aboutsummaryrefslogtreecommitdiff
path: root/docker/masakari
AgeCommit message (Collapse)AuthorFilesLines
2026-07-06Migrate to pyproject.tomlMichal Nasiadka7-155/+0
[tool.setuptools.data-files] does not support recursive directory installation. The old setup.cfg [files] worked because PBR's FilesConfig.expand_globs() used os.walk() to expand docker/*, but this hook is not triggered by the pbr.build PEP-517 backend. Move docker/ into kolla/ and use [tool.setuptools.package-data] instead. Update kolla_worker._get_images_dir() to check the kolla package directory first so both editable and regular installs work. Change-Id: I4fc452c03740ef22ebbb4e8d0d86c4f4783e2d09 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-29Merge "kolla-build: fix build-date LABEL invalidating Docker layer cache"Zuul4-4/+4
2026-06-24kolla-build: fix build-date LABEL invalidating Docker layer cacheMichal Nasiadka4-4/+4
The build-date label was rendered into a LABEL instruction on line 3 of every Dockerfile template, immediately after FROM. Because Docker invalidates the cache for a changed instruction and all subsequent layers, a date change caused a full rebuild of every image on each new calendar day, even when nothing else had changed. Fix this by removing build-date from the Dockerfile templates and applying it as a --label argument at build time via image.labels. Labels passed on the build command line are not part of the Dockerfile cache key, so the date is still recorded in the image metadata without affecting layer caching. Change-Id: I8ef0d85bab1a999a4d09f7cbf0c088ca00fdcf77 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-18Remove cgi-bin creation in gnocchi and masakariMichal Nasiadka1-2/+1
This is no longer required Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/993932 Change-Id: I20a2ff0a97b9fad86b6103ec488a39e42cdba091 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-02Merge "masakari: Add crmadmin and cibadmin to monitors sudoers"Zuul1-0/+2
2026-04-28Remove httpd_setup calls from api containersMichal Nasiadka1-2/+0
We have dropped mod_wsgi support from services in [1]. [1]: https://review.opendev.org/c/openstack/kolla-ansible/+/982414 Change-Id: Ie5da8427706dfb74bad4e174c990355a6870114c Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-03-13masakari: Add crmadmin and cibadmin to monitors sudoersKim soo1-0/+2
The hostmonitor calls crmadmin and cibadmin with run_as_root=True, but the sudoers file only includes crm_mon. Since the container runs as the masakari user, sudo calls to crmadmin and cibadmin fail with "password required", causing the hostmonitor to skip all host monitoring every cycle. This completely breaks automatic instance evacuation in HCI (hyper-converged) deployments where all nodes run the full pacemaker stack instead of pacemaker-remote. In separated deployments, the crmadmin code path is skipped because pacemaker_remote_status=True, which is why this bug has gone undetected. Closes-Bug: #2144074 Change-Id: I22bbaa1f1fd1f3d53de48ec7c0099d028118448b Signed-off-by: Kim soo <popododo0720@naver.com>
2025-10-02Move repo enablement to respective rpm blocksMichal Nasiadka1-2/+2
Currently we are enabling repos irrespective of rpm/deb statement blocks and not failing in the method used if a repository is missing. Downside is - we might be producing one more layer, but it probably is a more logical approach. This is required for adding rpm support in repos.yaml that will also include failing on missing repositories. Change-Id: I5479c5c935760f00fe4cd307366f261deee3199f Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-07-14masakari: Ensure log files are owned by masakari userMichal Nasiadka1-0/+3
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/954903 Change-Id: Icc2fe528956a0fb47dd66344d414c81212705480 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2024-11-15Add mechanism for patching files in containersMichal Arbet4-0/+8
This patch adds a way to patch files in a Docker image built by Kolla. This is very useful for several reasons, specifically: - Custom modifications - The stable branch of some library has a fix but no pip package has been released - Eliminates the need to package your own pip packages - Eliminates the need to invent your own versioning to prevent upstream versioning - Eliminates the need to manage a pip server - In other words, it eliminates the need to get a wheel into the image and install it manually using any method not previously mentioned It is also highly desirable because, although Kolla can replace the source for a service with a custom URL for a tarball or its own Git repo, it cannot do this for dependencies pulled from pip. I would also like to point out that this is a feature with its own code path and works only if the user "inserts" a patch into the folder patches/docker-image/something.patch and creates an analogous series file for patch source code. Simply said, this code will never interfere with the upstream build process since this feature is not intended for use in upstream. It is rather meant for downstream users who know what they are doing. Now they just have an option to patch their images. Everything works on all layers of the Docker image and stores a report of applied patches which can then be seen in /etc. This mechanism is similar as debian patch quilt. Change-Id: I61d0790c5d4d070b7ea9e8c99c0a76ff5d22bf9d
2024-02-26Remove calls to libvirt repoMichal Nasiadka1-1/+1
It does not exist in repos.yaml since [1]. [1]: Id585c7744ba130ad1dfc28138fb0f9e6eeae771d Change-Id: Ic74eba44fc6e5508976de24cf20a5039f3292731
2022-10-10Fix writable rootwrap/privsep configRadosław Piliszek2-2/+0
Fixes a hypothetical security issue related to privilege escalation via rootwrap/privsep. A potential vulnerable service could previously allow writes to its rootwrap/privsep config and thus allow for more commands to be run with root privileges via rootwrap/privsep. For a succesful attack, this would also require the service to allow to run arbitrary commands via rootwrap/privsep. Thus far, no such vulnerabilities have been reported and thus this fix is simply strengthening the container images against such an issue in the future. Change-Id: I92c81c77e6a16570a108cde8031f7977930fb02a Closes-Bug: #1874298
2022-04-22adjust permissions on _extend_start files (part II)Marcin Juszkiewicz1-1/+1
Tim Shearer started it in 1d96a2bbe1b536b7d7f4cdbf55c6dabae6d058ae. Since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: Ia1797c32fc6a35f9f077c673abf4d8e16e51a760
2022-04-21flatten images a bitMarcin Juszkiewicz2-12/+8
As we have one type of images now some RUN calls could be merged so we will have less layers in resulting images. Change-Id: I5178c58fbd8c65efe825dc249c0f1368ef0fe8e0
2022-04-11Adjust permissions on _extend_start files.Tim Shearer1-1/+1
Explicitly set the permissions on the kolla-toolbox kolla_extend_start file. Also, since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0
2022-04-09docker: drop binary partsMarcin Juszkiewicz4-120/+27
Big patch drops all mentions of binary images support. Suggestions are welcome how to split it into parts or handle better. Change-Id: I5d5a46c6ce7734ceb8b844e17b43e359d7cac6e3
2022-03-21masakari: add Cyrus SASL packages to monitors imageMark Goddard1-0/+6
Adds Cyrus SASL packages necessary for the DIGEST-MD5 and SCRAM-SHA-256 mechanisms. These can be used for libvirt SASL authentication. Follow up to I13e19ca29eeab40cd08fa3afe2cdf7531867f81b. Partial-Bug: #1964013 Change-Id: Ic4b6171789c3d360317599310492771bd78828ec
2021-08-18Always use the distro-provided libvirt-pythonRadosław Piliszek1-2/+2
This patch switches masakari-monitors image to follow nova-compute and ceilometer-compute images. This will be used and required after [1] merges. Usage of libvirt-python from PyPI has already proven to be problematic on CentOS Stream in our stable branches. [2] With this patch we avoid those issues as well. [1] https://review.opendev.org/c/openstack/masakari-monitors/+/804913 [2] https://review.opendev.org/c/openstack/kolla/+/797102 Depends-On: https://review.opendev.org/c/openstack/masakari-monitors/+/804913 Change-Id: I7d4788f5b63fba24e3b2f9b15c16866ff811d83e
2021-03-29masakari-monitors: enable libvirt repoMarcin Juszkiewicz1-1/+1
Change-Id: I61734318f2ddd81c3a20571f2be844c08a8b2a26
2021-01-25Build Masakari for Ubuntu binaryRadosław Piliszek4-14/+77
Change-Id: I448793566202e672348733b8bbbd6665dc251dfe
2020-09-29Merge "masakari: Add crm_mon to masakarimonitors sudoers"Zuul1-0/+1
2020-08-11Remove weird depsRadosław Piliszek1-2/+0
This is a follow-up on "Refactor httpd install to base image" [1]. It seems a copy-paste algorithm was used to craft Dockerfiles for some httpd-enabled services which resulted in an abundance of ldappool packages getting installed, even in the 'source' case. This seems to have also kept ldappool at a lower version because it did not get updated via pip later. This patch deals with that and also moves ldap deps for Keystone to their proper place in 'source' case (extras). Note Keystone client gets installed in openstack-base. Cinder does not need to include Keystone either. [1] https://review.opendev.org/744037 Change-Id: I017d7a6a5d2b1ae6c04556dcf172453a36de5be7
2020-08-10Refactor httpd install to base imageJames Kirsch1-11/+2
Refactor installing and initial setup of httpd and mod wsgi from individual services to base image. Change-Id: I651a55a9ebe258ef403d33de010a4dfb368a4021
2020-07-31masakari: Add crm_mon to masakarimonitors sudoersMark Goddard1-0/+1
This is necessary for the host monitor to query pacemaker Change-Id: I41066427169381e2bc57c70f7003bf4d83d9cde7 Partially-Implements: blueprint masakari-hostmonitor
2020-05-19Ensure the confs exists for cyborg and masakarigugug1-0/+1
1. When cyborg images build completed, the /etc/cyborg folder is not exits, and there is not confs, especially the api-paste.ini 2. When masakari images build completed, it's configs is missing, this ps add them together cyborg should keep consistence with the other images[1], this PS to add it. [1]: https://github.com/openstack/kolla/blob/master/docker/nova/nova-base/Dockerfile.j2#L137 Change-Id: I8a802617952f80cfb9f906398054ef6d17559589
2020-04-15Remove support for CentOS 7Marcin Juszkiewicz1-9/+0
With the move to RHEL/CentOS 8 we no longer have Python 2 in our images so there is no need for checking which Python version (2.x or 3.x) is used inside of containers. We also no longer have to support yum as a value for distro_package_manager. Partially-Implements: blueprint centos-rhel-8 Change-Id: Ie45cf3465fedddbde7856961527421883ba3d5c9
2020-03-12CentOS 8: Enable hacluster and masakari imagesMarcin Juszkiewicz1-1/+1
CentOS 8.1 came with HA repo. So we can use it. hacluster-pcs image is disabled as we lack 'crmsh' package for it. Partially-Implements: blueprint centos-rhel-8 Co-Authored-By: Mark Goddard <mark@stackhpc.com> Change-Id: I1c786eda399eca4464c9d68ac040c2965350f775
2020-03-01Add block labels to all DockerfilesChristian Berendt4-0/+8
Change-Id: I9692dda817ef134d647247431565e1b58cf9da41
2019-12-11Refactor Apache httpd setupMark Goddard1-11/+2
All Apache httpd setup has been moved to a new helper script, kolla_httpd_setup. This includes the existing clean of /run/httpd, /var/run/httpd, /tmp/httpd etc. Horizon has an additional bit of Apache config for Debian/binary, which has been kept in extend_start.sh for horizon. Change-Id: Ia2af74b69c151db0bd7e452460b0babcee50b282 Related: blueprint centos-rhel-8
2019-09-18Remove support for OracleLinuxMark Goddard1-2/+2
We have agreed to remove support for Oracle Linux. http://lists.openstack.org/pipermail/openstack-discuss/2019-June/006896.html Change-Id: I961dfba1aeef2c509ecdaf376dfe6928926ffb39 Depends-On: https://review.opendev.org/682858
2019-07-11Add Masakari containersKien Nguyen7-0/+194
Masakari provides Instances High Availability Service for OpenStack clouds by automatically recovering failed Instances. Change-Id: I279d6b43f8e4d4e30b39deb607823ceca272a4b8 Implements: blueprint masakari-support
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 22:09:40 +0000