summaryrefslogtreecommitdiff
path: root/docker/masakari
AgeCommit message (Collapse)AuthorFilesLines
2022-10-10Fix writable rootwrap/privsep configRadosław Piliszek2-2/+0
Fixes a hypothetical security issue related to privilege escalation via rootwrap/privsep. A potential vulnerable service could previously allow writes to its rootwrap/privsep config and thus allow for more commands to be run with root privileges via rootwrap/privsep. For a succesful attack, this would also require the service to allow to run arbitrary commands via rootwrap/privsep. Thus far, no such vulnerabilities have been reported and thus this fix is simply strengthening the container images against such an issue in the future. Change-Id: I92c81c77e6a16570a108cde8031f7977930fb02a Closes-Bug: #1874298
2022-04-22adjust permissions on _extend_start files (part II)Marcin Juszkiewicz1-1/+1
Tim Shearer started it in 1d96a2bbe1b536b7d7f4cdbf55c6dabae6d058ae. Since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: Ia1797c32fc6a35f9f077c673abf4d8e16e51a760
2022-04-21flatten images a bitMarcin Juszkiewicz2-12/+8
As we have one type of images now some RUN calls could be merged so we will have less layers in resulting images. Change-Id: I5178c58fbd8c65efe825dc249c0f1368ef0fe8e0
2022-04-11Adjust permissions on _extend_start files.Tim Shearer1-1/+1
Explicitly set the permissions on the kolla-toolbox kolla_extend_start file. Also, since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0
2022-04-09docker: drop binary partsMarcin Juszkiewicz4-120/+27
Big patch drops all mentions of binary images support. Suggestions are welcome how to split it into parts or handle better. Change-Id: I5d5a46c6ce7734ceb8b844e17b43e359d7cac6e3
2022-03-21masakari: add Cyrus SASL packages to monitors imageMark Goddard1-0/+6
Adds Cyrus SASL packages necessary for the DIGEST-MD5 and SCRAM-SHA-256 mechanisms. These can be used for libvirt SASL authentication. Follow up to I13e19ca29eeab40cd08fa3afe2cdf7531867f81b. Partial-Bug: #1964013 Change-Id: Ic4b6171789c3d360317599310492771bd78828ec
2021-08-18Always use the distro-provided libvirt-pythonRadosław Piliszek1-2/+2
This patch switches masakari-monitors image to follow nova-compute and ceilometer-compute images. This will be used and required after [1] merges. Usage of libvirt-python from PyPI has already proven to be problematic on CentOS Stream in our stable branches. [2] With this patch we avoid those issues as well. [1] https://review.opendev.org/c/openstack/masakari-monitors/+/804913 [2] https://review.opendev.org/c/openstack/kolla/+/797102 Depends-On: https://review.opendev.org/c/openstack/masakari-monitors/+/804913 Change-Id: I7d4788f5b63fba24e3b2f9b15c16866ff811d83e
2021-03-29masakari-monitors: enable libvirt repoMarcin Juszkiewicz1-1/+1
Change-Id: I61734318f2ddd81c3a20571f2be844c08a8b2a26
2021-01-25Build Masakari for Ubuntu binaryRadosław Piliszek4-14/+77
Change-Id: I448793566202e672348733b8bbbd6665dc251dfe
2020-09-29Merge "masakari: Add crm_mon to masakarimonitors sudoers"Zuul1-0/+1
2020-08-11Remove weird depsRadosław Piliszek1-2/+0
This is a follow-up on "Refactor httpd install to base image" [1]. It seems a copy-paste algorithm was used to craft Dockerfiles for some httpd-enabled services which resulted in an abundance of ldappool packages getting installed, even in the 'source' case. This seems to have also kept ldappool at a lower version because it did not get updated via pip later. This patch deals with that and also moves ldap deps for Keystone to their proper place in 'source' case (extras). Note Keystone client gets installed in openstack-base. Cinder does not need to include Keystone either. [1] https://review.opendev.org/744037 Change-Id: I017d7a6a5d2b1ae6c04556dcf172453a36de5be7
2020-08-10Refactor httpd install to base imageJames Kirsch1-11/+2
Refactor installing and initial setup of httpd and mod wsgi from individual services to base image. Change-Id: I651a55a9ebe258ef403d33de010a4dfb368a4021
2020-07-31masakari: Add crm_mon to masakarimonitors sudoersMark Goddard1-0/+1
This is necessary for the host monitor to query pacemaker Change-Id: I41066427169381e2bc57c70f7003bf4d83d9cde7 Partially-Implements: blueprint masakari-hostmonitor
2020-05-19Ensure the confs exists for cyborg and masakarigugug1-0/+1
1. When cyborg images build completed, the /etc/cyborg folder is not exits, and there is not confs, especially the api-paste.ini 2. When masakari images build completed, it's configs is missing, this ps add them together cyborg should keep consistence with the other images[1], this PS to add it. [1]: https://github.com/openstack/kolla/blob/master/docker/nova/nova-base/Dockerfile.j2#L137 Change-Id: I8a802617952f80cfb9f906398054ef6d17559589
2020-04-15Remove support for CentOS 7Marcin Juszkiewicz1-9/+0
With the move to RHEL/CentOS 8 we no longer have Python 2 in our images so there is no need for checking which Python version (2.x or 3.x) is used inside of containers. We also no longer have to support yum as a value for distro_package_manager. Partially-Implements: blueprint centos-rhel-8 Change-Id: Ie45cf3465fedddbde7856961527421883ba3d5c9
2020-03-12CentOS 8: Enable hacluster and masakari imagesMarcin Juszkiewicz1-1/+1
CentOS 8.1 came with HA repo. So we can use it. hacluster-pcs image is disabled as we lack 'crmsh' package for it. Partially-Implements: blueprint centos-rhel-8 Co-Authored-By: Mark Goddard <mark@stackhpc.com> Change-Id: I1c786eda399eca4464c9d68ac040c2965350f775
2020-03-01Add block labels to all DockerfilesChristian Berendt4-0/+8
Change-Id: I9692dda817ef134d647247431565e1b58cf9da41
2019-12-11Refactor Apache httpd setupMark Goddard1-11/+2
All Apache httpd setup has been moved to a new helper script, kolla_httpd_setup. This includes the existing clean of /run/httpd, /var/run/httpd, /tmp/httpd etc. Horizon has an additional bit of Apache config for Debian/binary, which has been kept in extend_start.sh for horizon. Change-Id: Ia2af74b69c151db0bd7e452460b0babcee50b282 Related: blueprint centos-rhel-8
2019-09-18Remove support for OracleLinuxMark Goddard1-2/+2
We have agreed to remove support for Oracle Linux. http://lists.openstack.org/pipermail/openstack-discuss/2019-June/006896.html Change-Id: I961dfba1aeef2c509ecdaf376dfe6928926ffb39 Depends-On: https://review.opendev.org/682858
2019-07-11Add Masakari containersKien Nguyen7-0/+194
Masakari provides Instances High Availability Service for OpenStack clouds by automatically recovering failed Instances. Change-Id: I279d6b43f8e4d4e30b39deb607823ceca272a4b8 Implements: blueprint masakari-support
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 18:23:41 +0000