summaryrefslogtreecommitdiff
path: root/docker/keystone
AgeCommit message (Collapse)AuthorFilesLines
2020-04-14Ensure proper JSON in keystone bootstrapRadosław Piliszek1-1/+3
This fixes the issue when keystone-manage output included backslashes and/or double quotation marks which broke JSON string. Change-Id: Ifae18c407210c12745d29fc4c95dca69aeafe6a8 Closes-bug: #1866017 (cherry picked from commit 33d184a731458bb45d1206bdae4fb172629a76e7)
2020-02-26CentOS 8: Allow SSH access to keystone_ssh and nova_sshMark Goddard1-0/+7
The centos:8 image contains a /run/nologin file, which prevents SSH access to it. Remove this file in the keystone_ssh and nova_ssh images to allow login via SSH. Change-Id: I59dc2c4207af6812501b6c6acdb34e51a3e848c4 Partially-Implements: blueprint centos-rhel-8 (cherry picked from commit 892ae92d971fd7a2c8d39e416512bb69f7fd833f)
2020-02-26CentOS 8: Update packages in imagesMark Goddard1-0/+8
* Some further changes for python2 vs python3 packages * Allow rabbitmq 3.7.*, since a newer erlang is available * Switch from qemu-img-ev to qemu-img on CentOS 8 * bridge-utils no longer available on CentOS 8 * libvirt-daemon-driver-lxc no longer available on CentOS 8 * Mark some more images buildable for CentOS 8 Depends-On: https://review.opendev.org/709553 Change-Id: Iaf5b68ff6d944ae730ca0b1d5832172c106a6c08 Partially-Implements: blueprint centos-rhel-8 Partially-Implements: blueprint centos-rhel-python-3 (cherry picked from commit 4b4e26262b9e03190c639481fb60a8f4f92c532a)
2020-02-20Merge "Refactor Apache httpd setup" into stable/trainZuul1-11/+2
2020-02-05Change fetch_fernet_tokens.py behaviour to check for minimum number of tokensMichal Nasiadka1-2/+2
Change is required to properly implement logic in fernet-node-sync.sh on kolla-ansible side - to add a check if fernet key store is populated with required number of tokens. Change-Id: I51ed61e34a1dd79532b4528e56a9cd9011d46e6d Related-Bug: #1846789 (cherry picked from commit 267cb8b14ae8472d00e09c2b5e35bda7de2de54f)
2020-01-14Refactor Apache httpd setupMark Goddard1-11/+2
All Apache httpd setup has been moved to a new helper script, kolla_httpd_setup. This includes the existing clean of /run/httpd, /var/run/httpd, /tmp/httpd etc. Horizon has an additional bit of Apache config for Debian/binary, which has been kept in extend_start.sh for horizon. Change-Id: Ia2af74b69c151db0bd7e452460b0babcee50b282 Related: blueprint centos-rhel-8 (cherry picked from commit 8484190e77e4237247dac7fba128e5a111fc9918)
2020-01-14Adapt fetch-fernet-tokens script to Python 3Michal Nasiadka1-1/+1
Backport: train Closes-Bug: #1859047 Change-Id: I9032e43bffa3a3de6c33a4ab59f65bafb0129dd5
2019-12-09Fix keystone bootstrap error message displayMark Goddard1-1/+5
In some situations, Keystone bootstrap can fail, and then unhelpfully fails displaying the error message output by the 'keystone-manage bootstrap' command. This appears to be due to unprintable control characters in the error message which prevent the output of the script from being valid JSON. This change fixes the issue by piping the output through 'cat -v', which replaces unprintable characters with control codes. Change-Id: I82444bc2272311023cc9e92c5a298d1c4c87483b Closes-Bug: #1855701 (cherry picked from commit bcca3fabe305c1e206fdb231c31809ceff2d4774)
2019-09-18Remove support for OracleLinuxMark Goddard1-3/+2
We have agreed to remove support for Oracle Linux. http://lists.openstack.org/pipermail/openstack-discuss/2019-June/006896.html Change-Id: I961dfba1aeef2c509ecdaf376dfe6928926ffb39 Depends-On: https://review.opendev.org/682858
2019-06-07Merge "Debian/Ubuntu: more python3 packages for binary"Zuul1-1/+1
2019-06-06Debian/Ubuntu: more python3 packages for binaryMark Goddard1-1/+1
backport: Stein During the switch to Stein UCA, we did not switch all packages to python 3 for Debian/Ubuntu binary images. This change switches some more of those packages. Change-Id: I0bff21384d88ea678608392de2db1ba418c96665 Co-Authored-By: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
2019-06-06Debian/Ubuntu: move to Python 3 for source imagesMarcin Juszkiewicz1-2/+2
Commit 43b74ccc157c0b50138c3785ed91dab504895571 enabled use of Python 3 based packages but not switched to use Python 3. Some of images still contain Python 2. There are two reasons: - Ceph (ceph-common depends on Py2) - python3-ldappool on Ubuntu 18.04 In Ceph situation Py3 packages were added. For second one we can not do anything - Py2 dependency got dropped in Ubuntu 18.10 version. Removed neutron-server-plugin-networking-infoblox due to being not maintained. Once https://review.opendev.org/#/c/657578/ get merged someone may revert that part. Implements: blueprint debian-ubuntu-python3 Depends-on: Ie2a1077f7def0743f1403341985e2109aa490026 Change-Id: Ibfe0c2b8be98db56c61f74fb0247488ab3749ef4
2019-06-03create missing apache2 directory on Debian/UbuntuMarcin Juszkiewicz1-0/+1
Ubuntu/source deployment of several images (horizon, placement-api, zun) failed with: + exec /usr/sbin/apache2 -DFOREGROUND apache2: Syntax error on line 80 of /etc/apache2/apache2.conf: DefaultRuntimeDir must be a valid directory, absolute or relative to ServerRoot Change-Id: Ie2a1077f7def0743f1403341985e2109aa490026
2019-05-09Fix bandit failure B105 in keystone fernetMark Goddard1-1/+2
>> Issue: [B105:hardcoded_password_string] Possible hardcoded password: '/etc/keystone/fernet-keys' Severity: Low Confidence: Medium Location: docker/keystone/keystone-fernet/fetch_fernet_tokens.py:27 More Info: https://bandit.readthedocs.io/en/latest/plugins/b105_hardcoded_password_string.html Ignore bandit failures on this line. Change-Id: I9828c23e4bcec7553a69aa5f20e990e0ef0538ea Closes-Bug: #1828416
2019-03-12Add python3 packages for RHEL systemsAlex Schultz2-5/+35
RDO is currently working on python3 support for the next version of CentOS/RHEL based systems. This package uses the distro_python3 flag that was added as part of I4028991bad92c0e8e21066cc4173c06ce5eba393 to use the python3 specific package names. This change only adds python3 package names for RHEL systems. Conflicts-With: https://review.openstack.org/#/c/636457/ Change-Id: Iad6b70b433a0dd1b0f8ae6790fd280594517661a Related-Blueprint: python3-support
2019-02-28debian/ubuntu: make use of Python3 based packagesMarcin Juszkiewicz1-2/+2
Both Ubuntu Stein UCA and Debian 'buster' migrated their OpenStack packages to Python 3. Note that Debian 'buster' is not released yet and contains Rocky packages. Stein ones will be available later. Co-Authored-By: Lee Yarwood <lyarwood@redhat.com> Co-Authored-By: Eduardo Gonzalez <dabarren@gmail.com> Change-Id: I160f79cc57f54ec3eac857c5babd1a6e2656d228
2019-01-17Use base_package_typeAlex Schultz4-12/+12
This change updates the docker files to use base_package_type instead of doing specific distro checks for the rhel/deb generic cases. The base_distro is still available and is used when a specific distro needs a customization but if the differences are purely rpm vs deb, then the base_package_type can be used. Change-Id: I8d720bb185df65a0178061ccf20b1ab2265da2c5
2018-07-10Stop using deprecated rpm package namesMartin André1-2/+2
These packages produce a warning during the installation, we should switch to their new names, usually to be specific about their use of python2. Change-Id: I0a80e822f64222d9a32aabd1fd834bcf794d6320
2018-06-15Merge "add support for keystone federation"Zuul1-0/+8
2018-06-14add support for keystone federationLars Kellogg-Stedman1-0/+8
This adds the Apache mod_auth_openidc and mod_auth_mellon packages to the Keystone container to support Keystone federation (as described in https://docs.openstack.org/keystone/9.3.0/configure_federation.html) Change-Id: Ia32176eb33737e6f7425bd5e63b4f95eb595cd5f
2018-06-08Remove the unused kolla_kubernetes script from keystonezhulingjie2-36/+0
Change-Id: I9eda6e6279ff70598d4d20487edcb682121fd54d
2018-05-29Stop showing passwords when bootstrap script is ranJoshua Harlow1-2/+0
Currently this causes bash to echo all lines parsed and executed; which makes it not so nicely output the bootstrapping password. This is not something we should encourage and have show up in peoples logs or other so stop doing that. Change-Id: Iac963a5df393d0359b4c8f93b8756ca168f6f193
2018-05-24keystone: Switch from mod_auth_kerb to mod_auth_gssapiJuan Antonio Osorio Robles1-4/+4
The packages needed for authentication using kerberos for keystone landed in a recent patch [1]. Unfortunately, shortly after the patch merging I was informed that the preferred module is mod_auth_gssapi nowadays (given that there is a planned deprecation for mod_auth_kerb). [1] I9ef972ea5a8e9cf4d1ed43ef27203576d9382822 Change-Id: I5f1aa4a959fd91b164a697e98e253fcab0fc1572
2018-05-23Enable packages for kerberos authentication for keystoneJuan Antonio Osorio Robles1-2/+27
This adds the packages required to do kerberos authentication with keystone. Change-Id: I9ef972ea5a8e9cf4d1ed43ef27203576d9382822
2018-04-18Merge "Do not require the bootstrap password to come in via arguments"Zuul1-0/+5
2018-03-26Do not require the bootstrap password to come in via argumentsJoshua Harlow1-0/+5
Currently when this is being ran, and say ara is being used to capture the running of kolla-ansible ara will capture the full command line ran (even if no_log is set); because by default these modules do not hide what they are running. So to avoid the situation where the command line shows the password have this also be able to take in the password via an environment variable as well (which ara will not capture). Change-Id: I4d42d592d8031d0f3923bccc6b2db1149af08e75
2018-01-23Remove customizable for plugins_pip_packagesMartin André1-1/+1
The pip packages are normally already configurable with the <image_name>_pip_packages variable. It doesn't make much sense to make the list of packages installed with the plugins mechanism configurable via the <image_name>_plugins_pip_packages variable too. And even if we wanted to, the parameter to the `customizable()` function should be 'plugins_pip_packages' and not 'pip_packages'. This commit removes the customizable bits from the plugins install macro, at least until we get a good use case for it. Change-Id: I90dd28b8c5d981e6028af353e34645712ef09b0b
2017-12-19Skip plugins install for keystone binary buildsMartin André1-8/+9
There should be no pip install in binary builds, move the installation of the downloaded bits where it belongs into the 'source' install_type section. Change-Id: I6d8609d072d18e635250df1c1e9aa687ce1f769d
2017-10-31Allow passing extra parameters to keystone-manage in extend_startJuan Antonio Osorio Robles1-4/+5
This allows deployers to pass arbitrary parameters to the kesytone-manage commands. Which can be useful to pass the keystone log dir and file as an empty environment variable, which, in turn, will allow us to make the db sync command to log to stdout instead of the file. Change-Id: Id9e8c641a6b00725d2f5c9623b05854a1b4e2af2
2017-06-02Merge "Remove all Heka related remaining stuff"Jenkins1-4/+0
2017-05-29Remove all Heka related remaining stuffBertrand Lallau1-4/+0
Heka has been removed and replaced by fluentd. Refer to https://review.openstack.org/#/c/437874/ Change-Id: I989e5d71b5ba4d036dd45c02b3923c5bf27a04ed
2017-05-10Only copy plugin-archive into image for source buildsMartin André1-0/+3
The plugin mechanism is meant to be for source install type only. Change-Id: I1371a253236b09dc62ea91dce6d652e1c5603015 Closes-Bug: #1681345
2017-05-03Override image's meta info.Jawon Choo4-4/+4
centos based images have wrong label info, these changes fix own image's name and build-date. Change-Id: I1d13f8f386c8db12b5fbe5f8ecbbf9e3fbb4ba1c Closes-Bug: #1680341
2017-04-20Merge "Use LABEL instead of MAINTAINER (deprecated) in all Dockerfile.j2"Jenkins4-4/+4
2017-04-20Add missing cleanup step for new apache imagesMartin André1-2/+0
A few new images got apache as part of blueprint apache-packages-for-apis without a cleaning up. Without this step the containers may fail to restart due to runtime files already present. This commit fixes it for all images with the exception of heat-base so that it can be cleanly backported to stable/ocata. It also removes the unused APACHE_DIR variable from freezer-api and keystone extend_start.sh script. Change-Id: I47d75221b3d1aae91f11d3e0da83e221a00315b7 Closes-Bug: #1679565
2017-04-20Use LABEL instead of MAINTAINER (deprecated) in all Dockerfile.j2Chen4-4/+4
Use LABEL instruction instead of MAINTAINER (deprecated) instruc- tion as suggested by Docker's official dockerfile guide. docs.docker.com/engine/reference/builder/#maintainer-deprecated Closes-Bug: #1683652 Change-Id: Ie87a1ddf31aefcd0b623fd2837d78de420e76898
2017-04-04debian: enable all images enabled for UbuntuMarcin Juszkiewicz3-5/+5
Debian support is not maintained in Kolla so it got a bit behind Ubuntu one. This changeset enables Debian for all images. Jessie (even with backports) may be too old for some images though. Also unify distro check to ['debian', 'ubuntu'] to keep alphabetical order like it is done for RPM distributions. Partially-Implements: blueprint multiarch-and-arm64-containers Change-Id: I056233fbfa277e0e2360c07c3f80d9558c554357
2017-03-28Alphabetize packagesEduardo Gonzalez1-6/+6
Some images have packages sorted alphabetically and some not. Unify common style between all images. Change-Id: I906ed89c10b12886665618752f525ba71d83d991
2017-03-27RHEL: Add mod_ssl for services running over httpdJuan Antonio Osorio Robles1-2/+6
This apache module is necessary for when one wants to use TLS for the services running over httpd. This only addressed RHEL based systems at the moment, since there is no such package available for Ubuntu. This requires apache2.2-common which will carry a lot more dependencies; So I think this should be handled and decided in a separate patch. when installing mod_ssl in RHEL-based distributions, an ssl.conf file is installed in the /etc/httpd/conf.d directory. This file tells httpd to listen on port 443; however, we don't want to do this by default, since this should be explicitly enabled by the container's configuration. This line is thus removed from the configuration. A release note was added, which specifies this. And the last sentence can be removed if this is addressed for debian/ubuntu as well. Related-Bug: #1675490 Co-Authored-By: Martin André <m.andre@redhat.com> Change-Id: Id6215d31547247309d43c031e163fa9e4c4ec5dc
2017-03-23Implement Keystone zero-downtime upgradeDuong Ha-Quang1-0/+19
- Introduce database upgrade into keystone extend_start.sh script. [1] [1] http://docs.openstack.org/developer/keystone/upgrading.html#upgrading-without-downtime Change-Id: Ic615026df2ce8fa79a3efe969d0dda9797c9e79f Closes-Bug: #1634016
2017-03-15Refactor and enable shell accessMohammed Naser1-0/+2
When installing from binary, packaging tools create a user for Keystone which does not have a shell. This results in fernet token operations failing due to the fact that `rsync` cannot connect over SSH because the Keystone user cannot login. This patch addresses this issue by enabling shell access to the Keystone user, it also refactors the Nova SSH controller to use the pre-existing macro. Change-Id: Ic753a94311c5d7d72a82d91c1279dfe982e9afbd Related-Bug: #1617902
2017-02-17Use install-pip macro in most source imagesChao Guo2-2/+14
1. Enable customization of pip packages in source branch of most images 2. All pip packages install uniformly through install-pip macro, user can easily customize his own pip command (For example using a mirror) Co-Authored-By: Mauricio Lima <mauriciolimab@gmail.com> Change-Id: If09582039f690fa4136e8f33200d5da15e092da7
2017-02-05Remove include_header and include_footer in all DockerfilesJeffrey Zhang3-3/+0
include_header and include_footer parameter is already removed, remove them in all Dockerfiles. Add missing footer block. Change-Id: I90da03eb9f95a3827361d5f5ede65fde7d6be2b3
2017-02-03Merge "Containerized sshd does not work with older PAM"Jenkins1-0/+2
2017-02-03Containerized sshd does not work with older PAMVladislav Belogrudov1-0/+2
sshd containers don't let logins on some systems with older PAM library because /proc/self/loginuid is not always readable or writeable. Examples of possible failures on such systems are erroneous cold and live migrations. This fix does not upgrade PAM but makes pam_loginuid optional for nova_ssh and keystone_ssh. More information: https://github.com/docker/docker/issues/5663 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=726661 https://git.fedorahosted.org/cgit/linux-pam.git/tree/modules/pam_loginuid/pam_loginuid.c#n61 Change-Id: Ic14255b042ceedcff536c062bdcba00502af7a87 Closes-Bug: #1651395
2017-01-20remove /var/log/apache on keystone dockerfilezhubingbing1-2/+2
Change-Id: Ie32a0dba2c4d482570605f1eea78eca086fe04cf
2017-01-17use static uid/gid in imagesSam Yaple1-3/+3
This centralizes all user and group creation into a single source. This will fix any current and furture uid/gid mismatches (such as with nova-libvirt). In the process, we also unify users between the distros in a standard way. The users in the following containers change from thier defaults: Ubuntu: _chrony user is now chrony Ubuntu: memcache user is now memcached All: qemu user is used for ownership and socket permissions All uid and gid numbers are customizable via kolla-build.conf Co-Authored-By: Kris Lindgren <klindgren@godaddy.com> Change-Id: I120f26ab0683dc87d69727c3df8d4707e52a4543 Partially-Implements: blueprint static-uid-gid
2017-01-05Remove footer block and variable in *-base imagesJeffrey Zhang1-2/+0
Change-Id: I39aa88489f744f779150695f3f55ef80d42e1c61 Closes-Bug: #1653247
2016-11-24Support adding customized plugin to keystone imagejackning1-1/+5
Kolla supports adding plugin to horizon and neutron-server images now, but it doesn't support adding plugin to keystone image. As keystone itself supports adding authentication plugins, there is a good chance that user may implement their own plugins for keystone authentication and identity. It would be better that kolla supports adding plugin for keystone image just the way like horizon and neutron-server. Change-Id: Id75c387668c6277efae05b59063f226843aa2a25 Closes-Bug: #1644133
2016-11-04Merge "Remove Fedora support"Jenkins3-4/+4
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 17:57:22 +0000