aboutsummaryrefslogtreecommitdiff
path: root/docker/nova
AgeCommit message (Collapse)AuthorFilesLines
2026-06-15Install and start virtlogd in nova-libvirt.Michael Still2-1/+16
Due to implementation choices in qemu and libvirt, standard log rotate does not work on these console files, and instead the usual approach is to have libvirt's virtlogd rotate the contents of the console log file when it gets a bit big. OpenStack Compute knows how to read data from more than one rotated console log file if required to service a REST API request. OpenStack Kolla and Kolla-Ansible deploy OpenStack components in docker or podman containers. An error in the startup configuration for the nova_libvirt container results in the libvirt virtlogd daemon not being run, which results in this console log rotation not occurring. This opens up the risk of a disk usage denial of service attack on a hypervisor. The console log is stored on the same filesystem as ephemeral disks, and OpenStack Nova will take a hypervisor out of service if disk space becomes constrained. There is some protection from the instance console not being able to write data particularly quickly, but it is definitely still possible to fill the hypervisor file system -- especially if multiple instances are used. This misconfiguration appears to exist in all versions of Kolla / Kolla-Ansible as best as I can tell. Partial-Bug: 2155214 Change-Id: Ib62191e3022e5bcff781c12f662c9800fb210eb9 Signed-off-by: Michael Still <mikal@stillhq.com> (cherry picked from commit 97d1352f225509bcb5e3e25013e9bfe1f3c995f0)
2026-04-28Remove httpd_setup calls from api containersMichal Nasiadka1-2/+0
We have dropped mod_wsgi support from services in [1]. [1]: https://review.opendev.org/c/openstack/kolla-ansible/+/982414 Change-Id: Ie5da8427706dfb74bad4e174c990355a6870114c Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-01-15Re-enable SPICE support on Debian.Michael Still1-0/+1
The move to Debian Trixie for Kolla master accidentally broke SPICE consoles for Nova (both Horizon and spice-direct). This is because Debian and Ubuntu now package the SPICE support in a separate package. Without this package, an attempt to start an instance in Nova requiring SPICE will result in messages like this in the nova-libvirt logs: libvirt.libvirtError: unsupported configuration: spice graphics are not supported with this QEMU And the instance will enter an error state. The fix is to install the `qemu-system-modules-spice` package as well in the nova-libvirt image. This re-arrangement of packages does not affect Debian Bookworm unless backports are explicitly enabled later. Closes-Bug: #2138186 Change-Id: Ib4ced4a04353b9c11c6f0abb7cfa91001b239e53 Signed-off-by: Michael Still <mikal@stillhq.com>
2025-12-09Add genisoimage package to nova-compute-ironicRafal Lewandowski1-1/+5
Closes-Bug: #2132960 Change-Id: I672f625e445bd1a2db1c4994baa7c44c20723a62 Signed-off-by: rafal Lewandowski <rafal@stackhpc.com>
2025-10-02Move repo enablement to respective rpm blocksMichal Nasiadka3-5/+6
Currently we are enabling repos irrespective of rpm/deb statement blocks and not failing in the method used if a repository is missing. Downside is - we might be producing one more layer, but it probably is a more logical approach. This is required for adding rpm support in repos.yaml that will also include failing on missing repositories. Change-Id: I5479c5c935760f00fe4cd307366f261deee3199f Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-08-29Remove RDO/DeloreanMichal Nasiadka2-3/+3
RDO has staffing problems and has decided to only support SLURP releases - let's drop reliance on that repository. Change-Id: I56f86a1c5262e3ee2bcbb52cae53c3b2655ed87f Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-07-17Merge "Move to CentOS Stream 10"Zuul3-3/+3
2025-07-16Move to CentOS Stream 10Michal Nasiadka3-3/+3
Known missing packages: - mod_auth_mellon - missing SAML support in Keystone/Horizon - built in Kolla COPR - glusterfs-fuse in manila-share - built in Kolla COPR - collectd/telegraf - no opstools repository - redis - needs a switch to valkey - python3-ethtool - not required for neutron-mlnx-agent since 6 years [1] Building packages in Kolla COPR is a temporary solution until these show up in EPEL10. [1]: Id2cae3ac9ff049e9fc8225551f99e1e99a87fc65 Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/951751 Change-Id: I7074fabcf95184fcfd2561648ae1e05acfb0bc11 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-06-13Add rsync package to the nova-ssh containerMaksim Malchuk1-1/+2
This change fixes the issue with absent rsync package when 'remote_filesystem_transport = rsync' is enabled in nova_compute. Closes-Bug: #2113926 Change-Id: Ie6719928e4ec2901d661f44c9f259add35afa269 Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
2025-04-01Merge "Added libvirt dependency to nova-libvirt debian based containers"Zuul1-0/+1
2025-03-20nova/aarch64: Fix qemu-efi build failuresMichal Nasiadka2-7/+1
It probably has been omitted in Ubuntu 24.04 introduction since aarch64 build jobs have not been stable. Removing from nova-compute since it's already in nova-base, nova-libvirt's parent is base - so updating to qemu-efi-aarch64 Change-Id: Idae2e87bfc8a556a090085e46f96d11279080f0f
2025-03-13Added libvirt dependency to nova-libvirt debian based containersMickael Razzouk1-0/+1
fix: added mdevctl to nova-libvirt debian based containers, mdevctl is an optional dependency of libvirt needed in 2024.2 for nova vGPU feature. Closes-Bug: #2088055 Change-Id: Ifa92999672ed267ce877c492c9140fbee271b8b3
2025-02-06Install pycadf from pypi packageMichal Arbet1-1/+1
Previously, the `pycadf` package did not include configuration files, so they were manually installed from source. However, this was fixed in pycadf's upstream in [1], allowing us to rely on the package itself. Additionally, the `ceilometer_api_audit_map.conf` file has been removed, as it was dropped in pycadf's upstream commit here [2] [1] https://review.opendev.org/c/openstack/pycadf/+/936741 [2] https://review.opendev.org/c/openstack/pycadf/+/930971 Change-Id: I022aa4c403f08385beb83b5d0c81f8abb42eb4a7
2024-11-15Add mechanism for patching files in containersMichal Arbet11-0/+22
This patch adds a way to patch files in a Docker image built by Kolla. This is very useful for several reasons, specifically: - Custom modifications - The stable branch of some library has a fix but no pip package has been released - Eliminates the need to package your own pip packages - Eliminates the need to invent your own versioning to prevent upstream versioning - Eliminates the need to manage a pip server - In other words, it eliminates the need to get a wheel into the image and install it manually using any method not previously mentioned It is also highly desirable because, although Kolla can replace the source for a service with a custom URL for a tarball or its own Git repo, it cannot do this for dependencies pulled from pip. I would also like to point out that this is a feature with its own code path and works only if the user "inserts" a patch into the folder patches/docker-image/something.patch and creates an analogous series file for patch source code. Simply said, this code will never interfere with the upstream build process since this feature is not intended for use in upstream. It is rather meant for downstream users who know what they are doing. Now they just have an option to patch their images. Everything works on all layers of the Docker image and stores a report of applied patches which can then be seen in /etc. This mechanism is similar as debian patch quilt. Change-Id: I61d0790c5d4d070b7ea9e8c99c0a76ff5d22bf9d
2024-10-22Fix missing tss user in Ubuntu/Debian nova containersRafal Lewandowski2-0/+2
Closes-Bug: #2067050 Change-Id: Ife426c073048ff27bdfd9f3af30aaaab8c2e4497
2024-09-30Switch to Ubuntu 24.04 LTSMichal Nasiadka1-6/+0
Add setuptools because Python3.12 dropped distutils Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/925581 Change-Id: Ie12c43dc1de122c203edc28181366457ccd67834
2024-08-23nova: drop dmidecodeMichal Nasiadka1-6/+0
It's basically noop since dmidecode is in libvirt deps in all distributions for a long time. Change-Id: I48251e0a96f22a3ca6e1cc2523b81e3e1aa1ae71
2024-08-19nova: Drop xen remnantsMichal Nasiadka2-7/+1
Xen support in Nova has been dropped cycles ago. Change-Id: Ieb52291529eb0d94206b3f30195c4d2527c9dc52
2024-04-29nova-compute: Remove duplicate openvswitch packageMichal Nasiadka1-1/+0
openvswitch package is already installed in nova-base from CentOS NFV SIG repos - and in nova-compute we don't enable this repo - so we get openvswitch installed from RDO packages. Closes-Bug: #2064098 Change-Id: If39e045357563111219a008fa7a81a82ef906627
2024-04-22Nova: fix swtpm and swtpm-tools missing from deb installsMichal Wyszkowski2-0/+3
Closes-Bug: 2062572 Change-Id: I456a5b8f66aa88a82fb54938e8df7195d127d9cd
2024-02-26Remove calls to libvirt repoMichal Nasiadka3-3/+3
It does not exist in repos.yaml since [1]. [1]: Id585c7744ba130ad1dfc28138fb0f9e6eeae771d Change-Id: Ic74eba44fc6e5508976de24cf20a5039f3292731
2024-01-19Merge "Stop removing missing /run/nologin in RPM images"Zuul1-7/+1
2024-01-17Fix openstack CADF audit maps and installationMichal Arbet1-0/+1
This patch fixes missing pycadf's audit maps for services and change the way how pycadf is installed. Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/905858 Closes-Bug: #2047941 Change-Id: I9b43d1a9990ad8aa7381ea81b0f2d692967be949
2024-01-08Stop removing missing /run/nologin in RPM imagesPierre Riteau1-7/+1
This code was valid for centos:8 and centos:stream8, but is not required for centos:stream9 or rockylinux:9 which do not include this file. Change-Id: I50f78d73afe0944dd91998ab9799fa2f36cc46a3
2023-12-21Sync only local cell in nova bootstrap & upgradeAlex-Welsh1-2/+2
Added the --local_cell argument to nova db sync commands during bootstrap and upgrade. This was previously thought to have no effect [1], but has since been discovered to fail when rotating the nova database password. [1] https://opendev.org/openstack/kolla-ansible/src/branch/master/ansible/roles/nova/tasks/bootstrap_service.yml#L2-L3 Closes-Bug: #2045558 Change-Id: Ic64eb51325b3503a14ebab9b9ff2f4d9caec734a
2023-11-22Update Ceph repo name for dnf config-manager commandPierre Riteau2-2/+2
Since change I1bc19f8198da3f9ab2ae2a8864c3349b21b0249e we install the centos-release-ceph-reef package as a dependency, but some code was still expecting the quincy package. Change-Id: I8ebcf815d80f3bead25e0078d69b34e17ad013bd
2023-10-22Add rsync to nova-computeJeffrey Zhang1-0/+2
when configure `remote_filesystem_transport` to rsync, rsync binary is required. Change-Id: I07be614846be9305f0775df22a6d931ceab1720a
2023-04-06nova-libvirt: Fix for missing libvirt-daemon-driver-nodedev packageRafal Lewandowski1-0/+1
Closes-Bug: #2012821 Change-Id: I989cedce7a9af3882b5510d3479b29150139e861
2023-03-28Add support for running Nova upgrade checksPierre Riteau1-0/+5
Related-Bug: #1957080 Change-Id: I6cbbdfcd40a8f486a3a636b41d704ee6ffafb812
2022-10-10Fix writable rootwrap/privsep configRadosław Piliszek1-1/+0
Fixes a hypothetical security issue related to privilege escalation via rootwrap/privsep. A potential vulnerable service could previously allow writes to its rootwrap/privsep config and thus allow for more commands to be run with root privileges via rootwrap/privsep. For a succesful attack, this would also require the service to allow to run arbitrary commands via rootwrap/privsep. Thus far, no such vulnerabilities have been reported and thus this fix is simply strengthening the container images against such an issue in the future. Change-Id: I92c81c77e6a16570a108cde8031f7977930fb02a Closes-Bug: #1874298
2022-10-04Support qemu block rbd in nova-computeRadosław Piliszek1-0/+2
This is necessary if using nova-compute with RBD backend (directly, not via Cinder) and wishing to make an instance image to Glance while (1) following the recommended Ceph permissions which do not give Nova write permissions to the images' pool or (2) not using RBD with Glance or (3) not revealing what Glance actually uses as the backend (hiding locations). Change-Id: I88e1e0ca01b2b2effad9515b905cc761fbb5d2d4
2022-09-27nova-libvirt: provide TPM emulationMarcin Juszkiewicz1-0/+2
The goal of the swtpm project is to provide a TPM emulator (TPM 1.2 & TPM 2) that can be integrated into virtualized environments, such as virtual machines and containers. Nova supports it for quite a while: https://review.opendev.org/c/openstack/nova/+/631363 Change-Id: Ifb7e0f1632805807851720873a70179218bdf372
2022-09-27Move to CentOS Stream 9Marcin Juszkiewicz2-4/+1
OpenStack 'zed' requires Python 3.8+ so RHEL 8 family has to go. This changeset moves to CentOS Stream 9 while move to RockyLinux 9 is planned as final solution. CI moved to CentOS Stream 9 nodes. Depends-on: https://review.opendev.org/c/openstack/kolla-ansible/+/839715 Change-Id: I113b9984294cf8663d3fc0c8840320e1d40ea731
2022-04-22adjust permissions on _extend_start files (part II)Marcin Juszkiewicz3-3/+3
Tim Shearer started it in 1d96a2bbe1b536b7d7f4cdbf55c6dabae6d058ae. Since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: Ia1797c32fc6a35f9f077c673abf4d8e16e51a760
2022-04-21flatten images a bitMarcin Juszkiewicz3-16/+15
As we have one type of images now some RUN calls could be merged so we will have less layers in resulting images. Change-Id: I5178c58fbd8c65efe825dc249c0f1368ef0fe8e0
2022-04-11Adjust permissions on _extend_start files.Tim Shearer3-3/+3
Explicitly set the permissions on the kolla-toolbox kolla_extend_start file. Also, since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0
2022-04-11Merge "docker: drop binary parts"Zuul9-372/+110
2022-04-11drop infra_image_prefixMarcin Juszkiewicz1-1/+1
We have one install_type only now so that infra stuff is not needed anymore. Change-Id: I60d50ba7699d46d001eaef365fb84b0ce8e9b262
2022-04-09docker: drop binary partsMarcin Juszkiewicz9-372/+110
Big patch drops all mentions of binary images support. Suggestions are welcome how to split it into parts or handle better. Change-Id: I5d5a46c6ce7734ceb8b844e17b43e359d7cac6e3
2022-03-11Merge "libvirt: add Cyrus SASL packages for DIGEST-MD5"Zuul2-0/+11
2022-03-10libvirt: add Cyrus SASL packages for DIGEST-MD5Mark Goddard2-0/+11
Adds Cyrus SASL packages necessary for the DIGEST-MD5 and SCRAM-SHA-256 mechanisms. These can be used for libvirt SASL authentication. Change-Id: I13e19ca29eeab40cd08fa3afe2cdf7531867f81b Partial-Bug: #1964013
2022-03-01Use python3-openvswitch from distroMichal Nasiadka1-2/+4
We should use the same Python OVS bindings package version as running OpenvSwitch. See related bug. Closes-Bug: #1961874 Change-Id: Id6968e3ec1093f26f25f3045e2a6d8cc4f41adaa
2022-02-22Add qemu-img also in nova-libvirt imageRadosław Piliszek1-0/+2
This is noop on CentOS (it was installed as a dep already - better be explicit) but installs qemu-img (and other qemu utils) on Debian and Ubuntu. qemu-img may be used by libvirtd to create non-raw images as it happens, e.g., when Kolla's libvirtd is used by tenks. Change-Id: Ib79b8486f4d5064e4f249201d28cf5d6541c69ef
2022-02-08Merge "Revert "nova: drop pypowervm dependency""Zuul1-3/+0
2022-02-08Revert "nova: drop pypowervm dependency"Marcin Juszkiewicz1-3/+0
This reverts commit 7de91fd60355104cbd650e0fe6f680b2eb0f2ffa. Reason for revert: Nova dropped pypowervm dependency so we do not need to handle it anymore. Change-Id: I8bb6c4c07c30f108e77fbb8cdc38d634b42b900f
2022-02-05nova-compute: 'ndctl' is available on all archsMarcin Juszkiewicz1-8/+1
In past 'ndctl' was x86-64 only in Ubuntu. This changed in 19.04 so time to adapt. Change-Id: I3e599f780e8f84ea131988f4a9a45f17055c8ab2
2021-12-23nova: remove EPEL repository from nova-spicehtml5proxy imageMark Goddard1-3/+0
The EPEL8 repository doesn't provide the necessary spice-html5 package, and the image is marked unbuildable for CentOS. Let's not make EPEL look more useful than it is. TrivialFix Change-Id: Ia37792ca6e5b40156ebd57b6c290d1ee9d4ff87a
2021-12-07Ensure nvme-cli is present in nova-compute imagesPierre Riteau2-4/+5
The nvme-cli package is required to get the nvme command executed by os-brick, which is used by nova-compute. We don't need to explicitely install it for centos binary images, as it is required by os-brick which is required by openstack-nova-common, but all other types of images were missing it. Change-Id: I754939da7636c57d2a8d5b83debb5d8a58e38432 Closes-Bug: #1953509
2021-12-04Merge "nova: drop pypowervm dependency"Zuul1-0/+3
2021-12-01nova: drop pypowervm dependencyMarcin Juszkiewicz1-0/+3
Nova depends on pypowervm for POWER architecture support. But it is unmaintained upstream and breaks CentOS builds (wants to install Py2 only 'futures' package). Change-Id: Ife9385c93239e910db2e4405ec4661f667357bc0
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 21:12:58 +0000