summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2015-11-12Merge "Added Ubuntu support for Vagrant"Jenkins3-18/+159
2015-11-12Drop root privileges for mariadbSteven Dake4-5/+15
Drop root privileges for mariadb. This isn't perfect. If somemone breaks out of the container and can run sudo within the contianer, it would be possible to replace the root credentials of the database. Any container that uses sudo suffers from some extra attack vector related to the sudo command. That said, the sudo commands are locked down to minimize harm. Change-Id: I4b3573725d940bb8aa90d43a6235d8cf7d30fc64 Partially-Implements: blueprint drop-root
2015-11-11Move the mariadb expect code to a scriptSteven Dake3-21/+25
Atleast in a script, sudo can be made to only allow the script to run from the mysql process in the future, versus all the proceesses being able to be executed as root presently. Change-Id: I030b57086e37e4dc8f668f98c04335d94ab9d2b0 Partially-Implements: blueprint drop-root
2015-11-11Drop root for Horizon serviceSteven Dake1-1/+19
Drop root privileges for Horizon service. It is necesssary to set a capability on the filesystem to allow binding to port 80 as a non-root user. I have tested this works correctly from a registry on both CentOS and Ubuntu. Change-Id: I4c26f28bb28b6633784e6842f3423a2425332c27 Partially-Implements: blueprint drop-root
2015-11-11Merge "Install keystoneauthv1 in openstack-base image"Jenkins2-1/+1
2015-11-11Merge "Drop root for kolla-ansible"Jenkins2-2/+8
2015-11-11Merge "Clean up horizon httpd pid files for RPM distros"Jenkins1-0/+7
2015-11-11Install keystoneauthv1 in openstack-base imageSteven Dake2-1/+1
Lots of tools rqeuire keystoneeauthv1 not just horizon TrivialFix Change-Id: I35eb958e35500b04657679371019f2e6f3c2f2dd
2015-11-11Drop root for heatSteven Dake5-1/+9
Drop root user for heat containers. Change-Id: Ib07c0193f97bb18cc6154b4015b4056fd983f6c1 Partially-Implements: blueprint drop-root
2015-11-11install openstack-heat-common in heat-baseSteven Dake1-1/+9
the openstack-heat-common package installs the Heat UID/GID. This is necessary pre-work for drop-root for heat services. Change-Id: I247b0209248de144d20f5245973833be5cd8f14f Partially-Implements: blueprint drop-root
2015-11-11Merge "Drop root for designate"Jenkins8-1/+15
2015-11-11Drop root for kolla-ansiblePaul Bourke2-2/+8
This change ensures commands run in the kolla-ansible container are done as the 'ansible' user rather than root. By default Ansible tries to write it's temporary files to $HOME/.ansible on the target, which in most cases won't exist when run as the new user. Hence we now supply the kolla-ansible container with an ansible.cfg, to tweak the remote_dir option to /tmp. Change-Id: I838a8c8cd0c7dc1aeca4d12e38c346f252170e7c Partially-Implements: blueprint drop-root
2015-11-11Added Ubuntu support for VagrantDiogo Monteiro3-18/+159
Added support for Vagrant VirtualBox provider to provision an Ubuntu VM to run kolla. A new bootstrap-ubuntu.sh script has been created which provisions the Ubuntu VM with all kolla depdencies including docker 1.8.2, ansible 1.9.6 and python-tools Also created vars in the Vagrantfile to define the cpu and memory settings of the VM nodes used to run kolla DocImpact Change-Id: I4609d7f577e948b04663901afd0c5d1d154c8ac4 Implements: blueprint vagrant-ubuntu-support
2015-11-11Rename jobs for KollaSam Yaple1-0/+69
Due to the length of the job name and the tox target we run into an uncommon limitation; the virtualenv that tox launches is nested in a path that is too long. This leads to and error on our longest named job which prevents tox from running at all. This limitation is the limit for the line length of the first line in a shell script. See `man execve` for more info. A quote from that manpage: 'A maximum line length of 127 characters is allowed for the first line in a #! executable shell script.' Change-Id: I43fba2a5ff1890d699045496c9eaee5e849f3e75 Backport: Liberty Partially-Implements: blueprint multinode-gate
2015-11-11Clean up horizon httpd pid files for RPM distrosPaul Bourke1-0/+7
(apply same fix that we did for keystone, to horizon) In some cases we're seeing httpd not cleaning up properly after itself, which results in the horizon container failing to restart. This is confirmed to happen on rpm based distros, but have not had any reports on Ubuntu. Change-Id: I8ece6da1a8a1180730d68be0d129a656ddcede07 Closes-Bug: #1515214 backport: liberty
2015-11-10Merge "We now have a logs publisher"Jenkins1-0/+5
2015-11-10Merge "Add a test case for load_config"Jenkins1-0/+47
2015-11-10Drop root for designateMichal Rostecki8-1/+15
Change-Id: I1df05608be62cc008ccef1ca88d0b37983568d22 Partially-Implements: blueprint drop-root
2015-11-10Horizon rdo package requires python-keystoneauth1Martin André1-0/+1
Change-Id: I0d98399d7d573ea43689746dda59a647c307b25f Closes-Bug: #1514697
2015-11-10Fix --retries option to kolla-buildMartin André1-1/+1
Off by one error made the --retries option control the number of tries rather than the number of retries. Closes-Bug: #1514730 backport: Liberty Change-Id: I976a8bb9e489d226f44926a6562d4d2af5de099c
2015-11-10Add a test case for load_configAngus Salkeld1-0/+47
This is just a basic test to make sure loading from file works. Change-Id: I074f36023ac4198c436fcee1668d32f9d1f0e61b
2015-11-09Merge "Add registry information to quickstart.rst"Jenkins1-11/+117
2015-11-09Merge "Remove unused cinder-data container"Jenkins2-18/+1
2015-11-09Add registry information to quickstart.rstSteven Dake1-11/+117
We get an awful lot of questions about how to operate with a registry on the IRC channel and the obvious way to fix that is to document it. I don't know what to document about Ubuntu but if someone leaves the appropriate commands in the review I'll be happy to update it to include the correct operations to make the registry run on Ubuntu. Another option is perhaps we can get Sam to write those docs once this hits the repo since the structure will be mostly in place. TrivialFix Change-Id: Ib88abbaf9bd6bcabddae994157d9288aab8be2bf
2015-11-09Merge "drop root for glance"Jenkins4-1/+7
2015-11-09Merge "Base image changes for drop-root"Jenkins3-3/+24
2015-11-09drop root for glanceSteven Dake4-1/+7
This uses the grouping feature of sudo to limit the amount of times the base sudo file has to be modified to only once. The container contents always runs as the user root, except the software which is controlled by Kolla. This software may run as root, but it has undergone a security audit and preserves permissions of the correct files and does not permit the glance user to write any of the set_config.py control files. Change-Id: Ie3cd23edcde5b408a8f66970456279a1b15028e0 Partially-Implements: blueprint drop-root
2015-11-09Base image changes for drop-rootSteven Dake3-3/+24
The reason we are doing drop root is so that a network exposed software component (i.e. glance) cannot be used to affect the immutability of the container which it runs in. I have tried several different approaches and this is the only approach which puts glance in PID=1 while ensuring no files may be written by the glance process in the container image except for the log files. Change-Id: Ifd3c8c361b78d0e4791dade3afa6435290407c41 Partially-Implements: blueprint drop-root
2015-11-09We now have a logs publisherSam Yaple1-0/+5
We need to create a directory to allow publishing of logs. Change-Id: Ieeac5d236b698bedaccb8b5f0bb16f0de9df9386 Backport: Liberty Partially-Implements: blueprint multinode-gate
2015-11-09Merge "Incorrect parsed variable name"Jenkins8-8/+8
2015-11-09Move data container to start.ymlSam Yaple4-36/+34
The original reason for having the data container in the bootstrap.yml was to keep consistency with rabbitmq and mariadb, but in light of this bug we need to move the data container out of the bootstrap.yml role since we will be limiting the hosts that those tasks can run on. Change-Id: I7f2f5979b01807275908699d1243756cb97d3588 Partial-Bug: #1513598
2015-11-09Remove unused cinder-data containerSam Yaple2-18/+1
The cinder-data container serves no purpose and is not actually used past the bootstrap container and should be removed. Additionally add the missing '---' header to the start.yml file. TrivialFix Related-Bug: #1513598 Related-Bug: #1513439 Change-Id: I22b630bbee954e12a4de5652b7fb068669f633c5
2015-11-09Incorrect parsed variable nameSam Yaple8-8/+8
database_user_create was not correctly referenced when parsing the variable names. This could never actually lead to a situation that reported a false change, but it could break an operation if you were using the --step option with ansible and skipped the database create task. TrivialFix Backport: Liberty Change-Id: Idf69fffcc3814f509448ccea11b7d175f074ccf1
2015-11-09Fix validate-all-maintainer.sh to look for Dockerfile.j2Angus Salkeld30-31/+30
And fix the fallout. Change-Id: Iccad3f4fdb0a6a7c14246df3408cae0425b833a5
2015-11-08Merge "Few improvements in the quickstart doc"Jenkins1-18/+47
2015-11-06Merge "Finish implementation of spice"Jenkins8-17/+94
2015-11-06Switch to RDO untested master repositoryDavid Moreau Simard1-1/+1
RDO does not yet provide a CI tested Mitaka repository. As such, the current-passed-ci repository is the last tested repository before the stable/liberty branch was cut. To be able to test against the latest packages, we need to use the untested repositories until the CI tested repository is in place. TrivialFix Change-Id: I4a125eb3c84fa790746a9a8eca19e4fb2d9ecf38
2015-11-06Merge "Make RHEL build properly"Jenkins1-11/+12
2015-11-06Few improvements in the quickstart docProskurin Kirill1-20/+49
Fixed commands for disabling\stoping libvirt and ntpd in different OS I encourage to install kolla tools via pip, so user could get rid of relative paths to config and scripts and run it from everythere. Change-Id: I77271ce2f72fbaa7d6586a84f7998a9888d9b3a2
2015-11-06Merge "Few improvements in Kolla tools. Added Ubuntu support."Jenkins2-7/+22
2015-11-06Few improvements in Kolla tools. Added Ubuntu support.Kirill Proskurin2-7/+22
pip install default prefix in Ubuntu is /usr/local, and Kolla tools scripts didnt respect that. So I added few OS checks in this scripts. I improve config path check in build.py. Added more verbose error if we can't find config directory. Change-Id: Ide521ed205b0dc1fc27e237a9a8f4da0168e664f Closes-Bug: #1512302
2015-11-06Merge "Update Centos7 docker commands"Jenkins1-3/+3
2015-11-06Update Centos7 docker commandsBritt Houser1-3/+3
The commands around installing docker on Centos7 in the quickstart guide needed a little tweaking and a little spell checking. Change-Id: Ia0367900ab9792a096f753d5fd943ffab0a005a4
2015-11-06Merge "Add new gate for multinode"Jenkins1-0/+9
2015-11-06Merge "Use the absoluate path"Jenkins1-1/+1
2015-11-06Make RHEL build properlySteven Dake1-11/+12
build.py -b rhel -t [rdo|rhos|source|binary] The last patch for this didn't quite fix the problem properly as it only permitted RHOS builds. backport: liberty Change-Id: I27eed202560adce450c07d043cc224e7a6c6bbf6 Closes-Bug: #1513088
2015-11-06Merge "Add additional ntp information around ceph"Jenkins1-9/+16
2015-11-06Merge "Remove mysql-devel cruft"Jenkins1-1/+0
2015-11-06Use the absoluate pathJeffrey Zhang1-1/+1
Use the absoluate path rather than that with `..`. This will be helpfull for end-user to see where is the folder/file. Closes-Bug: #1513726 Change-Id: I7169952d874ddf14469605444044de0163b033d3
2015-11-06Remove mysql-devel cruftMartin André1-1/+0
This was conflicting with Percona-Server-devel-55 and broke centos source build for openstack-base image. Backport: Liberty Change-Id: Ia2bb2106038e8e2eadb6668f4ae1ad1d95710c09 Closes-Bug: #1513711
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-08 09:00:32 +0000