summaryrefslogtreecommitdiff
path: root/docker/base
AgeCommit message (Collapse)AuthorFilesLines
2021-02-15sensu: drop Ubuntu supportMarcin Juszkiewicz1-3/+0
Upstream removed Ubuntu repositories. Train/Stein only Change-Id: Ice125e101a689fd3df9d1cd9a093a026f9747a3e
2020-09-14Fix kolla_set_configs --check with a directoryMark Goddard1-5/+6
There are several issues with kolla_set_configs --check: 1. We calculate the destination path incorrectly when comparing a file in a directory, due to passing arguments to os.path.relpath in the wrong order 2. For directories that have not changed, we also attempt to compare them as files, which fails when they are open()ed. 3. If the config JSON does not have a config_files key, it fails with a KeyError. The first two issues affect the fluentd container, which specifies directories as the source, without using a glob. The third affects OVN containers. This patch fixes these issues. Closes-Bug: #1890567 Change-Id: I8921befe51da4282121443849177a7ca5ebe8822 (cherry picked from commit c5320eb22386c34d83435fa0b9aa03b178996b52)
2020-09-03Fix ironic build issues - LANG relatedMichal Nasiadka1-0/+9
ironic drivers-requirements installation fails with: UnicodeDecodeError: 'ascii' codec can't decode byte 0xc5 in position 2: ordinal not in range(128) Squashed ,,cherry-pick'' from stable/train - adding LANG block and locale-gen for Ubuntu family in base Dockerfile: https://review.opendev.org/#/c/684808/ https://review.opendev.org/#/c/691835/ https://review.opendev.org/#/c/694099/ Temporarily blocks bifrost building as well - to revert! Change-Id: I79ee884ad35bf5166c9ea303d73416271ff5f637
2020-07-06Drop systemd support from nsswitch.conf on RHEL-based distros8.0.4Michele Baldessari1-1/+2
A bit like we did for I3e0e86026f5a4a78473bed824cd1682d3a020cd5 we should remove the nss-systemd lookup from containers. The reasons for this are as follows: 1) Just like for I3e0e86026f5a4a78473bed824cd1682d3a020cd5 when this nss module is triggered it tries to talk to dbus. It triggers a bunch of selinux denials and it makes little sense to open all containers to talk to dbus. In particular, if a container is run as non-privileged and bind-mounts /run from the host, we will hit selinux denials like the following: type=USER_AVC msg=audit(1592337775.860:74119): pid=1284 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.DBus member=Hello dest=org.freedesktop.DBus spid=406228 scontext=system_u:system_r:container_t:s0:c162,c886 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'UID="dbus" AUID="unset" SAUID="dbus" 2) It just makes little sense in a kolla-world to have containers talk to dbus/systemd and it saves us some time when a lookup triggers the systemd module for whatever reason. Especially because the nss-systemd module does a few things which are not useful in a container (ensures that the root and nobody users and groups remain resolvable, SystemD's DynamicUser= feature, provide Lookup API via Varlink) The sed regex gives us the wanted results: $ diff -u /etc/nsswitch.conf.orig /etc/nsswitch.conf --- /etc/nsswitch.conf.orig 2020-06-19 07:18:10.974580755 +0000 +++ /etc/nsswitch.conf 2020-06-19 07:20:12.260230103 +0000 @@ -53,9 +53,9 @@ # group: db files # In order of likelihood of use to accelerate lookup. -passwd: sss files systemd +passwd: sss files shadow: files sss -group: sss files systemd +group: sss files hosts: files dns myhostname services: files sss netgroup: sss Related-Bug: #1883849 Change-Id: I81e5b7abf4571fece13a029e25911e9e4dece673 (cherry picked from commit dc2ddfa9750f94430a5b04b62fc1fa6adcb234f8)
2020-03-17kibana, nova-libvirt: handle it properly for non-x86Marcin Juszkiewicz2-0/+32
manual backport from master changes: - https://review.opendev.org/#/c/712987/ - https://review.opendev.org/#/c/713403 Upstream kibana package contains NodeJS x86-64 binaries so can not be used directly on non-x86 architectures. I took upstream packages, removed NodeJS binary from it and added 'nodejs' dependency. Package is present in my Linaro OBS repository where I keep other packages needed for aarch64 kolla run. Via APT pinning I mark them as not wanted so they are not used on any architecture with two exceptions: 1. libvirt - we need fixed version to be able to use ThunderX servers 2. kibana - to be able to run it at all For x86-64 upstream kibana package is used. Closes-bug: #1867365 Change-Id: I955619d6992f8714ae753dc155e248d255340ecf
2019-11-05get 'apt_*' options of kolla-build.conf working againMarcin Juszkiewicz3-0/+4
We broke 'apt_sources_list' and 'apt_preferences' options quite a while ago. Turned out that fix is quite simple. This change adds empty sources.list and apt-preferences files which are always added into images. If kolla-build.conf will use any of APT related options then those files will be replaced with provided ones. Change-Id: I7bbdcbd5c60f654a484a872209e0537e3950346c Closes-bug: #1706549 (cherry picked from commit bf20b41e7dea702b693fa98ea27822c8a33a5591)
2019-10-30Change ODL repo to nexus.opendaylight.orgMichal Nasiadka1-3/+2
Change-Id: I242945edba84b891ccbf82d5fcce8ef5fe37ad3d (cherry picked from commit 939a56035b8f15b74dff2d68154963735b0f73b4)
2019-10-01Fluentd: td-agent repository for DebianViktor Michalek2-0/+4
Change-Id: I0f05183889971dcc014663a849d3fc1d87a19e8e (manual picked from commit 2131ef9875efd67a9dd45dc3329df8de16cacff1)
2019-10-01Add Debian Buster Stein backports APT repositoryViktor Michalek2-1/+6
Change-Id: Ie140cf0d6308a5ee3c09f06ddfcf63be2e1cec64 (manual picked from commit c08a4b5a6352f3d1ebf640687d68d00aabc11ff6)
2019-09-18base: fix OracleLinux buildMarcin Juszkiewicz1-1/+1
Change-Id: I7603ed700abd2d6ce3ac0f301dc433ed1ed11e64 Closes-Bug: #1844484
2019-08-03TrivialFix: remove unused ganesha nfs repo fileRadosław Piliszek1-5/+0
Change-Id: Iab036be2b25867a268f4cef6f735dc64f8910fa0 Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com> (cherry picked from commit 92b3b5699661d3b7707d48cf2fc4801118aca1ab)
2019-06-26Move back to CentOS StorageSIG repos for Ceph and GaneshaGiulio Fidente2-30/+4
Recently a new repo was created in CentOS to distribute Ganesha, and the repo made a dependency of the Ceph Nautilus repo package [1] When centos-release-ceph-nautilus 1.2-1 will go out, it should not be necessary to disable the CentOS Ceph repos pulled in by dependency of the RDO repositories, as done in [2] 1. https://github.com/CentOS-Storage-SIG/centos-release-ceph/commit/f1a17c9d145cabfa1dfd3102fe7e2fc584f6a907 2. https://review.opendev.org/#/c/651601/ Change-Id: I6bf0cbfaffc22147c5bec03b5897719de53366ed (cherry picked from commit cf47864ab1e4fa6192ea96727d01b3e935b7a1fc)
2019-06-14Fix issues with Percona in Zuul and clean up a little bitRadosław Piliszek6-96/+8
Percona site has connectivity issues from OVH hosts (of Zuul). This patch makes it so that: - the internal repo is actually used - RPM GPG keys are downloaded from the actually used repo - Ubuntu mimics the RHEL behavior (i.e. the Percona repo is enabled only in the xtrabackup image) extra benefit: no need for APT preferences for Percona repo to spare MariaDB deps Change-Id: Id27831f6b404762f9e44fd6bd1c4702bf06b05f8 Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com> (cherry picked from commit de58339a0e1704ae1ade4e032a73bb4708ecfaf1)
2019-06-06Switch to RDO Stein release on CentOS & OracleMark Goddard1-6/+12
This change switches from the Delorean yum repositories to the RDO Stein release repository. centos-release-openstack-stein pulls in centos-release-ceph-nautilus, which conflicts with upstream ceph packages. Disable the CentOS Ceph repo to work around this. Change-Id: I1df5dd28adc65ff461a893b60c57d7b5da96d653
2019-06-06Ceph: Update to Nautilus on CentOS and OracleLinuxMark Goddard2-4/+26
The CentOS Stein OpenStack distribution depends on the Ceph Nautilus release, while Kolla currently deploys Luminous on CentOS. This change switches CentOS and OracleLinux builds to use Ceph Nautilus. Support for auth UID has been removed in the Nautilus release [1][2], so we have removed the --set-uid argument from calls to ceph-authtool. Also ceph-osd bootstrap mode fails when no mon config is provided, so we added --no-mon-config (mon config is injected later after bootstrap). Due to ceph-nfs build issues (ceph upstream nfs-ganesha rpms relied on older version of userspace-rcu, than CentOS Storage SIG packages) we need to move to ceph upstream rpm repos. [1] https://github.com/ceph/ceph/commit/d6def8ba1126209f8dcb40e296977dc2b09a376e [2] http://docs.ceph.com/docs/master/releases/nautilus/ Co-Authored-By: Michal Nasiadka <michal.nasiadka@nokia.com> Change-Id: I000398f587c5f4d6cc8995e34e162eebc77bc3e3 Implements: blueprint centos-ceph-nautilus (cherry picked from commit e0cae62c4aab001fa7b5cc324f178793f4e88f3c)
2019-05-08Drop systemd support from PAMCédric Jeanneret1-0/+4
The line being removed is the cause of audit.log spam with a SELinux enforcing (and permissive) system. They are due to the fact we're calling "sudo" from within some containers, and PAM wants to connect to the host "dbus" socket (mounted in /run). This action is obviously denied by SELinux. The "-" prefix makes this module optional anyway, but apparently PAM does see it and tries to use it. Dropping this module has no consequences other than preventing log spamming. Change-Id: I3e0e86026f5a4a78473bed824cd1682d3a020cd5 Co-Authored-By: Michele Baldessari <mbaldess@redhat.com> Resolves-Bug: #1819461 (cherry picked from commit c4b62490714ea849cedfe07d4b9a6aebf1f815c0)
2019-04-13Add config option use_dumb_init to add it to container imagesRabi Mishra1-2/+4
Usage of dumb-init can also be disabled from cli with `--nouse-dumb-init` when building images. Also moves ENTRYPOINT outside of dumb_init_installation block. Change-Id: Id32d54fc9913b83cf121ede5a5e265e0772062ae Related-Bug: #1821970 (cherry picked from commit fb4cb9efda5a522ba0d837047385b61275d09150)
2019-04-10Install "procps(-ng)" in the base imageCédric Jeanneret1-0/+3
Providing tools like "ps", "pgrep" and related is interesting since it helps debugging a container in some cases. It is also useful for healthchecks in case we want to fetch running service PID and use it in another command, like "lsof". Change-Id: I91b1c407caa6b03ae522e649592300f9eddfc07e (cherry picked from commit 9616f49964439966ac8689345b52f4cfc0924258)
2019-03-21cleanup in base for yum install entriesJon Schlueter1-10/+4
- introduce install_packages(..., chain=True) to allow chaining on onto existing RUN commands - introduce install_packages(..., clean) which defaults correctly but allows you to override if you want to avoid doing extra package manager cleanup - refactored several calls in base to make use of these new features In general this allows for macros.install_packages to be chained after other calls for example RUN foo && {{ macros.install_packages(..., chain=True) }} Change-Id: I4b2fe8e13ee3c0fffe77a1179a7af5b534496996
2019-03-21Fixup whitespace issue in chainingJon Schlueter1-2/+2
base_rhel_package_installation block had whitespace isses depending on which branch of the if statement you had. this resulted in a blank line in the continued "\ \n &&" rendered Dockerfile Change-Id: I634f1bc01806e2606d611b3697e84b43278c4a9b
2019-03-21refactor to pull out rpm_security_update macroJon Schlueter1-11/+4
- pulled out the repeated code from 3 paths in base and moved it into docker/macros - created macros.rpm_security_update - made sure the new macro could be customized for cleanup caches - update macro to use distro_package_manager Change-Id: Ic79ff42d913e1cbb68be66743e4f79f0bcff47f5
2019-03-21Merge "Introduce clean_package_cache"Zuul1-6/+6
2019-03-20install ncurses explicitly for tput for rpm distroJon Schlueter1-0/+2
tput is used in PS1 env, but nothing explicitly makes sure that it is installed. Red Hat's ubi8 base image only contains ncurses-base and ncurses-libs but not ncurses rpm which provides the tput cli Change-Id: I4f6b101195d245e14f6600b1edd9caafd25dcaac
2019-03-17Introduce clean_package_cacheEmilien Macchi1-6/+6
Default to true (to maintain backward compatibility), this parameter will allow to disable the Package cache cleaning when building the Kolla images. In TripleO, we are investigating how we can accelerate the builds by not cleaning the Yum cache and this patch will help us to do so. Also included same for deb package_install method. Co-Authored-By: Jon Schlueter <jschluet@redhat.com> Change-Id: I0adc85302dfe0411d362c899f3e0d6a0019680d4
2019-03-15Merge "Move to Debian 'buster'"Zuul2-15/+3
2019-03-15Merge "base: more strict pin of Ceph/Luminous for Ubuntu"Zuul1-1/+1
2019-03-15Fix lower-constraints and kolla CI jobsMark Goddard1-3/+2
Multiple fixes to fix multiple problems. 1. Bump setuptools requirement to 21.0.0 The 16.0.0 requirement breaks the lower-constraints job on Ubuntu bionic. We see the following error: AttributeError: module 'importlib._bootstrap' has no attribute 'SourceFileLoader' 2. ubuntu-binary horizon image needs to use python3 for django manage.py 3. ubuntu-binary nova-placement-api image needs to use python3 for apache mod wsgi. 4. nova-libvirt needs exact qemu dependencies due to packaging change 5. OracleLinux repos definition was changed in official image. 6. Fetch InfluxDB gpg key for Ubuntu base image from influx server. Change-Id: Ic797d41f53a5f146d112619f1683cbfbf3a85dc2
2019-03-14Move to Debian 'buster'Marcin Juszkiewicz2-15/+3
Buster is at freeze phase so safe to update and use. Will give us Python 3 based OpenStack packages (usually release delayed). Change-Id: I48c2d252a834716f1bcf10b18f2d32fe541e8137
2019-03-13base: more strict pin of Ceph/Luminous for UbuntuMarcin Juszkiewicz1-1/+1
Change-Id: I5edc46c3b93f93bdb7fa97b08072a773b8296e02
2019-03-12Add distro_package_manager configurationAlex Schultz2-1/+17
Add configuration to allow the switch between dnf/yum or provide an alternative package manager. Change-Id: I913769fcf5875a12b4561958cf7c90b74cd116ea
2019-03-12Add python3 packages for RHEL systemsAlex Schultz1-1/+11
RDO is currently working on python3 support for the next version of CentOS/RHEL based systems. This package uses the distro_python3 flag that was added as part of I4028991bad92c0e8e21066cc4173c06ce5eba393 to use the python3 specific package names. This change only adds python3 package names for RHEL systems. Conflicts-With: https://review.openstack.org/#/c/636457/ Change-Id: Iad6b70b433a0dd1b0f8ae6790fd280594517661a Related-Blueprint: python3-support
2019-03-12replace 'distro_python3' variable with 'distro_python_version'Marcin Juszkiewicz1-1/+2
RHEL7 derived distros use Python 2.7 RHEL8 uses Python 3.6 Ubuntu 18.04 uses Python 3.6, but we haven't enabled it yet. Debian:buster uses Python 3.7, but we haven't enabled it yet. We have several places in code where "/lib/pythonX.Y/site-packages" is used so we need to know value of X.Y rather than py2/py3 switch. How to check for Python 2: {% if distro_python_version == '2.7' %} Breaks: Iad6b70b433a0dd1b0f8ae6790fd280594517661a Change-Id: Ie24f109af19ae0438c21e0d43cb3cc947812b4ce
2019-02-28debian/ubuntu: make use of Python3 based packagesMarcin Juszkiewicz3-3/+3
Both Ubuntu Stein UCA and Debian 'buster' migrated their OpenStack packages to Python 3. Note that Debian 'buster' is not released yet and contains Rocky packages. Stein ones will be available later. Co-Authored-By: Lee Yarwood <lyarwood@redhat.com> Co-Authored-By: Eduardo Gonzalez <dabarren@gmail.com> Change-Id: I160f79cc57f54ec3eac857c5babd1a6e2656d228
2019-02-25Merge "base: update to dumb-init 1.2.2"Zuul1-6/+9
2019-02-25base: update to dumb-init 1.2.2Marcin Juszkiewicz1-6/+9
This version allows us to use Debian binaries for non-x86 architectures instead of building 'dumb-init'. 'base_compiler_packages' are installed as they will be needed anyway to build other Python packages (no binary wheels for !x86). We also need 'binutils' to be installed for 'ar' command. Change-Id: I53ad946ead4f0b485d8c7e8a91ac2ef5d7735c5a
2019-02-22Change some repos from xenial to bionicMichal Nasiadka1-3/+3
At the time of bumping Ubuntu images to bionic, some repos did not have bionic versions - so xenial repos were used. Most of the repos - apart odl now have a bionic tree - so this patch enables them. Change-Id: Id3c67fad507adc7b9f200eced74ecba8fadf70e6
2019-01-30Fix broken xtrabackup and monasca-grafana imagesMartin André3-2/+85
Percona started signing packages with a new public GPG key, without providing it via HTTPS. Ship the PERCONA-PACKAGING-KEY extracted from the percona-release package. https://jira.percona.com/browse/PT-1685 monasca-grafana broken by 'rake' missing when trying to install the 'fpm' gem. Co-Authored-By: Mark Goddard <mark@stackhpc.com> Change-Id: Ica9867448dc20864f2fd4614a295a23a4a625af4 Closes-Bug: #1813906 Closes-Bug: #1813927
2019-01-23Guard adding contentdir RUN in base templateJon Schlueter1-1/+1
As a follow up to I402cff1ac86a2ba108f2f5378cc98db5f6ecc673 only add the echo command if there is a value in centos_contentdir Change-Id: Ie5144ee3b8bdb2535a32cfb43c43dfc1bb556ac8
2019-01-18Merge "Use base_package_type"Zuul1-5/+5
2019-01-18Make set_config.py compatible with both Py2 and Py3Damien Ciabrini1-1/+1
When asserting the validity of config files, we currently use viewkeys(), which has been removed in Python3, so a kolla container cannot set the config with Python3 only. "Traceback (most recent call last):", " File \"/usr/local/bin/kolla_set_configs\", line 406, in main", " config = load_config()", " File \"/usr/local/bin/kolla_set_configs\", line 297, in load_config", " validate_config(config)", " File \"/usr/local/bin/kolla_set_configs\", line 238, in validate_config", " if not data.viewkeys() >= required_keys:", "AttributeError: 'dict' object has no attribute 'viewkeys'" Use keys() instead, which is compatible with both Python2 and Python3, and has no visible performance disadvantage and wrap it in a set() call so that we are guranteed to compare sets. Change-Id: I5f53c8f5a390a9df3ebb60659ebdcef41e3a9cad Co-Authored-By: Michele Baldessari <michele@acksyn.org>
2019-01-17Use base_package_typeAlex Schultz1-5/+5
This change updates the docker files to use base_package_type instead of doing specific distro checks for the rhel/deb generic cases. The base_distro is still available and is used when a specific distro needs a customization but if the differences are purely rpm vs deb, then the base_package_type can be used. Change-Id: I8d720bb185df65a0178061ccf20b1ab2265da2c5
2019-01-15Ensure /run_command is readable by all usersDamien Ciabrini1-1/+7
On some distro, running kolla_start via su changes the default UMASK, and consequently set_configs.py generates a /run_command that is not world-readable, and kolla cannot start the configured service. Make sure /run_command always has 'go+r' permissions. Change-Id: I6304f5937c512068ee1fb8aac5c88a2bd086e387
2019-01-09Fix grafana repoJeffrey Zhang4-9/+10
Grafana repository is moved from packagecloud to packages.grafana.com[0]. Based on new grafana install guide[1], update the grafana.repo [0] https://grafana.com/blog/2019/01/05/moving-to-packages.grafana.com/ [1] http://docs.grafana.org/installation/rpm/#install-via-yum-repository Closes-Bug: #1810867 Change-Id: Ib065fdc561b72fc013b952b3df41ee83b083194e
2018-12-19Merge "Use infra mirrors for ODL and percona repos"Zuul1-2/+2
2018-12-18Merge "base/debian: add Percona repo key"Zuul1-0/+1
2018-12-18Use infra mirrors for ODL and percona reposEduardo Gonzalez1-2/+2
Change-Id: I212a53b235f2785d93d474660c87a8521f3cc8b2
2018-12-05Fix Oraclelinux build, disable collectd in gateEduardo Gonzalez1-4/+14
Oraclelinux repositories has been upgraded and previous file removed, this change update repos to new URLs. Disable collectd in gate as is currently broken and blocks mergingin voting jobs. Change-Id: I402cff1ac86a2ba108f2f5378cc98db5f6ecc673
2018-12-01Merge "base: tell gnupg to not use TTY when we import APT keys"Zuul1-1/+1
2018-11-27Merge "Use dumb-init with --single-child"Zuul1-4/+5
2018-11-21base/debian: add Percona repo keyMarcin Juszkiewicz1-0/+1
Change-Id: I8a70690d081e2ce1284cae60179ce0598a28a393
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 19:30:27 +0000