aboutsummaryrefslogtreecommitdiff
path: root/docker/ironic
AgeCommit message (Collapse)AuthorFilesLines
2026-07-06Migrate to pyproject.tomlMichal Nasiadka12-381/+0
[tool.setuptools.data-files] does not support recursive directory installation. The old setup.cfg [files] worked because PBR's FilesConfig.expand_globs() used os.walk() to expand docker/*, but this hook is not triggered by the pbr.build PEP-517 backend. Move docker/ into kolla/ and use [tool.setuptools.package-data] instead. Update kolla_worker._get_images_dir() to check the kolla package directory first so both editable and regular installs work. Change-Id: I4fc452c03740ef22ebbb4e8d0d86c4f4783e2d09 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-24kolla-build: fix build-date LABEL invalidating Docker layer cacheMichal Nasiadka6-6/+6
The build-date label was rendered into a LABEL instruction on line 3 of every Dockerfile template, immediately after FROM. Because Docker invalidates the cache for a changed instruction and all subsequent layers, a date change caused a full rebuild of every image on each new calendar day, even when nothing else had changed. Fix this by removing build-date from the Dockerfile templates and applying it as a --label argument at build time via image.labels. Labels passed on the build command line are not part of the Dockerfile cache key, so the date is still recorded in the image metadata without affecting layer caching. Change-Id: I8ef0d85bab1a999a4d09f7cbf0c088ca00fdcf77 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-05-08ironic-pxe: Remove httpd setup callMichal Nasiadka1-2/+0
We're not using ironic-pxe as ironic-http anymore and kolla_httpd_setup has been removed from base. Change-Id: Id25e39cee9fd64d147301a39528aa8525bd682c2 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-05-06Drop apache installation outside of httpd container22.0.0.0rc1Michal Nasiadka1-21/+0
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/986483 Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/986352 Change-Id: Ia66dde09bbbad2a5a9e67a8c642f3223ca38be43 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-28Remove httpd_setup calls from api containersMichal Nasiadka3-8/+0
We have dropped mod_wsgi support from services in [1]. [1]: https://review.opendev.org/c/openstack/kolla-ansible/+/982414 Change-Id: Ie5da8427706dfb74bad4e174c990355a6870114c Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-28Drop mod_wsgiMichal Nasiadka1-2/+0
It's not needed since [1]. [1]: https://review.opendev.org/c/openstack/kolla-ansible/+/982414 Change-Id: I39ab300240b0178f3697ff2dcdf1fab2c3b828bf Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-01-22Fix ironic-pxe syslinux-tftpboot on aarch64 Rocky LinuxBartosz Bezak1-6/+1
Closes-Bug: #2138872 Change-Id: I6e30b749488a0ef2f247adf182db40cda8fa8ca4 Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
2025-10-07ironic: Remove ipxe.efi handling for EL10Michal Nasiadka1-6/+1
RHEL removed ipxe.efi - see [1]. [1]: https://issues.redhat.com/browse/RHEL-37610 Change-Id: I142257d6537ceeff23cb2cb34e64d93de9f19d2e Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-03Adds ironic-pxe-filter containerWill Szumski2-0/+30
Used in conjunction with the inspector implementation built into Ironic and based on the Ironic documentation[1]. [1] https://docs.openstack.org/ironic/latest/admin/inspection/pxe_filter.html Partial-Bug: #2094790 Depends-On: https://review.opendev.org/c/openstack/ironic/+/959850 Change-Id: I17811f2225edd64fb20cc44f0d40e14e9edb1413 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> Signed-off-by: Will Szumski <will@stackhpc.com>
2025-08-06ironic: Stop copying rootwrap since Ironic dropped itMichal Nasiadka2-3/+0
See I0a8e26e8990eae8108537541159f7810d35b70f1 Change-Id: I95500612168871454ce269b3562a8daccdf4de4f Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-07-16Move to CentOS Stream 10Michal Nasiadka1-1/+1
Known missing packages: - mod_auth_mellon - missing SAML support in Keystone/Horizon - built in Kolla COPR - glusterfs-fuse in manila-share - built in Kolla COPR - collectd/telegraf - no opstools repository - redis - needs a switch to valkey - python3-ethtool - not required for neutron-mlnx-agent since 6 years [1] Building packages in Kolla COPR is a temporary solution until these show up in EPEL10. [1]: Id2cae3ac9ff049e9fc8225551f99e1e99a87fc65 Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/951751 Change-Id: I7074fabcf95184fcfd2561648ae1e05acfb0bc11 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-04-08Fix preparation of /tftpboot for ironic-pxeMatt Anson1-1/+4
Copy aarch64 snponly.efi to /tftpboot during bootstrapping of Centos- and Rocky-based ironic-pxe. Don't use $KOLLA_BASE_ARCH when symlinking to /tftpboot/ipxe.efi, because an aarch64 variant of this binary doesn't exist, just x86_64. Change-Id: Ie19fcb441a2e54a60762e5c8483487b713a29ddd
2025-03-27Add support for aarch64 ipxe to ironic-pxe imageMatt Anson2-1/+7
Support aarch64 ipxe only when using Ubuntu and Rocky Linux base images, as the Debian ipxe package does not provide a suitable aarch64 ipxe binary. Change-Id: If5610148fc80acf13d4eb79fef78349764f08a17
2025-03-21Merge "Add mtools package to ironic-conductor image"Zuul1-3/+5
2025-03-20Merge "Ironic: Add ESP image for UEFI virtual media"Zuul2-0/+34
2025-03-19Ironic: Add ESP image for UEFI virtual mediaBartosz Bezak2-0/+34
UEFI virtual media boot requires an ESP image [1]. [1] https://docs.openstack.org/ironic/2024.2/admin/drivers/redfish.html#virtual-media-boot Change-Id: Ie8485a7098743e1d736145e8fd9441cf13c929d7
2025-02-26Add mtools package to ironic-conductor imageDr. Jens Harbott1-3/+5
In certain deployments ironic-conductor needs to create floppy images to mount in virtual media. This needs the mtools package installed. Change-Id: I00ccc47f7a993f13e2b2feb3f6a2565dad32b80c
2025-02-07Fix permissions for ironic metricsMichal Arbet3-1/+14
This patch adds creation of metrics folder, set permissions and SetGID bit. Closes-Bug: #2097098 Change-Id: Ic46b895775edf5e5fb2b637be49e2de1eb4adf36
2025-02-06Install pycadf from pypi packageMichal Arbet1-1/+1
Previously, the `pycadf` package did not include configuration files, so they were manually installed from source. However, this was fixed in pycadf's upstream in [1], allowing us to rely on the package itself. Additionally, the `ceilometer_api_audit_map.conf` file has been removed, as it was dropped in pycadf's upstream commit here [2] [1] https://review.opendev.org/c/openstack/pycadf/+/936741 [2] https://review.opendev.org/c/openstack/pycadf/+/930971 Change-Id: I022aa4c403f08385beb83b5d0c81f8abb42eb4a7
2024-11-15Add mechanism for patching files in containersMichal Arbet5-0/+10
This patch adds a way to patch files in a Docker image built by Kolla. This is very useful for several reasons, specifically: - Custom modifications - The stable branch of some library has a fix but no pip package has been released - Eliminates the need to package your own pip packages - Eliminates the need to invent your own versioning to prevent upstream versioning - Eliminates the need to manage a pip server - In other words, it eliminates the need to get a wheel into the image and install it manually using any method not previously mentioned It is also highly desirable because, although Kolla can replace the source for a service with a custom URL for a tarball or its own Git repo, it cannot do this for dependencies pulled from pip. I would also like to point out that this is a feature with its own code path and works only if the user "inserts" a patch into the folder patches/docker-image/something.patch and creates an analogous series file for patch source code. Simply said, this code will never interfere with the upstream build process since this feature is not intended for use in upstream. It is rather meant for downstream users who know what they are doing. Now they just have an option to patch their images. Everything works on all layers of the Docker image and stores a report of applied patches which can then be seen in /etc. This mechanism is similar as debian patch quilt. Change-Id: I61d0790c5d4d070b7ea9e8c99c0a76ff5d22bf9d
2024-10-03aarch64: Exclude syslinux from ironic conductor packagesBartosz Bezak1-1/+5
The 'syslinux' package is not available on aarch64, so it is only included in the ironic conductor packages for x86_64 systems. Related-Bug: #1749780 Change-Id: I3eea308a0a70e47dd3b185eece106185b25616f5
2024-09-23Add missing iso packages to ironic-conductorRafal Lewandowski1-0/+4
Closes-Bug: #2067133 Change-Id: I097ad8988a4707173c19006d83b4d76cec5d0940
2024-01-17Fix openstack CADF audit maps and installationMichal Arbet1-0/+1
This patch fixes missing pycadf's audit maps for services and change the way how pycadf is installed. Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/905858 Closes-Bug: #2047941 Change-Id: I9b43d1a9990ad8aa7381ea81b0f2d692967be949
2023-08-29Add ironic-prometheus-exporterRobin Klostermeyer3-1/+53
This commit adds the ironic-prometheus-exporter, following the conventions used by the previously integrated exporters. '[The] Ironic Prometheus Exporter is a Tool to expose hardware sensor data in the Prometheus format through an HTTP endpoint.'[0] [0] https://opendev.org/openstack/ironic-prometheus-exporter Change-Id: If833f1f4a33c27cdc941dcc7cd5bbb06b26e1eaf
2023-02-15Remove ipxe code for Ubuntu FocalPierre Riteau1-8/+1
The ipxe package in Ubuntu Jammy includes snponly.efi [1]. Remove code to handle Focal in which snponly.efi is absent from the ipxe package. [1] https://packages.ubuntu.com/jammy/all/ipxe/filelist Change-Id: I5f494de36e6400b5486c1fb786b73c9e1512a046
2022-10-10Fix writable rootwrap/privsep configRadosław Piliszek1-3/+1
Fixes a hypothetical security issue related to privilege escalation via rootwrap/privsep. A potential vulnerable service could previously allow writes to its rootwrap/privsep config and thus allow for more commands to be run with root privileges via rootwrap/privsep. For a succesful attack, this would also require the service to allow to run arbitrary commands via rootwrap/privsep. Thus far, no such vulnerabilities have been reported and thus this fix is simply strengthening the container images against such an issue in the future. Change-Id: I92c81c77e6a16570a108cde8031f7977930fb02a Closes-Bug: #1874298
2022-10-03Fix ironic-pxe EFI path for rockyMichal Nasiadka1-2/+2
Change-Id: I6c82ef5b148b3ebdc8241871117dbe6cd68ed070
2022-09-30Add RockyLinux 9 supportMichal Nasiadka1-3/+3
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/859570 Change-Id: I7af51d07b8a939c908aa072294061def57dd67de
2022-04-22adjust permissions on _extend_start files (part II)Marcin Juszkiewicz2-2/+2
Tim Shearer started it in 1d96a2bbe1b536b7d7f4cdbf55c6dabae6d058ae. Since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: Ia1797c32fc6a35f9f077c673abf4d8e16e51a760
2022-04-21flatten images a bitMarcin Juszkiewicz1-9/+7
As we have one type of images now some RUN calls could be merged so we will have less layers in resulting images. Change-Id: I5178c58fbd8c65efe825dc249c0f1368ef0fe8e0
2022-04-11Adjust permissions on _extend_start files.Tim Shearer1-1/+1
Explicitly set the permissions on the kolla-toolbox kolla_extend_start file. Also, since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0
2022-04-09docker: drop binary partsMarcin Juszkiewicz3-114/+35
Big patch drops all mentions of binary images support. Suggestions are welcome how to split it into parts or handle better. Change-Id: I5d5a46c6ce7734ceb8b844e17b43e359d7cac6e3
2022-04-05ironic: make tftpboot and httpboot paths configurableMark Goddard4-24/+33
This is needed to support PXE and iPXE at the same time. We will move /tftpboot and /httpboot to /var/lib/ironic/. With these paths configurable via an environment variable, we can support a clean transition. This patch also cleans up pxelinux part, making it analogous to grub and ipxe parts. RHEL leftover mention is removed. Co-Authored-By: Radosław Piliszek <radoslaw.piliszek@gmail.com> Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/832159 Change-Id: I1ae81217c8bbf606c903c8009a372662ca3ab08c
2022-02-10ironic: Fix UEFI & iPXE bootloader filenamesMark Goddard1-0/+17
When using Ironic with UEFI boot mode and iPXE booting, nodes will attempt to chainload iPXE using a Network Boot Program (NBP). This is configured in Ironic via [pxe] uefi_ipxe_bootfile_name, and the default since Xena is snponly.efi. In Wallaby and earlier releases, the default was ipxe.efi. These files need to be available in the /tftpboot directory of the ironic-pxe image. The current default of snponly.efi was not present for any supported distros. ipxe.efi was present for Debian/Ubuntu but not CentOS, which appends the architecture to the filename (e.g. ipxe-x86_64.efi). This change ensures that both ipxe.efi and snponly.efi exist in /tftpboot for all supported distributions, ensuring that both the current and previous Ironic defaults should work. Where these files have different names, we use symlinks to allow for any deployers overriding the filenames in configuration. Closes-Bug: #1959203 Change-Id: I79e78dca550262fc86b092a036f9ea96b214ab48
2022-01-26Use distro provided GRUB efiXinliang Liu2-18/+30
Use distro provided GRUB efi instead of creating it like ironic GRUB setup doc[1]. This avoids below ubuntu ironic-python-agent images PXE booting failure. ---------- error: invalid magic number. error: you need to load the kernel first. Press any key to continue... ---------- This also fixes x86_64 uefi pxe booting issue by setting up GRUB efi for x86_64. Besides, GRUB setup only needs to do once at bootstrap stage. [1]: https://docs.openstack.org/ironic/train/install/configure-pxe.html#uefi-pxe-GRUB-setup Closes-Bug: #1879265 Change-Id: I8be5bdf5f1a62751aefe6bd0959e8f558fcfe591
2021-07-28drop leftovers of RHEL supportMarcin Juszkiewicz1-2/+2
As a project we never built RHEL based images so support for them was not tested. Change-Id: I27dfe34ade088228d71f6857ec4f3ab28ee63915
2021-05-11Drop ppc64le supportMarcin Juszkiewicz1-11/+3
We do not test support for ppc64le on CI or other systems. In previous cycles it was used by TripleO and now they have own way. Change-Id: Ibd955869a6f9485dfa4d08a8ad2f4b28b7d59c15
2020-09-17Merge "ironic-pxe: RHEL/CentOS: install AArch64 modules on all GRUB ↵Zuul2-5/+6
architectures"
2020-09-08Merge "Enable mod_wsgi in Ironic API and Inspector container"Zuul1-2/+0
2020-09-06ironic-pxe: RHEL/CentOS: install AArch64 modules on all GRUB architecturesYaakov Selkowitz2-5/+6
grub2-efi-aa64-modules ships in RHEL and CentOS on all GRUB architectures (x86_64, ppc64le, aarch64, but not s390x), and therefore can be used on any of them to support heterogeneous clusters with AArch64. Change-Id: Icf7e7bfddec89c4aec89410884480539b6bbfd74
2020-08-19Enable mod_wsgi in Ironic API and Inspector containerJames Kirsch1-2/+0
This patch modifies the Dockerfile for both the Ironic API and Inspector so that the 'root' user executes the container setup scripts. This enables the container httpd configuration script to execute. Change-Id: I02b58ac571cd4eb3b9d4a814fe0cb907a3564e23
2020-08-18ironic-pxe: add syslinux-tftpboot on ppc64leYaakov Selkowitz1-1/+1
syslinux-tftpboot was made installable on and shipped for ppc64le in RHEL and CentOS 8.1. Change-Id: I2135d6477d07e8786b81e6e3ea9f3367fc5e3ec6
2020-08-10Refactor httpd install to base imageJames Kirsch2-38/+5
Refactor installing and initial setup of httpd and mod wsgi from individual services to base image. Change-Id: I651a55a9ebe258ef403d33de010a4dfb368a4021
2020-07-07copy rootwarp files form venv in ironic baseSean Mooney1-1/+1
This change modifies the ironic base container to copy rootwarp filters from the virtual env rather than the source code directory. This is need because some required filters have been moved to ironic-lib and are not present in the /ironic dir. The rootwrap filters are not automitaclly installed in /etc/... due to kolla use of virtual envs and https://github.com/pypa/wheel/issues/92 Closes-Bug: #1886663 Change-Id: Idb0a675d92bab8b9a0cf5209f0a06e996e96033c
2020-04-15Remove support for CentOS 7Marcin Juszkiewicz3-80/+14
With the move to RHEL/CentOS 8 we no longer have Python 2 in our images so there is no need for checking which Python version (2.x or 3.x) is used inside of containers. We also no longer have to support yum as a value for distro_package_manager. Partially-Implements: blueprint centos-rhel-8 Change-Id: Ie45cf3465fedddbde7856961527421883ba3d5c9
2020-03-01Add block labels to all DockerfilesChristian Berendt4-0/+8
Change-Id: I9692dda817ef134d647247431565e1b58cf9da41
2020-02-26Actually disable EPEL, and epel-modularMark Goddard1-1/+4
The disable_extra_repos macro accepts a list as its only argument. We were calling it like this to disable EPEL: disable_extra_repos('epel') The macro interpreted this as a request to disable three repos, e, p, l. Thanks Python! Type validation to be improved separately. Additionally, on CentOS 8 the EPEL repository was not included in the repository mapping file, repos.yaml. There is also another EPEL repository on CentOS 8, epel-modular, which is enabled by default after installing epel-release. This change adds mappings for epel and epel-modular repos to repos.yaml, and fixes the disabling of epel in the base image, as well as disabling epel-modular. There are some cases where EPEL is still used (it seemed a bit too easy...), and the repository has been enabled for these images: * bifrost-base (nginx) * ironic-conductor (C7 only, shellinabox) * freezer-base (C7 only, trickle) * gnocchi-base (C8 binary only, python3-boto3) * mariadb (pv) * mongodb (C7 only, mongodb) * nova-spicehtml5proxy (C7 only, spice-html5) * telegraf (C7 only, python2-pip) A few other things were changed: * ironic-conductor does not require the ceph repo * python3-pika is no longer installed in the openstack-base image Related: blueprint remove-epel Change-Id: I3761825239dfc462072383cde6276c4fb3e1bf12
2020-02-06Add ssh clients to Ironic Conductor containerAntony Messerli1-0/+4
Adds ssh clients to Ironic Conductor container for ansible deploy interface. Change-Id: Ib995c6ebe5ee76ee1a39e4b5918a79bd61b87a01 Closes-Bug: #1862079
2020-02-04Merge "Adds python3-systemd for ansible deploy interface"Zuul1-0/+3
2020-02-01CentOS 8: Relax ironic iPXE EFI bootloader locationMark Goddard1-1/+1
CentOS 7 had ipxe.efi. CentOS 8 has ipxe-i386.efi and ipxe-x86_64.efi. Use a wildcard to copy any of these that are present. Change-Id: I6d409e56b424a039f5aff9af86ca1b026c2c6286 Partially-Implements: blueprint centos-rhel-8
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 20:19:49 +0000