diff options
76 files changed, 1236 insertions, 904 deletions
diff --git a/.yamllint b/.yamllint new file mode 100644 index 000000000..016ae71e8 --- /dev/null +++ b/.yamllint @@ -0,0 +1,27 @@ +extends: default + +rules: + comments: + # https://github.com/prettier/prettier/issues/6780 + min-spaces-from-content: 1 + # https://github.com/adrienverge/yamllint/issues/384 + comments-indentation: false + document-start: disable + # 160 chars was the default used by old E204 rule, but + # you can easily change it or disable in your .yamllint file. + line-length: + ignore: | + kolla/common/sources.yaml + max: 160 + # We are adding an extra space inside braces as that's how prettier does it + # and we are trying not to fight other linters. + braces: + min-spaces-inside: 0 # yamllint defaults to 0 + max-spaces-inside: 1 # yamllint defaults to 0 + # key-duplicates: + # forbid-duplicated-merge-keys: true # not enabled by default + octal-values: + forbid-implicit-octal: true # yamllint defaults to false + forbid-explicit-octal: true # yamllint defaults to false + # quoted-strings: + # quote-type: double diff --git a/doc/source/admin/image-building.rst b/doc/source/admin/image-building.rst index 82ea693ec..a3d9207d3 100644 --- a/doc/source/admin/image-building.rst +++ b/doc/source/admin/image-building.rst @@ -25,7 +25,7 @@ In general, images are built like this: kolla-build -By default, the above command would build all images based on a CentOS Stream +By default, the above command would build all images based on a Rocky Linux image. The operator can change the base distro with the ``-b`` option: @@ -36,7 +36,6 @@ The operator can change the base distro with the ``-b`` option: There are following distros (bases) available for building images: -- centos - debian - rocky - ubuntu @@ -704,8 +703,8 @@ additional configuration. For RPM-based distros they are enabled via ``dnf config-manager --enable``; for Debian-based distros they are a no-op as the sources are already provided by the base image. Examples include ``crb``, ``extras``, and the base repos ``baseos`` and ``appstream`` for -CentOS and Rocky Linux, as well as ``debian``, ``debian-security``, -``ubuntu``, ``ubuntu-security``. +Rocky Linux, as well as ``debian``, ``debian-security``, ``ubuntu``, +``ubuntu-security``. Repositories without ``distro: True`` are fully templated into a new repository file and must provide at least one of ``baseurl``, ``metalink``, diff --git a/doc/source/admin/kolla_api.rst b/doc/source/admin/kolla_api.rst index a34cd819f..b4266aea0 100644 --- a/doc/source/admin/kolla_api.rst +++ b/doc/source/admin/kolla_api.rst @@ -188,5 +188,5 @@ Variables available in the containers The following variables available in all images and can be evaluated in scripts: -* **KOLLA_BASE_DISTRO**: ``base_distro`` used to build the image (e.g. centos, +* **KOLLA_BASE_DISTRO**: ``base_distro`` used to build the image (e.g. rocky, ubuntu) diff --git a/doc/source/admin/template-override/ovs-dpdk.rst b/doc/source/admin/template-override/ovs-dpdk.rst index 73851a993..766caf9bc 100644 --- a/doc/source/admin/template-override/ovs-dpdk.rst +++ b/doc/source/admin/template-override/ovs-dpdk.rst @@ -1,7 +1,7 @@ OVS-DPDK Source build ===================== -CentOS currently does not provide packages for ovs with dpdk. +Rocky currently does not provide packages for ovs with dpdk. The Ubuntu packages do not support UIO based drivers. To use the uio_pci_generic driver on Ubuntu a source build is required. diff --git a/doc/source/contributor/adding-a-new-image.rst b/doc/source/contributor/adding-a-new-image.rst index 995bf13c7..072d3f294 100644 --- a/doc/source/contributor/adding-a-new-image.rst +++ b/doc/source/contributor/adding-a-new-image.rst @@ -75,7 +75,7 @@ cannot be built for some distribution/architecture/build-type combinations. "bifrost-base", # someone need to get upstream working first }, - 'centos': { + 'rocky': { "hacluster-pcs", # Missing crmsh package }, diff --git a/doc/source/contributor/versions.rst b/doc/source/contributor/versions.rst index af5d02f10..f553e18ed 100644 --- a/doc/source/contributor/versions.rst +++ b/doc/source/contributor/versions.rst @@ -9,9 +9,6 @@ information about those which come from 3rdparty sources. For each component used we list version used at branch release and provide information about package sources. -.. note:: - When table mentions 'CentOS' it means both CentOS Stream 10 and Rocky Linux 10. - ============== ================ ============================================= Name Version Package source information ============== ================ ============================================= @@ -20,13 +17,13 @@ information about package sources. Galera 26.4 (LTS) `MariaDB Community downloads`_ OpenSearch 3.x `OpenSearch install guide`_ ProxySQL 3.0.x `ProxySQL repository`_ - RabbitMQ 4.3.x - CentOS/Rocky: + RabbitMQ 4.3.x - Rocky: `Team RabbitMQ 'Cloudsmith' repo (RPM)`_ - Debian/Ubuntu: `Team RabbitMQ 'Cloudsmith' repo (Deb)`_ - Erlang 27.x - CentOS/Rocky aarch64: + Erlang 27.x - Rocky aarch64: `openstack-kolla COPR`_ - - CentOS/Rocky x86-64: + - Rocky x86-64: `Team RabbitMQ 'Cloudsmith' repo (RPM)`_ - Debian/Ubuntu: `Team RabbitMQ 'Modern Erlang' PPA`_ diff --git a/doc/source/support_matrix.rst b/doc/source/support_matrix.rst index c14c71954..5e3b06b76 100644 --- a/doc/source/support_matrix.rst +++ b/doc/source/support_matrix.rst @@ -17,7 +17,6 @@ The following base container images are supported: ================== =============================== ================ Distribution Default base Default base tag ================== =============================== ================ -Centos quay.io/centos/centos stream10 Debian Trixie debian trixie Rocky Linux quay.io/rockylinux/rockylinux 10 Ubuntu Noble ubuntu 24.04 diff --git a/kolla/common/config.py b/kolla/common/config.py index 1915f5c48..e1c0cb456 100644 --- a/kolla/common/config.py +++ b/kolla/common/config.py @@ -21,18 +21,16 @@ from kolla.common.users import USERS from kolla.version import version_info as version -BASE_OS_DISTRO = ['centos', 'debian', 'rocky', 'ubuntu'] +BASE_OS_DISTRO = ['debian', 'rocky', 'ubuntu'] BASE_ARCH = ['x86_64', 'aarch64'] DEBIAN_ARCH = ['amd64', 'arm64'] DEFAULT_BASE_TAGS = { - 'centos': {'name': 'quay.io/centos/centos', 'tag': 'stream10'}, 'debian': {'name': 'debian', 'tag': 'trixie'}, 'rocky': {'name': 'quay.io/rockylinux/rockylinux', 'tag': '10'}, 'ubuntu': {'name': 'ubuntu', 'tag': '24.04'}, } # NOTE(hrw): has to match PRETTY_NAME in /etc/os-release DISTRO_PRETTY_NAME = { - 'centos': 'CentOS Stream 10', 'debian': 'Debian GNU/Linux 13 (trixie)', 'rocky': 'Rocky Linux 10.* (Red Quartz)', 'ubuntu': 'Ubuntu 24.04.* LTS', diff --git a/kolla/common/sources.py b/kolla/common/sources.py index 59d2796f2..61dd10263 100644 --- a/kolla/common/sources.py +++ b/kolla/common/sources.py @@ -10,440 +10,11 @@ # See the License for the specific language governing permissions and # limitations under the License. -SOURCES = { - 'openstack-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/requirements/' - 'requirements-${openstack_branch}.tar.gz')}, - 'aodh-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/aodh/' - 'aodh-${openstack_branch}.tar.gz')}, - 'barbican-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/barbican/' - 'barbican-${openstack_branch}.tar.gz')}, - 'bifrost-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/bifrost/' - 'bifrost-${openstack_branch}.tar.gz')}, - 'blazar-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/blazar/' - 'blazar-${openstack_branch}.tar.gz')}, - 'ceilometer-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/ceilometer/' - 'ceilometer-${openstack_branch}.tar.gz')}, - 'cinder-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/cinder/' - 'cinder-${openstack_branch}.tar.gz')}, - 'cloudkitty-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/cloudkitty/' - 'cloudkitty-${openstack_branch}.tar.gz')}, - 'cyborg-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/cyborg/' - 'cyborg-${openstack_branch}.tar.gz')}, - 'designate-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/designate/' - 'designate-${openstack_branch}.tar.gz')}, - 'etcd': { - # NOTE(wszumski): Upgrade one minor version at a time: - # https://etcd.io/docs/v3.6/upgrades/upgrade_3_6/ - # NOTE(mnasiadka): lts_branch pins check_sources.py to the 3.6.x - # release series instead of jumping to the latest major.minor. - 'lts_branch': '3.6', - 'version': '3.6.5', - 'type': 'url', - 'sha256': { - 'amd64': '66bad39ed920f6fc15fd74adcb8bfd38ba9a6412f8c7852d09eb11670e88cac3', # noqa: E501 - 'arm64': '7010161787077b07de29b15b76825ceacbbcedcb77fe2e6832f509be102cab6b'}, # noqa: E501 - 'location': ('https://github.com/etcd-io/etcd/' - 'releases/download/v${version}' - '/etcd-v${version}-linux-${debian_arch}.tar.gz')}, - 'glance-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/glance/' - 'glance-${openstack_branch}.tar.gz')}, - 'gnocchi-base': { - 'type': 'git', - 'reference': '4.7.0', - 'location': ('https://github.com/gnocchixyz/' - 'gnocchi.git')}, - 'heat-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/heat/' - 'heat-${openstack_branch}.tar.gz')}, - 'horizon': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/horizon/' - 'horizon-${openstack_branch}.tar.gz')}, - 'horizon-plugin-blazar-dashboard': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/blazar-dashboard/' - 'blazar-dashboard-${openstack_branch}.tar.gz')}, - 'horizon-plugin-cloudkitty-dashboard': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/cloudkitty-dashboard/' - 'cloudkitty-dashboard-${openstack_branch}.tar.gz')}, - 'horizon-plugin-designate-dashboard': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/designate-dashboard/' - 'designate-dashboard-${openstack_branch}.tar.gz')}, - 'horizon-plugin-fwaas-dashboard': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/neutron-fwaas-dashboard/' - 'neutron-fwaas-dashboard-${openstack_branch}.tar.gz')}, - 'horizon-plugin-heat-dashboard': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/heat-dashboard/' - 'heat-dashboard-${openstack_branch}.tar.gz')}, - 'horizon-plugin-ironic-ui': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/ironic-ui/' - 'ironic-ui-${openstack_branch}.tar.gz')}, - 'horizon-plugin-magnum-ui': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/magnum-ui/' - 'magnum-ui-${openstack_branch}.tar.gz')}, - 'horizon-plugin-manila-ui': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/manila-ui/' - 'manila-ui-${openstack_branch}.tar.gz')}, - 'horizon-plugin-masakari-dashboard': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/masakari-dashboard/' - 'masakari-dashboard-${openstack_branch}.tar.gz')}, - 'horizon-plugin-mistral-dashboard': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/mistral-dashboard/' - 'mistral-dashboard-${openstack_branch}.tar.gz')}, - 'horizon-plugin-neutron-vpnaas-dashboard': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/neutron-vpnaas-dashboard/' - 'neutron-vpnaas-dashboard-${openstack_branch}.tar.gz')}, - 'horizon-plugin-octavia-dashboard': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/octavia-dashboard/' - 'octavia-dashboard-${openstack_branch}.tar.gz')}, - 'horizon-plugin-tacker-dashboard': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/tacker-horizon/' - 'tacker-horizon-${openstack_branch}.tar.gz')}, - 'horizon-plugin-trove-dashboard': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/trove-dashboard/' - 'trove-dashboard-${openstack_branch}.tar.gz')}, - 'horizon-plugin-watcher-dashboard': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/watcher-dashboard/' - 'watcher-dashboard-${openstack_branch}.tar.gz')}, - 'ironic-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/ironic/' - 'ironic-${openstack_branch}.tar.gz')}, - 'ironic-conductor-plugin-prometheus-exporter': { - 'type': 'url', - 'location': ( - '$tarballs_base/openstack/ironic-prometheus-exporter/' - 'ironic-prometheus-exporter-${openstack_branch}.tar.gz')}, - 'keystone-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/keystone/' - 'keystone-${openstack_branch}.tar.gz')}, - 'kerbside-base': { - 'type': 'git', - 'reference': 'develop', - 'location': ('https://github.com/shakenfist/kerbside')}, - 'kolla-toolbox': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/requirements/' - 'requirements-${openstack_branch}.tar.gz')}, - 'letsencrypt-lego': { - 'version': 'v4.27.0', - 'type': 'url', - 'sha256': { - 'amd64': '898b58bbbca4282d706b4f204593cb94fc2ed13232777236c06dc20259bbcd02', # noqa: E501 - 'arm64': '2973b412d37e5d652a91bda1a6bf7642491e316bc0f855a614e2c996249014dc'}, # noqa: E501 - 'location': ('https://github.com/go-acme/lego/' - 'releases/download/${version}/' - 'lego_${version}_linux_${debian_arch}.tar.gz')}, - 'magnum-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/magnum/' - 'magnum-${openstack_branch}.tar.gz')}, - 'magnum-conductor-plugin-helm': { - 'version': 'v3.19.0', - 'type': 'url', - # NOTE(mnasiadka): location points to get.helm.sh, but - # check_sources needs github releases access - 'github': 'helm/helm', - 'sha256': { - 'amd64': 'a7f81ce08007091b86d8bd696eb4d86b8d0f2e1b9f6c714be62f82f96a594496', # noqa: E501 - 'arm64': '440cf7add0aee27ebc93fada965523c1dc2e0ab340d4348da2215737fc0d76ad'}, # noqa: E501 - 'location': ('https://get.helm.sh/helm' - '-${version}-linux-${debian_arch}.tar.gz')}, - 'manila-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/manila/' - 'manila-${openstack_branch}.tar.gz')}, - 'mariadb-server-plugin-mariadb-docker': { - # NOTE(seunghun1ee): This repo is needed to get MariaDB healthcheck.sh - 'type': 'git', - 'reference': 'master', - 'location': ('https://github.com/MariaDB/mariadb-docker')}, - 'masakari-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/masakari/' - 'masakari-${openstack_branch}.tar.gz')}, - 'masakari-monitors': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/masakari-monitors/' - 'masakari-monitors-${openstack_branch}.tar.gz')}, - 'mistral-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/mistral/' - 'mistral-${openstack_branch}.tar.gz')}, - 'mistral-base-plugin-tacker': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/tacker/' - 'tacker-${openstack_branch}.tar.gz')}, - 'neutron-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/neutron/' - 'neutron-${openstack_branch}.tar.gz')}, - 'neutron-base-plugin-neutron-fwaas': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/neutron-fwaas/' - 'neutron-fwaas-${openstack_branch}.tar.gz')}, - 'neutron-base-plugin-networking-baremetal': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/networking-baremetal/' - 'networking-baremetal-${openstack_branch}.tar.gz')}, - 'neutron-base-plugin-networking-generic-switch': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/networking-generic-switch/' - 'networking-generic-switch-${openstack_branch}.tar.gz')}, - 'neutron-base-plugin-networking-sfc': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/networking-sfc/' - 'networking-sfc-${openstack_branch}.tar.gz')}, - 'neutron-base-plugin-tap-as-a-service': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/tap-as-a-service/' - 'tap-as-a-service-${openstack_branch}.tar.gz')}, - 'neutron-base-plugin-vpnaas-agent': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/neutron-vpnaas/' - 'neutron-vpnaas-${openstack_branch}.tar.gz')}, - 'neutron-bgp-dragent': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/neutron-dynamic-routing/' - 'neutron-dynamic-routing-${openstack_branch}.tar.gz')}, - 'neutron-server-plugin-neutron-dynamic-routing': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/neutron-dynamic-routing/' - 'neutron-dynamic-routing-${openstack_branch}.tar.gz')}, - 'neutron-vpnaas-agent': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/neutron-vpnaas/' - 'neutron-vpnaas-${openstack_branch}.tar.gz')}, - 'nova-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/nova/' - 'nova-${openstack_branch}.tar.gz')}, - 'nova-base-plugin-blazar': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/blazar-nova/' - 'blazar-nova-${openstack_branch}.tar.gz')}, - 'octavia-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/octavia/' - 'octavia-${openstack_branch}.tar.gz')}, - 'octavia-api-plugin-ovn-octavia-provider': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/ovn-octavia-provider/' - 'ovn-octavia-provider-${openstack_branch}.tar.gz')}, - 'octavia-driver-agent-plugin-ovn-octavia-provider': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/ovn-octavia-provider/' - 'ovn-octavia-provider-${openstack_branch}.tar.gz')}, - 'placement-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/placement/' - 'placement-${openstack_branch}.tar.gz')}, - 'prometheus-alertmanager': { - 'version': '0.31.1', - 'type': 'url', - 'sha256': { - 'amd64': '35191cbd9d4f8162458b78dd7e93990cccd246044d9a6f788adb1c66ac3ea07b', # noqa: E501 - 'arm64': '266dda88b64318c27847ef9af4ff450fc178c827550a8039420c5ca8657a4a8b'}, # noqa: E501 - 'location': ('https://github.com/' - 'prometheus/alertmanager/' - 'releases/download/v${version}/' - 'alertmanager' - '-${version}.linux-${debian_arch}.tar.gz')}, - 'prometheus-blackbox-exporter': { - 'version': '0.28.0', - 'type': 'url', - 'sha256': { - 'amd64': 'caf5d242fb1cf6d5cb678f3f799f22703d4fafea26b03dcbbd7e1f1825e06329', # noqa: E501 - 'arm64': '63312be0983d85e5109710a7dc93df3051157ae581853fa3655d171cc1b2806e'}, # noqa: E501 - 'location': ('https://github.com/' - 'prometheus/blackbox_exporter/' - 'releases/download/v${version}/' - 'blackbox_exporter' - '-${version}.linux-${debian_arch}.tar.gz')}, - 'prometheus-cadvisor': { - 'version': '0.56.2', - 'type': 'url', - 'sha256': { - 'amd64': 'ad92930f16a2f9da15190675e09eeaceb8fd38637d07a686bb0dd68695f692af', # noqa: E501 - 'arm64': 'b7a707379496fd7a7b5d2768c5c494427112f534ba5069f889af28ffe6ad11bb'}, # noqa: E501 - 'location': ('https://github.com/' - 'google/cadvisor/' - 'releases/download/v${version}/' - 'cadvisor' - '-v${version}-linux-${debian_arch}')}, - 'prometheus-elasticsearch-exporter': { - 'version': '1.10.0', - 'type': 'url', - 'sha256': { - 'amd64': '1dcf288082a25b2741e98da6c9fc012b6c821696a26c6ac57c20042f24714a74', # noqa: E501 - 'arm64': '0ff4753a975eb5611c03123d565e8aaa84e4c05f698ce0a2d6c0f437a14bfe34'}, # noqa: E501 - 'location': ('https://github.com/' - 'prometheus-community/elasticsearch_exporter/' - 'releases/download/v${version}/' - 'elasticsearch_exporter' - '-${version}.linux-${debian_arch}.tar.gz')}, - 'prometheus-libvirt-exporter': { - 'version': '2.3.1', - 'type': 'url', - 'sha256': { - 'amd64': '2e1657d10291059f420a467cbe3363c7353bbce9d5445f0d8d302bd96caaf0a8', # noqa: E501 - 'arm64': '676dc76766ce4a2eaa8324a3aca8cfe89711536337d3b5b862ddf141fb57a224'}, # noqa: E501 - 'location': ('https://github.com/' - 'inovex/prometheus-libvirt-exporter/' - 'releases/download/v${version}/' - 'prometheus-libvirt-exporter' - '-${version}.linux-${debian_arch}.tar.gz')}, - 'prometheus-memcached-exporter': { - 'version': '0.15.5', - 'type': 'url', - 'sha256': { - 'amd64': '5b82e6579b77fae00683d10d5923329173925a5abd95a799f5489a66136b884c', # noqa: E501 - 'arm64': '609e6d7484f22fd9e405c0022a9e2d7f86eedef1cfa55772231528271082aeae'}, # noqa: E501 - 'location': ('https://github.com/' - 'prometheus/memcached_exporter/' - 'releases/download/v${version}/' - 'memcached_exporter' - '-${version}.linux-${debian_arch}.tar.gz')}, - 'prometheus-mtail': { - 'version': '3.4.0', - 'type': 'url', - 'sha256': { - 'amd64': 'd3d0d34909d03ffba11baccd87989c1825fc5c68b1f59307fe188a6dd8e0da5a', # noqa: E501 - 'arm64': '2b166f4d4165b508b9c9b96de6364bc35ff019545810ad07d919ee5ea3d064c7'}, # noqa: E501 - 'location': ('https://github.com/' - 'jaqx0r/mtail/' - 'releases/download/v${version}/' - 'mtail' - '_${version}_linux_${debian_arch}.tar.gz')}, - 'prometheus-mysqld-exporter': { - 'version': '0.18.0', - 'type': 'url', - 'sha256': { - 'amd64': '46e8f45654352bdd42d162b2b4a68f00055d45acc168f9c068235b9e3acc39c1', # noqa: E501 - 'arm64': 'abdb452600ca086b68244aadf8045fbf0b6a48dcb76eed5576995806c176f6ce'}, # noqa: E501 - 'location': ('https://github.com/' - 'prometheus/mysqld_exporter/' - 'releases/download/v${version}/' - 'mysqld_exporter' - '-${version}.linux-${debian_arch}.tar.gz')}, - 'prometheus-node-exporter': { - 'version': '1.10.2', - 'type': 'url', - 'sha256': { - 'amd64': 'c46e5b6f53948477ff3a19d97c58307394a29fe64a01905646f026ddc32cb65b', # noqa: E501 - 'arm64': 'de69ec8341c8068b7c8e4cfe3eb85065d24d984a3b33007f575d307d13eb89a6'}, # noqa: E501 - 'location': ('https://github.com/' - 'prometheus/node_exporter/' - 'releases/download/v${version}/' - 'node_exporter' - '-${version}.linux-${debian_arch}.tar.gz')}, - 'prometheus-openstack-exporter': { - 'version': '1.7.0', - 'type': 'url', - 'sha256': { - 'amd64': 'dfaa0d3dcff22e882d3f61c56bb9ac6f70790df9d67361464159bbb4c7223192', # noqa: E501 - 'arm64': 'd6e0b23fe755732a93796255e3a2be8ec5a699b0a64c21afd377c60ccf60cd55'}, # noqa: E501 - 'location': ('https://github.com/' - 'openstack-exporter/openstack-exporter/' - 'releases/download/v${version}/' - 'openstack-exporter' - '_${version}_linux_${debian_arch}.tar.gz')}, - 'prometheus-openstack-network-exporter': { - 'version': '0.2.0', - 'type': 'url', - 'sha256': { - 'amd64': 'c93e6c62a0b861af50292f51b1443114e2178d89450b37cb0462723eaa3b2338', # noqa: E501 - 'arm64': '478de6e005188d0e2545e34ca2c5b93a33a32dc7d1f1b03dc3210c4ef7e44305'}, # noqa: E501 - 'location': ('https://github.com/' - 'openstack-k8s-operators/openstack-network-exporter/' - 'releases/download/v${version}/' - 'openstack-network-exporter' - '-linux-${debian_arch}')}, - 'prometheus-server': { - # NOTE(mnasiadka): lts_branch pins check_sources.py to the 3.5.x - # release series instead of jumping to the latest major.minor. - 'lts_branch': '3.5', - 'version': '3.5.4', - 'type': 'url', - 'sha256': { - 'amd64': 'be64e1cf657e6e7d132aca022f6135abedd660db053952e3f69e8affa3b9cc9e', # noqa: E501 - 'arm64': '97634b9b6ed9ef18689e3b3572f1b277714650657516494fd164dcc53c1d3f48'}, # noqa: E501 - 'location': ('https://github.com/' - 'prometheus/prometheus/' - 'releases/download/v${version}/' - 'prometheus' - '-${version}.linux-${debian_arch}.tar.gz')}, - 'prometheus-valkey-exporter': { - 'version': '1.82.0', - 'type': 'url', - 'sha256': { - 'amd64': '2d98dd0888f46e206bf3ad1b7c1784934a3a39cd8774cf47615f4c15594547cd', # noqa: E501 - 'arm64': '13aaa6acbb145848cb97ed3bab22747e094b3f0ed22df83c8ace593e3c527c95'}, # noqa: E501 - 'location': ('https://github.com/' - 'oliver006/redis_exporter/' - 'releases/download/v${version}/' - 'redis_exporter' - '-v${version}.linux-${debian_arch}.tar.gz')}, - 'skyline-apiserver': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/skyline-apiserver/' - 'skyline-apiserver-${openstack_branch}.tar.gz')}, - 'skyline-console': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/skyline-console/' - 'skyline-console-${openstack_branch}.tar.gz')}, - 'tacker-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/tacker/' - 'tacker-${openstack_branch}.tar.gz')}, - 'tacker-base-plugin-networking-sfc': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/networking-sfc/' - 'networking-sfc-${openstack_branch}.tar.gz')}, - 'trove-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/trove/' - 'trove-${openstack_branch}.tar.gz')}, - 'watcher-base': { - 'type': 'url', - 'location': ('$tarballs_base/openstack/watcher/' - 'watcher-${openstack_branch}.tar.gz')} -} +import os + +import yaml + +SOURCES_YAML = os.path.dirname(os.path.realpath(__file__)) + '/sources.yaml' + +with open(SOURCES_YAML, 'r') as f: + SOURCES = yaml.safe_load(f) diff --git a/kolla/common/sources.yaml b/kolla/common/sources.yaml new file mode 100644 index 000000000..db892daa8 --- /dev/null +++ b/kolla/common/sources.yaml @@ -0,0 +1,318 @@ +--- +openstack-base: + type: "url" + location: "$tarballs_base/openstack/requirements/requirements-${openstack_branch}.tar.gz" +aodh-base: + type: "url" + location: "$tarballs_base/openstack/aodh/aodh-${openstack_branch}.tar.gz" +barbican-base: + type: "url" + location: "$tarballs_base/openstack/barbican/barbican-${openstack_branch}.tar.gz" +bifrost-base: + type: "url" + location: "$tarballs_base/openstack/bifrost/bifrost-${openstack_branch}.tar.gz" +blazar-base: + type: "url" + location: "$tarballs_base/openstack/blazar/blazar-${openstack_branch}.tar.gz" +ceilometer-base: + type: "url" + location: "$tarballs_base/openstack/ceilometer/ceilometer-${openstack_branch}.tar.gz" +cinder-base: + type: "url" + location: "$tarballs_base/openstack/cinder/cinder-${openstack_branch}.tar.gz" +cloudkitty-base: + type: "url" + location: "$tarballs_base/openstack/cloudkitty/cloudkitty-${openstack_branch}.tar.gz" +cyborg-base: + type: "url" + location: "$tarballs_base/openstack/cyborg/cyborg-${openstack_branch}.tar.gz" +designate-base: + type: "url" + location: "$tarballs_base/openstack/designate/designate-${openstack_branch}.tar.gz" +etcd: + # NOTE(wszumski): Upgrade one minor version at a time: + # https://etcd.io/docs/v3.6/upgrades/upgrade_3_6/ + # NOTE(mnasiadka): lts_branch pins check_sources.py to the 3.6.x + # release series instead of jumping to the latest major.minor. + lts_branch: "3.6" + version: "3.6.15" + type: "url" + sha256: + amd64: "b51d86e6bff2168de5ba8cd631c0fe6c785c7a1b32b083079f5677d6b7e2772c" + arm64: "567d9b8fa9e75b349600d2b64ef9bf6bc6d512cea75a2ce1c39b1b3046131244" + location: "https://github.com/etcd-io/etcd/releases/download/v${version}/etcd-v${version}-linux-${debian_arch}.tar.gz" +glance-base: + type: "url" + location: "$tarballs_base/openstack/glance/glance-${openstack_branch}.tar.gz" +gnocchi-base: + type: "git" + reference: "4.7.0" + location: "https://github.com/gnocchixyz/gnocchi.git" +heat-base: + type: "url" + location: "$tarballs_base/openstack/heat/heat-${openstack_branch}.tar.gz" +horizon: + type: "url" + location: "$tarballs_base/openstack/horizon/horizon-${openstack_branch}.tar.gz" +horizon-plugin-blazar-dashboard: + type: "url" + location: "$tarballs_base/openstack/blazar-dashboard/blazar-dashboard-${openstack_branch}.tar.gz" +horizon-plugin-cloudkitty-dashboard: + type: "url" + location: "$tarballs_base/openstack/cloudkitty-dashboard/cloudkitty-dashboard-${openstack_branch}.tar.gz" +horizon-plugin-designate-dashboard: + type: "url" + location: "$tarballs_base/openstack/designate-dashboard/designate-dashboard-${openstack_branch}.tar.gz" +horizon-plugin-fwaas-dashboard: + type: "url" + location: "$tarballs_base/openstack/neutron-fwaas-dashboard/neutron-fwaas-dashboard-${openstack_branch}.tar.gz" +horizon-plugin-heat-dashboard: + type: "url" + location: "$tarballs_base/openstack/heat-dashboard/heat-dashboard-${openstack_branch}.tar.gz" +horizon-plugin-ironic-ui: + type: "url" + location: "$tarballs_base/openstack/ironic-ui/ironic-ui-${openstack_branch}.tar.gz" +horizon-plugin-magnum-ui: + type: "url" + location: "$tarballs_base/openstack/magnum-ui/magnum-ui-${openstack_branch}.tar.gz" +horizon-plugin-manila-ui: + type: "url" + location: "$tarballs_base/openstack/manila-ui/manila-ui-${openstack_branch}.tar.gz" +horizon-plugin-masakari-dashboard: + type: "url" + location: "$tarballs_base/openstack/masakari-dashboard/masakari-dashboard-${openstack_branch}.tar.gz" +horizon-plugin-mistral-dashboard: + type: "url" + location: "$tarballs_base/openstack/mistral-dashboard/mistral-dashboard-${openstack_branch}.tar.gz" +horizon-plugin-neutron-vpnaas-dashboard: + type: "url" + location: "$tarballs_base/openstack/neutron-vpnaas-dashboard/neutron-vpnaas-dashboard-${openstack_branch}.tar.gz" +horizon-plugin-octavia-dashboard: + type: "url" + location: "$tarballs_base/openstack/octavia-dashboard/octavia-dashboard-${openstack_branch}.tar.gz" +horizon-plugin-tacker-dashboard: + type: "url" + location: "$tarballs_base/openstack/tacker-horizon/tacker-horizon-${openstack_branch}.tar.gz" +horizon-plugin-trove-dashboard: + type: "url" + location: "$tarballs_base/openstack/trove-dashboard/trove-dashboard-${openstack_branch}.tar.gz" +horizon-plugin-watcher-dashboard: + type: "url" + location: "$tarballs_base/openstack/watcher-dashboard/watcher-dashboard-${openstack_branch}.tar.gz" +ironic-base: + type: "url" + location: "$tarballs_base/openstack/ironic/ironic-${openstack_branch}.tar.gz" +ironic-conductor-plugin-prometheus-exporter: + type: "url" + location: "$tarballs_base/openstack/ironic-prometheus-exporter/ironic-prometheus-exporter-${openstack_branch}.tar.gz" +keystone-base: + type: "url" + location: "$tarballs_base/openstack/keystone/keystone-${openstack_branch}.tar.gz" +kerbside-base: + type: "git" + reference: "develop" + location: "https://github.com/shakenfist/kerbside" +kolla-toolbox: + type: "url" + location: "$tarballs_base/openstack/requirements/requirements-${openstack_branch}.tar.gz" +letsencrypt-lego: + lts_branch: "4" + version: "v4.35.2" + type: "url" + sha256: + amd64: "ee5be4bf457de8e3efa86a51651c75c87f0ee0e4e9f3ae14f6034d68365770f3" + arm64: "e1f153179098d27ce044aaaa168c0e323d50ae71b0f1a147aa8ae49ac6b14d89" + location: "https://github.com/go-acme/lego/releases/download/${version}/lego_${version}_linux_${debian_arch}.tar.gz" +magnum-base: + type: "url" + location: "$tarballs_base/openstack/magnum/magnum-${openstack_branch}.tar.gz" +magnum-conductor-plugin-helm: + version: "v4.3.0" + type: "url" + # NOTE(mnasiadka): location points to get.helm.sh, but + # check_sources needs github releases access + github: "helm/helm" + sha256: + amd64: "86584a54def73570558f66f5111cc53dfed56689637ae32c1201205d494f54fb" + arm64: "31c5794dd55c66a51e6b7d2e2ac7a114ae8b1de41ff1d9ba51748ac973b06a08" + location: "https://get.helm.sh/helm-${version}-linux-${debian_arch}.tar.gz" +manila-base: + type: "url" + location: "$tarballs_base/openstack/manila/manila-${openstack_branch}.tar.gz" +mariadb-server-plugin-mariadb-docker: + # NOTE(seunghun1ee): This repo is needed to get MariaDB healthcheck.sh + type: "git" + reference: "master" + location: "https://github.com/MariaDB/mariadb-docker" +masakari-base: + type: "url" + location: "$tarballs_base/openstack/masakari/masakari-${openstack_branch}.tar.gz" +masakari-monitors: + type: "url" + location: "$tarballs_base/openstack/masakari-monitors/masakari-monitors-${openstack_branch}.tar.gz" +mistral-base: + type: "url" + location: "$tarballs_base/openstack/mistral/mistral-${openstack_branch}.tar.gz" +mistral-base-plugin-tacker: + type: "url" + location: "$tarballs_base/openstack/tacker/tacker-${openstack_branch}.tar.gz" +neutron-base: + type: "url" + location: "$tarballs_base/openstack/neutron/neutron-${openstack_branch}.tar.gz" +neutron-base-plugin-neutron-fwaas: + type: "url" + location: "$tarballs_base/openstack/neutron-fwaas/neutron-fwaas-${openstack_branch}.tar.gz" +neutron-base-plugin-networking-baremetal: + type: "url" + location: "$tarballs_base/openstack/networking-baremetal/networking-baremetal-${openstack_branch}.tar.gz" +neutron-base-plugin-networking-generic-switch: + type: "url" + location: "$tarballs_base/openstack/networking-generic-switch/networking-generic-switch-${openstack_branch}.tar.gz" +neutron-base-plugin-networking-sfc: + type: "url" + location: "$tarballs_base/openstack/networking-sfc/networking-sfc-${openstack_branch}.tar.gz" +neutron-base-plugin-tap-as-a-service: + type: "url" + location: "$tarballs_base/openstack/tap-as-a-service/tap-as-a-service-${openstack_branch}.tar.gz" +neutron-base-plugin-vpnaas-agent: + type: "url" + location: "$tarballs_base/openstack/neutron-vpnaas/neutron-vpnaas-${openstack_branch}.tar.gz" +neutron-bgp-dragent: + type: "url" + location: "$tarballs_base/openstack/neutron-dynamic-routing/neutron-dynamic-routing-${openstack_branch}.tar.gz" +neutron-server-plugin-neutron-dynamic-routing: + type: "url" + location: "$tarballs_base/openstack/neutron-dynamic-routing/neutron-dynamic-routing-${openstack_branch}.tar.gz" +neutron-vpnaas-agent: + type: "url" + location: "$tarballs_base/openstack/neutron-vpnaas/neutron-vpnaas-${openstack_branch}.tar.gz" +nova-base: + type: "url" + location: "$tarballs_base/openstack/nova/nova-${openstack_branch}.tar.gz" +nova-base-plugin-blazar: + type: "url" + location: "$tarballs_base/openstack/blazar-nova/blazar-nova-${openstack_branch}.tar.gz" +octavia-base: + type: "url" + location: "$tarballs_base/openstack/octavia/octavia-${openstack_branch}.tar.gz" +octavia-api-plugin-ovn-octavia-provider: + type: "url" + location: "$tarballs_base/openstack/ovn-octavia-provider/ovn-octavia-provider-${openstack_branch}.tar.gz" +octavia-driver-agent-plugin-ovn-octavia-provider: + type: "url" + location: "$tarballs_base/openstack/ovn-octavia-provider/ovn-octavia-provider-${openstack_branch}.tar.gz" +placement-base: + type: "url" + location: "$tarballs_base/openstack/placement/placement-${openstack_branch}.tar.gz" +prometheus-alertmanager: + version: "0.34.1" + type: "url" + sha256: + amd64: "265b9d1e55ef0d5306a436018af6d2b686c2ce051f03d968f7464ecb1372a7e8" + arm64: "d98d6cbaf52151c7e76e24355fec88b11cebcb9875d4cdd8b76ddce7a7e5535c" + location: "https://github.com/prometheus/alertmanager/releases/download/v${version}/alertmanager-${version}.linux-${debian_arch}.tar.gz" +prometheus-blackbox-exporter: + version: "0.28.0" + type: "url" + sha256: + amd64: "caf5d242fb1cf6d5cb678f3f799f22703d4fafea26b03dcbbd7e1f1825e06329" + arm64: "63312be0983d85e5109710a7dc93df3051157ae581853fa3655d171cc1b2806e" + location: "https://github.com/prometheus/blackbox_exporter/releases/download/v${version}/blackbox_exporter-${version}.linux-${debian_arch}.tar.gz" +prometheus-cadvisor: + version: "0.60.6" + type: "url" + sha256: + amd64: "c381c2c911bc43d465d1e0eaff60f96d58c031c409bddf06da0316fdde8a9296" + arm64: "d788162d9deea8aa024fd79a0a685df90a987362d8f0e580f822474c1fbef7f9" + location: "https://github.com/google/cadvisor/releases/download/v${version}/cadvisor-v${version}-linux-${debian_arch}" +prometheus-elasticsearch-exporter: + version: "1.11.0" + type: "url" + sha256: + amd64: "2bebc50d6980578ad37a376000bc039485ceea129ae229f78baed3379db4f61c" + arm64: "7020d10e29896d329cecc7bfe2e90dcc376d68fc0c75ac27014af3747870ce1f" + location: "https://github.com/prometheus-community/elasticsearch_exporter/releases/download/v${version}/elasticsearch_exporter-${version}.linux-${debian_arch}.tar.gz" +prometheus-libvirt-exporter: + version: "2.6.0" + type: "url" + sha256: + amd64: "1820ace3d38feebaf35ef2823ada1e95b538a080074c3f362caf39a7d3e39e91" + arm64: "b8d3bfbe590d1f2db4faac48984d5b2bcf2cfa525c39f9a8d307912220307550" + location: "https://github.com/inovex/prometheus-libvirt-exporter/releases/download/v${version}/prometheus-libvirt-exporter-${version}.linux-${debian_arch}.tar.gz" +prometheus-memcached-exporter: + version: "0.17.0" + type: "url" + sha256: + amd64: "40e85262e4340a56fa7cc96722cd596d25ed76ab501459b0b42f1f8e0562d0d1" + arm64: "d1abf0ef1196ff5de5cf3462eb962b4a3d6733327951ae6d81c062902b5f2a60" + location: "https://github.com/prometheus/memcached_exporter/releases/download/v${version}/memcached_exporter-${version}.linux-${debian_arch}.tar.gz" +prometheus-mtail: + version: "3.4.14" + type: "url" + sha256: + amd64: "a01c7713d97c8725067e3f6cf2a5dccccb7aee62c8af57ffcff3a658f48b1b29" + arm64: "05c484b6a03510f8e6dfffccfe43453e71d357168c157342448e174f3263ca22" + location: "https://github.com/jaqx0r/mtail/releases/download/v${version}/mtail_${version}_linux_${debian_arch}.tar.gz" +prometheus-mysqld-exporter: + version: "0.20.0" + type: "url" + sha256: + amd64: "5773496e9962ca3817b3599fe4d74f218c95c1295eb2a742462df8e035fe51bd" + arm64: "837804c0a59cbe1f3ab46670dec1b4c37940c8d48062374691b27f1f37abf8dd" + location: "https://github.com/prometheus/mysqld_exporter/releases/download/v${version}/mysqld_exporter-${version}.linux-${debian_arch}.tar.gz" +prometheus-node-exporter: + version: "1.12.1" + type: "url" + sha256: + amd64: "b51d8a76aa2a9156a55d501aca6276fae09e262259a5e4e831d2c2222f084e63" + arm64: "ad35b605f9954b9f1ffddf5ba054bdc5a98d790b9eae5291e1eeb83f1ecbd0e7" + location: "https://github.com/prometheus/node_exporter/releases/download/v${version}/node_exporter-${version}.linux-${debian_arch}.tar.gz" +prometheus-openstack-exporter: + version: "1.7.0" + type: "url" + sha256: + amd64: "dfaa0d3dcff22e882d3f61c56bb9ac6f70790df9d67361464159bbb4c7223192" + arm64: "d6e0b23fe755732a93796255e3a2be8ec5a699b0a64c21afd377c60ccf60cd55" + location: "https://github.com/openstack-exporter/openstack-exporter/releases/download/v${version}/openstack-exporter_${version}_linux_${debian_arch}.tar.gz" +prometheus-openstack-network-exporter: + version: "0.3.0" + type: "url" + sha256: + amd64: "bca401a6854bdc350578ff9e3477b4c54527c3f677d7549191e2523f1d03605d" + arm64: "06640f01fd088068f2552e702b624d4b9f2441d532409f8be7d94206fc18b9c0" + location: "https://github.com/openstack-k8s-operators/openstack-network-exporter/releases/download/v${version}/openstack-network-exporter-linux-${debian_arch}" +prometheus-server: + # NOTE(mnasiadka): lts_branch pins check_sources.py to the 3.13.x + # release series instead of jumping to the latest major.minor. + lts_branch: "3.13" + version: "3.13.3" + type: "url" + sha256: + amd64: "b349c732d8a853e657d0e7ae1bbad4d11b586615fb65fdc59d896b9f869c001e" + arm64: "aa9be9c36608e7ab7cc089726195d0e4fa74f87b330538df9d30d3da1f2b0e18" + location: "https://github.com/prometheus/prometheus/releases/download/v${version}/prometheus-${version}.linux-${debian_arch}.tar.gz" +prometheus-valkey-exporter: + version: "1.92.1" + type: "url" + sha256: + amd64: "60e9819172ec1c954bad9b44ba0b15ef064e8551bd74461d0ed1a7585bb2c6ad" + arm64: "9aecfb030b173516266773e7d88256bedf414e6a552afc385cbb1ecd49f26832" + location: "https://github.com/oliver006/redis_exporter/releases/download/v${version}/redis_exporter-v${version}.linux-${debian_arch}.tar.gz" +skyline-apiserver: + type: "url" + location: "$tarballs_base/openstack/skyline-apiserver/skyline-apiserver-${openstack_branch}.tar.gz" +skyline-console: + type: "url" + location: "$tarballs_base/openstack/skyline-console/skyline-console-${openstack_branch}.tar.gz" +tacker-base: + type: "url" + location: "$tarballs_base/openstack/tacker/tacker-${openstack_branch}.tar.gz" +tacker-base-plugin-networking-sfc: + type: "url" + location: "$tarballs_base/openstack/networking-sfc/networking-sfc-${openstack_branch}.tar.gz" +trove-base: + type: "url" + location: "$tarballs_base/openstack/trove/trove-${openstack_branch}.tar.gz" +watcher-base: + type: "url" + location: "$tarballs_base/openstack/watcher/watcher-${openstack_branch}.tar.gz" diff --git a/kolla/docker/base/Dockerfile.j2 b/kolla/docker/base/Dockerfile.j2 index 60419f41d..c1f07ade6 100644 --- a/kolla/docker/base/Dockerfile.j2 +++ b/kolla/docker/base/Dockerfile.j2 @@ -58,12 +58,12 @@ COPY dnf.conf /etc/dnf/dnf.conf {% set base_yum_repo_keys = [ ] %} -{% block base_centos_repo_overrides_post_copy %}{% endblock %} +{% block base_rocky_repo_overrides_post_copy %}{% endblock %} # Install what is needed for en_US.UTF-8 -{% block base_centos_distro_sync_and_languages %} +{% block base_rocky_distro_sync_and_languages %} -{% set base_centos_language_packages = [ +{% set base_rocky_language_packages = [ 'langpacks-en', 'glibc-all-langpacks' ] %} @@ -71,7 +71,7 @@ COPY dnf.conf /etc/dnf/dnf.conf # NOTE(hrw): this macro file drops all languages other than C.UTF-8 so horizon fails # https://bugzilla.redhat.com/show_bug.cgi?id=1729770 RUN rm -f /etc/rpm/macros.image-language-conf \ - && {{ macros.install_packages(base_centos_language_packages | customizable("centos_language_packages"), chain=True, clean=False) }} \ + && {{ macros.install_packages(base_rocky_language_packages | customizable("rocky_language_packages"), chain=True, clean=False) }} \ && {{ macros.rpm_security_update(clean_package_cache) }} {% endblock %} @@ -88,29 +88,29 @@ RUN rm -f /etc/rpm/macros.image-language-conf \ {{ cmd }} {% endfor %} -{% block base_centos_repo_overrides_post_rpm %}{% endblock %} +{% block base_rocky_repo_overrides_post_rpm %}{% endblock %} -{% block base_centos_gpg_key_import %} +{% block base_rocky_gpg_key_import %} {% endblock %} -{% set base_centos_yum_repo_keys = [ +{% set base_rocky_yum_repo_keys = [ ] %} -{% set base_centos_yum_repo_packages = [ +{% set base_rocky_yum_repo_packages = [ 'centos-release-ceph-squid', 'centos-release-nfv-openvswitch', 'epel-release', ] %} # We need 'dnf-plugins-core' for 'dnf config-manager' -{% set base_centos_yum_repo_packages = base_centos_yum_repo_packages + [ +{% set base_rocky_yum_repo_packages = base_rocky_yum_repo_packages + [ 'dnf-plugins-core' ] %} -RUN {{ macros.install_packages(base_centos_yum_repo_packages | customizable("centos_yum_repo_packages"), chain=True, clean=False) }} +RUN {{ macros.install_packages(base_rocky_yum_repo_packages | customizable("rocky_yum_repo_packages"), chain=True, clean=False) }} -{%- for key in base_centos_yum_repo_keys | customizable('centos_yum_repo_keys') %} && rpm --import {{ key }} {% endfor %} \ -{% block base_centos_repo_overrides_post_yum %}{% endblock -%} +{%- for key in base_rocky_yum_repo_keys | customizable('rocky_yum_repo_keys') %} && rpm --import {{ key }} {% endfor %} \ +{% block base_rocky_repo_overrides_post_yum %}{% endblock -%} && {{ macros.rpm_security_update(clean_package_cache) }} #### END REPO ENABLEMENT @@ -120,8 +120,7 @@ RUN {{ macros.install_packages(base_centos_yum_repo_packages | customizable("cen {% block base_redhat_binary_versionlock %}{% endblock %} -{# NOTE(hrw): CentOS Stream 9 has curl-minimal, Rocky Linux 9 has curl so we do not install any #} -{% set base_centos_packages = [ +{% set base_rocky_packages = [ 'ca-certificates', 'crypto-policies-scripts', 'dumb-init', @@ -148,7 +147,7 @@ RUN {{ macros.install_packages(base_centos_yum_repo_packages | customizable("cen # Install base packages {{ macros.enable_extra_repos(['epel']) }} -{{ macros.install_packages(base_centos_packages | customizable("centos_packages") | customizable("centos_binary_packages") | customizable("centos_source_packages")) }} +{{ macros.install_packages(base_rocky_packages | customizable("rocky_packages")) }} {# endif for base_package_type rpm #} {% elif base_package_type == 'deb' %} @@ -302,11 +301,6 @@ RUN apt-get --error-on=any update \ {%- if not loop.last %} \{% endif -%} {%- endfor %} -{% if base_distro == 'centos' %} -RUN sed -ri '/-session(\s+)optional(\s+)pam_systemd.so/d' /etc/pam.d/system-auth \ - && sed -ri '/^[^#]/ s/systemd//g' /etc/nsswitch.conf -{% endif %} - COPY set_configs.py /usr/local/bin/kolla_set_configs COPY start.sh /usr/local/bin/kolla_start COPY copy_cacerts.sh /usr/local/bin/kolla_copy_cacerts diff --git a/kolla/docker/base/ci-centos.repo b/kolla/docker/base/ci-centos.repo deleted file mode 100644 index 4c08f1fea..000000000 --- a/kolla/docker/base/ci-centos.repo +++ /dev/null @@ -1,75 +0,0 @@ -[baseos] -name=(OpenDev mirror) CentOS Stream $releasever - BaseOS -baseurl=http://MIRROR/centos-stream/$stream/BaseOS/$basearch/os/ -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial -gpgcheck=1 -repo_gpgcheck=0 -enabled=1 - -[appstream] -name=(OpenDev mirror) CentOS Stream $releasever - AppStream -baseurl=http://MIRROR/centos-stream/$stream/AppStream/$basearch/os/ -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial -gpgcheck=1 -repo_gpgcheck=0 -enabled=1 - -[extras-common] -name=(OpenDev mirror) CentOS Stream $releasever - Extras packages -baseurl=http://MIRROR/centos-stream/SIGs/$stream/extras/$basearch/extras-common/ -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Extras-SHA512 -gpgcheck=1 -repo_gpgcheck=0 -enabled=1 - -[crb] -name=(OpenDev mirror) CentOS Stream $releasever - CRB -baseurl=http://MIRROR/centos-stream/$stream/CRB/$basearch/os/ -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial -gpgcheck=1 -repo_gpgcheck=0 -enabled=0 - -[highavailability] -name=(OpenDev mirror) CentOS Stream $releasever - HighAvailability -baseurl=http://MIRROR/centos-stream/$stream/HighAvailability/$basearch/os/ -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial -gpgcheck=1 -repo_gpgcheck=0 -enabled=0 - -[centos-ceph-reef] -name=(OpenDev mirror) CentOS-$stream - Ceph Reef -baseurl=http://MIRROR/centos-stream/SIGs/$stream/storage/$basearch/ceph-reef/ -gpgcheck=1 -enabled=0 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Storage - -[centos-nfv-openvswitch] -name=(OpenDev mirror) CentOS Stream $releasever - NFV OpenvSwitch -baseurl=http://MIRROR/centos-stream/SIGs/$stream/nfv/$basearch/openvswitch-2/ -gpgcheck=1 -enabled=0 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-NFV -module_hotfixes=1 - -[centos-opstools] -name=(OpenDev mirror) CentOS Stream $releasever - OpsTools - collectd -baseurl=http://MIRROR/centos-stream/SIGs/$stream/opstools/$basearch/collectd-5/ -gpgcheck=1 -enabled=0 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-OpsTools - -[centos-rabbitmq-38] -name=(OpenDev mirror) CentOS-9 - RabbitMQ 38 -baseurl=http://MIRROR/centos-stream/SIGs/$stream/messaging/$basearch/rabbitmq-38 -gpgcheck=1 -enabled=0 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Messaging - -[epel] -name=(OpenDev mirror) Extra Packages for Enterprise Linux $releasever - $basearch -baseurl=http://MIRROR/epel/$releasever/Everything/$basearch/ -enabled=0 -gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$releasever diff --git a/kolla/docker/grafana/Dockerfile.j2 b/kolla/docker/grafana/Dockerfile.j2 index 971994baf..a3a2210e5 100644 --- a/kolla/docker/grafana/Dockerfile.j2 +++ b/kolla/docker/grafana/Dockerfile.j2 @@ -24,11 +24,14 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start {% block grafana_plugins_install %} -{% set grafana_default_plugins = ['grafana-opensearch-datasource'] %} +{% set grafana_default_plugins = [ + 'grafana-opensearch-datasource', + 'prometheus' +] %} {% set grafana_plugins = grafana_default_plugins | customizable("plugins") %} {% if grafana_plugins | length > 0 %} -RUN {{ (['grafana-cli plugins install %s'] * grafana_plugins | length ) | join(' && ') | format(*grafana_plugins) }} +RUN {{ (['grafana cli plugins install %s'] * grafana_plugins | length ) | join(' && ') | format(*grafana_plugins) }} {% endif %} {% endblock %} diff --git a/kolla/docker/httpd/httpd_setup.sh b/kolla/docker/httpd/httpd_setup.sh index 35f7b5b1e..5188c5518 100644 --- a/kolla/docker/httpd/httpd_setup.sh +++ b/kolla/docker/httpd/httpd_setup.sh @@ -17,7 +17,7 @@ if [[ "$(whoami)" == 'root' ]]; then rm -rf /var/run/apache2/* else rm -rf /var/run/httpd/* /run/httpd/* /tmp/httpd* - # NOTE(mmalchuk): This added to make Rocky/Centos similar to Ubuntu/Debian + # NOTE(mmalchuk): This added to make Rocky similar to Ubuntu/Debian # to provide /server-status handler for local monitoring of the Apache. # The module already loaded in the /etc/httpd/conf.modules.d/00-base.conf. cat << EOF >/etc/httpd/conf.modules.d/99-server-status.conf @@ -28,13 +28,13 @@ if [[ "$(whoami)" == 'root' ]]; then EOF fi - # CentOS/Rocky have an issue with mod_ssl which produces an invalid Apache + # Rocky have an issue with mod_ssl which produces an invalid Apache # configuration in /etc/httpd/conf.d/ssl.conf. This causes the following error # on startup: # SSLCertificateFile: file '/etc/pki/tls/certs/localhost.crt' does not exist or is empty # Work around this by generating certificates manually. # NOTE(mnasiadka): in EL9 upgrade jobs gencerts is failing on wrong permissions to dhparams.pem - if [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]] && [[ ! -e /etc/pki/tls/certs/localhost.crt ]]; then + if [[ "${KOLLA_BASE_DISTRO}" =~ rocky ]] && [[ ! -e /etc/pki/tls/certs/localhost.crt ]]; then rm -f /tmp/dhparams.pem /usr/libexec/httpd-ssl-gencerts fi diff --git a/kolla/docker/ironic/ironic-conductor/Dockerfile.j2 b/kolla/docker/ironic/ironic-conductor/Dockerfile.j2 index 7ab9d4d65..cef504ca3 100644 --- a/kolla/docker/ironic/ironic-conductor/Dockerfile.j2 +++ b/kolla/docker/ironic/ironic-conductor/Dockerfile.j2 @@ -25,7 +25,8 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" 'systemd-udev', 'util-linux', 'xfsprogs', - 'xorriso' + 'xorriso', + 'zstd' ] %} {% if base_arch in ['x86_64'] %} {% set ironic_conductor_packages = ironic_conductor_packages + [ @@ -51,6 +52,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" 'syslinux-common', 'udev', 'xfsprogs', + 'zstd' ] %} {% endif %} diff --git a/kolla/docker/ironic/ironic-pxe/extend_start.sh b/kolla/docker/ironic/ironic-pxe/extend_start.sh index 8e4d63307..e6100247d 100644 --- a/kolla/docker/ironic/ironic-pxe/extend_start.sh +++ b/kolla/docker/ironic/ironic-pxe/extend_start.sh @@ -7,7 +7,7 @@ function prepare_pxe_pxelinux { cp /usr/lib/PXELINUX/pxelinux.0 \ /usr/lib/syslinux/modules/bios/{chain.c32,ldlinux.c32} \ ${TFTPBOOT_PATH}/ - elif [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]]; then + elif [[ "${KOLLA_BASE_DISTRO}" =~ rocky ]]; then if [[ "${TFTPBOOT_PATH}" != /tftpboot ]]; then cp /tftpboot/{pxelinux.0,chain.c32,ldlinux.c32} \ ${TFTPBOOT_PATH}/ @@ -20,7 +20,7 @@ function prepare_pxe_grub { if [[ "${KOLLA_BASE_DISTRO}" =~ debian|ubuntu ]]; then shim_src_file="/usr/lib/shim/shim*64.efi.signed" grub_src_file="/usr/lib/grub/*-efi-signed/grubnet*64.efi.signed" - elif [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]]; then + elif [[ "${KOLLA_BASE_DISTRO}" =~ rocky ]]; then shim_src_file="/boot/efi/EFI/${KOLLA_BASE_DISTRO}/shim*64.efi" grub_src_file="/boot/efi/EFI/${KOLLA_BASE_DISTRO}/grub*64.efi" fi @@ -49,7 +49,7 @@ function prepare_ipxe { ln -sf /boot/ipxe-arm64.efi /usr/lib/ipxe/ fi cp /usr/lib/ipxe/{undionly.kpxe,ipxe*.efi,snponly.efi} ${TFTPBOOT_PATH}/ - elif [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]]; then + elif [[ "${KOLLA_BASE_DISTRO}" =~ rocky ]]; then cp /usr/share/ipxe/{undionly.kpxe,ipxe-snponly-x86_64.efi} ${TFTPBOOT_PATH}/ cp /usr/share/ipxe/arm64-efi/snponly.efi ${TFTPBOOT_PATH}/ipxe-snponly-aarch64.efi ln -sf ${TFTPBOOT_PATH}/ipxe-snponly-${KOLLA_BASE_ARCH}.efi ${TFTPBOOT_PATH}/snponly.efi @@ -63,7 +63,7 @@ function prepare_esp_image { if [[ "${KOLLA_BASE_DISTRO}" =~ debian|ubuntu ]]; then shim_src_file="/usr/lib/shim/shim*64.efi.signed" grub_src_file="/usr/lib/grub/*-efi-signed/grubnet*64.efi.signed" - elif [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]]; then + elif [[ "${KOLLA_BASE_DISTRO}" =~ rocky ]]; then shim_src_file="/boot/efi/EFI/${KOLLA_BASE_DISTRO}/shim*64.efi" grub_src_file="/boot/efi/EFI/${KOLLA_BASE_DISTRO}/grub*64.efi" fi diff --git a/kolla/docker/iscsid/Dockerfile.j2 b/kolla/docker/iscsid/Dockerfile.j2 index 49c8fb9fe..d4f41463c 100644 --- a/kolla/docker/iscsid/Dockerfile.j2 +++ b/kolla/docker/iscsid/Dockerfile.j2 @@ -28,7 +28,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" {{ macros.install_packages(iscsid_packages | customizable("packages")) }} COPY extend_start.sh /usr/local/bin/kolla_extend_start -# NOTE(hrw): CentOS Stream 9 lacks initiatorname.iscsi file +# NOTE(hrw): Rocky Linux lacks initiatorname.iscsi file RUN chmod 644 /usr/local/bin/kolla_extend_start \ && rm -f /etc/iscsi/initiatorname.iscsi diff --git a/kolla/docker/keystone/keystone-api/Dockerfile.j2 b/kolla/docker/keystone/keystone-api/Dockerfile.j2 new file mode 100644 index 000000000..df2003f10 --- /dev/null +++ b/kolla/docker/keystone/keystone-api/Dockerfile.j2 @@ -0,0 +1,48 @@ +FROM {{ namespace }}/{{ image_prefix }}keystone-base:{{ tag }} +{% block labels %} +LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" +{% endblock %} + +{% block keystone_header %}{% endblock %} + +{% import "macros.j2" as macros with context %} + +{{ macros.kolla_enable_base_repos() }} + +{% if base_package_type == 'rpm' %} + {% set keystone_packages = [ + 'krb5-devel', + ] %} +{% elif base_package_type == 'deb' %} + {% set keystone_packages = [ + 'libkrb5-dev', + ] %} +{% endif %} +{{ macros.install_packages(keystone_packages | customizable("packages")) }} + +{% set keystone_pip_packages = [ + 'requests-kerberos', +] %} + +RUN {{ macros.install_pip(keystone_pip_packages | customizable("pip_packages")) }} + +ADD plugins-archive / + +{% set keystone_plugins_pip_packages = [ + '/plugins/*', +] %} + +COPY keystone_bootstrap.sh /usr/local/bin/kolla_keystone_bootstrap +COPY extend_start.sh /usr/local/bin/kolla_extend_start + +RUN chmod 644 /usr/local/bin/kolla_extend_start \ + && chmod 755 /usr/local/bin/kolla_keystone_bootstrap \ + && if [ "$(ls /plugins)" ]; then \ + {{ macros.install_pip(keystone_plugins_pip_packages) }}; \ + fi + +{{ macros.kolla_patch_sources() }} + +{% block keystone_footer %}{% endblock %} +{% block footer %}{% endblock %} +{{ macros.kolla_cleanup_repos() }} diff --git a/kolla/docker/keystone/keystone-api/extend_start.sh b/kolla/docker/keystone/keystone-api/extend_start.sh new file mode 100644 index 000000000..b45c94d0d --- /dev/null +++ b/kolla/docker/keystone/keystone-api/extend_start.sh @@ -0,0 +1,46 @@ +#!/bin/bash + +# Create log dir for Keystone logs +KEYSTONE_LOG_DIR="/var/log/kolla/keystone" +if [[ ! -d "${KEYSTONE_LOG_DIR}" ]]; then + mkdir -p ${KEYSTONE_LOG_DIR} +fi +if [[ $(stat -c %U:%G ${KEYSTONE_LOG_DIR}) != "keystone:kolla" ]]; then + chown keystone:kolla ${KEYSTONE_LOG_DIR} +fi +if [ ! -f "${KEYSTONE_LOG_DIR}/keystone.log" ]; then + touch ${KEYSTONE_LOG_DIR}/keystone.log +fi +if [[ $(stat -c %U:%G ${KEYSTONE_LOG_DIR}/keystone.log) != "keystone:keystone" ]]; then + chown keystone:keystone ${KEYSTONE_LOG_DIR}/keystone.log +fi +if [[ $(stat -c %a ${KEYSTONE_LOG_DIR}) != "755" ]]; then + chmod 755 ${KEYSTONE_LOG_DIR} +fi + +EXTRA_KEYSTONE_MANAGE_ARGS=${EXTRA_KEYSTONE_MANAGE_ARGS-} +# Upgrade and exit if KOLLA_UPGRADE variable is set. This catches all cases +# of the KOLLA_UPGRADE variable being set, including empty. +if [[ "${!KOLLA_UPGRADE[@]}" ]]; then + # TODO(duonghq): check doctor result here + # TODO: find reason why doctor failed in gate + # sudo -H -u keystone keystone-manage doctor + sudo -H -u keystone keystone-manage ${EXTRA_KEYSTONE_MANAGE_ARGS} db_sync --expand + sudo -H -u keystone keystone-manage ${EXTRA_KEYSTONE_MANAGE_ARGS} db_sync --migrate + exit 0 +fi + +# Contract database and exit if KOLLA_FINISH_UPGRADE variable is set. +# This catches all cases of the KOLLA_FINISH_UPGRADE variable being set, +# including empty. +if [[ "${!KOLLA_FINISH_UPGRADE[@]}" ]]; then + sudo -H -u keystone keystone-manage ${EXTRA_KEYSTONE_MANAGE_ARGS} db_sync --contract + exit 0 +fi + +# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases +# of the KOLLA_BOOTSTRAP variable being set, including empty. +if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then + sudo -H -u keystone keystone-manage ${EXTRA_KEYSTONE_MANAGE_ARGS} db_sync + exit 0 +fi diff --git a/kolla/docker/keystone/keystone-api/keystone_bootstrap.sh b/kolla/docker/keystone/keystone-api/keystone_bootstrap.sh new file mode 100644 index 000000000..1b04d99b6 --- /dev/null +++ b/kolla/docker/keystone/keystone-api/keystone_bootstrap.sh @@ -0,0 +1,66 @@ +#!/bin/bash + +set -o pipefail + +# NOTE(SamYaple): Kolla needs to wraps `keystone-manage bootstrap` to ensure +# any change is reported correctly for idempotency. This script will exit with +# valid json that can be parsed with information about if the task has failed +# and if anything changed. + +USERNAME=$1 +PASSWORD=$2 +if [ -z "$PASSWORD" ]; then + # Avoid having the password always come in via CLI (which makes + # it show up in things like ara) + PASSWORD="$OS_BOOTSTRAP_PASSWORD" +fi +PROJECT=$3 +ROLE=$4 +if [ $# -ge 8 ]; then + # ignored ADMIN_URL compat mode + # ADMIN_URL=$5 + INTERNAL_URL=$6 + PUBLIC_URL=$7 + REGION=$8 +else + # no ADMIN_URL modern mode + INTERNAL_URL=$5 + PUBLIC_URL=$6 + REGION=$7 +fi + +function fail_json { + echo '{"failed": true, "msg": "'$1'", "changed": true}' + exit 1 +} + +function exit_json { + echo '{"failed": false, "changed": '"${changed}"'}' +} + +changed="false" +# NOTE(mgoddard): pipe through cat -v to remove unprintable control characters +# which prevent JSON decoding. +# NOTE(yoctozepto): also apply sed to escape double quotation marks +# and backslashes +keystone_bootstrap=$(keystone-manage bootstrap --bootstrap-username "${USERNAME}" --bootstrap-password "${PASSWORD}" --bootstrap-project-name "${PROJECT}" --bootstrap-role-name "${ROLE}" --bootstrap-internal-url "${INTERNAL_URL}" --bootstrap-public-url "${PUBLIC_URL}" --bootstrap-service-name "keystone" --bootstrap-region-id "${REGION}" 2>&1 | cat -v | sed 's/\\/\\\\/g' | sed 's/"/\\"/g') +if [[ $? != 0 ]]; then + fail_json "${keystone_bootstrap}" +fi + +changed=$(echo "${keystone_bootstrap}" | awk ' + /Domain default already exists, skipping creation./ || + /Project '"${PROJECT}"' already exists, skipping creation./ || + /User '"${USERNAME}"' already exists, skipping creation./ || + /Role '"${ROLE}"' exists, skipping creation./ || + /User '"${USERNAME}"' already has '"${ROLE}"' on '"${PROJECT}"'./ || + /Region '"${REGION}"' exists, skipping creation./ || + /Skipping internal endpoint as already created/ || + /Skipping public endpoint as already created/ {count++} + END { + if (count == 9) changed="false"; else changed="true" + print changed + }' +) + +exit_json diff --git a/kolla/docker/keystone/keystone-ssh/extend_start.sh b/kolla/docker/keystone/keystone-ssh/extend_start.sh index 559cd65a9..a6418b4d9 100644 --- a/kolla/docker/keystone/keystone-ssh/extend_start.sh +++ b/kolla/docker/keystone/keystone-ssh/extend_start.sh @@ -1,6 +1,6 @@ #!/bin/bash -# NOTE(mnasiadka): CentOS 10 does not support dsa +# NOTE(mnasiadka): Rocky 10 does not support dsa SSH_HOST_KEY_TYPES=( "rsa" "ecdsa" "ed25519" ) for key_type in ${SSH_HOST_KEY_TYPES[@]}; do diff --git a/kolla/docker/letsencrypt/letsencrypt-lego/letsencrypt-certificates.sh b/kolla/docker/letsencrypt/letsencrypt-lego/letsencrypt-certificates.sh index 83bdede87..4c06688e1 100755 --- a/kolla/docker/letsencrypt/letsencrypt-lego/letsencrypt-certificates.sh +++ b/kolla/docker/letsencrypt/letsencrypt-lego/letsencrypt-certificates.sh @@ -24,6 +24,9 @@ function obtain_or_renew_certificate { local hmac="${9}" local key_id="${10}" local letsencrypt_key_type="${11:-}" + local challenge_type="${12:-http-01}" + local dns_provider="${13:-}" + local dns_additional_opts="${14:-}" certificate_domain_opts=$(echo ${certificate_fqdns} | sed -r -e 's/^/,/g' -e 's/,/--domains=/g' -e 's/--/ --/g') certificate_fqdn=$(echo ${certificate_fqdns} | awk -F ',' '{print $1}') @@ -68,17 +71,24 @@ function obtain_or_renew_certificate { fi fi - log_info "[${certificate_fqdn} - cron] Obtaining certificate for domains ${certificate_fqdns}." + if [ "${challenge_type}" = "http-01" ]; then + challenge_opts="--http --http.webroot /etc/letsencrypt/http-01 --http.port ${listen_port}" + elif [ "${challenge_type}" = "dns-01" ]; then + challenge_opts="--dns ${dns_provider} ${dns_additional_opts}" + else + log_error "Unsupported challenge type: ${challenge_type}." + exit 1 + fi + + log_info "[${certificate_fqdn} - cron] Obtaining certificate for domains ${certificate_fqdns} using ${challenge_type} challenge." mapfile -t cmd_output < <(/opt/lego --email="${mail}" \ $( [ -n "${letsencrypt_key_type}" ] && echo "--key-type ${letsencrypt_key_type}" ) \ ${certificate_domain_opts} \ --server "${acme_url}" \ --path "/etc/letsencrypt/lego/${certificate_type}/" \ - --http.webroot "/etc/letsencrypt/http-01" \ - --http.port ${listen_port} \ + ${challenge_opts} \ --cert.timeout ${valid_days} \ --accept-tos \ - --http \ ${eab_opts} \ --pem ${lego_action} \ --${lego_action}-hook="/usr/bin/sync-and-update-certificate --${certificate_type} --fqdn ${certificate_fqdn} --haproxies-ssh ${letsencrypt_ssh_port}" 2>&1) @@ -117,10 +127,14 @@ EXTERNAL_SET="false" EXTERNAL_ACCOUNT_BINDING="false" HMAC="NONE" KEY_ID="NONE" +CHALLENGE_TYPE="http-01" +DNS_PROVIDER="" +DNS_ADDITIONAL_OPTS="" +DNS_ENV_FILE="" LOG_FILE="/var/log/kolla/letsencrypt/lesencrypt-lego.log" -VALID_ARGS=$(getopt -o ief:p:d:m:a:v:h:k: --long internal,external,fqdns:,port:,days:,mail:,acme:,vips:,haproxies-ssh:,eab,kid:,hmac:,key-type: -- "$@") +VALID_ARGS=$(getopt -o ief:p:d:m:a:v:h:k: --long internal,external,fqdns:,port:,days:,mail:,acme:,vips:,haproxies-ssh:,eab,kid:,hmac:,key-type:,challenge:,dns-provider:,dns-additional-opts:,env-file: -- "$@") if [[ $? -ne 0 ]]; then exit 1; fi @@ -182,12 +196,53 @@ while [ : ]; do LETSENCRYPT_KEY_TYPE="${2}" shift 2 ;; + --challenge) + CHALLENGE_TYPE="${2}" + shift 2 + ;; + --dns-provider) + DNS_PROVIDER="${2}" + shift 2 + ;; + --dns-additional-opts) + DNS_ADDITIONAL_OPTS="${2}" + shift 2 + ;; + --env-file) + DNS_ENV_FILE="${2}" + shift 2 + ;; --) shift; break ;; esac done +if [ "${CHALLENGE_TYPE}" = "dns-01" ]; then + if [ "${DNS_PROVIDER}" = "" ]; then + log_error "dns-01 challenge requires --dns-provider." + exit 1 + fi + # lego DNS providers take their credentials from environment variables, + # so the env file must be exported into this process before lego runs. + # The file is parsed like docker --env-file: literal KEY=VALUE pairs, + # split on the first '=', values taken verbatim. It is deliberately not + # sourced, so values containing spaces or shell metacharacters survive + # and nothing in the file is ever executed. + if [ "${DNS_ENV_FILE}" != "" ]; then + if [ ! -r "${DNS_ENV_FILE}" ]; then + log_error "DNS provider environment file ${DNS_ENV_FILE} is not readable." + exit 1 + fi + while IFS='=' read -r env_key env_value || [ -n "${env_key}" ]; do + case "${env_key}" in + ''|\#*) continue ;; + esac + export "${env_key}=${env_value}" + done < "${DNS_ENV_FILE}" + fi +fi + FQDN=$(echo "${FQDNS}" | awk -F ',' '{print $1}') if [ "${INTERNAL_SET}" = "true" ] || [ "${EXTERNAL_SET}" = "true" ]; then @@ -209,12 +264,12 @@ if [ "${INTERNAL_SET}" = "true" ] || [ "${EXTERNAL_SET}" = "true" ]; then log_info "[${FQDN} - cron] This Letsencrypt-lego host is active..." if [ "${LETSENCRYPT_INTERNAL_FQDNS}" != "" ]; then log_info "[${FQDN} - cron] Processing domains ${LETSENCRYPT_INTERNAL_FQDNS}" - obtain_or_renew_certificate ${LETSENCRYPT_INTERNAL_FQDNS} internal ${PORT} ${DAYS} ${ACME} ${MAIL} ${LETSENCRYPT_SSH_PORT} ${EXTERNAL_ACCOUNT_BINDING} ${HMAC} ${KEY_ID} ${LETSENCRYPT_KEY_TYPE} + obtain_or_renew_certificate "${LETSENCRYPT_INTERNAL_FQDNS}" "internal" "${PORT}" "${DAYS}" "${ACME}" "${MAIL}" "${LETSENCRYPT_SSH_PORT}" "${EXTERNAL_ACCOUNT_BINDING}" "${HMAC}" "${KEY_ID}" "${LETSENCRYPT_KEY_TYPE}" "${CHALLENGE_TYPE}" "${DNS_PROVIDER}" "${DNS_ADDITIONAL_OPTS}" fi if [ "${LETSENCRYPT_EXTERNAL_FQDNS}" != "" ]; then log_info "[${FQDN} - cron] Processing domains ${LETSENCRYPT_EXTERNAL_FQDNS}" - obtain_or_renew_certificate ${LETSENCRYPT_EXTERNAL_FQDNS} external ${PORT} ${DAYS} ${ACME} ${MAIL} ${LETSENCRYPT_SSH_PORT} ${EXTERNAL_ACCOUNT_BINDING} ${HMAC} ${KEY_ID} ${LETSENCRYPT_KEY_TYPE} + obtain_or_renew_certificate "${LETSENCRYPT_EXTERNAL_FQDNS}" "external" "${PORT}" "${DAYS}" "${ACME}" "${MAIL}" "${LETSENCRYPT_SSH_PORT}" "${EXTERNAL_ACCOUNT_BINDING}" "${HMAC}" "${KEY_ID}" "${LETSENCRYPT_KEY_TYPE}" "${CHALLENGE_TYPE}" "${DNS_PROVIDER}" "${DNS_ADDITIONAL_OPTS}" fi else log_info "[${FQDN} - cron] This Letsencrypt-lego host is passive, nothing to do..." diff --git a/kolla/docker/mariadb-server/Dockerfile.j2 b/kolla/docker/mariadb-server/Dockerfile.j2 index a9a84bf73..436953e80 100644 --- a/kolla/docker/mariadb-server/Dockerfile.j2 +++ b/kolla/docker/mariadb-server/Dockerfile.j2 @@ -54,12 +54,10 @@ COPY mariadb_sudoers /etc/sudoers.d/kolla_mariadb_sudoers COPY extend_start.sh /usr/local/bin/kolla_extend_start COPY security_reset.expect /usr/local/bin/kolla_security_reset COPY backup.sh /usr/local/bin/kolla_mariadb_backup.sh -COPY backup_replica.sh /usr/local/bin/kolla_mariadb_backup_replica.sh RUN chmod 644 /usr/local/bin/kolla_extend_start \ && chmod 755 /usr/local/bin/kolla_security_reset \ /usr/local/bin/kolla_mariadb_backup.sh \ - /usr/local/bin/kolla_mariadb_backup_replica.sh \ && chmod 750 /etc/sudoers.d \ && chmod 440 /etc/sudoers.d/kolla_mariadb_sudoers \ && rm -rf /var/lib/mysql/* diff --git a/kolla/docker/mariadb-server/backup_replica.sh b/kolla/docker/mariadb-server/backup_replica.sh deleted file mode 100644 index fe10bc61b..000000000 --- a/kolla/docker/mariadb-server/backup_replica.sh +++ /dev/null @@ -1,149 +0,0 @@ -#!/usr/bin/env bash - -set -eu -set -o pipefail - -BACKUP_DIR=/backup/ -DEFAULT_MY_CNF="/etc/mysql/my.cnf" -REPLICA_MY_CNF="$(mktemp)" -RETRY_INTERVAL=5 # Interval between retries (in seconds) -MAX_RETRIES=12 # Max retries (12 retries * 5 seconds = 60 seconds) -VERIFY_DB_SERVER_CERT="${VERIFY_DB_SERVER_CERT:=FALSE}" - -# Cleanup function to remove the REPLICA_MY_CNF file -cleanup() { - rm -f "${REPLICA_MY_CNF}" -} - -# Set trap to ensure cleanup occurs on exit or error -trap cleanup EXIT - -cd "${BACKUP_DIR}" - -# Execute a full backup -backup_full() { - echo "Taking a full backup" - LAST_FULL_DATE=$(date +%d-%m-%Y-%s) - BACKUP_FILE="backup-full-${LAST_FULL_DATE}.mbs.gz" - BACKUP_PATH="${BACKUP_DIR}/full-${LAST_FULL_DATE}" - mkdir -p "${BACKUP_PATH}" - - mariabackup \ - --defaults-file="${REPLICA_MY_CNF}" \ - --backup \ - --stream=mbstream \ - --history="${LAST_FULL_DATE}" \ - | gzip > "${BACKUP_PATH}/${BACKUP_FILE}" - - echo "${BACKUP_PATH}/${BACKUP_FILE}" > "${BACKUP_DIR}/last_full_file" -} - -# Execute an incremental backup -backup_incremental() { - if [ ! -r "${BACKUP_DIR}/last_full_file" ]; then - echo "Error: No full backup file found." - exit 1 - fi - - FULL_BACKUP_FILE=$(cat "${BACKUP_DIR}/last_full_file") - LAST_FULL_DATE=$(basename "$(dirname "${FULL_BACKUP_FILE}")" | sed 's/^full-//') - NOW=$(date +%H-%M-%S-%d-%m-%Y) - INCR_DIR="${BACKUP_DIR}/incr-${NOW}-since-${LAST_FULL_DATE}" - mkdir -p "${INCR_DIR}" - - # Temp dir for full base restore - TMP_BASEDIR=$(mktemp -d) - - echo "Decompressing full backup to temp dir: ${TMP_BASEDIR}" - gunzip -c "${FULL_BACKUP_FILE}" | mbstream -x -C "${TMP_BASEDIR}" - - mariabackup \ - --defaults-file="${REPLICA_MY_CNF}" \ - --backup \ - --stream=mbstream \ - --incremental-basedir="${TMP_BASEDIR}" \ - --history="incr-${NOW}" \ - | gzip > "${INCR_DIR}/backup-incremental-${NOW}.mbs.gz" - - rm -rf "${TMP_BASEDIR}" -} - -# Retry logic for database queries -retry_mysql_query() { - local query="$1" - local result="" - local attempt=1 - - while [ ${attempt} -le ${MAX_RETRIES} ]; do - result=$(mariadb --ssl-verify-server-cert="${VERIFY_DB_SERVER_CERT}" -h "${HOST}" -u "${USER}" -p"${PASS}" -s -N -e "${query}" 2>/dev/null || true) - if [ -n "${result}" ]; then - echo "${result}" - return 0 - fi - echo "Attempt ${attempt}/${MAX_RETRIES} failed. Retrying in ${RETRY_INTERVAL} seconds..." - sleep "${RETRY_INTERVAL}" - attempt=$((attempt + 1)) - done - - echo "Error: Failed to execute the query after ${MAX_RETRIES} attempts." - return 1 -} - -get_and_set_replica_server() { - HOST="$(grep '^host' "${DEFAULT_MY_CNF}" | awk -F '=' '{print $2}' | xargs)" - USER="$(grep '^user' "${DEFAULT_MY_CNF}" | awk -F '=' '{print $2}' | xargs)" - PASS="$(grep '^password' "${DEFAULT_MY_CNF}" | awk -F '=' '{print $2}' | xargs)" - - ALL_HOSTS_SELECT="SELECT REGEXP_REPLACE(VARIABLE_VALUE, ':[0-9]*','') FROM information_schema.GLOBAL_STATUS WHERE VARIABLE_NAME = 'wsrep_incoming_addresses';" - ALL_HOSTS=$(retry_mysql_query "${ALL_HOSTS_SELECT}") - if [ -z "${ALL_HOSTS}" ]; then - echo "Backup failed due to inability to fetch a list of servers." - exit 1 - fi - - ACTIVE_HOST_SELECT='SELECT @@hostname;' - ACTIVE_HOST=$(retry_mysql_query "${ACTIVE_HOST_SELECT}" | xargs getent hosts | awk '{print $1}') - if [ -z "${ACTIVE_HOST}" ]; then - echo "Backup failed due to inability to fetch active host." - exit 1 - fi - - # Multinode - if echo "${ALL_HOSTS}" | grep -q ','; then - for server in $(echo "${ALL_HOSTS}" | tr ',' '\n'); do - if [[ "${server}" != "${ACTIVE_HOST}" ]]; then - REPLICA_HOST="${server}" - break - fi - done - # Single node - else - REPLICA_HOST="${ALL_HOSTS}" - fi - if [ -z "${REPLICA_HOST}" ]; then - echo "Backup failed due to inability to determine replica host." - exit 1 - fi - - cp "${DEFAULT_MY_CNF}" "${REPLICA_MY_CNF}" - sed -i "s/${HOST}/${REPLICA_HOST}/g" "${REPLICA_MY_CNF}" -} - -if [ -n "${BACKUP_TYPE}" ]; then - get_and_set_replica_server - case "${BACKUP_TYPE}" in - "full") - backup_full - ;; - "incremental") - backup_incremental - ;; - *) - echo "Only full or incremental options are supported." - exit 1 - ;; - esac -else - echo "You need to specify either full or incremental backup options." - exit 1 -fi diff --git a/kolla/docker/neutron/neutron-base/extend_start.sh b/kolla/docker/neutron/neutron-base/extend_start.sh index e2a2dfca4..6e6288ffb 100644 --- a/kolla/docker/neutron/neutron-base/extend_start.sh +++ b/kolla/docker/neutron/neutron-base/extend_start.sh @@ -14,7 +14,7 @@ fi # so no need to even use u-a on RHEL 9 family as there is one provider # (and there is no u-a for ip6tables so script fails) -if [[ ! ${KOLLA_BASE_DISTRO} =~ centos|rocky ]]; then +if [[ ! ${KOLLA_BASE_DISTRO} =~ rocky ]]; then if /usr/bin/update-alternatives --display iptables; then # NOTE(yoctozepto): Kolla-Ansible does not always set KOLLA_LEGACY_IPTABLES; # the workaround below ensures it gets set to `false` in such cases to fix diff --git a/kolla/docker/neutron/neutron-l3-agent/extend_start.sh b/kolla/docker/neutron/neutron-l3-agent/extend_start.sh index f95c1eda2..4c7cd345f 100644 --- a/kolla/docker/neutron/neutron-l3-agent/extend_start.sh +++ b/kolla/docker/neutron/neutron-l3-agent/extend_start.sh @@ -12,7 +12,7 @@ fi # nftables framework." # so no need to even use u-a on RHEL 9 family as there is one provider # (and there is no u-a for ip6tables so script fails) -if [[ ! ${KOLLA_BASE_DISTRO} =~ centos|rocky ]]; then +if [[ ! ${KOLLA_BASE_DISTRO} =~ rocky ]]; then if /usr/bin/update-alternatives --display iptables; then # NOTE(yoctozepto): Kolla-Ansible does not always set KOLLA_LEGACY_IPTABLES; # the workaround below ensures it gets set to `false` in such cases to fix diff --git a/kolla/docker/nova/nova-compute/Dockerfile.j2 b/kolla/docker/nova/nova-compute/Dockerfile.j2 index de8d8062d..864222f11 100644 --- a/kolla/docker/nova/nova-compute/Dockerfile.j2 +++ b/kolla/docker/nova/nova-compute/Dockerfile.j2 @@ -38,7 +38,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" 'xfsprogs' ] %} - # NOTE(hrw): daxio is part of pmdk which is x86-64 only in CentOS 8 + # NOTE(hrw): daxio is part of pmdk which is x86-64 only in Rocky {% if base_arch == 'x86_64' %} {% set nova_compute_packages = nova_compute_packages + [ 'daxio' diff --git a/kolla/docker/ovn/ovn-base/Dockerfile.j2 b/kolla/docker/ovn/ovn-base/Dockerfile.j2 index 9ab9f0aa6..96893782a 100644 --- a/kolla/docker/ovn/ovn-base/Dockerfile.j2 +++ b/kolla/docker/ovn/ovn-base/Dockerfile.j2 @@ -10,6 +10,9 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" {{ macros.kolla_enable_base_repos() }} {% if base_package_type == 'rpm' %} + +{{ macros.enable_extra_repos(['openvswitch']) }} + {% set ovn_base_packages = [ 'ovn${KOLLA_RPM_OVN_VERSION}', ] %} diff --git a/kolla/docker/ovn/ovn-controller/Dockerfile.j2 b/kolla/docker/ovn/ovn-controller/Dockerfile.j2 index a04562107..b70db50e6 100644 --- a/kolla/docker/ovn/ovn-controller/Dockerfile.j2 +++ b/kolla/docker/ovn/ovn-controller/Dockerfile.j2 @@ -10,6 +10,9 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" {{ macros.kolla_enable_base_repos() }} {% if base_package_type == 'rpm' %} + +{{ macros.enable_extra_repos(['openvswitch']) }} + {% set ovn_controller_packages = [ 'ovn${KOLLA_RPM_OVN_VERSION}-host' ] %} diff --git a/kolla/docker/ovn/ovn-nb-db-server/Dockerfile.j2 b/kolla/docker/ovn/ovn-nb-db-server/Dockerfile.j2 index 932d7a5d7..472c6e8c9 100644 --- a/kolla/docker/ovn/ovn-nb-db-server/Dockerfile.j2 +++ b/kolla/docker/ovn/ovn-nb-db-server/Dockerfile.j2 @@ -10,6 +10,9 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" {{ macros.kolla_enable_base_repos() }} {% if base_package_type == 'rpm' %} + +{{ macros.enable_extra_repos(['openvswitch']) }} + {% set ovn_nb_db_server_packages = [ 'ovn${KOLLA_RPM_OVN_VERSION}-central', ] %} diff --git a/kolla/docker/ovn/ovn-northd/Dockerfile.j2 b/kolla/docker/ovn/ovn-northd/Dockerfile.j2 index 227584ed4..6a9c1b03f 100644 --- a/kolla/docker/ovn/ovn-northd/Dockerfile.j2 +++ b/kolla/docker/ovn/ovn-northd/Dockerfile.j2 @@ -10,6 +10,9 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" {{ macros.kolla_enable_base_repos() }} {% if base_package_type == 'rpm' %} + +{{ macros.enable_extra_repos(['openvswitch']) }} + {% set ovn_northd_packages = [ 'ovn${KOLLA_RPM_OVN_VERSION}-central', ] %} diff --git a/kolla/docker/ovn/ovn-sb-db-relay/Dockerfile.j2 b/kolla/docker/ovn/ovn-sb-db-relay/Dockerfile.j2 index 1d1761033..667c89afd 100644 --- a/kolla/docker/ovn/ovn-sb-db-relay/Dockerfile.j2 +++ b/kolla/docker/ovn/ovn-sb-db-relay/Dockerfile.j2 @@ -7,12 +7,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" {% import "macros.j2" as macros with context %} -{% block ovn_sb_db_relay_ovn_ctl %} -{# TODO(mnasiadka): Switch to 25.03 branch when available, ideally rpm/deb packages will be - available. #} -RUN curl -o /usr/share/ovn/scripts/ovn-ctl https://raw.githubusercontent.com/ovn-org/ovn/refs/heads/main/utilities/ovn-ctl -{% endblock %} - COPY extend_start.sh /usr/local/bin/kolla_ovn_extend_start RUN chmod 644 /usr/local/bin/kolla_ovn_extend_start diff --git a/kolla/docker/ovn/ovn-sb-db-server/Dockerfile.j2 b/kolla/docker/ovn/ovn-sb-db-server/Dockerfile.j2 index fbef63713..419622389 100644 --- a/kolla/docker/ovn/ovn-sb-db-server/Dockerfile.j2 +++ b/kolla/docker/ovn/ovn-sb-db-server/Dockerfile.j2 @@ -10,6 +10,9 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" {{ macros.kolla_enable_base_repos() }} {% if base_package_type == 'rpm' %} + +{{ macros.enable_extra_repos(['openvswitch']) }} + {% set ovn_sb_db_server_packages = [ 'ovn${KOLLA_RPM_OVN_VERSION}-central', ] %} diff --git a/kolla/docker/ovsdpdk/ovsdpdk/Dockerfile.j2 b/kolla/docker/ovsdpdk/ovsdpdk/Dockerfile.j2 index 0eaf85cf1..fc0b55646 100644 --- a/kolla/docker/ovsdpdk/ovsdpdk/Dockerfile.j2 +++ b/kolla/docker/ovsdpdk/ovsdpdk/Dockerfile.j2 @@ -13,7 +13,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" {% if base_package_type == 'rpm' %} #TODO(sean-k-mooney) create repo via open suse build system to package -# for centos distro. +# for rocky distro. RUN echo 'image not yet available for {{ base_distro }}' \ && /bin/false diff --git a/kolla/image/kolla_worker.py b/kolla/image/kolla_worker.py index acaa08ed0..837bd797c 100644 --- a/kolla/image/kolla_worker.py +++ b/kolla/image/kolla_worker.py @@ -120,7 +120,7 @@ class KollaWorker(object): conf.rpm_setup_config if repo_file is not None]) self.rpm_setup = self.build_rpm_setup(rpm_setup_config) - if self.base in ['centos', 'rocky']: + if self.base == 'rocky': self.distro_package_manager = 'dnf' self.base_package_type = 'rpm' elif self.base in ['debian']: @@ -423,7 +423,7 @@ class KollaWorker(object): if pip_args: lines = content.split('\n') for i, line in enumerate(lines): - if line.startswith('FROM '): + if re.match(r'^FROM\s', line, re.IGNORECASE): lines[i + 1:i + 1] = pip_args break content = '\n'.join(lines) @@ -756,7 +756,8 @@ class KollaWorker(object): image_name = os.path.basename(path) canonical_name = (self.namespace + '/' + self.image_prefix + image_name + ':' + self.tag) - parent_search_pattern = re.compile(r'^FROM.*$', re.MULTILINE) + parent_search_pattern = re.compile(r'^FROM.*$', + re.MULTILINE | re.IGNORECASE) match = re.search(parent_search_pattern, content) if match: parent_name = match.group(0).split(' ')[1] diff --git a/kolla/image/tasks.py b/kolla/image/tasks.py index ba2ade743..87dff5640 100644 --- a/kolla/image/tasks.py +++ b/kolla/image/tasks.py @@ -56,6 +56,12 @@ def normalize_tarinfo(tarinfo): # unchanged. An integer mtime also stops tarfile's PAX writer # emitting per-entry float-mtime extended headers. tarinfo.mtime = 0 + + # Ensure directories are writable. Git repos contain directories + # such as .git/objects/pack/ with mode 0555, which prevents + # non-root users from re-extracting into an existing items_path + # on build retry. + tarinfo.mode |= 0o200 return tarinfo diff --git a/kolla/image/unbuildable.py b/kolla/image/unbuildable.py index 5dbc72094..6d7f4eb5c 100644 --- a/kolla/image/unbuildable.py +++ b/kolla/image/unbuildable.py @@ -19,16 +19,6 @@ UNBUILDABLE_IMAGES = { "bifrost-base", # someone need to get upstream working first }, - # Issues for SHA1 keys: - # https://github.com/grafana/grafana/issues/41036 - 'centos': { - "collectd", # CS10 no opstools repo - "hacluster-pcs", # Missing crmsh package - "nova-spicehtml5proxy", # Missing spicehtml5 package - "ovsdpdk", # Not supported on CentOS - "tgtd", # Not supported on CentOS - }, - 'debian': { }, @@ -36,8 +26,8 @@ UNBUILDABLE_IMAGES = { "collectd", # Missing libpqos.so.4()(64bit) "hacluster-pcs", # Missing crmsh package "nova-spicehtml5proxy", # Missing spicehtml5 package - "ovsdpdk", # Not supported on CentOS - "tgtd", # Not supported on CentOS + "ovsdpdk", # Not supported on Rocky + "tgtd", # Not supported on Rocky }, 'ubuntu': { @@ -45,7 +35,4 @@ UNBUILDABLE_IMAGES = { 'ubuntu+aarch64': { }, - - 'centos+aarch64': { - }, } diff --git a/kolla/template/methods.py b/kolla/template/methods.py index fcef7ae11..461003fa0 100644 --- a/kolla/template/methods.py +++ b/kolla/template/methods.py @@ -161,11 +161,11 @@ def handle_repos(context, reponames, mode): Repo names are distro/arch-agnostic aliases that map to the real repo name and URL for the target platform. So 'ceph' becomes - 'centos-ceph-squid' on CentOS, uses UCA on Ubuntu, and so on. + 'centos-ceph-squid' on Rocky, uses UCA on Ubuntu, and so on. Distro/arch sections are not required to have all entries - missing ones are silently ignored. - NOTE(hrw): we need to handle CentOS, Debian and Ubuntu with one macro. + NOTE(hrw): we need to handle Debian, Rocky and Ubuntu with one macro. """ if not isinstance(reponames, list): diff --git a/kolla/template/repos.yaml b/kolla/template/repos.yaml index 42e0185c4..1ae76d137 100644 --- a/kolla/template/repos.yaml +++ b/kolla/template/repos.yaml @@ -195,24 +195,6 @@ rpm: https://github.com/rabbitmq/signing-keys/releases/download/3.0/rabbitmq-release-signing-key.asc name: "rabbitmq_rabbitmq-server" -centos: - appstream: - distro: True - file_group: "centos.repo" - name: "appstream" - baseos: - distro: True - file_group: "centos.repo" - name: "baseos" - crb: - file_group: "centos.repo" - -centos-aarch64: - erlang: - baseurl: "https://download.copr.fedorainfracloud.org/results/@openstack-kolla/rabbitmq-erlang-27/rhel-$releasever-aarch64/" - gpgkey: "https://download.copr.fedorainfracloud.org/results/@openstack-kolla/rabbitmq-erlang-27/pubkey.gpg" - name: "copr-rabbitmq-erlang" - rocky: appstream: distro: True diff --git a/kolla/tests/test_build.py b/kolla/tests/test_build.py index 21f7fc59c..7d7c58d0f 100644 --- a/kolla/tests/test_build.py +++ b/kolla/tests/test_build.py @@ -820,7 +820,7 @@ class KollaWorkerTest(base.TestCase): self.mock_client = patcher.start() def test_supported_base_distro(self): - build_base = ['centos', 'debian', 'ubuntu'] + build_base = ['debian', 'rocky', 'ubuntu'] for base_distro in build_base: self.conf.set_override('base', base_distro) @@ -962,6 +962,48 @@ class KollaWorkerTest(base.TestCase): self.assertRaises(jinja2.exceptions.SecurityError, kolla.create_dockerfiles) + @mock.patch(engine_client) + def test_create_dockerfiles_pip_args_lowercase_from(self, mock_client): + tmpdir = self.useFixture(fixtures.TempDir()).path + base_dir = os.path.join(tmpdir, 'base') + os.makedirs(base_dir) + with open(os.path.join(base_dir, 'Dockerfile.j2'), 'w') as f: + f.write('from {{ base_distro }}:{{ base_distro_tag }}\n') + self.conf.set_override('pip_index_url', 'https://example.org/simple') + with mock.patch.object(build.KollaWorker, '_get_images_dir', + return_value=tmpdir): + kolla = build.KollaWorker(self.conf) + kolla.setup_working_dir() + kolla.find_dockerfiles() + kolla.create_dockerfiles() + dockerfile = os.path.join(kolla.working_dir, 'base', 'Dockerfile') + with open(dockerfile) as f: + content = f.read() + self.assertIn('ARG PIP_INDEX_URL', content) + + @mock.patch(engine_client) + def test_build_image_list_parent_name_lowercase_from(self, mock_client): + tmpdir = self.useFixture(fixtures.TempDir()).path + base_dir = os.path.join(tmpdir, 'base') + os.makedirs(base_dir) + with open(os.path.join(base_dir, 'Dockerfile.j2'), 'w') as f: + f.write('FROM {{ base_distro }}:{{ base_distro_tag }}\n') + child_dir = os.path.join(tmpdir, 'child') + os.makedirs(child_dir) + with open(os.path.join(child_dir, 'Dockerfile.j2'), 'w') as f: + f.write('from {{ namespace }}/{{ image_prefix }}base:{{ tag }}\n') + with mock.patch.object(build.KollaWorker, '_get_images_dir', + return_value=tmpdir): + kolla = build.KollaWorker(self.conf) + kolla.setup_working_dir() + kolla.find_dockerfiles() + kolla.create_dockerfiles() + kolla.build_image_list() + expected_parent = '{}/{}base:{}'.format( + kolla.namespace, kolla.image_prefix, kolla.tag) + child = [i for i in kolla.images if i.name == 'child'][0] + self.assertEqual(expected_parent, child.parent_name) + def _get_matched_images(self, images): return [image for image in images if image.status == utils.Status.MATCHED] diff --git a/kolla/tests/test_methods.py b/kolla/tests/test_methods.py index 1e30f1f9b..9b5dd212a 100644 --- a/kolla/tests/test_methods.py +++ b/kolla/tests/test_methods.py @@ -27,10 +27,10 @@ class MethodsTest(base.TestCase): expectCmd = 'apt-get -y install --no-install-recommends package2.deb' self.assertEqual(expectCmd, result.split("&&")[1].strip()) - def test_enable_repos_centos_baseurl(self): + def test_enable_repos_rocky_baseurl(self): template_vars = { 'base_arch': 'x86_64', - 'base_distro': 'centos', + 'base_distro': 'rocky', 'base_package_type': 'rpm', } @@ -49,10 +49,10 @@ class MethodsTest(base.TestCase): expectCmd += ">>/etc/yum.repos.d/grafana.repo" self.assertEqual(expectCmd, result) - def test_enable_repos_centos_ceph_distro(self): + def test_enable_repos_rocky_ceph_distro(self): template_vars = { 'base_arch': 'x86_64', - 'base_distro': 'centos', + 'base_distro': 'rocky', 'base_package_type': 'rpm', } @@ -60,10 +60,10 @@ class MethodsTest(base.TestCase): expectCmd = "RUN dnf config-manager --enable centos-ceph-squid || true" self.assertEqual(expectCmd, result) - def test_enable_repos_centos_arch(self): + def test_enable_repos_rocky_arch(self): template_vars = { "base_arch": "aarch64", - "base_distro": "centos", + "base_distro": "rocky", "base_package_type": "rpm", } @@ -82,10 +82,10 @@ class MethodsTest(base.TestCase): expectCmd += ">>/etc/yum.repos.d/grafana.repo" self.assertEqual(expectCmd, result) - def test_enable_repos_centos_multiple(self): + def test_enable_repos_rocky_multiple(self): template_vars = { "base_arch": "x86_64", - "base_distro": "centos", + "base_distro": "rocky", "base_package_type": "rpm", } @@ -122,10 +122,10 @@ class MethodsTest(base.TestCase): expectCmd += ">>/etc/yum.repos.d/rabbitmq.repo" self.assertEqual(expectCmd, result) - def test_enable_repos_centos_distro_enable(self): + def test_enable_repos_rocky_distro_enable(self): template_vars = { "base_arch": "x86_64", - "base_distro": "centos", + "base_distro": "rocky", "base_package_type": "rpm", } @@ -134,10 +134,10 @@ class MethodsTest(base.TestCase): expectCmd = "RUN dnf config-manager --enable crb || true" self.assertEqual(expectCmd, result) - def test_enable_repos_centos_distro_disable(self): + def test_enable_repos_rocky_distro_disable(self): template_vars = { "base_arch": "x86_64", - "base_distro": "centos", + "base_distro": "rocky", "base_package_type": "rpm", } @@ -145,10 +145,10 @@ class MethodsTest(base.TestCase): expectCmd = "RUN dnf config-manager --disable crb || true" self.assertEqual(expectCmd, result) - def test_enable_repos_centos_distro_enable_multiple(self): + def test_enable_repos_rocky_distro_enable_multiple(self): template_vars = { "base_arch": "x86_64", - "base_distro": "centos", + "base_distro": "rocky", "base_package_type": "rpm", } @@ -316,17 +316,28 @@ class MethodsTest(base.TestCase): 'Signed-By: /usr/share/keyrings/test.gpg', result) def test_repos_yaml_merge_keeps_default_repos(self): - repos = {'rocky': {'baseos': { - 'name': 'baseos', - 'baseurl': 'http://mirror.example.com/rocky/10/BaseOS/$basearch/', - 'gpgkey': 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-10', - }}} + mirror_url = ("http://mirror.example.com/rocky/10/{component}/" + "$basearch/") + repos = {'rocky': { + 'appstream': { + 'name': 'appstream', + 'baseurl': mirror_url.format(component='AppStream'), + 'gpgkey': 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-10'}, + 'baseos': { + 'name': 'baseos', + 'baseurl': mirror_url.format(component='BaseOS'), + 'gpgkey': 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-10'}, + 'crb': { + 'name': 'crb', + 'baseurl': mirror_url.format(component='CRB'), + 'gpgkey': 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-10'}, + }} with tempfile.NamedTemporaryFile(mode='w', suffix='.yaml') as f: yaml.dump(repos, f) f.flush() template_vars = { 'base_arch': 'x86_64', - 'base_distro': 'centos', + 'base_distro': 'rocky', 'base_package_type': 'rpm', 'repos_yaml': f.name, } @@ -375,7 +386,7 @@ class MethodsTest(base.TestCase): f.flush() template_vars = { 'base_arch': 'x86_64', - 'base_distro': 'centos', + 'base_distro': 'rocky', 'base_package_type': 'rpm', 'repos_yaml': f.name, } @@ -392,7 +403,7 @@ class MethodsTest(base.TestCase): f.flush() template_vars = { 'base_arch': 'x86_64', - 'base_distro': 'centos', + 'base_distro': 'rocky', 'base_package_type': 'rpm', 'repos_yaml': f.name, } @@ -778,7 +789,7 @@ class MethodsTest(base.TestCase): The more-specific distro section must not merge distro:True back on top of a URL-bearing override from the generic 'rpm' section. """ - base = 'http://mirror.example.com/centos/10' + base = 'http://mirror.example.com/rocky/10' gpgkey = 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial' repos = {'rpm': { 'baseos': { @@ -802,7 +813,7 @@ class MethodsTest(base.TestCase): f.flush() template_vars = { 'base_arch': 'x86_64', - 'base_distro': 'centos', + 'base_distro': 'rocky', 'base_package_type': 'rpm', 'repos_yaml': f.name, } diff --git a/lint-requirements.txt b/lint-requirements.txt index 41f6c792e..e88fa52c4 100644 --- a/lint-requirements.txt +++ b/lint-requirements.txt @@ -1 +1 @@ -ansible-lint===26.8.0 # MIT +ansible-lint===26.9.0 # MIT diff --git a/releasenotes/notes/bug-2163314-d99dd8d0f7a76a95.yaml b/releasenotes/notes/bug-2163314-d99dd8d0f7a76a95.yaml new file mode 100644 index 000000000..0683c8ced --- /dev/null +++ b/releasenotes/notes/bug-2163314-d99dd8d0f7a76a95.yaml @@ -0,0 +1,6 @@ +--- +fixes: + - | + Fixes child image builds from ``openvswitch-base`` with a custom + OpenvSwitch repo. + `LP#2163314 <https://launchpad.net/bugs/2163314>`__ diff --git a/releasenotes/notes/bug-2165921-a70d2839ab32f423.yaml b/releasenotes/notes/bug-2165921-a70d2839ab32f423.yaml new file mode 100644 index 000000000..91f900ec4 --- /dev/null +++ b/releasenotes/notes/bug-2165921-a70d2839ab32f423.yaml @@ -0,0 +1,7 @@ +--- +fixes: + - | + Install the Prometheus datasource plugin for Grafana 13.2+. + Grafana 13.2 moved Prometheus to a standalone plugin, which + is not automatically installed in offline environments. + `LP#2165921 <https://launchpad.net/bugs/2165921>`__ diff --git a/releasenotes/notes/bug-2166075-ea3b86dd40834b08.yaml b/releasenotes/notes/bug-2166075-ea3b86dd40834b08.yaml new file mode 100644 index 000000000..62dda913c --- /dev/null +++ b/releasenotes/notes/bug-2166075-ea3b86dd40834b08.yaml @@ -0,0 +1,5 @@ +--- +fixes: + - | + Replace deprecated ``grafana-cli`` with ``grafana cli``. + `LP#2166075 <https://launchpad.net/bugs/2166075>`__ diff --git a/releasenotes/notes/bug-2167459-3dbfafe10ea28fdc.yaml b/releasenotes/notes/bug-2167459-3dbfafe10ea28fdc.yaml new file mode 100644 index 000000000..ca6ba4080 --- /dev/null +++ b/releasenotes/notes/bug-2167459-3dbfafe10ea28fdc.yaml @@ -0,0 +1,5 @@ +--- +fixes: + - | + Fixes ironic-conductor failing to decompress zstd + compressed files. `LP#2167459 <https://launchpad.net/bugs/2167459>_` diff --git a/releasenotes/notes/deprecate-keystone-container-87d598bc05bc8ee5.yaml b/releasenotes/notes/deprecate-keystone-container-87d598bc05bc8ee5.yaml new file mode 100644 index 000000000..de925e0c6 --- /dev/null +++ b/releasenotes/notes/deprecate-keystone-container-87d598bc05bc8ee5.yaml @@ -0,0 +1,5 @@ +--- +deprecations: + - | + ``keystone`` container image has been deprecated in favor of newly + introduced (and identical) ``keystone-api`` container image. diff --git a/releasenotes/notes/drop-centos10-c53c4eee6f8253d0.yaml b/releasenotes/notes/drop-centos10-c53c4eee6f8253d0.yaml new file mode 100644 index 000000000..69cd340e1 --- /dev/null +++ b/releasenotes/notes/drop-centos10-c53c4eee6f8253d0.yaml @@ -0,0 +1,6 @@ +--- +upgrade: + - | + Support for ``CentOS Stream 10`` has been dropped. Users using + ``base_centos_*`` override blocks should adapt them to + ``base_rocky_*``. diff --git a/releasenotes/notes/letsencrypt-dns01-challenge-432b5122dc832f4a.yaml b/releasenotes/notes/letsencrypt-dns01-challenge-432b5122dc832f4a.yaml new file mode 100644 index 000000000..0b35c17ca --- /dev/null +++ b/releasenotes/notes/letsencrypt-dns01-challenge-432b5122dc832f4a.yaml @@ -0,0 +1,14 @@ +--- +features: + - | + The ``letsencrypt-lego`` image now supports the ACME ``dns-01`` challenge + in addition to the existing ``http-01`` challenge. The + ``letsencrypt-certificates`` script accepts a new ``--challenge`` option + (defaulting to ``http-01``) and, when ``dns-01`` is selected, a + ``--dns-provider`` option naming any DNS provider supported by the bundled + ``lego`` binary. An optional ``--dns-additional-opts`` passthrough allows + forwarding extra ``lego`` DNS flags (such as ``--dns.resolvers`` or + ``--dns.propagation-disable-ans``) for environments where the default + authoritative name server propagation check cannot be performed. The + default behaviour is unchanged: without ``--challenge`` the ``http-01`` + challenge is used exactly as before. diff --git a/releasenotes/notes/prometheus-server-3.13LTS-b33f7bc56ed9cd44.yaml b/releasenotes/notes/prometheus-server-3.13LTS-b33f7bc56ed9cd44.yaml new file mode 100644 index 000000000..5dcd22e29 --- /dev/null +++ b/releasenotes/notes/prometheus-server-3.13LTS-b33f7bc56ed9cd44.yaml @@ -0,0 +1,4 @@ +--- +upgrade: + - | + Update Prometheus server to latest LTS release (3.5.x -> 3.13.x). diff --git a/releasenotes/notes/update-external-components-419631c0a728a61e.yaml b/releasenotes/notes/update-external-components-419631c0a728a61e.yaml new file mode 100644 index 000000000..baff1d3e6 --- /dev/null +++ b/releasenotes/notes/update-external-components-419631c0a728a61e.yaml @@ -0,0 +1,7 @@ +--- +upgrade: + - | + ``prometheus-mtail`` has been updated from ``3.4.13`` to ``3.4.14``. + - | + ``prometheus-valkey-exporter`` has been updated from ``1.92.0`` to + ``1.92.1``. diff --git a/releasenotes/notes/update-external-components-55c57492253a6d19.yaml b/releasenotes/notes/update-external-components-55c57492253a6d19.yaml new file mode 100644 index 000000000..e78d660cc --- /dev/null +++ b/releasenotes/notes/update-external-components-55c57492253a6d19.yaml @@ -0,0 +1,16 @@ +--- +upgrade: + - | + ``etcd`` has been updated from ``3.6.14`` to ``3.6.15``. + - | + ``prometheus-alertmanager`` has been updated from ``0.34.0`` to ``0.34.1``. + - | + ``prometheus-cadvisor`` has been updated from ``0.60.5`` to ``0.60.6``. + - | + ``prometheus-libvirt-exporter`` has been updated from ``2.5.0`` to + ``2.6.0``. + - | + ``prometheus-mtail`` has been updated from ``3.4.12`` to ``3.4.13``. + - | + ``prometheus-valkey-exporter`` has been updated from ``1.91.1`` to + ``1.92.0``. diff --git a/releasenotes/notes/update-external-components-625902310f4f5536.yaml b/releasenotes/notes/update-external-components-625902310f4f5536.yaml new file mode 100644 index 000000000..bf69959f5 --- /dev/null +++ b/releasenotes/notes/update-external-components-625902310f4f5536.yaml @@ -0,0 +1,9 @@ +--- +upgrade: + - | + ``letsencrypt-lego`` has been updated from ``5.4.0`` to ``5.4.1``. + - | + ``prometheus-mtail`` has been updated from ``3.4.9`` to ``3.4.10``. + - | + ``prometheus-valkey-exporter`` has been updated from ``1.89.0`` to + ``1.90.0``. diff --git a/releasenotes/notes/update-external-components-7ad94672447b4901.yaml b/releasenotes/notes/update-external-components-7ad94672447b4901.yaml new file mode 100644 index 000000000..c6bace2f9 --- /dev/null +++ b/releasenotes/notes/update-external-components-7ad94672447b4901.yaml @@ -0,0 +1,35 @@ +--- +upgrade: + - | + ``etcd`` has been updated from ``3.6.5`` to ``3.6.14``. + - | + ``letsencrypt-lego`` has been updated from ``4.27.0`` to ``5.4.0``. + - | + ``magnum-conductor-plugin-helm`` has been updated from ``3.19.0`` to + ``4.2.4``. + - | + ``prometheus-alertmanager`` has been updated from ``0.31.1`` to ``0.34.0``. + - | + ``prometheus-cadvisor`` has been updated from ``0.56.2`` to ``0.60.5``. + - | + ``prometheus-elasticsearch-exporter`` has been updated from ``1.10.0`` to + ``1.11.0``. + - | + ``prometheus-libvirt-exporter`` has been updated from ``2.3.1`` to + ``2.5.0``. + - | + ``prometheus-memcached-exporter`` has been updated from ``0.15.5`` to + ``0.17.0``. + - | + ``prometheus-mtail`` has been updated from ``3.4.0`` to ``3.4.9``. + - | + ``prometheus-mysqld-exporter`` has been updated from ``0.18.0`` to + ``0.20.0``. + - | + ``prometheus-node-exporter`` has been updated from ``1.10.2`` to + ``1.12.1``. + - | + ``prometheus-server`` has been updated from ``3.5.4`` to ``3.5.5``. + - | + ``prometheus-valkey-exporter`` has been updated from ``1.82.0`` to + ``1.89.0``. diff --git a/releasenotes/notes/update-external-components-94f3c485be382c8e.yaml b/releasenotes/notes/update-external-components-94f3c485be382c8e.yaml new file mode 100644 index 000000000..e72f54e25 --- /dev/null +++ b/releasenotes/notes/update-external-components-94f3c485be382c8e.yaml @@ -0,0 +1,7 @@ +--- +upgrade: + - | + ``prometheus-mtail`` has been updated from ``3.4.10`` to ``3.4.11``. + - | + ``prometheus-openstack-network-exporter`` has been updated from ``0.2.0`` + to ``0.3.0``. diff --git a/releasenotes/notes/update-external-components-97b947c8fdb88ac9.yaml b/releasenotes/notes/update-external-components-97b947c8fdb88ac9.yaml new file mode 100644 index 000000000..d758f9412 --- /dev/null +++ b/releasenotes/notes/update-external-components-97b947c8fdb88ac9.yaml @@ -0,0 +1,7 @@ +--- +upgrade: + - | + ``prometheus-server`` has been updated from ``3.13.2`` to ``3.13.3``. + - | + ``prometheus-valkey-exporter`` has been updated from ``1.90.0`` to + ``1.91.1``. diff --git a/releasenotes/notes/update-magnum-conductor-plugin-helm-6afa6c8dc5a98d5a.yaml b/releasenotes/notes/update-magnum-conductor-plugin-helm-6afa6c8dc5a98d5a.yaml new file mode 100644 index 000000000..122ee7c67 --- /dev/null +++ b/releasenotes/notes/update-magnum-conductor-plugin-helm-6afa6c8dc5a98d5a.yaml @@ -0,0 +1,5 @@ +--- +upgrade: + - | + ``magnum-conductor-plugin-helm`` has been updated from ``4.2.4`` to + ``4.3.0``. diff --git a/releasenotes/notes/update-prometheus-mtail-4d73dd09f088a408.yaml b/releasenotes/notes/update-prometheus-mtail-4d73dd09f088a408.yaml new file mode 100644 index 000000000..a9c6e7ed8 --- /dev/null +++ b/releasenotes/notes/update-prometheus-mtail-4d73dd09f088a408.yaml @@ -0,0 +1,4 @@ +--- +upgrade: + - | + ``prometheus-mtail`` has been updated from ``3.4.11`` to ``3.4.12``. diff --git a/releasenotes/source/2026.2.rst b/releasenotes/source/2026.2.rst new file mode 100644 index 000000000..a423bf972 --- /dev/null +++ b/releasenotes/source/2026.2.rst @@ -0,0 +1,6 @@ +=========================== +2026.2 Series Release Notes +=========================== + +.. release-notes:: + :branch: stable/2026.2 diff --git a/releasenotes/source/index.rst b/releasenotes/source/index.rst index f49536313..c240c6a2f 100644 --- a/releasenotes/source/index.rst +++ b/releasenotes/source/index.rst @@ -9,6 +9,7 @@ Contents :maxdepth: 2 unreleased + 2026.2 2026.1 2025.2 2025.1 diff --git a/roles/kolla-build-config/defaults/main.yml b/roles/kolla-build-config/defaults/main.yml index 38eae184c..ced1ac659 100644 --- a/roles/kolla-build-config/defaults/main.yml +++ b/roles/kolla-build-config/defaults/main.yml @@ -11,58 +11,70 @@ kolla_build_config: {} # Dict mapping project names to sections in kolla-build.conf. kolla_build_sources: - openstack/requirements: openstack-base - + gnocchixyz/gnocchi: gnocchi-base openstack/aodh: aodh-base openstack/barbican: barbican-base openstack/bifrost: bifrost-base openstack/blazar: blazar-base + openstack/blazar-dashboard: horizon-plugin-blazar-dashboard openstack/blazar-nova: nova-base-plugin-blazar openstack/ceilometer: ceilometer-base openstack/cinder: cinder-base openstack/cloudkitty: cloudkitty-base + openstack/cloudkitty-dashboard: horizon-plugin-cloudkitty-dashboard + openstack/cyborg: cyborg-base openstack/designate: designate-base + openstack/designate-dashboard: horizon-plugin-designate-dashboard openstack/glance: glance-base - openstack/gnocchi: gnocchi-base openstack/heat: heat-base + openstack/heat-dashboard: horizon-plugin-heat-dashboard + openstack/horizon: horizon openstack/ironic: ironic-base + openstack/ironic-prometheus-exporter: ironic-conductor-plugin-prometheus-exporter + openstack/ironic-ui: horizon-plugin-ironic-ui openstack/keystone: keystone-base openstack/magnum: magnum-base + openstack/magnum-ui: horizon-plugin-magnum-ui openstack/manila: manila-base + openstack/manila-ui: horizon-plugin-manila-ui + openstack/masakari: masakari-base + openstack/masakari-dashboard: horizon-plugin-masakari-dashboard + openstack/masakari-monitors: masakari-monitors openstack/mistral: mistral-base - openstack/neutron: neutron-base + openstack/mistral-dashboard: horizon-plugin-mistral-dashboard openstack/networking-baremetal: neutron-base-plugin-networking-baremetal - openstack/neutron-dynamic-routing: - - neutron-bgp-dragent - - neutron-server-plugin-neutron-dynamic-routing openstack/networking-generic-switch: neutron-base-plugin-networking-generic-switch openstack/networking-sfc: - neutron-base-plugin-networking-sfc - tacker-base-plugin-networking-sfc + openstack/neutron: neutron-base + openstack/neutron-dynamic-routing: + - neutron-bgp-dragent + - neutron-server-plugin-neutron-dynamic-routing + openstack/neutron-fwaas: neutron-base-plugin-neutron-fwaas + openstack/neutron-fwaas-dashboard: horizon-plugin-fwaas-dashboard openstack/neutron-vpnaas: - neutron-vpnaas-agent - neutron-base-plugin-vpnaas-agent + openstack/neutron-vpnaas-dashboard: horizon-plugin-neutron-vpnaas-dashboard openstack/nova: nova-base openstack/octavia: octavia-base - openstack/skyline: skyline-base + openstack/octavia-dashboard: horizon-plugin-octavia-dashboard + openstack/ovn-octavia-provider: + - octavia-api-plugin-ovn-octavia-provider + - octavia-driver-agent-plugin-ovn-octavia-provider + openstack/placement: placement-base + openstack/requirements: + - openstack-base + - kolla-toolbox + openstack/skyline-apiserver: skyline-apiserver + openstack/skyline-console: skyline-console openstack/tacker: - tacker-base - mistral-base-plugin-tacker - openstack/trove: trove-base - openstack/watcher: watcher-base - - # Horizon and its plugins - openstack/horizon: horizon - openstack/blazar-dashboard: horizon-plugin-blazar-dashboard - openstack/cloudkitty-dashboard: horizon-plugin-cloudkitty-dashboard - openstack/designate-dashboard: horizon-plugin-designate-dashboard - openstack/heat-dashboard: horizon-plugin-heat-dashboard - openstack/ironic-ui: horizon-plugin-ironic-ui - openstack/magnum-ui: horizon-plugin-magnum-ui - openstack/manila-ui: horizon-plugin-manila-ui - openstack/mistral-dashboard: horizon-plugin-mistral-dashboard - openstack/neutron-vpnaas-dashboard: horizon-plugin-neutron-vpnaas-dashboard - openstack/octavia-dashboard: horizon-plugin-octavia-dashboard openstack/tacker-horizon: horizon-plugin-tacker-dashboard + openstack/tap-as-a-service: neutron-base-plugin-tap-as-a-service + openstack/trove: trove-base openstack/trove-dashboard: horizon-plugin-trove-dashboard + openstack/watcher: watcher-base openstack/watcher-dashboard: horizon-plugin-watcher-dashboard diff --git a/roles/kolla-build-config/templates/kolla-build.conf.j2 b/roles/kolla-build-config/templates/kolla-build.conf.j2 index bfc5dd426..07a50baae 100644 --- a/roles/kolla-build-config/templates/kolla-build.conf.j2 +++ b/roles/kolla-build-config/templates/kolla-build.conf.j2 @@ -7,20 +7,21 @@ {% endfor %} {% endfor %} -{# Generate a section for every build source for which there is a Zuul change. #} +{# Generate a section for every build source Zuul has a checkout for, + whether it's a required-project or a Depends-On. #} -{% for zuul_item in zuul['items'] %} -{% if zuul_item.project.name in kolla_build_sources %} -{% set source_names = kolla_build_sources[zuul_item.project.name] %} +{% for canonical_name, project in zuul['projects'].items() %} +{% if project.name in kolla_build_sources %} +{% set source_names = kolla_build_sources[project.name] %} {% if source_names is string %} [{{ source_names }}] type = local -location = {{ ansible_env.PWD ~ '/' ~ zuul_item.project.src_dir }} +location = {{ ansible_env.PWD ~ '/' ~ project.src_dir }} {% else %} {% for source_name in source_names %} [{{ source_name }}] type = local -location = {{ ansible_env.PWD ~ '/' ~ zuul_item.project.src_dir }} +location = {{ ansible_env.PWD ~ '/' ~ project.src_dir }} {% endfor %} {% endif %} {% endif %} diff --git a/tests/files/process_build_logs.py b/tests/files/process_build_logs.py index 0db5228d9..248acf954 100755 --- a/tests/files/process_build_logs.py +++ b/tests/files/process_build_logs.py @@ -30,7 +30,7 @@ parser.add_argument('-b', '--base', required=True) args = vars(parser.parse_args()) -if args['base'] not in ['rocky', 'centos']: +if args['base'] != 'rocky': print("Non rpm-based distros are not yet supported.") sys.exit() diff --git a/tests/templates/repos.yaml.j2 b/tests/templates/repos.yaml.j2 index 9129f74eb..573173d95 100644 --- a/tests/templates/repos.yaml.j2 +++ b/tests/templates/repos.yaml.j2 @@ -32,6 +32,11 @@ rocky: build_only: true gpgkey: "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-10" name: "crb" + openvswitch: + baseurl: "http://centos-stream.mirrorservice.org/SIGs/$releasever-stream/nfv/$basearch/openvswitch-2/" + build_only: true + gpgkey: "https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-NFV" + name: "centos-nfv-openvswitch" {% elif base_distro == 'ubuntu' %} ubuntu: ubuntu: diff --git a/tests/vars/zuul.yml b/tests/vars/zuul.yml index dbcc01d19..b2962b85b 100644 --- a/tests/vars/zuul.yml +++ b/tests/vars/zuul.yml @@ -3,7 +3,6 @@ nodepool_rdo_proxy: "http://{{ zuul_site_mirror_fqdn }}:8080/rdo" nodepool_pypi_mirror: "http://{{ zuul_site_mirror_fqdn }}:8080/pypi/simple" nodepool_mirror_host: "{{ zuul_site_mirror_fqdn }}" nodepool_npmjs_proxy: "http://{{ zuul_site_mirror_fqdn }}:8080/registry.npmjs/" -nodepool_cbs_centos_proxy: "http://{{ zuul_site_mirror_fqdn }}:8080/cbs.centos" nodepool_docker_proxy: "http://{{ zuul_site_mirror_fqdn }}:8080/docker" # NOTE(hrw): wheel cache goes over 80/443 not on 8080 diff --git a/tools/check_sources.py b/tools/check_sources.py index 189ddb170..38fc03acc 100644 --- a/tools/check_sources.py +++ b/tools/check_sources.py @@ -19,10 +19,7 @@ import sys import textwrap import requests - -sys.path.append(os.getcwd()) - -from kolla.common.sources import SOURCES # noqa: E402 +import yaml def github_headers(): @@ -202,14 +199,9 @@ def get_helm_sh_hashes(version, arch_map): return hashes -SOURCES_PATH = os.path.normpath( - os.path.join(os.path.dirname(os.path.abspath(__file__)), - '..', 'kolla', 'common', 'sources.py')) - - -def apply_update(name, info, new_v, new_hashes): - """Update version and sha256 entries for one source in sources.py.""" - with open(SOURCES_PATH) as f: +def apply_update(name, info, new_v, new_hashes, sources_path): + """Update version and sha256 entries for one source in sources.yaml.""" + with open(sources_path) as f: content = f.read() version_key = 'reference' if info.get('type') == 'git' else 'version' @@ -217,26 +209,23 @@ def apply_update(name, info, new_v, new_hashes): if old_v: new_v_str = ('v' + new_v) if old_v.startswith('v') else new_v content = content.replace( - f"'{version_key}': '{old_v}'", - f"'{version_key}': '{new_v_str}'", 1) + f'{version_key}: "{old_v}"', + f'{version_key}: "{new_v_str}"', 1) for arch, new_sha in new_hashes.items(): old_sha = info.get('sha256', {}).get(arch, '') if old_sha and old_sha != new_sha: content = content.replace(old_sha, new_sha) - with open(SOURCES_PATH, 'w') as f: + with open(sources_path, 'w') as f: f.write(content) -REPO_ROOT = os.path.normpath( - os.path.join(os.path.dirname(os.path.abspath(__file__)), '..')) - - -def create_releasenote(changes): +def create_releasenote(changes, repo_root): """Create a reno release note listing all updated components. :param changes: list of (name, old_version, new_version) tuples + :param repo_root: root of the kolla repository checkout """ if len(changes) == 1: slug = f"update-{changes[0][0]}" @@ -244,7 +233,7 @@ def create_releasenote(changes): slug = "update-external-components" result = subprocess.run( # nosec - ['reno', 'new', slug, REPO_ROOT], + ['reno', 'new', slug, repo_root], capture_output=True, text=True) if result.returncode != 0: @@ -269,8 +258,13 @@ def create_releasenote(changes): print(f"Created release note: {note_path}") -def check_versions(update=False): - """Monitor Kolla architectures and compare with latest releases.""" +def check_versions(sources, sources_path, repo_root, update=False): + """Monitor Kolla architectures and compare with latest releases. + + :param sources: the kolla.common.sources.SOURCES dict + :param sources_path: path to the sources.yaml file to update + :param repo_root: root of the kolla repository checkout + """ check_github_rate_limit() arch_map = {'amd64': 'linux-amd64', 'arm64': 'linux-arm64'} version_changes = [] @@ -280,7 +274,7 @@ def check_versions(update=False): print(header) print("-" * 110) - for name, info in SOURCES.items(): + for name, info in sources.items(): current_v = info.get('version') or info.get('reference', '') if not re.match(r'^v?\d+[\.\d]+', current_v or ''): current_v = None @@ -324,23 +318,54 @@ def check_versions(update=False): print(line) if update and lines_to_print: - apply_update(name, info, latest_v, new_hashes) + apply_update(name, info, latest_v, new_hashes, + sources_path) if status_v == "UPDATE": version_changes.append( (name, current_v, latest_v)) if update and version_changes: - create_releasenote(version_changes) + create_releasenote(version_changes, repo_root) -if __name__ == "__main__": +def parse_args(): parser = argparse.ArgumentParser( description='Check and optionally update Kolla source versions.') + parser.add_argument('--repo', default=None, + help='Path to the kolla repository checkout ' + '(default: the checkout this script lives in, ' + 'if any, otherwise the current directory)') parser.add_argument('--update', action='store_true', - help='Update kolla/common/sources.py in place') - args = parser.parse_args() + help='Update kolla/common/sources.yaml in place') + return parser.parse_args() + + +def default_repo_root(): + """Guess the repo root when run in-tree from <repo>/tools/.""" + in_tree = os.path.normpath( + os.path.join(os.path.dirname(os.path.abspath(__file__)), '..')) + if os.path.isfile( + os.path.join(in_tree, 'kolla', 'common', 'sources.yaml')): + return in_tree + return os.getcwd() + + +if __name__ == "__main__": + args = parse_args() if args.update and not shutil.which('reno'): print("ERROR: 'reno' is not installed or not in PATH. " "Install it with: pip install reno") sys.exit(1) - check_versions(update=args.update) + + repo_root = os.path.abspath(args.repo or default_repo_root()) + sources_path = os.path.join( + repo_root, 'kolla', 'common', 'sources.yaml') + if not os.path.isfile(sources_path): + print(f"ERROR: {sources_path} not found. Pass --repo pointing at " + "a kolla repository checkout.") + sys.exit(1) + + with open(sources_path) as f: + SOURCES = yaml.safe_load(f) + + check_versions(SOURCES, sources_path, repo_root, update=args.update) diff --git a/tools/validate-build-sources-overrides.py b/tools/validate-build-sources-overrides.py new file mode 100644 index 000000000..5d9db62f5 --- /dev/null +++ b/tools/validate-build-sources-overrides.py @@ -0,0 +1,175 @@ +#!/usr/bin/env python3 + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +"""Check that every buildable-from-source entry in kolla/common/sources.yaml +has a matching CI override in +roles/kolla-build-config/defaults/main.yml (kolla_build_sources), that +each such project is declared in the kolla-base job's required-projects +in zuul.d/base.yaml, and that any pinned git reference in sources.yaml +matches the override-checkout used to fetch it in CI. This ensures CI +builds every source from a Zuul-cached git checkout instead of +downloading a tarball from tarballs.opendev.org. +""" + +import os +import sys + +import yaml + +PROJECT_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), '..')) +sys.path.append(PROJECT_ROOT) + +from kolla.common.sources import SOURCES # noqa: E402 + +BUILD_SOURCES_PATH = os.path.join( + PROJECT_ROOT, 'roles', 'kolla-build-config', 'defaults', 'main.yml') +ZUUL_BASE_PATH = os.path.join(PROJECT_ROOT, 'zuul.d', 'base.yaml') + +# Sources deliberately not covered by kolla_build_sources, with the +# reason a git-checkout override doesn't apply to them. +EXCLUDED_SOURCES = { + # Binary releases downloaded from GitHub, not built from a source + # checkout. + 'etcd', + 'letsencrypt-lego', + 'magnum-conductor-plugin-helm', + # GitHub projects that are not registered with the OpenStack Zuul + # tenant (unlike gnocchixyz/gnocchi), so they can't be required-projects. + 'kerbside-base', + 'mariadb-server-plugin-mariadb-docker', +} + + +def is_excluded(name): + return name in EXCLUDED_SOURCES or name.startswith('prometheus-') + + +def as_list(section_names): + if isinstance(section_names, str): + return [section_names] + return list(section_names) + + +def load_kolla_build_sources(): + with open(BUILD_SOURCES_PATH) as f: + return yaml.safe_load(f)['kolla_build_sources'] + + +def load_required_projects(): + """Parse the kolla-base job's required-projects in zuul.d/base.yaml. + + Returns (all project names, {project: override-checkout}). + """ + with open(ZUUL_BASE_PATH) as f: + docs = yaml.safe_load(f) + + job = next(doc['job'] for doc in docs + if 'job' in doc and doc['job']['name'] == 'kolla-base') + + all_projects = set() + checkouts = {} + for entry in job.get('required-projects', []): + if isinstance(entry, str): + all_projects.add(entry) + else: + all_projects.add(entry['name']) + if 'override-checkout' in entry: + checkouts[entry['name']] = entry['override-checkout'] + return all_projects, checkouts + + +def main(): + kolla_build_sources = load_kolla_build_sources() + required_projects, override_checkouts = load_required_projects() + + covered = set() + for section_names in kolla_build_sources.values(): + covered.update(as_list(section_names)) + + buildable = {name for name in SOURCES if not is_excluded(name)} + + missing = sorted(buildable - covered) + stale = sorted(covered - set(SOURCES)) + redundant_exclusions = sorted( + name for name in EXCLUDED_SOURCES if name not in SOURCES) + not_required = sorted(set(kolla_build_sources) - required_projects) + + ref_errors = [] + for project, section_names in sorted(kolla_build_sources.items()): + for section in as_list(section_names): + info = SOURCES.get(section) + if not info or info.get('type') != 'git': + continue + expected_ref = info.get('reference') + actual = override_checkouts.get(project) + if actual is None: + ref_errors.append( + f"{project} ({section}) is pinned to reference " + f"'{expected_ref}' in sources.yaml but has no " + "override-checkout in zuul.d/base.yaml " + "required-projects") + elif actual != expected_ref: + ref_errors.append( + f"{project} ({section}): sources.yaml reference " + f"'{expected_ref}' != required-projects " + f"override-checkout '{actual}'") + + for project, checkout in sorted(override_checkouts.items()): + section_names = kolla_build_sources.get(project) + if section_names is None: + continue + git_sections = [s for s in as_list(section_names) + if SOURCES.get(s, {}).get('type') == 'git'] + if not git_sections: + ref_errors.append( + f"{project} has override-checkout '{checkout}' in " + "required-projects but none of its kolla_build_sources " + "sections are type 'git' in sources.yaml") + + if missing: + print("ERROR: sources.yaml entries missing a kolla_build_sources " + "override in roles/kolla-build-config/defaults/main.yml:") + for name in missing: + print(f" {name}") + + if stale: + print("ERROR: kolla_build_sources overrides referencing sections " + "that no longer exist in kolla/common/sources.yaml:") + for name in stale: + print(f" {name}") + + if redundant_exclusions: + print("ERROR: EXCLUDED_SOURCES entries referencing sections that " + "no longer exist in kolla/common/sources.yaml, remove them:") + for name in redundant_exclusions: + print(f" {name}") + + if not_required: + print("ERROR: kolla_build_sources projects missing from the " + "kolla-base job's required-projects in zuul.d/base.yaml:") + for name in not_required: + print(f" {name}") + + if ref_errors: + print("ERROR: git reference mismatches between sources.yaml and " + "zuul.d/base.yaml required-projects:") + for msg in ref_errors: + print(f" {msg}") + + return 1 if (missing or stale or redundant_exclusions or not_required + or ref_errors) else 0 + + +if __name__ == "__main__": + sys.exit(main()) @@ -52,6 +52,7 @@ commands = flake8 {posargs} bash {toxinidir}/tools/validate-all-dockerfiles.sh python {toxinidir}/tools/validate-all-file.py + python {toxinidir}/tools/validate-build-sources-overrides.py bandit -r docker kolla tests tools codespell -I {toxinidir}/.codespell-ignore -x zuul.d/secrets.yaml ansible-galaxy collection install -r test-requirements.yml diff --git a/zuul.d/base.yaml b/zuul.d/base.yaml index 8d58c81f0..21cc98371 100644 --- a/zuul.d/base.yaml +++ b/zuul.d/base.yaml @@ -10,6 +10,63 @@ attempts: 5 roles: - zuul: openstack/ansible-collection-kolla + required-projects: + - name: gnocchixyz/gnocchi + override-checkout: 4.7.0 + - openstack/aodh + - openstack/barbican + - openstack/bifrost + - openstack/blazar + - openstack/blazar-dashboard + - openstack/blazar-nova + - openstack/ceilometer + - openstack/cinder + - openstack/cloudkitty + - openstack/cloudkitty-dashboard + - openstack/cyborg + - openstack/designate + - openstack/designate-dashboard + - openstack/glance + - openstack/heat + - openstack/heat-dashboard + - openstack/horizon + - openstack/ironic + - openstack/ironic-prometheus-exporter + - openstack/ironic-ui + - openstack/keystone + - openstack/magnum + - openstack/magnum-ui + - openstack/manila + - openstack/manila-ui + - openstack/masakari + - openstack/masakari-dashboard + - openstack/masakari-monitors + - openstack/mistral + - openstack/mistral-dashboard + - openstack/networking-baremetal + - openstack/networking-generic-switch + - openstack/networking-sfc + - openstack/neutron + - openstack/neutron-dynamic-routing + - openstack/neutron-fwaas + - openstack/neutron-fwaas-dashboard + - openstack/neutron-vpnaas + - openstack/neutron-vpnaas-dashboard + - openstack/nova + - openstack/octavia + - openstack/octavia-dashboard + - openstack/ovn-octavia-provider + - openstack/placement + - openstack/requirements + - openstack/skyline-apiserver + - openstack/skyline-console + - openstack/tacker + - openstack/tacker-horizon + - openstack/tap-as-a-service + - openstack/trove + - openstack/trove-dashboard + - openstack/watcher + - openstack/watcher-dashboard irrelevant-files: - ^.*\.md$ - ^.*\.rst$ diff --git a/zuul.d/centos.yaml b/zuul.d/centos.yaml deleted file mode 100644 index 3c48f9e0c..000000000 --- a/zuul.d/centos.yaml +++ /dev/null @@ -1,31 +0,0 @@ ---- -- job: - name: kolla-build-centos-10s - parent: kolla-base - nodeset: kolla-centos-10s-8GB - voting: false - -- job: - name: kolla-build-centos-10s-arm64 - parent: kolla-build-centos-10s - nodeset: kolla-centos-10s-arm64-8GB - voting: false - -- job: - name: kolla-build-centos-10s-no-infra-wheels - parent: kolla-build-no-infra-wheels-base - nodeset: kolla-centos-10s-8GB - -- project-template: - name: kolla-build-centos - description: | - Runs Kolla CentOS build jobs. - check: - jobs: - - kolla-build-centos-10s - check-arm64: - jobs: - - kolla-build-centos-10s-arm64 - experimental: - jobs: - - kolla-build-centos-10s-no-infra-wheels diff --git a/zuul.d/nodesets.yaml b/zuul.d/nodesets.yaml index 1c85b45fb..ccb3513f0 100644 --- a/zuul.d/nodesets.yaml +++ b/zuul.d/nodesets.yaml @@ -1,17 +1,5 @@ --- - nodeset: - name: kolla-centos-10s-8GB - nodes: - - name: primary - label: centos-10-stream-8GB - -- nodeset: - name: kolla-centos-10s-arm64-8GB - nodes: - - name: primary - label: centos-10-stream-arm64-8GB - -- nodeset: name: kolla-debian-bookworm-8GB nodes: - name: primary diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml index 62cd45f1b..782a5c640 100644 --- a/zuul.d/project.yaml +++ b/zuul.d/project.yaml @@ -5,7 +5,6 @@ - project: templates: - check-requirements - - kolla-build-centos - kolla-build-debian - kolla-build-rocky - kolla-build-ubuntu @@ -15,6 +14,7 @@ - kolla-scenario-cells - kolla-scenario-cephadm - kolla-scenario-ironic + - kolla-scenario-lets-encrypt - kolla-scenario-mariadb - kolla-scenario-masakari - kolla-scenario-octavia diff --git a/zuul.d/scenarios/aio.yaml b/zuul.d/scenarios/aio.yaml index 4a8a324ea..0d2258848 100644 --- a/zuul.d/scenarios/aio.yaml +++ b/zuul.d/scenarios/aio.yaml @@ -5,9 +5,10 @@ Runs Kolla-Ansible AIO jobs on all Kolla changes. check: jobs: - - kolla-ansible-centos-10s: &files - files: ^kolla/docker/ - - kolla-ansible-debian-trixie: *files + - kolla-ansible-debian-trixie: &files + files: + - ^kolla/common/sources.yaml + - ^kolla/docker/ - kolla-ansible-debian-trixie-upgrade: *files - kolla-ansible-rocky-10: *files - kolla-ansible-rocky-10-upgrade: *files @@ -15,7 +16,6 @@ - kolla-ansible-ubuntu-noble-upgrade: *files check-arm64: jobs: - - kolla-ansible-centos-10s-aarch64: *files - kolla-ansible-debian-trixie-aarch64: *files gate: jobs: diff --git a/zuul.d/scenarios/lets-encrypt.yaml b/zuul.d/scenarios/lets-encrypt.yaml new file mode 100644 index 000000000..9649d4ea6 --- /dev/null +++ b/zuul.d/scenarios/lets-encrypt.yaml @@ -0,0 +1,12 @@ +--- +- project-template: + name: kolla-scenario-lets-encrypt + description: | + Runs Kolla-Ansible Let's Encrypt scenario jobs. + check: + jobs: + - kolla-ansible-debian-trixie-lets-encrypt: &files + files: + - ^kolla/common/sources.yaml + - ^kolla/docker/(haproxy|httpd|letsencrypt)/ + - kolla-ansible-ubuntu-noble-lets-encrypt: *files diff --git a/zuul.d/scenarios/mariadb.yaml b/zuul.d/scenarios/mariadb.yaml index 882e1338e..c53a27fca 100644 --- a/zuul.d/scenarios/mariadb.yaml +++ b/zuul.d/scenarios/mariadb.yaml @@ -6,6 +6,8 @@ check: jobs: - kolla-ansible-debian-trixie-mariadb: &files - files: ^kolla/docker/(base|mariadb-server)/ + files: + - ^kolla/common/sources.yaml + - ^kolla/docker/(base|mariadb-server)/ - kolla-ansible-rocky-10-mariadb: *files - kolla-ansible-ubuntu-noble-mariadb: *files diff --git a/zuul.d/scenarios/prometheus-opensearch.yaml b/zuul.d/scenarios/prometheus-opensearch.yaml index 84649c360..c1a5778de 100644 --- a/zuul.d/scenarios/prometheus-opensearch.yaml +++ b/zuul.d/scenarios/prometheus-opensearch.yaml @@ -4,7 +4,9 @@ check: jobs: - kolla-ansible-debian-trixie-prometheus-opensearch: &files - files: ^kolla/docker/(base|fluentd|grafana|opensearch|prometheus)/ + files: + - ^kolla/common/sources.yaml + - ^kolla/docker/(base|fluentd|grafana|opensearch|prometheus)/ - kolla-ansible-debian-trixie-prometheus-opensearch-upgrade: *files - kolla-ansible-rocky-10-prometheus-opensearch: *files - kolla-ansible-rocky-10-prometheus-opensearch-upgrade: *files |