+    ] %}
+{% endif %}
+
+{{ macros.configure_user(name='proxysql') }}
+{{ macros.install_packages(proxysql_packages | customizable("packages")) }}
+
+COPY kolla_proxysql_config_sync kolla_extend_start /usr/local/bin/
+RUN chmod 755 /usr/local/bin/kolla_proxysql_config_sync \
+    && chmod 644 /usr/local/bin/kolla_extend_start
+
+RUN install -g proxysql -o proxysql -m 770 -d /var/lib/kolla/proxysql \
+    && touch /etc/proxysql.cnf \
+    && chown proxysql:proxysql /etc/proxysql.cnf \
+    && chmod 600 /etc/proxysql.cnf
+
+{{ macros.kolla_patch_sources() }}
+
+{% block proxysql_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER proxysql
diff --git a/kolla/docker/proxysql/kolla_extend_start b/kolla/docker/proxysql/kolla_extend_start
new file mode 100644
index 000000000..229e8ada2
--- /dev/null
+++ b/kolla/docker/proxysql/kolla_extend_start
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+PROXYSQL_LIB_DIR="/var/lib/proxysql"
+PROXYSQL_LOG_DIR="/var/log/kolla/proxysql"
+
+if [[ ! -d "${PROXYSQL_LOG_DIR}" ]]; then
+    mkdir -p "${PROXYSQL_LOG_DIR}"
+fi
+chown -R proxysql:kolla "${PROXYSQL_LOG_DIR}"
+
+# Remove old pid
+rm -f ${PROXYSQL_LIB_DIR}/proxysql.pid
+
+# As proxysql supports only one
+# configuration file, there is a
+# script which reads global and services
+# configs (similar to haproxy) and
+# generate single configuration file
+# from which is internal DB created
+# every time.
+kolla_proxysql_config_sync
diff --git a/kolla/docker/proxysql/kolla_proxysql_config_sync b/kolla/docker/proxysql/kolla_proxysql_config_sync
new file mode 100644
index 000000000..094642c8a
--- /dev/null
+++ b/kolla/docker/proxysql/kolla_proxysql_config_sync
@@ -0,0 +1,162 @@
+#!/usr/bin/python3
+
+# Copyright 2021 Michal Arbet
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import logging
+import os
+import yaml
+
+# Default paths
+PROXYSQL_CONFIG_DIR = "/etc/proxysql"
+PROXYSQL_CONFIG = "/etc/proxysql.cnf"
+
+# Logging
+log_format = '%(asctime)s,%(msecs)d %(name)s %(levelname)s %(message)s'
+logging.basicConfig(format=log_format,
+                    datefmt='%H:%M:%S',
+                    level=logging.DEBUG)
+LOG = logging.getLogger("proxysql_config_sync")
+
+
+class ProxySQLConfig:
+
+    def __init__(self, conf_dir, conf_file):
+        self.configs = dict()
+        self.config = dict()
+        self.configs['global'] = "{}/proxysql.yaml".format(conf_dir)
+        self.configs['users'] = "{}/users".format(conf_dir)
+        self.configs['rules'] = "{}/rules".format(conf_dir)
+        self.conf_file = conf_file
+        self._load_config()
+
+    def _load_config(self):
+        users = dict()
+        rules = dict()
+
+        for cfg, path in self.configs.items():
+            if not os.path.isdir(path):
+                with open(path) as config_file:
+                    self.config.update(
+                        yaml.safe_load(config_file))
+            else:
+                users['mysql_users'] = list()
+                rules['mysql_query_rules'] = list()
+                user_paths = [os.path.join(self.configs['users'], f)
+                              for f in os.listdir(self.configs['users'])]
+                rule_paths = [os.path.join(self.configs['rules'], f)
+                              for f in os.listdir(self.configs['rules'])]
+
+                for user_conf in user_paths:
+                    with open(user_conf) as config_file:
+                        tmp_users = yaml.safe_load(config_file)
+                        for i in tmp_users['mysql_users']:
+                            users['mysql_users'].append(i)
+                self.config.update(users)
+                for rule_conf in rule_paths:
+                    with open(rule_conf) as config_file:
+                        tmp_rules = yaml.safe_load(config_file)
+                        for i in tmp_rules['mysql_query_rules']:
+                            rules['mysql_query_rules'].append(i)
+                self.config.update(rules)
+        self._sanity()
+
+    def _sanity(self):
+        self._users_sanity()
+        self._rules_sanity()
+
+    def _users_sanity(self):
+        users_added = list()
+        users = list()
+        for user in self.config['mysql_users']:
+            if user['username'] not in users_added:
+                users_added.append(user['username'])
+                users.append(user)
+            else:
+                LOG.warning("User {} already exist, ignoring."
+                            .format(user['username']))
+        self.config['mysql_users'] = users
+
+    def _rules_sanity(self):
+        rules_added = list()
+        rules = list()
+        rule_id = 1
+        for rule in self.config['mysql_query_rules']:
+            if 'schemaname' in rule:
+                key = f"schema:{rule['schemaname']}"
+            elif 'username' in rule:
+                key = f"user:{rule['username']}"
+            else:
+                LOG.warning(
+                    f"Rule without schemaname or username found, skipping: {rule}"
+                )
+                continue
+
+            if key not in rules_added:
+                rules_added.append(key)
+                rule['rule_id'] = rule_id
+                rules.append(rule)
+                rule_id += 1
+            else:
+                LOG.warning("Duplicate rule for {}, ignoring.".format(key))
+
+        self.config['mysql_query_rules'] = rules
+
+    def _write_dict(self, key, value):
+        if not isinstance(value, list):
+            value = [value]
+        with open(self.conf_file, "a+") as f:
+            if key:
+                f.write("{} =\n".format(key))
+            for i in range(len(value)):
+                f.write("  {\n")
+                for k, v in value[i].items():
+                    if isinstance(v, str):
+                        v = '"{}"'.format(v)
+                    f.write("     {} = {}\n".format(k, v))
+                if i == len(value)-1:
+                    f.write("  }\n")
+                else:
+                    f.write("  },\n")
+
+    def _write_list(self, key, values):
+        with open(self.conf_file, "a+") as f:
+            f.write("{} =\n".format(key))
+            f.write("(\n")
+        self._write_dict(key=None, value=values)
+        with open(self.conf_file, "a+") as f:
+            f.write(")\n")
+
+    def _write(self, key, value):
+        with open(self.conf_file, "a+") as f:
+            if isinstance(value, str):
+                value = '"{}"'.format(value)
+            f.write("{} = {}\n".format(key, value))
+
+    def write_config(self):
+        LOG.info("Writing config to {}".format(self.conf_file))
+        with open(self.conf_file, 'wb') as f:
+            pass
+        for k, v in self.config.items():
+            if isinstance(v, dict):
+                self._write_dict(k, v)
+            elif isinstance(v, list):
+                self._write_list(k, v)
+            else:
+                self._write(k, v)
+
+
+if __name__ == "__main__":
+    config = ProxySQLConfig(PROXYSQL_CONFIG_DIR, PROXYSQL_CONFIG)
+    config.write_config()
diff --git a/kolla/docker/rabbitmq/Dockerfile.j2 b/kolla/docker/rabbitmq/Dockerfile.j2
new file mode 100644
index 000000000..a167356a7
--- /dev/null
+++ b/kolla/docker/rabbitmq/Dockerfile.j2
@@ -0,0 +1,69 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block rabbitmq_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='rabbitmq') }}
+
+{{ macros.enable_extra_repos(['erlang', 'rabbitmq']) }}
+
+{% block rabbitmq_apt_preferences %}
+{% if base_package_type == 'deb' %}
+COPY apt_preferences_rabbitmq.{{ base_distro }} /etc/apt/preferences.d/rabbitmq
+{% endif %}
+{% endblock %}
+
+{% block rabbitmq_install %}
+{% if base_package_type == 'rpm' %}
+
+{{ macros.enable_extra_repos(['crb']) }}
+
+    {% set rabbitmq_packages = [
+        'erlang-27.*',
+        'rabbitmq-server-4.2.*'
+    ] %}
+
+{% elif base_package_type == 'deb' %}
+    {% set rabbitmq_packages = [
+        'logrotate',
+        'rabbitmq-server',
+    ] %}
+
+{% endif %}
+
+{{ macros.install_packages(rabbitmq_packages | customizable("packages")) }}
+
+{% endblock %}
+
+{% block rabbitmq_install_plugins %}
+
+RUN rm -rf /var/lib/rabbitmq/* \
+    && mkdir -p /usr/lib/rabbitmq/plugins \
+    && /usr/lib/rabbitmq/bin/rabbitmq-plugins enable --offline \
+       rabbitmq_management \
+       rabbitmq_prometheus
+
+{% endblock %}
+
+{% if docker_healthchecks %}
+{% block healthcheck_installation %}
+
+COPY healthcheck_rabbitmq /usr/local/bin/healthcheck_rabbitmq
+RUN chmod 755 /usr/local/bin/healthcheck_rabbitmq
+
+{% endblock %}
+{% endif %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block rabbitmq_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER rabbitmq
diff --git a/kolla/docker/rabbitmq/apt_preferences_rabbitmq.debian b/kolla/docker/rabbitmq/apt_preferences_rabbitmq.debian
new file mode 100644
index 000000000..cc6404b3e
--- /dev/null
+++ b/kolla/docker/rabbitmq/apt_preferences_rabbitmq.debian
@@ -0,0 +1,7 @@
+Package: rabbitmq-server
+Pin: version 4.2.*
+Pin-Priority: 1000
+
+Package: erlang*
+Pin: version 1:27.*
+Pin-Priority: 1000
diff --git a/kolla/docker/rabbitmq/apt_preferences_rabbitmq.ubuntu b/kolla/docker/rabbitmq/apt_preferences_rabbitmq.ubuntu
new file mode 100644
index 000000000..cc6404b3e
--- /dev/null
+++ b/kolla/docker/rabbitmq/apt_preferences_rabbitmq.ubuntu
@@ -0,0 +1,7 @@
+Package: rabbitmq-server
+Pin: version 4.2.*
+Pin-Priority: 1000
+
+Package: erlang*
+Pin: version 1:27.*
+Pin-Priority: 1000
diff --git a/kolla/docker/rabbitmq/extend_start.sh b/kolla/docker/rabbitmq/extend_start.sh
new file mode 100644
index 000000000..ef28d2b5f
--- /dev/null
+++ b/kolla/docker/rabbitmq/extend_start.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+
+: ${RABBITMQ_LOG_DIR:=/var/log/kolla/rabbitmq}
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+
+# NOTE(sbezverk): In kubernetes environment, if this file exists from previous
+# bootstrap, the system does not allow to overwrite it (it bootstrap files with
+# permission denied error) but it allows to delete it and then recreate it.
+    if [[ -e "/var/lib/rabbitmq/.erlang.cookie" ]]; then
+        rm -f /var/lib/rabbitmq/.erlang.cookie
+    fi
+    echo "${RABBITMQ_CLUSTER_COOKIE}" > /var/lib/rabbitmq/.erlang.cookie
+    chmod 400 /var/lib/rabbitmq/.erlang.cookie
+    exit 0
+fi
+
+if [[ ! -d "${RABBITMQ_LOG_DIR}" ]]; then
+    mkdir -p ${RABBITMQ_LOG_DIR}
+fi
+
+if [[ $(stat -c %a ${RABBITMQ_LOG_DIR}) != "755" ]]; then
+    chmod 755 ${RABBITMQ_LOG_DIR}
+fi
diff --git a/kolla/docker/rabbitmq/healthcheck_rabbitmq b/kolla/docker/rabbitmq/healthcheck_rabbitmq
new file mode 100644
index 000000000..277ab098c
--- /dev/null
+++ b/kolla/docker/rabbitmq/healthcheck_rabbitmq
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+set -e
+
+for check in ping status check_running check_local_alarms check_port_connectivity check_virtual_hosts; do
+    echo "Running rabbitmq-diagnostics $check"
+    rabbitmq-diagnostics -t 5 -q $check || (echo "ERROR: $check failed" && exit 1)
+done
diff --git a/kolla/docker/skyline/skyline-apiserver/Dockerfile.j2 b/kolla/docker/skyline/skyline-apiserver/Dockerfile.j2
new file mode 100644
index 000000000..85b40d51c
--- /dev/null
+++ b/kolla/docker/skyline/skyline-apiserver/Dockerfile.j2
@@ -0,0 +1,27 @@
+FROM {{ namespace }}/{{ image_prefix }}skyline-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block skyline_apiserver_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+ADD skyline-apiserver-archive /skyline-apiserver-source
+
+{% set skyline_apiserver_pip_packages = [
+    '/skyline-apiserver'
+] %}
+
+COPY extend_start.sh /usr/local/bin/kolla_skyline_extend_start
+
+RUN ln -s skyline-apiserver-source/* skyline-apiserver \
+    && {{ macros.install_pip(skyline_apiserver_pip_packages | customizable("pip_packages")) }} \
+    && chmod 644 /usr/local/bin/kolla_skyline_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block skyline_apiserver_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER skyline
diff --git a/kolla/docker/skyline/skyline-apiserver/extend_start.sh b/kolla/docker/skyline/skyline-apiserver/extend_start.sh
new file mode 100644
index 000000000..e1802937b
--- /dev/null
+++ b/kolla/docker/skyline/skyline-apiserver/extend_start.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    SITE_PACKAGES="/var/lib/kolla/venv/lib/python3/site-packages"
+    pushd ${SITE_PACKAGES}/skyline_apiserver/db/alembic
+    alembic upgrade head
+    popd
+    exit 0
+fi
diff --git a/kolla/docker/skyline/skyline-base/Dockerfile.j2 b/kolla/docker/skyline/skyline-base/Dockerfile.j2
new file mode 100644
index 000000000..815fa504f
--- /dev/null
+++ b/kolla/docker/skyline/skyline-base/Dockerfile.j2
@@ -0,0 +1,19 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block skyline_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='skyline') }}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN touch /usr/local/bin/kolla_skyline_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_skyline_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block skyline_base_footer %}{% endblock %}
diff --git a/kolla/docker/skyline/skyline-base/extend_start.sh b/kolla/docker/skyline/skyline-base/extend_start.sh
new file mode 100644
index 000000000..34362ad04
--- /dev/null
+++ b/kolla/docker/skyline/skyline-base/extend_start.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/skyline" ]]; then
+    mkdir -p /var/log/kolla/skyline
+fi
+if [[ $(stat -c %U:%G /var/log/kolla/skyline) != "skyline:kolla" ]]; then
+    chown skyline:kolla /var/log/kolla/skyline
+fi
+if [[ $(stat -c %a /var/log/kolla/skyline) != "755" ]]; then
+    chmod 755 /var/log/kolla/skyline
+fi
+
+if [[ ! -d "/var/lib/skyline" ]]; then
+    mkdir -p /var/lib/skyline
+fi
+if [[ $(stat -c %U:%G /var/lib/skyline) != "skyline:kolla" ]]; then
+    chown skyline:kolla /var/lib/skyline
+fi
+if [[ $(stat -c %a /var/lib/skyline) != "755" ]]; then
+    chmod 755 /var/lib/skyline
+fi
+
+. /usr/local/bin/kolla_skyline_extend_start
diff --git a/kolla/docker/skyline/skyline-console/Dockerfile.j2 b/kolla/docker/skyline/skyline-console/Dockerfile.j2
new file mode 100644
index 000000000..ba62f5041
--- /dev/null
+++ b/kolla/docker/skyline/skyline-console/Dockerfile.j2
@@ -0,0 +1,30 @@
+FROM {{ namespace }}/{{ image_prefix }}skyline-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block skyline_console_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set skyline_console_packages = [
+    'nginx'
+] %}
+
+{{ macros.install_packages(skyline_console_packages | customizable("packages")) }}
+
+ADD skyline-console-archive /skyline-console-source
+
+{% set skyline_console_pip_packages = [
+    '/skyline-console'
+] %}
+
+RUN ln -s skyline-console-source/* skyline-console \
+    && {{ macros.install_pip(skyline_console_pip_packages | customizable("pip_packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block skyline_console_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER root
diff --git a/kolla/docker/tacker/tacker-base/Dockerfile.j2 b/kolla/docker/tacker/tacker-base/Dockerfile.j2
new file mode 100644
index 000000000..c24c8d87c
--- /dev/null
+++ b/kolla/docker/tacker/tacker-base/Dockerfile.j2
@@ -0,0 +1,43 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block tacker_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='tacker') }}
+
+{% if base_package_type == 'rpm' %}
+
+{{ macros.enable_extra_repos(['openvswitch']) }}
+
+{% endif %}
+
+ADD tacker-base-archive /tacker-base-source
+ADD plugins-archive /
+
+{% set tacker_base_pip_packages = [
+    '/tacker'
+] %}
+
+{% set tacker_base_plugins_pip_packages = [
+    '/plugins/*'
+] %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN ln -s tacker-base-source/* tacker \
+    && {{ macros.install_pip(tacker_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/tacker \
+    && cp -r /tacker/etc/tacker/* /etc/tacker \
+    && if [ "$(ls /plugins)" ]; then \
+        {{ macros.install_pip(tacker_base_plugins_pip_packages) }}; \
+       fi \
+    && touch /usr/local/bin/kolla_tacker_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_tacker_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block tacker_base_footer %}{% endblock %}
diff --git a/kolla/docker/tacker/tacker-base/extend_start.sh b/kolla/docker/tacker/tacker-base/extend_start.sh
new file mode 100644
index 000000000..a3b7db8d3
--- /dev/null
+++ b/kolla/docker/tacker/tacker-base/extend_start.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/tacker" ]]; then
+    mkdir -p /var/log/kolla/tacker
+fi
+if [[ $(stat -c %a /var/log/kolla/tacker) != "755" ]]; then
+    chmod 755 /var/log/kolla/tacker
+fi
+
+. /usr/local/bin/kolla_tacker_extend_start
diff --git a/kolla/docker/tacker/tacker-conductor/Dockerfile.j2 b/kolla/docker/tacker/tacker-conductor/Dockerfile.j2
new file mode 100644
index 000000000..676c90106
--- /dev/null
+++ b/kolla/docker/tacker/tacker-conductor/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}tacker-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block tacker_conductor_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block tacker_conductor_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER tacker
diff --git a/kolla/docker/tacker/tacker-server/Dockerfile.j2 b/kolla/docker/tacker/tacker-server/Dockerfile.j2
new file mode 100644
index 000000000..659b70bea
--- /dev/null
+++ b/kolla/docker/tacker/tacker-server/Dockerfile.j2
@@ -0,0 +1,18 @@
+FROM {{ namespace }}/{{ image_prefix }}tacker-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block tacker_server_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+COPY extend_start.sh /usr/local/bin/kolla_tacker_extend_start
+RUN chmod 644 /usr/local/bin/kolla_tacker_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block tacker_server_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER tacker
diff --git a/kolla/docker/tacker/tacker-server/extend_start.sh b/kolla/docker/tacker/tacker-server/extend_start.sh
new file mode 100644
index 000000000..311d21f71
--- /dev/null
+++ b/kolla/docker/tacker/tacker-server/extend_start.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    tacker-db-manage --config-file /etc/tacker/tacker.conf upgrade head
+    exit 0
+fi
diff --git a/kolla/docker/tgtd/Dockerfile.j2 b/kolla/docker/tgtd/Dockerfile.j2
new file mode 100644
index 000000000..b8cbbaaf5
--- /dev/null
+++ b/kolla/docker/tgtd/Dockerfile.j2
@@ -0,0 +1,26 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block tgtd_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+
+RUN echo 'Not available for {{ base_distro }}' \
+    && /bin/false
+
+{% elif base_package_type == 'deb' %}
+    {% set tgtd_packages = ['tgt'] %}
+
+{{ macros.install_packages(tgtd_packages | customizable("packages")) }}
+RUN sed -i '1 i include /var/lib/cinder/volumes/*' /etc/tgt/targets.conf
+
+{% endif %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block tgtd_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/trove/trove-api/Dockerfile.j2 b/kolla/docker/trove/trove-api/Dockerfile.j2
new file mode 100644
index 000000000..8d2885b86
--- /dev/null
+++ b/kolla/docker/trove/trove-api/Dockerfile.j2
@@ -0,0 +1,16 @@
+FROM {{ namespace }}/{{ image_prefix }}trove-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block trove_api_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+COPY extend_start.sh /usr/local/bin/kolla_trove_extend_start
+RUN chmod 644 /usr/local/bin/kolla_trove_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block trove_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/kolla/docker/trove/trove-api/extend_start.sh b/kolla/docker/trove/trove-api/extend_start.sh
new file mode 100644
index 000000000..76839e2d4
--- /dev/null
+++ b/kolla/docker/trove/trove-api/extend_start.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    trove-manage db_sync
+    exit 0
+fi
diff --git a/kolla/docker/trove/trove-base/Dockerfile.j2 b/kolla/docker/trove/trove-base/Dockerfile.j2
new file mode 100644
index 000000000..a675b2b72
--- /dev/null
+++ b/kolla/docker/trove/trove-base/Dockerfile.j2
@@ -0,0 +1,30 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block trove_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='trove') }}
+
+ADD trove-base-archive /trove-base-source
+
+{% set trove_base_pip_packages = [
+    '/trove'
+] %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN ln -s trove-base-source/* trove \
+    && {{ macros.install_pip(trove_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/trove \
+    && cp -r /trove/etc/trove/* /etc/trove/ \
+    && cp /var/lib/kolla/venv/etc/pycadf/trove_api_audit_map.conf /etc/trove/ \
+    && touch /usr/local/bin/kolla_trove_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_trove_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block trove_base_footer %}{% endblock %}
diff --git a/kolla/docker/trove/trove-base/extend_start.sh b/kolla/docker/trove/trove-base/extend_start.sh
new file mode 100644
index 000000000..581a83d7b
--- /dev/null
+++ b/kolla/docker/trove/trove-base/extend_start.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/trove" ]]; then
+    mkdir -p /var/log/kolla/trove
+fi
+if [[ $(stat -c %a /var/log/kolla/trove) != "755" ]]; then
+    chmod 755 /var/log/kolla/trove
+fi
+
+. /usr/local/bin/kolla_trove_extend_start
diff --git a/kolla/docker/trove/trove-conductor/Dockerfile.j2 b/kolla/docker/trove/trove-conductor/Dockerfile.j2
new file mode 100644
index 000000000..4a038c7f9
--- /dev/null
+++ b/kolla/docker/trove/trove-conductor/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}trove-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block trove_conductor_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block trove_conductor_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER trove
diff --git a/kolla/docker/trove/trove-guestagent/Dockerfile.j2 b/kolla/docker/trove/trove-guestagent/Dockerfile.j2
new file mode 100644
index 000000000..178260cae
--- /dev/null
+++ b/kolla/docker/trove/trove-guestagent/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}trove-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block trove_guestagent_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block trove_guestagent_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER trove
diff --git a/kolla/docker/trove/trove-taskmanager/Dockerfile.j2 b/kolla/docker/trove/trove-taskmanager/Dockerfile.j2
new file mode 100644
index 000000000..cef0a0ce9
--- /dev/null
+++ b/kolla/docker/trove/trove-taskmanager/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}trove-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block trove_taskmanager_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block trove_taskmanager_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER trove
diff --git a/kolla/docker/valkey/valkey-base/Dockerfile.j2 b/kolla/docker/valkey/valkey-base/Dockerfile.j2
new file mode 100644
index 000000000..bc17c0cbb
--- /dev/null
+++ b/kolla/docker/valkey/valkey-base/Dockerfile.j2
@@ -0,0 +1,17 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block valkey_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='valkey', homedir='/run/valkey') }}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block valkey_base_footer %}{% endblock %}
diff --git a/kolla/docker/valkey/valkey-base/extend_start.sh b/kolla/docker/valkey/valkey-base/extend_start.sh
new file mode 100644
index 000000000..3a3a321d4
--- /dev/null
+++ b/kolla/docker/valkey/valkey-base/extend_start.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/valkey" ]]; then
+    mkdir -p /var/log/kolla/valkey
+fi
+
+if [[ $(stat -c %a /var/log/kolla/valkey) != "755" ]]; then
+    chmod 755 /var/log/kolla/valkey
+fi
diff --git a/kolla/docker/valkey/valkey-sentinel/Dockerfile.j2 b/kolla/docker/valkey/valkey-sentinel/Dockerfile.j2
new file mode 100644
index 000000000..94828a38f
--- /dev/null
+++ b/kolla/docker/valkey/valkey-sentinel/Dockerfile.j2
@@ -0,0 +1,26 @@
+FROM {{ namespace }}/{{ image_prefix }}valkey-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block valkey_sentinel_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+{{ macros.enable_extra_repos(['epel']) }}
+    {% set valkey_sentinel_packages = ['valkey'] %}
+{% elif base_package_type == 'deb' %}
+    {% set valkey_sentinel_packages = ['valkey-sentinel'] %}
+{% endif %}
+{{ macros.install_packages(valkey_sentinel_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block valkey_sentinel_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER valkey
diff --git a/kolla/docker/valkey/valkey-sentinel/extend_start.sh b/kolla/docker/valkey/valkey-sentinel/extend_start.sh
new file mode 100644
index 000000000..e6af42ef6
--- /dev/null
+++ b/kolla/docker/valkey/valkey-sentinel/extend_start.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/valkey" ]]; then
+    mkdir -p /var/log/kolla/valkey
+fi
+
+if [[ $(stat -c %a /var/log/kolla/valkey) != "755" ]]; then
+    chmod 755 /var/log/kolla/valkey
+fi
+
+# The CONFIG REWRITE command rewrites the valkey.conf
+# file the server was started with, applying the minimal
+# changes needed to make it reflect the configuration
+# currently used by the server, which may be different
+# compared to the original one because of the use of
+# the CONFIG SET command.
+#
+# https://valkey.io/commands/config-rewrite/
+#
+# Because of above behaviour it's needed to
+# hack kolla's CMD.
+#
+# Without this hack
+# /usr/local/bin/kolla_set_configs --check
+# is always reporting changed.
+#
+# Therefore valkey-sentinel is always restarted
+# even if configuration is not changed from
+# kolla-ansible side.
+if [ ! -z "${VALKEY_CONF}" ] && [ ! -z ${VALKEY_GEN_CONF} ]; then
+    cp ${VALKEY_CONF} ${VALKEY_GEN_CONF}
+fi
diff --git a/kolla/docker/valkey/valkey-server/Dockerfile.j2 b/kolla/docker/valkey/valkey-server/Dockerfile.j2
new file mode 100644
index 000000000..be157d89e
--- /dev/null
+++ b/kolla/docker/valkey/valkey-server/Dockerfile.j2
@@ -0,0 +1,23 @@
+FROM {{ namespace }}/{{ image_prefix }}valkey-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block valkey_server_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if base_package_type == 'rpm' %}
+{{ macros.enable_extra_repos(['epel']) }}
+{% endif %}
+
+{% set valkey_server_packages = ['valkey'] %}
+
+{{ macros.install_packages(valkey_server_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block valkey_server_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER valkey
diff --git a/kolla/docker/watcher/watcher-api/Dockerfile.j2 b/kolla/docker/watcher/watcher-api/Dockerfile.j2
new file mode 100644
index 000000000..f31b53ecf
--- /dev/null
+++ b/kolla/docker/watcher/watcher-api/Dockerfile.j2
@@ -0,0 +1,18 @@
+FROM {{ namespace }}/{{ image_prefix }}watcher-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block watcher_api_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+COPY extend_start.sh /usr/local/bin/kolla_watcher_extend_start
+RUN chmod 644 /usr/local/bin/kolla_watcher_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block watcher_api_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER watcher
diff --git a/kolla/docker/watcher/watcher-api/extend_start.sh b/kolla/docker/watcher/watcher-api/extend_start.sh
new file mode 100644
index 000000000..629ea6355
--- /dev/null
+++ b/kolla/docker/watcher/watcher-api/extend_start.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    watcher-db-manage --config-file /etc/watcher/watcher.conf upgrade
+    exit 0
+fi
diff --git a/kolla/docker/watcher/watcher-applier/Dockerfile.j2 b/kolla/docker/watcher/watcher-applier/Dockerfile.j2
new file mode 100644
index 000000000..db28d81d9
--- /dev/null
+++ b/kolla/docker/watcher/watcher-applier/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}watcher-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block watcher_applier_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block watcher_applier_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER watcher
diff --git a/kolla/docker/watcher/watcher-base/Dockerfile.j2 b/kolla/docker/watcher/watcher-base/Dockerfile.j2
new file mode 100644
index 000000000..8de6ceb9d
--- /dev/null
+++ b/kolla/docker/watcher/watcher-base/Dockerfile.j2
@@ -0,0 +1,29 @@
+FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block watcher_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.configure_user(name='watcher') }}
+
+ADD watcher-base-archive /watcher-base-source
+
+{% set watcher_base_pip_packages = [
+    '/watcher'
+] %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+RUN ln -s watcher-base-source/* watcher \
+    && {{ macros.install_pip(watcher_base_pip_packages | customizable("pip_packages")) }} \
+    && mkdir -p /etc/watcher \
+    && cp -r /watcher/etc/watcher/* /etc/watcher/ \
+    && touch /usr/local/bin/kolla_watcher_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_watcher_extend_start
+
+{{ macros.kolla_patch_sources() }}
+
+{% block watcher_base_footer %}{% endblock %}
diff --git a/kolla/docker/watcher/watcher-base/extend_start.sh b/kolla/docker/watcher/watcher-base/extend_start.sh
new file mode 100644
index 000000000..9e27a9cf0
--- /dev/null
+++ b/kolla/docker/watcher/watcher-base/extend_start.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [[ ! -d "/var/log/kolla/watcher" ]]; then
+    mkdir -p /var/log/kolla/watcher
+fi
+if [[ $(stat -c %a /var/log/kolla/watcher) != "755" ]]; then
+    chmod 755 /var/log/kolla/watcher
+fi
+
+. /usr/local/bin/kolla_watcher_extend_start
diff --git a/kolla/docker/watcher/watcher-engine/Dockerfile.j2 b/kolla/docker/watcher/watcher-engine/Dockerfile.j2
new file mode 100644
index 000000000..2518a92b6
--- /dev/null
+++ b/kolla/docker/watcher/watcher-engine/Dockerfile.j2
@@ -0,0 +1,15 @@
+FROM {{ namespace }}/{{ image_prefix }}watcher-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
+{% endblock %}
+
+{% block watcher_engine_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.kolla_patch_sources() }}
+
+{% block watcher_engine_footer %}{% endblock %}
+{% block footer %}{% endblock %}
+
+USER watcher
diff --git a/kolla/image/kolla_worker.py b/kolla/image/kolla_worker.py
index 1c704d1cf..1dc37e2a6 100644
--- a/kolla/image/kolla_worker.py
+++ b/kolla/image/kolla_worker.py
@@ -40,6 +40,8 @@ from oslo_config import cfg
 
 PROJECT_ROOT = os.path.abspath(os.path.join(
     os.path.dirname(os.path.realpath(__file__)), '../..'))
+KOLLA_PACKAGE_DIR = os.path.abspath(os.path.join(
+    os.path.dirname(os.path.realpath(__file__)), '..'))
 
 
 class Image(object):
@@ -213,6 +215,7 @@ class KollaWorker(object):
 
     def _get_images_dir(self):
         possible_paths = (
+            KOLLA_PACKAGE_DIR,
             PROJECT_ROOT,
             os.path.join(sys.prefix, 'share/kolla'),
             os.path.join(sys.prefix, 'local/share/kolla'),