aboutsummaryrefslogtreecommitdiff
path: root/docker/haproxy
AgeCommit message (Collapse)AuthorFilesLines
2024-12-18[letsencrypt] Rename script for updating certificatesMichal Arbet2-1/+1
This patch renames the update-haproxy-cert script to update-loadbalancer-cert to make the name more generic. The change is necessary because support for ProxySQL will be introduced in the next patch, requiring a name that reflects broader applicability. To keep the diff in the following patch clean and easier to review, this patch focuses exclusively on the rename. Change-Id: I15f9b5cf3976f4298cdc7da4530f2d7d09614e88
2024-11-15Add mechanism for patching files in containersMichal Arbet2-0/+4
This patch adds a way to patch files in a Docker image built by Kolla. This is very useful for several reasons, specifically: - Custom modifications - The stable branch of some library has a fix but no pip package has been released - Eliminates the need to package your own pip packages - Eliminates the need to invent your own versioning to prevent upstream versioning - Eliminates the need to manage a pip server - In other words, it eliminates the need to get a wheel into the image and install it manually using any method not previously mentioned It is also highly desirable because, although Kolla can replace the source for a service with a custom URL for a tarball or its own Git repo, it cannot do this for dependencies pulled from pip. I would also like to point out that this is a feature with its own code path and works only if the user "inserts" a patch into the folder patches/docker-image/something.patch and creates an analogous series file for patch source code. Simply said, this code will never interfere with the upstream build process since this feature is not intended for use in upstream. It is rather meant for downstream users who know what they are doing. Now they just have an option to patch their images. Everything works on all layers of the Docker image and stores a report of applied patches which can then be seen in /etc. This mechanism is similar as debian patch quilt. Change-Id: I61d0790c5d4d070b7ea9e8c99c0a76ff5d22bf9d
2024-01-20trivial: fix typos in let's encrypt status logsPiotr Parczewski1-1/+1
Change-Id: Icb158d296989ba7c99ba108e7697ca71176f07db
2024-01-08Stop removing missing /run/nologin in RPM imagesPierre Riteau1-4/+0
This code was valid for centos:8 and centos:stream8, but is not required for centos:stream9 or rockylinux:9 which do not include this file. Change-Id: I50f78d73afe0944dd91998ab9799fa2f36cc46a3
2023-11-07Fix letsencrypt-lego loggingMichal Arbet1-7/+19
This patch fixes formatting of letsencrypt, so it will be easier to parse via fluent. Change-Id: I8a403e14819df4351e28d53c676571a3ad0c14be
2023-09-18Rework letsencryptMichal Arbet3-2/+140
This patch is adding "API layer" to letsencrypt images which is represented by set of scripts inside. This scripts are called by kolla-ansible orchestration. Change-Id: I61b70fb4e12ba03b96e79004e735d2ead0f52319
2022-09-27repos: in CentOS Stream 9 haproxy is in appstream repoMarcin Juszkiewicz1-2/+0
So we do not need to define repo for it like it was in past. Change-Id: I9e22a43e068490d762c42a7bb491e445a715381b
2022-05-30Replace Certbot with Lego for Let's Encrypt containergeneralfuzz4-0/+56
Replaces Certbot with Lego for certificate retrieval and renewal. Lego includes support for DNS ACME Challenges. Adds ssh-client to LetsEncrypt and ssh-server to HAProxy to allow both the transfer of Let's Encrypt certificates to the HAProxy container and to enable live updating of HAProxy certifices using the HAProxy API exposed on the local HAProxy socket. Implements: blueprint letsencrypt-https Change-Id: I737e1ce5bfc37d0703879c8272a9e915084c5ca6
2022-04-21flatten images a bitMarcin Juszkiewicz1-4/+4
As we have one type of images now some RUN calls could be merged so we will have less layers in resulting images. Change-Id: I5178c58fbd8c65efe825dc249c0f1368ef0fe8e0
2022-04-11drop infra_image_prefixMarcin Juszkiewicz1-1/+1
We have one install_type only now so that infra stuff is not needed anymore. Change-Id: I60d50ba7699d46d001eaef365fb84b0ce8e9b262
2021-08-27haproxy: Use haproxy 2.2.xMichał Nasiadka1-0/+2
For CentOS nfv-extras repository will be used, for Ubuntu - a PPA maintained by Vincent Bernat (Debian developer and package maintainer).. Debian Bullseye already uses 2.2. Change-Id: I7cd753cf66b492c75a185e365cf988cabb9c0142
2020-07-09introduce 'infra_image_prefix' for infra imagesMarcin Juszkiewicz1-1/+1
Defaults to 'image_prefix' for now but shows which images gets their names changed soon. Change-Id: I0608e8f62f28d6667b4c8753c47553e4cbf75503
2020-03-01Add block labels to all DockerfilesChristian Berendt1-0/+2
Change-Id: I9692dda817ef134d647247431565e1b58cf9da41
2019-11-29drop *_existing_user_fix macrosMarcin Juszkiewicz1-4/+0
Commit 109706aa8b26f6f915e1cadae89de8135c3b68bf bumped 'system' users beyond range used by Kolla. So Debian/Ubuntu does not complain that system users created by packages exist already on package install. Change-Id: I9bf4b240839d46088ac668f26cf065dd5e3775c2
2019-01-17Use base_package_typeAlex Schultz1-1/+1
This change updates the docker files to use base_package_type instead of doing specific distro checks for the rhel/deb generic cases. The base_distro is still available and is used when a specific distro needs a customization but if the differences are purely rpm vs deb, then the base_package_type can be used. Change-Id: I8d720bb185df65a0178061ccf20b1ab2265da2c5
2018-02-14Add socat to base imageMartin Mágr1-2/+1
We would need socat tool to perform healthchecks on the various containers. Closes-Bug: #1749227 Change-Id: Ibda77a8d041d894f5efac6578e52b11651bca97f
2017-05-03Override image's meta info.Jawon Choo1-1/+1
centos based images have wrong label info, these changes fix own image's name and build-date. Change-Id: I1d13f8f386c8db12b5fbe5f8ecbbf9e3fbb4ba1c Closes-Bug: #1680341
2017-04-20Use LABEL instead of MAINTAINER (deprecated) in all Dockerfile.j2Chen1-1/+1
Use LABEL instruction instead of MAINTAINER (deprecated) instruc- tion as suggested by Docker's official dockerfile guide. docs.docker.com/engine/reference/builder/#maintainer-deprecated Closes-Bug: #1683652 Change-Id: Ie87a1ddf31aefcd0b623fd2837d78de420e76898
2017-04-04debian: enable all images enabled for UbuntuMarcin Juszkiewicz1-1/+1
Debian support is not maintained in Kolla so it got a bit behind Ubuntu one. This changeset enables Debian for all images. Jessie (even with backports) may be too old for some images though. Also unify distro check to ['debian', 'ubuntu'] to keep alphabetical order like it is done for RPM distributions. Partially-Implements: blueprint multiarch-and-arm64-containers Change-Id: I056233fbfa277e0e2360c07c3f80d9558c554357
2017-02-05Remove include_header and include_footer in all DockerfilesJeffrey Zhang1-1/+0
include_header and include_footer parameter is already removed, remove them in all Dockerfiles. Add missing footer block. Change-Id: I90da03eb9f95a3827361d5f5ede65fde7d6be2b3
2017-01-17use static uid/gid in imagesSam Yaple1-2/+7
This centralizes all user and group creation into a single source. This will fix any current and furture uid/gid mismatches (such as with nova-libvirt). In the process, we also unify users between the distros in a standard way. The users in the following containers change from thier defaults: Ubuntu: _chrony user is now chrony Ubuntu: memcache user is now memcached All: qemu user is used for ownership and socket permissions All uid and gid numbers are customizable via kolla-build.conf Co-Authored-By: Kris Lindgren <klindgren@godaddy.com> Change-Id: I120f26ab0683dc87d69727c3df8d4707e52a4543 Partially-Implements: blueprint static-uid-gid
2016-11-23Add socat into haproxy imageJeffrey Zhang1-1/+4
socat is needed by I060e21ada928577e833de2782be5ea570be32730 Change-Id: I0773851b61d341117ab214382856a9036aca51bb
2016-09-13Add header blocks to all DockerfilesPaul Bourke1-0/+2
Change needed to add header blocks to all Dockerfiles, similar to the base. Use case is to easily run something before packages are installed, e.g. to COPY a local rpm in that can be added to the package list. Change-Id: I1bbfdf0b762da0a392aa8bf47781315b45377bee Closes-Bug: 1618969
2016-08-19Handle empty package list for install_packagesShaun Smekel1-1/+1
Currently if the install_packages macro is run with an empty package list, it will add a yum or apt-get command with no packages listed. This bug fix aims to omit this line when no packages have been given, or, the operator wants to use the "_override" / "_remove" functionality to disable all packages being installed in a Dockerfile. Co-Authored-By: Paul Bourke <paul.bourke@oracle.com> Change-Id: Ifaaaebfccc3adb0f2f68a35ac08e59378bc87fdb Closes-bug: 1612446
2016-07-28Customizations for haproxyEduardo Gonzalez1-12/+5
This patchset contains customization of Dockerfile of haproxy containers Change-Id: I67790816766641ebc3138d6b3726f0bbd9c68038 Partially-implements: blueprint third-party-plugin-support Signed-off-by: Eduardo Gonzalez <dabarren@gmail.com>
2016-05-27Merge "Run HAProxy in a chroot jail"Jenkins1-0/+4
2016-05-26Update ubuntu dockerfiles for formattingSwapnil Kulkarni (coolsvap)1-1/+1
Change-Id: If4be00b937e14ec93443dcb7249cf17099d57cbe Closes-Bug: #1569417
2016-05-06Run HAProxy in a chroot jailMichal Rostecki1-0/+4
It's impossible to drop root for the HAProxy container. But HAProxy provides a possibility to use a chroot jail. When attaching to the HAProxy container, we see that the root directory is changed: $ sudo docker exec -ti haproxy bash (haproxy)[root@operator /]# ls -di / 259 / Co-Authored-By: Vikram Hosakote <vhosakot@cisco.com> Closes-Bug: #1552289 Change-Id: I9d55e9b741b8560cac53dc8b837a24a3029a4dc0
2016-04-13Update haproxy dockerfile for formattingSwapnil Kulkarni (coolsvap)1-2/+4
Change-Id: I49231ddf2d8e6136e8a627cdf5674301018f984a Partial-Bug:#1569417
2016-03-30Start the haproxy by using haproxy-system-wrapperJeffrey Zhang3-22/+4
haproxy-system-wrapper is a solution for systemd from upstream. it can handle the reload graceful. Change-Id: I6a3d141af065e429bd1be1b7252f5c6df1fda3bb Closes-Bug: #1559238
2016-03-20Merge "Fix race condition in haproxy"Jenkins1-4/+9
2016-03-16Fix race condition in haproxyMD NADEEM1-4/+9
The time period between getting pid of haproxy service and checking existance of pid file is very short, if with in this period haproxy service get reload then the race condition occured and container get exit as extend_start.sh script exit. To minimize the risk of race condition, this patch let the extend_start.sh script to try upto 3 times before exit. Closes-Bug: #1479888 Change-Id: I2f9b7ec832dec8d94a2cdd27ca8a212d0c65a60d
2016-03-15Move sysctl out of haproxy containerSamYaple1-3/+0
sysctl was improperly set in the contaienr itself which is not correct TrivialFix Change-Id: If2ffca6d2a40e86db4af2f103a27b280bc5fa2ff
2016-03-13Fix false alert messages in HAProxy logsVikram Hosakote1-0/+4
Bug #1549753 raises false alarm about haproxy to the operator and monitoring tools even though haproxy is running fine and there is no issue. haproxy uses UDP datagram socket for logging and the default queue length of 10 datagrams causes false alert messages in haproxy logs. This patch set fixes this bug by increasing the queue length to 128. Test results of the fix in this patch set are at http://paste.openstack.org/show/490302/. Change-Id: I64fdd17cd278d51616aa0dfa4e8d2a422c8ee630 Closes-Bug: #1549753
2016-02-23cloud-archive contains newer version of haproxySamYaple1-6/+1
cloud-archive contains at least version 1.5 of haproxy and that is new enough for ssl offloading. TrivialFix Change-Id: Ib306e54b455430fdc9be896e8d14784ef1feb011
2015-11-23Remove hardcoded MAINTAINER in DockerfilesSwapnil Kulkarni (coolsvap)1-1/+1
Added new option in kolla-build.conf Change-Id: I45fe51966bcb59ea19d112281ba3d5a1ba091a56 Closes-Bug:#1514304
2015-10-06Bring Kolla inline with FHSSam Yaple2-7/+5
This brings Kolla images inline with FHS and should make finding locations of things more consistent and reliable with the linux world at large. Change-Id: Iece5b4da4bace0fb8b1f41a65ab2c852ec73e6f8 Closes-Bug: #1485742
2015-10-06Common start.shSam Yaple3-7/+6
The majority of the start.sh code is identical. This removes that duplicate code while still maintaining the ability to call code in a specific container. The start.sh is moved into /usr/local/bin/kolla_start in the container The extend_start.sh script is called by the kolla_start script at the location /usr/local/bin/kolla_extend_start . It always exists because we create a noop kolla_extend_start in the base directory. We override it with extend_start.sh in a specific image should we need to. Of note, the neutron-agents container is exempt from this new structure due to it being a fat container. Additionally, we fix the inconsistent permissions throughout. 644 for repo files and the scripts are set to 755 via a Docker RUN command to ensure someones local perm change won't break upstream containers. Change-Id: I7da8d19965463ad30ee522a71183e3f092e0d6ad Closes-Bug: #1501295
2015-09-28Merge "Implement a install_type and install_metatype"Jenkins1-1/+1
2015-09-28Implement a install_type and install_metatypeSteven Dake1-1/+1
This prepares for the RHEL OSP implementation by making the build tool convert all binary-* into an install_type of binary and * into an install_metatype variable substitution inside the Dockerfiles. Further binary-* is substituted as install_name to enable proper building only. Change-Id: Ib681b29176eb79a3cab12ec824313fdecb6e7a5f Partially-Implements: blueprint rhel-based-image-support
2015-09-27remove set_configsSam Yaple1-4/+0
Change-Id: I9bb0a1fac63cc326234b0f06b1e56b43e0753279 Partially-Implements: blueprint replace-config-external
2015-09-25Fix removal of config-externalSam Yaple1-1/+1
I removed the files but not the COPY commands thus breaking all of Kolla Change-Id: I37d3e0cb94a1ecc12971f485f953310ba8fee53c Partially-Implements: blueprint replace-config-external
2015-09-25Remove config-external.shSam Yaple1-10/+0
Removes config-external for all services that have been replaced in Ansible Change-Id: I839a14418638b977fbc1d02ba6839811b0f909ea Partially-Implements: blueprint replace-config-external
2015-09-25Replace config-external - haproxy keepalivedSam Yaple2-7/+5
Change-Id: I668c31401305713e720f0f0ae8ec18e320ea1c76 Partially-Implements: blueprint replace-config-external
2015-09-04Add 'rhel' for RPM distrosSteven Dake1-1/+1
Add 'rhel' to list for RPM based distros. Also sort the distro list for rpm packages for affected lines. Change-Id: Ied4cb3e9763d6c6359f314d16185383ac3e006ed Partially-Implements: blueprint rhel-based-image-support
2015-09-03Create openstack-base containerSam Yaple1-0/+0
This creates and moves the dependencies for Ubuntu into a common openstack-base container. This commit shows dramatically smaller sizes for all non-openstack containers. The Openstack container remain the same size. Change-Id: I2f46420d4b9edcfddda374caddcce906fc708f6c Partially-Implements: blueprint openstack-common-container
2015-08-28Move docker_templates to docker dirSam Yaple4-0/+69
Updated build.py to reflect this change. Deprecate --template option and make it a noop. Change-Id: I7cd98d1ee684a4c64984a49597159868152683b2 Partially-Implements: blueprint remove-docker-dir
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 21:37:32 +0000