summaryrefslogtreecommitdiff
path: root/docker/keystone
AgeCommit message (Collapse)AuthorFilesLines
2017-04-20Use LABEL instead of MAINTAINER (deprecated) in all Dockerfile.j2Chen4-4/+4
Use LABEL instruction instead of MAINTAINER (deprecated) instruc- tion as suggested by Docker's official dockerfile guide. docs.docker.com/engine/reference/builder/#maintainer-deprecated Closes-Bug: #1683652 Change-Id: Ie87a1ddf31aefcd0b623fd2837d78de420e76898
2017-04-04debian: enable all images enabled for UbuntuMarcin Juszkiewicz3-5/+5
Debian support is not maintained in Kolla so it got a bit behind Ubuntu one. This changeset enables Debian for all images. Jessie (even with backports) may be too old for some images though. Also unify distro check to ['debian', 'ubuntu'] to keep alphabetical order like it is done for RPM distributions. Partially-Implements: blueprint multiarch-and-arm64-containers Change-Id: I056233fbfa277e0e2360c07c3f80d9558c554357
2017-03-28Alphabetize packagesEduardo Gonzalez1-6/+6
Some images have packages sorted alphabetically and some not. Unify common style between all images. Change-Id: I906ed89c10b12886665618752f525ba71d83d991
2017-03-27RHEL: Add mod_ssl for services running over httpdJuan Antonio Osorio Robles1-2/+6
This apache module is necessary for when one wants to use TLS for the services running over httpd. This only addressed RHEL based systems at the moment, since there is no such package available for Ubuntu. This requires apache2.2-common which will carry a lot more dependencies; So I think this should be handled and decided in a separate patch. when installing mod_ssl in RHEL-based distributions, an ssl.conf file is installed in the /etc/httpd/conf.d directory. This file tells httpd to listen on port 443; however, we don't want to do this by default, since this should be explicitly enabled by the container's configuration. This line is thus removed from the configuration. A release note was added, which specifies this. And the last sentence can be removed if this is addressed for debian/ubuntu as well. Related-Bug: #1675490 Co-Authored-By: Martin André <m.andre@redhat.com> Change-Id: Id6215d31547247309d43c031e163fa9e4c4ec5dc
2017-03-23Implement Keystone zero-downtime upgradeDuong Ha-Quang1-0/+19
- Introduce database upgrade into keystone extend_start.sh script. [1] [1] http://docs.openstack.org/developer/keystone/upgrading.html#upgrading-without-downtime Change-Id: Ic615026df2ce8fa79a3efe969d0dda9797c9e79f Closes-Bug: #1634016
2017-03-15Refactor and enable shell accessMohammed Naser1-0/+2
When installing from binary, packaging tools create a user for Keystone which does not have a shell. This results in fernet token operations failing due to the fact that `rsync` cannot connect over SSH because the Keystone user cannot login. This patch addresses this issue by enabling shell access to the Keystone user, it also refactors the Nova SSH controller to use the pre-existing macro. Change-Id: Ic753a94311c5d7d72a82d91c1279dfe982e9afbd Related-Bug: #1617902
2017-02-17Use install-pip macro in most source imagesChao Guo2-2/+14
1. Enable customization of pip packages in source branch of most images 2. All pip packages install uniformly through install-pip macro, user can easily customize his own pip command (For example using a mirror) Co-Authored-By: Mauricio Lima <mauriciolimab@gmail.com> Change-Id: If09582039f690fa4136e8f33200d5da15e092da7
2017-02-05Remove include_header and include_footer in all DockerfilesJeffrey Zhang3-3/+0
include_header and include_footer parameter is already removed, remove them in all Dockerfiles. Add missing footer block. Change-Id: I90da03eb9f95a3827361d5f5ede65fde7d6be2b3
2017-02-03Merge "Containerized sshd does not work with older PAM"Jenkins1-0/+2
2017-02-03Containerized sshd does not work with older PAMVladislav Belogrudov1-0/+2
sshd containers don't let logins on some systems with older PAM library because /proc/self/loginuid is not always readable or writeable. Examples of possible failures on such systems are erroneous cold and live migrations. This fix does not upgrade PAM but makes pam_loginuid optional for nova_ssh and keystone_ssh. More information: https://github.com/docker/docker/issues/5663 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=726661 https://git.fedorahosted.org/cgit/linux-pam.git/tree/modules/pam_loginuid/pam_loginuid.c#n61 Change-Id: Ic14255b042ceedcff536c062bdcba00502af7a87 Closes-Bug: #1651395
2017-01-20remove /var/log/apache on keystone dockerfilezhubingbing1-2/+2
Change-Id: Ie32a0dba2c4d482570605f1eea78eca086fe04cf
2017-01-17use static uid/gid in imagesSam Yaple1-3/+3
This centralizes all user and group creation into a single source. This will fix any current and furture uid/gid mismatches (such as with nova-libvirt). In the process, we also unify users between the distros in a standard way. The users in the following containers change from thier defaults: Ubuntu: _chrony user is now chrony Ubuntu: memcache user is now memcached All: qemu user is used for ownership and socket permissions All uid and gid numbers are customizable via kolla-build.conf Co-Authored-By: Kris Lindgren <klindgren@godaddy.com> Change-Id: I120f26ab0683dc87d69727c3df8d4707e52a4543 Partially-Implements: blueprint static-uid-gid
2017-01-05Remove footer block and variable in *-base imagesJeffrey Zhang1-2/+0
Change-Id: I39aa88489f744f779150695f3f55ef80d42e1c61 Closes-Bug: #1653247
2016-11-24Support adding customized plugin to keystone imagejackning1-1/+5
Kolla supports adding plugin to horizon and neutron-server images now, but it doesn't support adding plugin to keystone image. As keystone itself supports adding authentication plugins, there is a good chance that user may implement their own plugins for keystone authentication and identity. It would be better that kolla supports adding plugin for keystone image just the way like horizon and neutron-server. Change-Id: Id75c387668c6277efae05b59063f226843aa2a25 Closes-Bug: #1644133
2016-11-04Merge "Remove Fedora support"Jenkins3-4/+4
2016-11-03Fix keystone image building issueJeffrey Zhang1-4/+4
wsgi.py file is remove in O. should move to keystone-wsgi-admin and keystone-wsgi-public script. TrivialFix Change-Id: If86c407fd208adc5be6df54ac05dc39ee1cf757e
2016-11-03Remove Fedora supportChristian Berendt3-4/+4
Closes-bug: #1616387 Change-Id: Id97f88b9baa3d48d33ce120962450a374282d044
2016-10-19Add validate no new line at end of fileJeffrey Zhang2-2/+2
TrivialFix Change-Id: I817aa52caf56b7d54b266e553db6db1ceb38b773 Signed-off-by: Jeffrey Zhang <zhang.lei.fly@gmail.com>
2016-10-13Merge "Fix keystone fernet file exchange via ssh"Jenkins3-5/+13
2016-10-12Fix keystone fernet file exchange via sshChristian Berendt3-5/+13
* install openssh client in keystone-fernet container * install rsync in keystone-ssh container * fix syntax issue in ssh configuration * copy ssh configuration into keystone-fernet container * copy id_rsa.pub into keystone-ssh container * copy id_rsa into keystone-fernet container * use full path to ssh binary in used scripts * add missing newlines at EOF * when using type source set /var/lib/keystone as home directory for the user keystone Co-Authored-By: Jeffrey Zhang <jeffrey.zhang@99cloud.net> Change-Id: Id6b41030056a69f6516a054beb2fc0e08226e876 Closes-bug: #1623013
2016-10-09Change keystone.log's permit to keystone:keystonejackning1-0/+6
At present, keystone.log's user:group permit is root:kolla, when got token from keystone, it failed. The reason is that: Permission denied. So it shoud be changed keystone:keystone. Change-Id: Ibbbf1d88ba16e5040f9068ea9948373d10593514 Closes-Bug: #1631685
2016-09-16Allow operators to customise keystone source installPaul Bourke1-1/+3
TrivialFix Change-Id: I5fb6e2b72e56e018ed640811a9f4d1d77a3efb11
2016-09-13Add header blocks to all DockerfilesPaul Bourke4-0/+11
Change needed to add header blocks to all Dockerfiles, similar to the base. Use case is to easily run something before packages are installed, e.g. to COPY a local rpm in that can be added to the package list. Change-Id: I1bbfdf0b762da0a392aa8bf47781315b45377bee Closes-Bug: 1618969
2016-08-29Change source with dot at extend_start filesEduardo Gonzalez1-1/+1
Is a best practice in Unix/Linux scripts to use dots instead of source command. Using dots will avoid issues with non BASH shells TrivialFix Change-Id: Ie6480a1954f853f79faffa093452715ebd9f7d90 Signed-off-by: Eduardo Gonzalez <dabarren@gmail.com>
2016-08-25Add dockerfiles for keystone fernetShaun Smekel10-22/+229
This adds the docker aspects of fernet key bootstrapping as well as distributed key rotation. - Bootstrapping is handled in the same way as keystone bootstrap. - A new keystone-fernet and keystone-ssh container is created to allow the nodes to communicate with each other (taken from nova-ssh). - The keystone-fernet is a keystone container with crontab installed. This will handle key rotations through keystone-manage and trigger an rsync to push new tokens to other nodes. The Ansible component is implemented in: https://review.openstack.org/#/c/349366 Change-Id: Id610e00e8c63c7f1bc0974c0aa1b3f44c18e1019 Partially-Implements: blueprint keystone-fernet-token Partially-Implements: blueprint third-party-plugin-support
2016-08-24Fix Ubuntu binary build and deploy gateJeffrey Zhang1-1/+2
Signed-off-by: Jeffrey Zhang <jeffrey.zhang@99cloud.net> Closes-Bug: #1616349 Change-Id: I82a245474392d22017faf30fa89d6dc5e01ab2c2
2016-08-19Handle empty package list for install_packagesShaun Smekel1-4/+4
Currently if the install_packages macro is run with an empty package list, it will add a yum or apt-get command with no packages listed. This bug fix aims to omit this line when no packages have been given, or, the operator wants to use the "_override" / "_remove" functionality to disable all packages being installed in a Dockerfile. Co-Authored-By: Paul Bourke <paul.bourke@oracle.com> Change-Id: Ifaaaebfccc3adb0f2f68a35ac08e59378bc87fdb Closes-bug: 1612446
2016-08-04Add customizations for keystoneNaren Narendra1-27/+35
Adds customizations for keystone. Change-Id: I970e690539388e05f974f92b1e20710cc8de37ed Partially-Implements: blueprint third-party-plugin-support
2016-07-10Add LDAP support to keystone DockerfileDave Walker (Daviey)1-0/+4
Currently, the keystone docker image doesn't support LDAP/AD which is a common to manage users and group for identity management and authentication. This change adds ldappool to the builds. Change-Id: Ida5a58f6c57cd173642f0a801dc9ecd84ded55e8 Closes-Bug: #1600586 Signed-off-by: Dave Walker (Daviey) <email@daviey.com>
2016-06-05Add kolla-kubernetes bootstap logic endpoint scriptRyan Hallisey1-0/+20
Kolla-kubernetes will setup the endpoints after the bootstrap is complete. Closes-bug: #1589282 Change-Id: Ife8d81930af8ef5ad8af166b2f87dae436dc7492 Partially-implements: blueprint kolla-kubernetes-extended-dockerfiles
2016-06-05Add kolla-kubernetes bootstrap capability to KeystoneRyan Hallisey1-0/+18
Kolla-kubernetes requires there be an alternative way to bootstrap the container. Kolla-kubernetes needs to signal the Kubernetes API endpoint to make the cluster aware a bootstrap is in progress. Partially-implements: blueprint kolla-kubernetes-extended-dockerfiles Change-Id: Ie078017496eec81188d4c7c7916a70d1722f8aee
2016-05-26Update ubuntu dockerfiles for formattingSwapnil Kulkarni (coolsvap)1-2/+2
Change-Id: If4be00b937e14ec93443dcb7249cf17099d57cbe Closes-Bug: #1569417
2016-05-12Merge "Revert "Install master's version of an RDO keystone""Jenkins1-3/+1
2016-05-09Revert "Install master's version of an RDO keystone"Steven Dake1-3/+1
This was a temporary workaround because RDO didn't update to keystone bootstrap command operations. This reverts commit c5f27aa8a69cffd4393ad56dbee1acd7ed5ba4bf. Closes-Bug: #1573102 Change-Id: Ic6db97cf15d6f96c8e660aa15f089c1f10d6dfa7
2016-05-03Use updated wsgi file for Keystone 9.0.0 releaseQiu Yu1-2/+2
httpd/keystone.py is already deprecated in Keystone upstream[1] post 9.0.0 release. This change swiches to use keystone-wsgi-admin and keystone-wsgi-public to match the upstream change. [1] https://github.com/openstack/keystone/commit/70a42e7a82ddae9be75dba8f063170a1d13ce301 Change-Id: Iac3bb7309fc88c3e62bb2e92a3272545cbf9a778 Closes-Bug: #1579275
2016-03-28Change keystone log dirCarlos Cesario1-9/+0
Proposed patch to change keystone and heka log dir from /var/log/kolla/apache2/ to /var/log/kolla/keystone/ Closes-Bug: #1560620 Change-Id: I70c65ceba5a301cc56880313ca86f01bd35676cb
2016-03-21Fix bad apache2 closeSamYaple1-9/+5
Change-Id: Id19450a566da1bf7b824f0050e7c3e3f73581a9b Closes-Bug: #1557036
2016-03-11Remove openstack client from keystone bootstrapSamYaple1-58/+18
Keystone has merged the rest of thier bootstrap code. Lets take advantage of that. TrivialFix Change-Id: Icfe8a2dca7ae49724fa3290fdfe9fb21b8ba01a2
2016-03-11Install master's version of an RDO keystoneSteven Dake1-1/+3
RDO isn't moving for approxximately 1 week new packages into current-passed-ci. This blocks Sam's keystone bootstrap patch. To unblock this, we temporarily have provided copr built RPMs based upon the srpm from RDO and keystone-master tarball. TrivialFix Change-Id: Ic0fe30c56e8dd229f2a25157125272324621bad9
2016-03-04Retry token retrival in keystone bootstrap scriptSamYaple1-2/+8
TrivialFix Change-Id: I83da0298067d5f37603c52fb312828ea1fbbb00c
2016-03-03Merge "When ansible fails it still reads chaged key"Jenkins1-1/+1
2016-03-03When ansible fails it still reads chaged keySamYaple1-1/+1
Add changed key failure as well. Closes-Bug: #1552405 Change-Id: Ic25a57ba20928bee136932cc422713e76dcbe2a1
2016-03-03Fix Keystone v3 and HorizonSamYaple1-1/+1
After our switch to keystone-manage bootstrap Horizon is not happy due to v3 not being setup correctly. This patch fixes that This also includes removal of unused variables (transforms them into endpoint url variables) TrivialFix Change-Id: I1e04db8c24049f80e974c063f03068a2ab32a563
2016-03-01Remove keystone admin tokenSamYaple2-6/+84
Admin token has been deprecated upstream. It will be removed in O. We switch over to the new `keystone-manage bootstrap` method for creating the initial admin user, role, and project. Co-Authored-By: Sam Yaple <sam@yaple.net> Change-Id: I6ca90e8d4c3b71009e24b049b2efbc08c05ebfbf
2016-02-28No need the keystone-dist-paste.ini fileJeffrey Zhang1-1/+0
This file is in the expected path when using CentOS binary install TrivialFix Change-Id: Ic64d2bed4791250065464b6bdb6cc0992c858aaf
2016-02-19Make Heka collect Keystone logsÉric Lemoine2-1/+26
Partially implements: blueprint heka Change-Id: I940143876981a04464af67aff65c09a06926701d
2016-02-14Fix keystone initial auth mechanismSamYaple1-0/+5
A recent change in keystone [1] has deprecated the token auth mechanism that we used. We reintroduce it temporarily while a more permanant solution is worked on. [1] https://github.com/openstack/keystone/commit/5286b4a297b5a94895a311a9e564aa87cb54dbfd Change-Id: I4d585733a9abd201c1b0680e6196dd2a36db3c7e Closes-Bug: #1545292
2016-02-14Install keystone-dist-paste.ini in /etc/keystoneSteven Dake1-0/+1
The CentOS packages install a default version of the paste file but don't install them in the /etc directory. Kolla doesn't configure the paste files, so this file never gets setup properly. With the recent change in Keystone around the default admin_token being changed, this triggered Keystone to return a 401 Auth error. A follow-on patch from Sam edits this file, and that patch breaks the build without this dependent patch. TrivialFix Change-Id: Ib1568e186bdd7d19b7e5af151388197755902488
2015-12-30Merge "Keystone ubuntu binary container"Jenkins1-0/+13
2015-12-30Keystone ubuntu binary containerArtur Zarzycki1-0/+13
Change-Id: Ibacbc5e2d3988c646998f6e69e2ea34c69e039f8 Partially-Implements: blueprint binary-ubuntu
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-11 12:01:38 +0000