aboutsummaryrefslogtreecommitdiff
path: root/docker/keystone
AgeCommit message (Collapse)AuthorFilesLines
2026-05-06Drop apache installation outside of httpd container22.0.0.0rc1Michal Nasiadka2-6/+0
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/986483 Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/986352 Change-Id: Ia66dde09bbbad2a5a9e67a8c642f3223ca38be43 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-28keystone: Remove wsgi fileMichal Nasiadka2-3/+0
Kolla-Ansible has been migrated long ago to use uwsgi app instead of file. Change-Id: I347c6f89136427347e9443c85230632474adb7eb Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-28Remove httpd_setup calls from api containersMichal Nasiadka1-3/+0
We have dropped mod_wsgi support from services in [1]. [1]: https://review.opendev.org/c/openstack/kolla-ansible/+/982414 Change-Id: Ie5da8427706dfb74bad4e174c990355a6870114c Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-02Move repo enablement to respective rpm blocksMichal Nasiadka1-3/+4
Currently we are enabling repos irrespective of rpm/deb statement blocks and not failing in the method used if a repository is missing. Downside is - we might be producing one more layer, but it probably is a more logical approach. This is required for adding rpm support in repos.yaml that will also include failing on missing repositories. Change-Id: I5479c5c935760f00fe4cd307366f261deee3199f Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-08-07keystone: Add local wsgi fileMichal Nasiadka2-6/+5
It has been removed with I9fa7cd60bf27768db06f69681675fce2e55712af Change-Id: Ib42be3d56bdb64247ac6f17b8ac1f1baa873f475 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-07-17Merge "Move to CentOS Stream 10"Zuul2-1/+5
2025-07-16Move to CentOS Stream 10Michal Nasiadka2-1/+5
Known missing packages: - mod_auth_mellon - missing SAML support in Keystone/Horizon - built in Kolla COPR - glusterfs-fuse in manila-share - built in Kolla COPR - collectd/telegraf - no opstools repository - redis - needs a switch to valkey - python3-ethtool - not required for neutron-mlnx-agent since 6 years [1] Building packages in Kolla COPR is a temporary solution until these show up in EPEL10. [1]: Id2cae3ac9ff049e9fc8225551f99e1e99a87fc65 Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/951751 Change-Id: I7074fabcf95184fcfd2561648ae1e05acfb0bc11 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-06-09keystone: Remove ARGS to support uwsgiMichal Nasiadka1-1/+0
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/952093 Change-Id: I38688e442b995d38e9826fbb545b6ab09e06bdf5
2024-11-15Add mechanism for patching files in containersMichal Arbet4-0/+8
This patch adds a way to patch files in a Docker image built by Kolla. This is very useful for several reasons, specifically: - Custom modifications - The stable branch of some library has a fix but no pip package has been released - Eliminates the need to package your own pip packages - Eliminates the need to invent your own versioning to prevent upstream versioning - Eliminates the need to manage a pip server - In other words, it eliminates the need to get a wheel into the image and install it manually using any method not previously mentioned It is also highly desirable because, although Kolla can replace the source for a service with a custom URL for a tarball or its own Git repo, it cannot do this for dependencies pulled from pip. I would also like to point out that this is a feature with its own code path and works only if the user "inserts" a patch into the folder patches/docker-image/something.patch and creates an analogous series file for patch source code. Simply said, this code will never interfere with the upstream build process since this feature is not intended for use in upstream. It is rather meant for downstream users who know what they are doing. Now they just have an option to patch their images. Everything works on all layers of the Docker image and stores a report of applied patches which can then be seen in /etc. This mechanism is similar as debian patch quilt. Change-Id: I61d0790c5d4d070b7ea9e8c99c0a76ff5d22bf9d
2024-08-29keystone: Fix requests-kerberos installationMichal Nasiadka1-1/+9
Since it was bundled with plugins installation, and we did not have any plugins in keystone container - it was not installed at all. Adding in libkrb5 dependencies for requests-kerberos. Closes-Bug: #2078305 Change-Id: I51c69d0673280e351daa410d943f769d33a10d6c
2024-01-08Stop removing missing /run/nologin in RPM imagesPierre Riteau1-4/+0
This code was valid for centos:8 and centos:stream8, but is not required for centos:stream9 or rockylinux:9 which do not include this file. Change-Id: I50f78d73afe0944dd91998ab9799fa2f36cc46a3
2023-03-29keystone: Fix for missing libldap-common package for debianRafal Lewandowski1-0/+1
Closes-Bug: #2009484 Change-Id: I01578289e65010748bfaf6d6b81861764aa62368
2022-10-10Fix writable rootwrap/privsep configRadosław Piliszek1-4/+2
Fixes a hypothetical security issue related to privilege escalation via rootwrap/privsep. A potential vulnerable service could previously allow writes to its rootwrap/privsep config and thus allow for more commands to be run with root privileges via rootwrap/privsep. For a succesful attack, this would also require the service to allow to run arbitrary commands via rootwrap/privsep. Thus far, no such vulnerabilities have been reported and thus this fix is simply strengthening the container images against such an issue in the future. Change-Id: I92c81c77e6a16570a108cde8031f7977930fb02a Closes-Bug: #1874298
2022-09-27Move to CentOS Stream 9Marcin Juszkiewicz1-2/+0
OpenStack 'zed' requires Python 3.8+ so RHEL 8 family has to go. This changeset moves to CentOS Stream 9 while move to RockyLinux 9 is planned as final solution. CI moved to CentOS Stream 9 nodes. Depends-on: https://review.opendev.org/c/openstack/kolla-ansible/+/839715 Change-Id: I113b9984294cf8663d3fc0c8840320e1d40ea731
2022-08-26Make keystone_bootstrap accept no ADMIN_URL tooRadosław Piliszek1-4/+12
To be able to drop the dummy arg. Change-Id: Ibcc3e6b4e6015604c218e384d87de7b9e9aed4c8
2022-08-09Remove Keystone admin endpointRadosław Piliszek1-3/+2
It can still be optionally enabled in Kolla Ansible. Change-Id: I34ec4a2e9505e9b4c1b8306b87fcd7242a0da227
2022-04-21flatten images a bitMarcin Juszkiewicz2-9/+9
As we have one type of images now some RUN calls could be merged so we will have less layers in resulting images. Change-Id: I5178c58fbd8c65efe825dc249c0f1368ef0fe8e0
2022-04-11Adjust permissions on _extend_start files.Tim Shearer3-3/+5
Explicitly set the permissions on the kolla-toolbox kolla_extend_start file. Also, since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0
2022-04-09docker: drop binary partsMarcin Juszkiewicz2-75/+24
Big patch drops all mentions of binary images support. Suggestions are welcome how to split it into parts or handle better. Change-Id: I5d5a46c6ce7734ceb8b844e17b43e359d7cac6e3
2020-08-11Remove weird depsRadosław Piliszek1-4/+5
This is a follow-up on "Refactor httpd install to base image" [1]. It seems a copy-paste algorithm was used to craft Dockerfiles for some httpd-enabled services which resulted in an abundance of ldappool packages getting installed, even in the 'source' case. This seems to have also kept ldappool at a lower version because it did not get updated via pip later. This patch deals with that and also moves ldap deps for Keystone to their proper place in 'source' case (extras). Note Keystone client gets installed in openstack-base. Cinder does not need to include Keystone either. [1] https://review.opendev.org/744037 Change-Id: I017d7a6a5d2b1ae6c04556dcf172453a36de5be7
2020-08-10Refactor httpd install to base imageJames Kirsch1-21/+3
Refactor installing and initial setup of httpd and mod wsgi from individual services to base image. Change-Id: I651a55a9ebe258ef403d33de010a4dfb368a4021
2020-06-02Stop to use the __future__ module.Hervé Beraud1-2/+0
The __future__ module [1] was used in this context to ensure compatibility between python 2 and python 3. We previously dropped the support of python 2.7 [2] and now we only support python 3 so we don't need to continue to use this module and the imports listed below. Imports commonly used and their related PEPs: - `division` is related to PEP 238 [3] - `print_function` is related to PEP 3105 [4] - `unicode_literals` is related to PEP 3112 [5] - `with_statement` is related to PEP 343 [6] - `absolute_import` is related to PEP 328 [7] [1] https://docs.python.org/3/library/__future__.html [2] https://governance.openstack.org/tc/goals/selected/ussuri/drop-py27.html [3] https://www.python.org/dev/peps/pep-0238 [4] https://www.python.org/dev/peps/pep-3105 [5] https://www.python.org/dev/peps/pep-3112 [6] https://www.python.org/dev/peps/pep-0343 [7] https://www.python.org/dev/peps/pep-0328 Change-Id: Ie97dcb610b6c723ba08a84ad79763bbbd4af20d9
2020-04-15Merge "Remove support for CentOS 7"Zuul3-37/+2
2020-04-15Remove support for CentOS 7Marcin Juszkiewicz3-37/+2
With the move to RHEL/CentOS 8 we no longer have Python 2 in our images so there is no need for checking which Python version (2.x or 3.x) is used inside of containers. We also no longer have to support yum as a value for distro_package_manager. Partially-Implements: blueprint centos-rhel-8 Change-Id: Ie45cf3465fedddbde7856961527421883ba3d5c9
2020-03-04Ensure proper JSON in keystone bootstrapRadosław Piliszek1-1/+3
This fixes the issue when keystone-manage output included backslashes and/or double quotation marks which broke JSON string. Change-Id: Ifae18c407210c12745d29fc4c95dca69aeafe6a8 Closes-bug: #1866017
2020-03-01Add block labels to all DockerfilesChristian Berendt4-0/+8
Change-Id: I9692dda817ef134d647247431565e1b58cf9da41
2020-02-01Merge "CentOS 8: Allow SSH access to keystone_ssh and nova_ssh"Zuul1-0/+7
2020-01-30Merge "CentOS 8: Update packages in images"Zuul1-0/+8
2020-01-30CentOS 8: Allow SSH access to keystone_ssh and nova_sshMark Goddard1-0/+7
The centos:8 image contains a /run/nologin file, which prevents SSH access to it. Remove this file in the keystone_ssh and nova_ssh images to allow login via SSH. Change-Id: I59dc2c4207af6812501b6c6acdb34e51a3e848c4 Partially-Implements: blueprint centos-rhel-8
2020-01-29CentOS 8: Update packages in imagesMark Goddard1-0/+8
* Some further changes for python2 vs python3 packages * Allow rabbitmq 3.7.*, since a newer erlang is available * Switch from qemu-img-ev to qemu-img on CentOS 8 * bridge-utils no longer available on CentOS 8 * libvirt-daemon-driver-lxc no longer available on CentOS 8 * Mark some more images buildable for CentOS 8 Change-Id: Iaf5b68ff6d944ae730ca0b1d5832172c106a6c08 Partially-Implements: blueprint centos-rhel-8 Partially-Implements: blueprint centos-rhel-python-3
2020-01-22Change fetch_fernet_tokens.py behaviour to check for minimum number of tokensMichal Nasiadka1-2/+2
Change is required to properly implement logic in fernet-node-sync.sh on kolla-ansible side - to add a check if fernet key store is populated with required number of tokens. Change-Id: I51ed61e34a1dd79532b4528e56a9cd9011d46e6d Related-Bug: #1846789
2020-01-13Adapt fetch-fernet-tokens script to Python 3Michal Nasiadka1-1/+1
Backport: train Closes-Bug: #1859047 Change-Id: I9032e43bffa3a3de6c33a4ab59f65bafb0129dd5
2019-12-11Refactor Apache httpd setupMark Goddard1-11/+2
All Apache httpd setup has been moved to a new helper script, kolla_httpd_setup. This includes the existing clean of /run/httpd, /var/run/httpd, /tmp/httpd etc. Horizon has an additional bit of Apache config for Debian/binary, which has been kept in extend_start.sh for horizon. Change-Id: Ia2af74b69c151db0bd7e452460b0babcee50b282 Related: blueprint centos-rhel-8
2019-12-09Fix keystone bootstrap error message displayMark Goddard1-1/+5
In some situations, Keystone bootstrap can fail, and then unhelpfully fails displaying the error message output by the 'keystone-manage bootstrap' command. This appears to be due to unprintable control characters in the error message which prevent the output of the script from being valid JSON. This change fixes the issue by piping the output through 'cat -v', which replaces unprintable characters with control codes. Change-Id: I82444bc2272311023cc9e92c5a298d1c4c87483b Closes-Bug: #1855701
2019-09-18Remove support for OracleLinuxMark Goddard1-3/+2
We have agreed to remove support for Oracle Linux. http://lists.openstack.org/pipermail/openstack-discuss/2019-June/006896.html Change-Id: I961dfba1aeef2c509ecdaf376dfe6928926ffb39 Depends-On: https://review.opendev.org/682858
2019-06-07Merge "Debian/Ubuntu: more python3 packages for binary"Zuul1-1/+1
2019-06-06Debian/Ubuntu: more python3 packages for binaryMark Goddard1-1/+1
backport: Stein During the switch to Stein UCA, we did not switch all packages to python 3 for Debian/Ubuntu binary images. This change switches some more of those packages. Change-Id: I0bff21384d88ea678608392de2db1ba418c96665 Co-Authored-By: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
2019-06-06Debian/Ubuntu: move to Python 3 for source imagesMarcin Juszkiewicz1-2/+2
Commit 43b74ccc157c0b50138c3785ed91dab504895571 enabled use of Python 3 based packages but not switched to use Python 3. Some of images still contain Python 2. There are two reasons: - Ceph (ceph-common depends on Py2) - python3-ldappool on Ubuntu 18.04 In Ceph situation Py3 packages were added. For second one we can not do anything - Py2 dependency got dropped in Ubuntu 18.10 version. Removed neutron-server-plugin-networking-infoblox due to being not maintained. Once https://review.opendev.org/#/c/657578/ get merged someone may revert that part. Implements: blueprint debian-ubuntu-python3 Depends-on: Ie2a1077f7def0743f1403341985e2109aa490026 Change-Id: Ibfe0c2b8be98db56c61f74fb0247488ab3749ef4
2019-06-03create missing apache2 directory on Debian/UbuntuMarcin Juszkiewicz1-0/+1
Ubuntu/source deployment of several images (horizon, placement-api, zun) failed with: + exec /usr/sbin/apache2 -DFOREGROUND apache2: Syntax error on line 80 of /etc/apache2/apache2.conf: DefaultRuntimeDir must be a valid directory, absolute or relative to ServerRoot Change-Id: Ie2a1077f7def0743f1403341985e2109aa490026
2019-05-09Fix bandit failure B105 in keystone fernetMark Goddard1-1/+2
>> Issue: [B105:hardcoded_password_string] Possible hardcoded password: '/etc/keystone/fernet-keys' Severity: Low Confidence: Medium Location: docker/keystone/keystone-fernet/fetch_fernet_tokens.py:27 More Info: https://bandit.readthedocs.io/en/latest/plugins/b105_hardcoded_password_string.html Ignore bandit failures on this line. Change-Id: I9828c23e4bcec7553a69aa5f20e990e0ef0538ea Closes-Bug: #1828416
2019-03-12Add python3 packages for RHEL systemsAlex Schultz2-5/+35
RDO is currently working on python3 support for the next version of CentOS/RHEL based systems. This package uses the distro_python3 flag that was added as part of I4028991bad92c0e8e21066cc4173c06ce5eba393 to use the python3 specific package names. This change only adds python3 package names for RHEL systems. Conflicts-With: https://review.openstack.org/#/c/636457/ Change-Id: Iad6b70b433a0dd1b0f8ae6790fd280594517661a Related-Blueprint: python3-support
2019-02-28debian/ubuntu: make use of Python3 based packagesMarcin Juszkiewicz1-2/+2
Both Ubuntu Stein UCA and Debian 'buster' migrated their OpenStack packages to Python 3. Note that Debian 'buster' is not released yet and contains Rocky packages. Stein ones will be available later. Co-Authored-By: Lee Yarwood <lyarwood@redhat.com> Co-Authored-By: Eduardo Gonzalez <dabarren@gmail.com> Change-Id: I160f79cc57f54ec3eac857c5babd1a6e2656d228
2019-01-17Use base_package_typeAlex Schultz4-12/+12
This change updates the docker files to use base_package_type instead of doing specific distro checks for the rhel/deb generic cases. The base_distro is still available and is used when a specific distro needs a customization but if the differences are purely rpm vs deb, then the base_package_type can be used. Change-Id: I8d720bb185df65a0178061ccf20b1ab2265da2c5
2018-07-10Stop using deprecated rpm package namesMartin André1-2/+2
These packages produce a warning during the installation, we should switch to their new names, usually to be specific about their use of python2. Change-Id: I0a80e822f64222d9a32aabd1fd834bcf794d6320
2018-06-15Merge "add support for keystone federation"Zuul1-0/+8
2018-06-14add support for keystone federationLars Kellogg-Stedman1-0/+8
This adds the Apache mod_auth_openidc and mod_auth_mellon packages to the Keystone container to support Keystone federation (as described in https://docs.openstack.org/keystone/9.3.0/configure_federation.html) Change-Id: Ia32176eb33737e6f7425bd5e63b4f95eb595cd5f
2018-06-08Remove the unused kolla_kubernetes script from keystonezhulingjie2-36/+0
Change-Id: I9eda6e6279ff70598d4d20487edcb682121fd54d
2018-05-29Stop showing passwords when bootstrap script is ranJoshua Harlow1-2/+0
Currently this causes bash to echo all lines parsed and executed; which makes it not so nicely output the bootstrapping password. This is not something we should encourage and have show up in peoples logs or other so stop doing that. Change-Id: Iac963a5df393d0359b4c8f93b8756ca168f6f193
2018-05-24keystone: Switch from mod_auth_kerb to mod_auth_gssapiJuan Antonio Osorio Robles1-4/+4
The packages needed for authentication using kerberos for keystone landed in a recent patch [1]. Unfortunately, shortly after the patch merging I was informed that the preferred module is mod_auth_gssapi nowadays (given that there is a planned deprecation for mod_auth_kerb). [1] I9ef972ea5a8e9cf4d1ed43ef27203576d9382822 Change-Id: I5f1aa4a959fd91b164a697e98e253fcab0fc1572
2018-05-23Enable packages for kerberos authentication for keystoneJuan Antonio Osorio Robles1-2/+27
This adds the packages required to do kerberos authentication with keystone. Change-Id: I9ef972ea5a8e9cf4d1ed43ef27203576d9382822
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 19:57:40 +0000