aboutsummaryrefslogtreecommitdiff
path: root/docker/letsencrypt
AgeCommit message (Collapse)AuthorFilesLines
2026-07-06Migrate to pyproject.tomlMichal Nasiadka5-443/+0
[tool.setuptools.data-files] does not support recursive directory installation. The old setup.cfg [files] worked because PBR's FilesConfig.expand_globs() used os.walk() to expand docker/*, but this hook is not triggered by the pbr.build PEP-517 backend. Move docker/ into kolla/ and use [tool.setuptools.package-data] instead. Update kolla_worker._get_images_dir() to check the kolla package directory first so both editable and regular installs work. Change-Id: I4fc452c03740ef22ebbb4e8d0d86c4f4783e2d09 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-24kolla-build: fix build-date LABEL invalidating Docker layer cacheMichal Nasiadka2-2/+2
The build-date label was rendered into a LABEL instruction on line 3 of every Dockerfile template, immediately after FROM. Because Docker invalidates the cache for a changed instruction and all subsequent layers, a date change caused a full rebuild of every image on each new calendar day, even when nothing else had changed. Fix this by removing build-date from the Dockerfile templates and applying it as a --label argument at build time via image.labels. Labels passed on the build command line are not part of the Dockerfile cache key, so the date is still recorded in the image metadata without affecting layer caching. Change-Id: I8ef0d85bab1a999a4d09f7cbf0c088ca00fdcf77 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-05-06Drop apache installation outside of httpd container22.0.0.0rc1Michal Nasiadka2-37/+0
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/986483 Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/986352 Change-Id: Ia66dde09bbbad2a5a9e67a8c642f3223ca38be43 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-04-24Allow specification of a key typeJay Jahns1-3/+9
Letsencrypt allows using a specific key type for certificates. If the user has an internal letsencrypt mechanism, such as Vault Acme, then they have to provide a specific key type as the default is not supported. This change will allow a user to specify a key type and use the lego default in the event that they don't specify it. Partial-Bug: 2087860 Change-Id: I83e618a861b4d51b6a7893f79c50fdfc35228891
2024-12-18[letsencrypt] Rename script for updating certificatesMichal Arbet1-2/+2
This patch renames the update-haproxy-cert script to update-loadbalancer-cert to make the name more generic. The change is necessary because support for ProxySQL will be introduced in the next patch, requiring a name that reflects broader applicability. To keep the diff in the following patch clean and easier to review, this patch focuses exclusively on the rename. Change-Id: I15f9b5cf3976f4298cdc7da4530f2d7d09614e88
2024-12-11Fix EAB support in letsencryptMichal Arbet1-10/+12
This patch fixes recently merged [1] patch. - Original patch added params function args eab, hmac, key_id, but then EXTERNAL_ACCOUNT_BINDING_OPTS var is passed into obtain_or_renew_certificate which can't work - This patch correctly set EXTERNAL_ACCOUNT_BINDING, HMAC, KEY_ID defaults and then call obtain_or_renew_certificate function with them. This will ensure that arguments are always set, so we can write if condtional correctly and process. [1] https://review.opendev.org/c/openstack/kolla/+/916617 Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/933924 Change-Id: I406ff10edec9dc94b1a3de005080e149ee3ab3f2
2024-12-05Add Let's Encrypt EAB supportPiotr Parczewski1-3/+29
Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/935656 Change-Id: I0b20d82a0061062f8aa9dfe179b1d02708ad610e
2024-11-15Add mechanism for patching files in containersMichal Arbet3-0/+6
This patch adds a way to patch files in a Docker image built by Kolla. This is very useful for several reasons, specifically: - Custom modifications - The stable branch of some library has a fix but no pip package has been released - Eliminates the need to package your own pip packages - Eliminates the need to invent your own versioning to prevent upstream versioning - Eliminates the need to manage a pip server - In other words, it eliminates the need to get a wheel into the image and install it manually using any method not previously mentioned It is also highly desirable because, although Kolla can replace the source for a service with a custom URL for a tarball or its own Git repo, it cannot do this for dependencies pulled from pip. I would also like to point out that this is a feature with its own code path and works only if the user "inserts" a patch into the folder patches/docker-image/something.patch and creates an analogous series file for patch source code. Simply said, this code will never interfere with the upstream build process since this feature is not intended for use in upstream. It is rather meant for downstream users who know what they are doing. Now they just have an option to patch their images. Everything works on all layers of the Docker image and stores a report of applied patches which can then be seen in /etc. This mechanism is similar as debian patch quilt. Change-Id: I61d0790c5d4d070b7ea9e8c99c0a76ff5d22bf9d
2024-06-28Trivial fix letsencrypt base imageMichal Arbet1-2/+0
Replace cinder -> letsencrypt typo in letsencrypt-base image. Change-Id: Ia21f81d9cb0850e37882dd6155b4d2d6ba774a05
2024-02-21Move curl sources to sources.pyMichal Nasiadka1-14/+3
Move most curl sources to sources.py, so it can be automatically updated in future. This also makes overriding the versions/locations/sha256 easier. Change-Id: Ib3497fe96162ae190e5c113cacaaa3ef8334f590
2024-02-02Merge "[follow-up] Use full binary path when invoking ip"Zuul1-1/+1
2024-01-31Merge "Use full binary path when invoking ip"Zuul1-1/+1
2024-01-31[follow-up] Use full binary path when invoking ipMichal Arbet1-1/+1
Patch [1] fixed invoking of ip command in one script but forgot to fix on another place in another script. This patch is follow-up path and fix the same issue in those script. [1] https://review.opendev.org/c/openstack/kolla/+/906516 Change-Id: I5e41a550e438fb3e4008a9e6b8df35c4775c5c30
2024-01-24Use full binary path when invoking ipPiotr Parczewski1-1/+1
Closes-bug: #2051111 Change-Id: I2a4df6121236379d88d0d7f2f7a888feab273003
2024-01-20trivial: fix typos in let's encrypt status logsPiotr Parczewski1-1/+1
Change-Id: Icb158d296989ba7c99ba108e7697ca71176f07db
2023-11-07Fix letsencrypt-lego loggingMichal Arbet2-17/+42
This patch fixes formatting of letsencrypt, so it will be easier to parse via fluent. Change-Id: I8a403e14819df4351e28d53c676571a3ad0c14be
2023-09-18Rework letsencryptMichal Arbet9-48/+428
This patch is adding "API layer" to letsencrypt images which is represented by set of scripts inside. This scripts are called by kolla-ansible orchestration. Change-Id: I61b70fb4e12ba03b96e79004e735d2ead0f52319
2022-09-12Add missing labels blocksChristian Berendt1-1/+3
Change-Id: I1396131c3e33e5f139339a203ebfb48841a358d7
2022-05-30Replace Certbot with Lego for Let's Encrypt containergeneralfuzz1-6/+13
Replaces Certbot with Lego for certificate retrieval and renewal. Lego includes support for DNS ACME Challenges. Adds ssh-client to LetsEncrypt and ssh-server to HAProxy to allow both the transfer of Let's Encrypt certificates to the HAProxy container and to enable live updating of HAProxy certifices using the HAProxy API exposed on the local HAProxy socket. Implements: blueprint letsencrypt-https Change-Id: I737e1ce5bfc37d0703879c8272a9e915084c5ca6
2022-04-11Adjust permissions on _extend_start files.Tim Shearer1-1/+1
Explicitly set the permissions on the kolla-toolbox kolla_extend_start file. Also, since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0
2022-02-04Add LetsEncrypt images for cert request/renewalJason Anderson2-0/+39
Adds container images for LetsEncrypt. Implements: blueprint letsencrypt-https Change-Id: I36d1a367fd8f40bb93ebc49122c8ee4fdcc151b2 Co-Authored-By: Jason Anderson <jasonanderson@uchicago.edu>
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 21:42:15 +0000