aboutsummaryrefslogtreecommitdiff
path: root/docker/nova/nova-libvirt/Dockerfile.j2
AgeCommit message (Collapse)AuthorFilesLines
2026-07-06Migrate to pyproject.tomlMichal Nasiadka1-100/+0
[tool.setuptools.data-files] does not support recursive directory installation. The old setup.cfg [files] worked because PBR's FilesConfig.expand_globs() used os.walk() to expand docker/*, but this hook is not triggered by the pbr.build PEP-517 backend. Move docker/ into kolla/ and use [tool.setuptools.package-data] instead. Update kolla_worker._get_images_dir() to check the kolla package directory first so both editable and regular installs work. Change-Id: I4fc452c03740ef22ebbb4e8d0d86c4f4783e2d09 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-24kolla-build: fix build-date LABEL invalidating Docker layer cacheMichal Nasiadka1-1/+1
The build-date label was rendered into a LABEL instruction on line 3 of every Dockerfile template, immediately after FROM. Because Docker invalidates the cache for a changed instruction and all subsequent layers, a date change caused a full rebuild of every image on each new calendar day, even when nothing else had changed. Fix this by removing build-date from the Dockerfile templates and applying it as a --label argument at build time via image.labels. Labels passed on the build command line are not part of the Dockerfile cache key, so the date is still recorded in the image metadata without affecting layer caching. Change-Id: I8ef0d85bab1a999a4d09f7cbf0c088ca00fdcf77 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-12Install and start virtlogd in nova-libvirt.Michael Still1-1/+4
Due to implementation choices in qemu and libvirt, standard log rotate does not work on these console files, and instead the usual approach is to have libvirt's virtlogd rotate the contents of the console log file when it gets a bit big. OpenStack Compute knows how to read data from more than one rotated console log file if required to service a REST API request. OpenStack Kolla and Kolla-Ansible deploy OpenStack components in docker or podman containers. An error in the startup configuration for the nova_libvirt container results in the libvirt virtlogd daemon not being run, which results in this console log rotation not occurring. This opens up the risk of a disk usage denial of service attack on a hypervisor. The console log is stored on the same filesystem as ephemeral disks, and OpenStack Nova will take a hypervisor out of service if disk space becomes constrained. There is some protection from the instance console not being able to write data particularly quickly, but it is definitely still possible to fill the hypervisor file system -- especially if multiple instances are used. This misconfiguration appears to exist in all versions of Kolla / Kolla-Ansible as best as I can tell. Partial-Bug: 2155214 Change-Id: Ib62191e3022e5bcff781c12f662c9800fb210eb9 Signed-off-by: Michael Still <mikal@stillhq.com>
2026-01-15Re-enable SPICE support on Debian.Michael Still1-0/+1
The move to Debian Trixie for Kolla master accidentally broke SPICE consoles for Nova (both Horizon and spice-direct). This is because Debian and Ubuntu now package the SPICE support in a separate package. Without this package, an attempt to start an instance in Nova requiring SPICE will result in messages like this in the nova-libvirt logs: libvirt.libvirtError: unsupported configuration: spice graphics are not supported with this QEMU And the instance will enter an error state. The fix is to install the `qemu-system-modules-spice` package as well in the nova-libvirt image. This re-arrangement of packages does not affect Debian Bookworm unless backports are explicitly enabled later. Closes-Bug: #2138186 Change-Id: Ib4ced4a04353b9c11c6f0abb7cfa91001b239e53 Signed-off-by: Michael Still <mikal@stillhq.com>
2025-10-02Move repo enablement to respective rpm blocksMichal Nasiadka1-2/+2
Currently we are enabling repos irrespective of rpm/deb statement blocks and not failing in the method used if a repository is missing. Downside is - we might be producing one more layer, but it probably is a more logical approach. This is required for adding rpm support in repos.yaml that will also include failing on missing repositories. Change-Id: I5479c5c935760f00fe4cd307366f261deee3199f Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-08-29Remove RDO/DeloreanMichal Nasiadka1-1/+1
RDO has staffing problems and has decided to only support SLURP releases - let's drop reliance on that repository. Change-Id: I56f86a1c5262e3ee2bcbb52cae53c3b2655ed87f Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-07-16Move to CentOS Stream 10Michal Nasiadka1-1/+1
Known missing packages: - mod_auth_mellon - missing SAML support in Keystone/Horizon - built in Kolla COPR - glusterfs-fuse in manila-share - built in Kolla COPR - collectd/telegraf - no opstools repository - redis - needs a switch to valkey - python3-ethtool - not required for neutron-mlnx-agent since 6 years [1] Building packages in Kolla COPR is a temporary solution until these show up in EPEL10. [1]: Id2cae3ac9ff049e9fc8225551f99e1e99a87fc65 Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/951751 Change-Id: I7074fabcf95184fcfd2561648ae1e05acfb0bc11 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-03-13Added libvirt dependency to nova-libvirt debian based containersMickael Razzouk1-0/+1
fix: added mdevctl to nova-libvirt debian based containers, mdevctl is an optional dependency of libvirt needed in 2024.2 for nova vGPU feature. Closes-Bug: #2088055 Change-Id: Ifa92999672ed267ce877c492c9140fbee271b8b3
2024-11-15Add mechanism for patching files in containersMichal Arbet1-0/+2
This patch adds a way to patch files in a Docker image built by Kolla. This is very useful for several reasons, specifically: - Custom modifications - The stable branch of some library has a fix but no pip package has been released - Eliminates the need to package your own pip packages - Eliminates the need to invent your own versioning to prevent upstream versioning - Eliminates the need to manage a pip server - In other words, it eliminates the need to get a wheel into the image and install it manually using any method not previously mentioned It is also highly desirable because, although Kolla can replace the source for a service with a custom URL for a tarball or its own Git repo, it cannot do this for dependencies pulled from pip. I would also like to point out that this is a feature with its own code path and works only if the user "inserts" a patch into the folder patches/docker-image/something.patch and creates an analogous series file for patch source code. Simply said, this code will never interfere with the upstream build process since this feature is not intended for use in upstream. It is rather meant for downstream users who know what they are doing. Now they just have an option to patch their images. Everything works on all layers of the Docker image and stores a report of applied patches which can then be seen in /etc. This mechanism is similar as debian patch quilt. Change-Id: I61d0790c5d4d070b7ea9e8c99c0a76ff5d22bf9d
2024-10-22Fix missing tss user in Ubuntu/Debian nova containersRafal Lewandowski1-0/+1
Closes-Bug: #2067050 Change-Id: Ife426c073048ff27bdfd9f3af30aaaab8c2e4497
2024-09-30Switch to Ubuntu 24.04 LTSMichal Nasiadka1-6/+0
Add setuptools because Python3.12 dropped distutils Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/925581 Change-Id: Ie12c43dc1de122c203edc28181366457ccd67834
2024-08-23nova: drop dmidecodeMichal Nasiadka1-6/+0
It's basically noop since dmidecode is in libvirt deps in all distributions for a long time. Change-Id: I48251e0a96f22a3ca6e1cc2523b81e3e1aa1ae71
2024-08-19nova: Drop xen remnantsMichal Nasiadka1-2/+1
Xen support in Nova has been dropped cycles ago. Change-Id: Ieb52291529eb0d94206b3f30195c4d2527c9dc52
2024-04-22Nova: fix swtpm and swtpm-tools missing from deb installsMichal Wyszkowski1-0/+1
Closes-Bug: 2062572 Change-Id: I456a5b8f66aa88a82fb54938e8df7195d127d9cd
2024-02-26Remove calls to libvirt repoMichal Nasiadka1-1/+1
It does not exist in repos.yaml since [1]. [1]: Id585c7744ba130ad1dfc28138fb0f9e6eeae771d Change-Id: Ic74eba44fc6e5508976de24cf20a5039f3292731
2023-11-22Update Ceph repo name for dnf config-manager commandPierre Riteau1-1/+1
Since change I1bc19f8198da3f9ab2ae2a8864c3349b21b0249e we install the centos-release-ceph-reef package as a dependency, but some code was still expecting the quincy package. Change-Id: I8ebcf815d80f3bead25e0078d69b34e17ad013bd
2023-04-06nova-libvirt: Fix for missing libvirt-daemon-driver-nodedev packageRafal Lewandowski1-0/+1
Closes-Bug: #2012821 Change-Id: I989cedce7a9af3882b5510d3479b29150139e861
2022-09-27nova-libvirt: provide TPM emulationMarcin Juszkiewicz1-0/+2
The goal of the swtpm project is to provide a TPM emulator (TPM 1.2 & TPM 2) that can be integrated into virtualized environments, such as virtual machines and containers. Nova supports it for quite a while: https://review.opendev.org/c/openstack/nova/+/631363 Change-Id: Ifb7e0f1632805807851720873a70179218bdf372
2022-09-27Move to CentOS Stream 9Marcin Juszkiewicz1-1/+0
OpenStack 'zed' requires Python 3.8+ so RHEL 8 family has to go. This changeset moves to CentOS Stream 9 while move to RockyLinux 9 is planned as final solution. CI moved to CentOS Stream 9 nodes. Depends-on: https://review.opendev.org/c/openstack/kolla-ansible/+/839715 Change-Id: I113b9984294cf8663d3fc0c8840320e1d40ea731
2022-04-11Adjust permissions on _extend_start files.Tim Shearer1-1/+1
Explicitly set the permissions on the kolla-toolbox kolla_extend_start file. Also, since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0
2022-04-11drop infra_image_prefixMarcin Juszkiewicz1-1/+1
We have one install_type only now so that infra stuff is not needed anymore. Change-Id: I60d50ba7699d46d001eaef365fb84b0ce8e9b262
2022-03-10libvirt: add Cyrus SASL packages for DIGEST-MD5Mark Goddard1-0/+3
Adds Cyrus SASL packages necessary for the DIGEST-MD5 and SCRAM-SHA-256 mechanisms. These can be used for libvirt SASL authentication. Change-Id: I13e19ca29eeab40cd08fa3afe2cdf7531867f81b Partial-Bug: #1964013
2022-02-22Add qemu-img also in nova-libvirt imageRadosław Piliszek1-0/+2
This is noop on CentOS (it was installed as a dep already - better be explicit) but installs qemu-img (and other qemu utils) on Debian and Ubuntu. qemu-img may be used by libvirtd to create non-raw images as it happens, e.g., when Kolla's libvirtd is used by tenks. Change-Id: Ib79b8486f4d5064e4f249201d28cf5d6541c69ef
2021-06-18Revert "libvirt: pin edk2-ovmf"Pierre Riteau1-2/+1
The "internal error: unknown feature amd-sev-es" error in libvirt seen with the edk2-ovmf package is fixed by a commit in libvirt 7.4.0 [0] to avoid erroring out on unknown QEMU firmware features. CentOS Stream 8 was wrongly using the CentOS 8 advanced-virtualization repository [1] instead of the CentOS Stream 8 one [2]. This is fixed by centos-release-advanced-virtualization-1.0-3 [3], which should bring libvirt-7.4.0-1 into our nova-libvirt image. This reverts commit 1a2c33512b6c4bdcdbf7d7bb08e791fb53e4f063. [0] https://github.com/libvirt/libvirt/commit/61d95a1073833ec4323c1ef28e71e913c55aa7b9 [1] http://mirror.centos.org/centos/8/virt/x86_64/advanced-virtualization/ [2] http://mirror.centos.org/centos/8-stream/virt/x86_64/advancedvirt-common/ [3] https://koji.mbox.centos.org/koji/buildinfo?buildID=18004 Change-Id: I1f58262109dd27a4c4ee9b60d87010170b5ea7bb
2021-05-25libvirt: pin edk2-ovmfMichał Nasiadka1-1/+2
edk2-ovmf introduced a bug [1] and results libvirt/qemu errors It's going to be fixed in next rebase to libvirt 7.4.0 - but let's pin for now. [1]: https://bugzilla.redhat.com/show_bug.cgi?id=1961558#c10 Change-Id: I0cb0512ef40c48353d582b1c37a446f251b79ac7
2021-04-13centos: enable repos where neededMarcin Juszkiewicz1-1/+1
With RDO use we did not disabled some repositories. This patch disable them and enable where needed. Change-Id: Ia9d537fe9c1ad54789d2bfb4027254fbb3defe7e
2021-02-04get rid of traces of CentOS 7 supportMarcin Juszkiewicz1-18/+6
Change-Id: I4d20f23a9b26364943bf967908255d82c8f6621b
2020-08-24Debian: use QEMU 5.0 from buster-backportsMarcin Juszkiewicz1-1/+6
This will allow us to make sure of all updates. 'qemu-kvm' got dropped in Debian Change-Id: If09a8188030baa284dd353b1c3f830d78c5091b7
2020-07-09introduce 'infra_image_prefix' for infra imagesMarcin Juszkiewicz1-1/+1
Defaults to 'image_prefix' for now but shows which images gets their names changed soon. Change-Id: I0608e8f62f28d6667b4c8753c47553e4cbf75503
2020-04-16nova-libvirt: fix after centos 7 removal damageMarcin Juszkiewicz1-8/+1
Removal of CentOS 7 butchered Dockerfile.j2 so UEFI was not installed in Debian/Ubuntu images. Change-Id: I13be95df12ed30a366bd7d0e934704bd338781cf
2020-04-15Remove support for CentOS 7Marcin Juszkiewicz1-22/+8
With the move to RHEL/CentOS 8 we no longer have Python 2 in our images so there is no need for checking which Python version (2.x or 3.x) is used inside of containers. We also no longer have to support yum as a value for distro_package_manager. Partially-Implements: blueprint centos-rhel-8 Change-Id: Ie45cf3465fedddbde7856961527421883ba3d5c9
2020-03-13kibana, nova-libvirt: handle it properly for non-x86Marcin Juszkiewicz1-1/+1
Upstream kibana package contains NodeJS x86-64 binaries so can not be used directly on non-x86 architectures. I took upstream packages, removed NodeJS binary from it and added 'nodejs' dependency. Package is present in my Linaro OBS repository where I keep other packages needed for aarch64 kolla run. Via APT pinning I mark them as not wanted so they are not used on any architecture with two exceptions: 1. libvirt - we need fixed version to be able to use ThunderX servers 2. kibana - to be able to run it at all For x86-64 upstream kibana package is used. Closes-bug: #1867365 Change-Id: I456402849022100bde1fffdfbf6292b35690f0f2
2020-03-05nova-libvirt: use dmidecode and xen-utils on archs which have themMarcin Juszkiewicz1-1/+1
Instead of listing architectures which do not have those packages we should list those which have. Makes adding s390x easier. Change-Id: I68aa6f4b7fb1c8d63c84f3436a34399cc9644060
2020-03-03Use StorageSIG repos for Ceph in CentOS8Alfredo Moralejo1-6/+1
Storage SIG has built Ceph Nautilus and Ganesha for CentOS8 in CentOS Build System. Let's switch to use them in kolla. Change-Id: Id37dca84c4eb918aaf2d3c036ef5387fe75988dd
2020-03-01Add block labels to all DockerfilesChristian Berendt1-0/+2
Change-Id: I9692dda817ef134d647247431565e1b58cf9da41
2020-01-31Merge "CentOS 8: Use upstream Ceph/master"Zuul1-1/+6
2020-01-31Merge "nova-libvirt: add UEFI packages to support UEFI instances"Zuul1-0/+30
2020-01-31nova-libvirt: add UEFI packages to support UEFI instanceschenxing1-0/+30
Fix inability to run UEFI-based images/instances by installing UEFI packages also in nova-libvirt image which is not based on nova-base. Includes support for C8. Backport below Train w/o C8. Closes-Bug: #1814552 Co-authored-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org> Co-authored-by: Radosław Piliszek <radoslaw.piliszek@gmail.com> Change-Id: I1d5cd3d9af98444acac5bedd7daeaa6c6673dcd6
2020-01-30CentOS 8: Use upstream Ceph/masterMichal Nasiadka1-1/+6
The only Ceph version that will support CentOS 8 is Octopus. It will be released end of March 2020 - so for now let's use master. Change-Id: I5955acb41e7346802d76f4f2b244cbf5c36f5bf2 Partially-Implements: blueprint centos-rhel-8
2020-01-29CentOS 8: Update packages in imagesMark Goddard1-4/+8
* Some further changes for python2 vs python3 packages * Allow rabbitmq 3.7.*, since a newer erlang is available * Switch from qemu-img-ev to qemu-img on CentOS 8 * bridge-utils no longer available on CentOS 8 * libvirt-daemon-driver-lxc no longer available on CentOS 8 * Mark some more images buildable for CentOS 8 Change-Id: Iaf5b68ff6d944ae730ca0b1d5832172c106a6c08 Partially-Implements: blueprint centos-rhel-8 Partially-Implements: blueprint centos-rhel-python-3
2019-11-29Enable repos only when neededMarcin Juszkiewicz1-0/+2
Disable external repositories by default and enable only when needed. Depends-on: https://review.opendev.org/696480 Implements: blueprint repos-off-by-default Change-Id: Icf2a8397a8349e0fe849d88d160409fd234480a9
2019-09-18Remove support for OracleLinuxMark Goddard1-1/+1
We have agreed to remove support for Oracle Linux. http://lists.openstack.org/pipermail/openstack-discuss/2019-June/006896.html Change-Id: I961dfba1aeef2c509ecdaf376dfe6928926ffb39 Depends-On: https://review.opendev.org/682858
2019-06-06Debian/Ubuntu: more python3 packages for binaryMark Goddard1-0/+3
backport: Stein During the switch to Stein UCA, we did not switch all packages to python 3 for Debian/Ubuntu binary images. This change switches some more of those packages. Change-Id: I0bff21384d88ea678608392de2db1ba418c96665 Co-Authored-By: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
2019-05-06nova-libvirt: in Debian qemu-kvm is x86 onlyMarcin Juszkiewicz1-1/+4
This package provides just a wrapper script /usr/bin/kvm which run qemu-system-x86 in kvm mode for backwards compatibility. Change-Id: I0cc03a1ab5a79ae49fa7d13ac549e21d3ec5295d
2019-03-25Install trousers to get user tss for nova_libvirtMartin Schuppert1-1/+3
The user tss is wanted by libvirt and comes with the trousers package. Prior RHEL8 it comes via the gnutls -> trousers dependencies, but there is no such a dependency in RHEL8, so make sure we have trousers installed. Change-Id: I9f11ba53d5c6f0a435a62bb462164566c4519d9f Closes-Bug: #1821309
2019-03-21Merge "Install qemu-system in nova-libvirt on ubuntu"Zuul1-1/+1
2019-03-15Merge "Move to Debian 'buster'"Zuul1-1/+0
2019-03-15Install qemu-system in nova-libvirt on ubuntuMark Goddard1-1/+1
In https://review.openstack.org/643308 we installed only the x86 qemu emulator due to an issue in nova when installing all emulators via qemu-system. The nova issue should be fixed by https://review.openstack.org/643458, at which point it should be safe to merge this patch. Depends-On: https://review.openstack.org/643458 Change-Id: I1c045d85a8473725baf907d7c6ecb780b8f6748d
2019-03-15Fix lower-constraints and kolla CI jobsMark Goddard1-2/+3
Multiple fixes to fix multiple problems. 1. Bump setuptools requirement to 21.0.0 The 16.0.0 requirement breaks the lower-constraints job on Ubuntu bionic. We see the following error: AttributeError: module 'importlib._bootstrap' has no attribute 'SourceFileLoader' 2. ubuntu-binary horizon image needs to use python3 for django manage.py 3. ubuntu-binary nova-placement-api image needs to use python3 for apache mod wsgi. 4. nova-libvirt needs exact qemu dependencies due to packaging change 5. OracleLinux repos definition was changed in official image. 6. Fetch InfluxDB gpg key for Ubuntu base image from influx server. Change-Id: Ic797d41f53a5f146d112619f1683cbfbf3a85dc2
2019-03-14Move to Debian 'buster'Marcin Juszkiewicz1-1/+0
Buster is at freeze phase so safe to update and use. Will give us Python 3 based OpenStack packages (usually release delayed). Change-Id: I48c2d252a834716f1bcf10b18f2d32fe541e8137
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 21:04:24 +0000