summaryrefslogtreecommitdiff
path: root/docker/designate
AgeCommit message (Collapse)AuthorFilesLines
2022-10-10Fix writable rootwrap/privsep configRadosław Piliszek1-1/+0
Fixes a hypothetical security issue related to privilege escalation via rootwrap/privsep. A potential vulnerable service could previously allow writes to its rootwrap/privsep config and thus allow for more commands to be run with root privileges via rootwrap/privsep. For a succesful attack, this would also require the service to allow to run arbitrary commands via rootwrap/privsep. Thus far, no such vulnerabilities have been reported and thus this fix is simply strengthening the container images against such an issue in the future. Change-Id: I92c81c77e6a16570a108cde8031f7977930fb02a Closes-Bug: #1874298
2022-04-22adjust permissions on _extend_start files (part II)Marcin Juszkiewicz1-1/+1
Tim Shearer started it in 1d96a2bbe1b536b7d7f4cdbf55c6dabae6d058ae. Since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: Ia1797c32fc6a35f9f077c673abf4d8e16e51a760
2022-04-21flatten images a bitMarcin Juszkiewicz1-6/+6
As we have one type of images now some RUN calls could be merged so we will have less layers in resulting images. Change-Id: I5178c58fbd8c65efe825dc249c0f1368ef0fe8e0
2022-04-11Adjust permissions on _extend_start files.Tim Shearer1-1/+1
Explicitly set the permissions on the kolla-toolbox kolla_extend_start file. Also, since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0
2022-04-09docker: drop binary partsMarcin Juszkiewicz7-95/+8
Big patch drops all mentions of binary images support. Suggestions are welcome how to split it into parts or handle better. Change-Id: I5d5a46c6ce7734ceb8b844e17b43e359d7cac6e3
2020-04-15Remove support for CentOS 7Marcin Juszkiewicz2-22/+2
With the move to RHEL/CentOS 8 we no longer have Python 2 in our images so there is no need for checking which Python version (2.x or 3.x) is used inside of containers. We also no longer have to support yum as a value for distro_package_manager. Partially-Implements: blueprint centos-rhel-8 Change-Id: Ie45cf3465fedddbde7856961527421883ba3d5c9
2020-03-01Add block labels to all DockerfilesChristian Berendt8-0/+16
Change-Id: I9692dda817ef134d647247431565e1b58cf9da41
2019-11-18Designate: pool-manager has been removedViktor Michalek1-1/+0
Change-Id: I4a7bbfaf3c30c57432de056f701d8abc7992d142 Closes-Bug: 1852784
2019-10-08Remove designate-pool-manager containerAlfredo Moralejo1-37/+0
designate-pool-manager service has been removed in Train cycle [1] so let's remove it. This container was already retired in kolla-ansible [2]. [1] https://review.opendev.org/#/c/665476/ [2] https://review.opendev.org/#/c/682253/ Change-Id: I4f95c6515f73c9e952d0e66c1ed44b1271c798c0
2019-06-06Debian/Ubuntu: more python3 packages for binaryMark Goddard2-2/+2
backport: Stein During the switch to Stein UCA, we did not switch all packages to python 3 for Debian/Ubuntu binary images. This change switches some more of those packages. Change-Id: I0bff21384d88ea678608392de2db1ba418c96665 Co-Authored-By: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
2019-03-12Add python3 packages for RHEL systemsAlex Schultz2-2/+22
RDO is currently working on python3 support for the next version of CentOS/RHEL based systems. This package uses the distro_python3 flag that was added as part of I4028991bad92c0e8e21066cc4173c06ce5eba393 to use the python3 specific package names. This change only adds python3 package names for RHEL systems. Conflicts-With: https://review.openstack.org/#/c/636457/ Change-Id: Iad6b70b433a0dd1b0f8ae6790fd280594517661a Related-Blueprint: python3-support
2019-01-17Use base_package_typeAlex Schultz9-23/+23
This change updates the docker files to use base_package_type instead of doing specific distro checks for the rhel/deb generic cases. The base_distro is still available and is used when a specific distro needs a customization but if the differences are purely rpm vs deb, then the base_package_type can be used. Change-Id: I8d720bb185df65a0178061ccf20b1ab2265da2c5
2018-08-27designate: remove trailing continuation on RUN lineJon Schlueter1-1/+1
in change I06de60a35bc2c046bbdf4f43df8bd7b4a98de34a the commit had an extra tailing line contunation on the the last RUN command Change-Id: I463e7a15e096fed0b849de4122727284b0c7cfa2
2017-11-22Add designate-producer containercaowei1-0/+20
reference: https://docs.openstack.org/designate/latest/contributor/architecture.html Change-Id: Ia22128e5ce4a717612af658d63258e78e52176ad
2017-11-08Fix designate image buildEduardo Gonzalez1-11/+0
Designate implemented policy in code global goal. This caused to policy.json is not present anymore. Change-Id: Ib0b876019d4622f0c62429605c64d18a607b0320
2017-05-03Override image's meta info.Jawon Choo8-8/+8
centos based images have wrong label info, these changes fix own image's name and build-date. Change-Id: I1d13f8f386c8db12b5fbe5f8ecbbf9e3fbb4ba1c Closes-Bug: #1680341
2017-04-20Use LABEL instead of MAINTAINER (deprecated) in all Dockerfile.j2Chen8-8/+8
Use LABEL instruction instead of MAINTAINER (deprecated) instruc- tion as suggested by Docker's official dockerfile guide. docs.docker.com/engine/reference/builder/#maintainer-deprecated Closes-Bug: #1683652 Change-Id: Ie87a1ddf31aefcd0b623fd2837d78de420e76898
2017-04-04debian: enable all images enabled for UbuntuMarcin Juszkiewicz8-11/+11
Debian support is not maintained in Kolla so it got a bit behind Ubuntu one. This changeset enables Debian for all images. Jessie (even with backports) may be too old for some images though. Also unify distro check to ['debian', 'ubuntu'] to keep alphabetical order like it is done for RPM distributions. Partially-Implements: blueprint multiarch-and-arm64-containers Change-Id: I056233fbfa277e0e2360c07c3f80d9558c554357
2017-02-17Use install-pip macro in most source imagesChao Guo1-1/+5
1. Enable customization of pip packages in source branch of most images 2. All pip packages install uniformly through install-pip macro, user can easily customize his own pip command (For example using a mirror) Co-Authored-By: Mauricio Lima <mauriciolimab@gmail.com> Change-Id: If09582039f690fa4136e8f33200d5da15e092da7
2017-01-20Fix designate dockerfilezhubingbing1-2/+1
* remove /var/log/designate * remove usermod -a -G kolla designate, it create by macros.j2 Change-Id: I8bae9627604cf57edfa68221cd960085e7bb5312
2017-01-18Fix designate dockerfilezhubingbing1-2/+2
remove avoid /var/log/designate Change-Id: I9a1359106f7c9ba38b9603c7ed70373dbb08483b
2017-01-17use static uid/gid in imagesSam Yaple1-3/+4
This centralizes all user and group creation into a single source. This will fix any current and furture uid/gid mismatches (such as with nova-libvirt). In the process, we also unify users between the distros in a standard way. The users in the following containers change from thier defaults: Ubuntu: _chrony user is now chrony Ubuntu: memcache user is now memcached All: qemu user is used for ownership and socket permissions All uid and gid numbers are customizable via kolla-build.conf Co-Authored-By: Kris Lindgren <klindgren@godaddy.com> Change-Id: I120f26ab0683dc87d69727c3df8d4707e52a4543 Partially-Implements: blueprint static-uid-gid
2017-01-05Remove footer block and variable in *-base imagesJeffrey Zhang1-1/+0
Change-Id: I39aa88489f744f779150695f3f55ef80d42e1c61 Closes-Bug: #1653247
2016-12-22Fix designate containerEduardo Gonzalez9-14/+50
Fix designate-backend-bind9 image. Create designate-worker image. Create sudoers file to execute designate-rootwrap command. Closes-Bug: #1651524 Change-Id: I06de60a35bc2c046bbdf4f43df8bd7b4a98de34a
2016-11-22Fix Designate source image container assetsportdirect2-8/+16
When building Desginate from source, the require binaries were not included, this commit addresses that issue by installing them regardless of the build type. Change-Id: I05d11ce8289a6f201311b556d2b43b373c90cd64 Closes-Bug: #1642995
2016-11-08Merge "Fix designate dockerfile"Jenkins1-2/+2
2016-11-08Fix designate dockerfilezhubingbing1-2/+2
change kolla_extend_start to kolla_designate_extend_start TrivialFix Change-Id: I34a355aa24e2ff1ff483fa596e190922159a4d0b
2016-11-03Remove Fedora supportChristian Berendt7-7/+7
Closes-bug: #1616387 Change-Id: Id97f88b9baa3d48d33ce120962450a374282d044
2016-09-13Add header blocks to all DockerfilesPaul Bourke7-0/+21
Change needed to add header blocks to all Dockerfiles, similar to the base. Use case is to easily run something before packages are installed, e.g. to COPY a local rpm in that can be added to the package list. Change-Id: I1bbfdf0b762da0a392aa8bf47781315b45377bee Closes-Bug: 1618969
2016-08-29Change source with dot at extend_start filesEduardo Gonzalez1-1/+1
Is a best practice in Unix/Linux scripts to use dots instead of source command. Using dots will avoid issues with non BASH shells TrivialFix Change-Id: Ie6480a1954f853f79faffa093452715ebd9f7d90 Signed-off-by: Eduardo Gonzalez <dabarren@gmail.com>
2016-08-24Fix Ubuntu binary build and deploy gateJeffrey Zhang1-1/+1
Signed-off-by: Jeffrey Zhang <jeffrey.zhang@99cloud.net> Closes-Bug: #1616349 Change-Id: I82a245474392d22017faf30fa89d6dc5e01ab2c2
2016-08-19Handle empty package list for install_packagesShaun Smekel7-9/+9
Currently if the install_packages macro is run with an empty package list, it will add a yum or apt-get command with no packages listed. This bug fix aims to omit this line when no packages have been given, or, the operator wants to use the "_override" / "_remove" functionality to disable all packages being installed in a Dockerfile. Co-Authored-By: Paul Bourke <paul.bourke@oracle.com> Change-Id: Ifaaaebfccc3adb0f2f68a35ac08e59378bc87fdb Closes-bug: 1612446
2016-08-12Customizations for DesignateEduardo Gonzalez8-89/+83
This patchset contains customization of Dockerfile of designate containers Change-Id: I846437df7c3c417846f1c771883e5eb266b78a37 Partially-implements: blueprint third-party-plugin-support Signed-off-by: Eduardo Gonzalez <dabarren@gmail.com>
2016-08-11Fix designate bootstrap.Ross Krumbeck6-12/+37
According to http://docs.openstack.org/developer/designate/getting-started.html#initialize-start-the-central-service designate database bootstrap to be done by designate-manage database sync. Was also missing designate-manage pool_manager_cache sync. designate-manage command is packaged with designate-central. Boot strap commands moved to designate-central. Added creation of log directories. Added python2-oslo-reports and python2-suds for bootstrap to complete. Change-Id: I3896064b0abb31c96307b16005a340fc193aac3c Closes-Bug: 1610795
2016-05-26Update ubuntu dockerfiles for formattingSwapnil Kulkarni (coolsvap)7-7/+7
Change-Id: If4be00b937e14ec93443dcb7249cf17099d57cbe Closes-Bug: #1569417
2016-04-21Update designate dockerfile for formattingSwapnil Kulkarni (coolsvap)7-9/+12
Change-Id: I6d87fd19db433023d3d466e21e6dff27d7bf3927 Partial-Bug:#1569417
2016-02-17fix spelling problem in designate-sink ubuntu binaryxionglingfeng1-1/+1
Change-Id: I60ecdcdfbb1259fa261e982116123b4c2f81eedc Closes-Bug: 1546754
2016-02-16install the openstack-designate-api in the base stageJeffrey Zhang1-0/+1
https://review.openstack.org/#/c/276676/ remove this line and break the gate TrivialFix Change-Id: I0332caeffc6571801fba339108745f302487b33e
2016-02-15Merge "Designate ubuntu binary container"Jenkins7-2/+46
2016-02-08Designate ubuntu binary containerMD NADEEM7-2/+46
Change-Id: I546d25249527d7f1f7dfa2059ae38e7cc0e0a765 Partially-Implements: blueprint binary-ubuntu
2016-02-06Correct issue with virtualenv rootwrapSamYaple1-1/+3
Because we use rootwrap in a venv we need to update the exec_dirs. Without doing this *some* commands will break for various reasons that I won't get into in this review in detail. But this is required for neutron-l3-agent in a container + drop-root. Change-Id: I1a09f7188fdd501b7ce251d9f2fb0e5b10222142 Partially-Implements: blueprint drop-root
2016-01-15Remove old config-external.shWanlong Gao6-60/+0
TrivialFix Change-Id: Ib1923d8782699904cbc6a71d2f326d9c207d0005
2015-12-27Fix pip install settingsSamYaple1-1/+1
There were some inconsistencies with pip install instructions thoughout Kolla. We fix those here. Additionally, we fix the virtualenv to properly use the site-packages on the host if a library is not available in the venv. Change-Id: Ib84d48e8826bb96060338b3fa0782620c98794a8 Related-Bug: #1524684 Closes-Bug: #1529434
2015-11-27Source installation in virtualenvMichal Rostecki1-1/+1
Use virtualenv for installation of OpenStack projects and dependencies to avoid conflicts with Python libraries installed by non-OpenStack binary packages. Change-Id: I21ecd673b2e93335b1d3dd4e279e940c9d694c3c Implements: blueprint virtualenv
2015-11-23Remove hardcoded MAINTAINER in DockerfilesSwapnil Kulkarni (coolsvap)7-7/+7
Added new option in kolla-build.conf Change-Id: I45fe51966bcb59ea19d112281ba3d5a1ba091a56 Closes-Bug:#1514304
2015-11-12Move USER operation after footerSam Yaple6-12/+12
The USER operation affects all docker commands after it. This causes a problem with our {{ include_footer }} implementation since commands in that footer may require elevated permissions to perform. In the current implementation I can no longer remove my proxy settings once the USER has been changed. Change-Id: I9b2bab5a15f595f6d52a46c64ddf59ba5608b938 Partially-Implements: blueprint drop-root
2015-11-10Drop root for designateMichal Rostecki8-1/+15
Change-Id: I1df05608be62cc008ccef1ca88d0b37983568d22 Partially-Implements: blueprint drop-root
2015-11-09Fix validate-all-maintainer.sh to look for Dockerfile.j2Angus Salkeld7-7/+7
And fix the fallout. Change-Id: Iccad3f4fdb0a6a7c14246df3408cae0425b833a5
2015-10-15Use openstack/requirements for designatePaul Bourke1-1/+1
See Iccb4e99f8e4b6659a19c1817d0f4c697824af25c for context. Change-Id: I07ed5f20ab4b4bcd0fc6b3c231a54ebe0d51bf67 Partial-Bug: #150530
2015-10-13Fix issue with su and bad kernelsSam Yaple1-1/+1
Long story short, some kernels before 3.15 had an issue with using su in a container when the network namespace was --net=host. The gate has a 3.10 and a 3.13 kernel and has a problem with this. This changes everything to use sudo backport: liberty Partially-Implements: blueprint functional-testing-gate Change-Id: I4d79ccaa1cddffcc8393f64e7e1be2538efe33e5
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 18:23:04 +0000