summaryrefslogtreecommitdiff
path: root/docker/nova
AgeCommit message (Collapse)AuthorFilesLines
2023-12-22Sync only local cell in nova bootstrap & upgradeAlex-Welsh1-2/+2
Added the --local_cell argument to nova db sync commands during bootstrap and upgrade. This was previously thought to have no effect [1], but has since been discovered to fail when rotating the nova database password. [1] https://opendev.org/openstack/kolla-ansible/src/branch/master/ansible/roles/nova/tasks/bootstrap_service.yml#L2-L3 Closes-Bug: #2045558 Change-Id: Ic64eb51325b3503a14ebab9b9ff2f4d9caec734a (cherry picked from commit de1487f05187387aea3f113dcbb6926734b1ce6b)
2023-11-27Add rsync to nova-computeJeffrey Zhang1-0/+2
when configure `remote_filesystem_transport` to rsync, rsync binary is required. Change-Id: I07be614846be9305f0775df22a6d931ceab1720a (cherry picked from commit 92cedcd2b155907ab65884a0ba4dbae480900d28)
2023-08-22Add support for running Nova upgrade checksPierre Riteau2-1/+6
NOTE: Specific to the Zed release, the KOLLA_UPGRADE_CHECK feature is not guaranteed to be present in the nova_api image. As such. a label has been added to be checked for in Kolla-Ansible. Related-Bug: #1957080 Change-Id: I6cbbdfcd40a8f486a3a636b41d704ee6ffafb812 (cherry picked from commit 48b5980c6352ad4e5cf0ac6da369140910c8f389)
2023-04-12nova-libvirt: Fix for missing libvirt-daemon-driver-nodedev packageRafal Lewandowski1-0/+1
Closes-Bug: #2012821 Change-Id: I989cedce7a9af3882b5510d3479b29150139e861 (cherry picked from commit 2783fb710710103fe6aca3ff18c976590ca15e09)
2022-10-10Fix writable rootwrap/privsep configRadosław Piliszek1-1/+0
Fixes a hypothetical security issue related to privilege escalation via rootwrap/privsep. A potential vulnerable service could previously allow writes to its rootwrap/privsep config and thus allow for more commands to be run with root privileges via rootwrap/privsep. For a succesful attack, this would also require the service to allow to run arbitrary commands via rootwrap/privsep. Thus far, no such vulnerabilities have been reported and thus this fix is simply strengthening the container images against such an issue in the future. Change-Id: I92c81c77e6a16570a108cde8031f7977930fb02a Closes-Bug: #1874298
2022-10-04Support qemu block rbd in nova-computeRadosław Piliszek1-0/+2
This is necessary if using nova-compute with RBD backend (directly, not via Cinder) and wishing to make an instance image to Glance while (1) following the recommended Ceph permissions which do not give Nova write permissions to the images' pool or (2) not using RBD with Glance or (3) not revealing what Glance actually uses as the backend (hiding locations). Change-Id: I88e1e0ca01b2b2effad9515b905cc761fbb5d2d4
2022-09-27nova-libvirt: provide TPM emulationMarcin Juszkiewicz1-0/+2
The goal of the swtpm project is to provide a TPM emulator (TPM 1.2 & TPM 2) that can be integrated into virtualized environments, such as virtual machines and containers. Nova supports it for quite a while: https://review.opendev.org/c/openstack/nova/+/631363 Change-Id: Ifb7e0f1632805807851720873a70179218bdf372
2022-09-27Move to CentOS Stream 9Marcin Juszkiewicz2-4/+1
OpenStack 'zed' requires Python 3.8+ so RHEL 8 family has to go. This changeset moves to CentOS Stream 9 while move to RockyLinux 9 is planned as final solution. CI moved to CentOS Stream 9 nodes. Depends-on: https://review.opendev.org/c/openstack/kolla-ansible/+/839715 Change-Id: I113b9984294cf8663d3fc0c8840320e1d40ea731
2022-04-22adjust permissions on _extend_start files (part II)Marcin Juszkiewicz3-3/+3
Tim Shearer started it in 1d96a2bbe1b536b7d7f4cdbf55c6dabae6d058ae. Since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: Ia1797c32fc6a35f9f077c673abf4d8e16e51a760
2022-04-21flatten images a bitMarcin Juszkiewicz3-16/+15
As we have one type of images now some RUN calls could be merged so we will have less layers in resulting images. Change-Id: I5178c58fbd8c65efe825dc249c0f1368ef0fe8e0
2022-04-11Adjust permissions on _extend_start files.Tim Shearer3-3/+3
Explicitly set the permissions on the kolla-toolbox kolla_extend_start file. Also, since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0
2022-04-11Merge "docker: drop binary parts"Zuul9-372/+110
2022-04-11drop infra_image_prefixMarcin Juszkiewicz1-1/+1
We have one install_type only now so that infra stuff is not needed anymore. Change-Id: I60d50ba7699d46d001eaef365fb84b0ce8e9b262
2022-04-09docker: drop binary partsMarcin Juszkiewicz9-372/+110
Big patch drops all mentions of binary images support. Suggestions are welcome how to split it into parts or handle better. Change-Id: I5d5a46c6ce7734ceb8b844e17b43e359d7cac6e3
2022-03-11Merge "libvirt: add Cyrus SASL packages for DIGEST-MD5"Zuul2-0/+11
2022-03-10libvirt: add Cyrus SASL packages for DIGEST-MD5Mark Goddard2-0/+11
Adds Cyrus SASL packages necessary for the DIGEST-MD5 and SCRAM-SHA-256 mechanisms. These can be used for libvirt SASL authentication. Change-Id: I13e19ca29eeab40cd08fa3afe2cdf7531867f81b Partial-Bug: #1964013
2022-03-01Use python3-openvswitch from distroMichal Nasiadka1-2/+4
We should use the same Python OVS bindings package version as running OpenvSwitch. See related bug. Closes-Bug: #1961874 Change-Id: Id6968e3ec1093f26f25f3045e2a6d8cc4f41adaa
2022-02-22Add qemu-img also in nova-libvirt imageRadosław Piliszek1-0/+2
This is noop on CentOS (it was installed as a dep already - better be explicit) but installs qemu-img (and other qemu utils) on Debian and Ubuntu. qemu-img may be used by libvirtd to create non-raw images as it happens, e.g., when Kolla's libvirtd is used by tenks. Change-Id: Ib79b8486f4d5064e4f249201d28cf5d6541c69ef
2022-02-08Merge "Revert "nova: drop pypowervm dependency""Zuul1-3/+0
2022-02-08Revert "nova: drop pypowervm dependency"Marcin Juszkiewicz1-3/+0
This reverts commit 7de91fd60355104cbd650e0fe6f680b2eb0f2ffa. Reason for revert: Nova dropped pypowervm dependency so we do not need to handle it anymore. Change-Id: I8bb6c4c07c30f108e77fbb8cdc38d634b42b900f
2022-02-05nova-compute: 'ndctl' is available on all archsMarcin Juszkiewicz1-8/+1
In past 'ndctl' was x86-64 only in Ubuntu. This changed in 19.04 so time to adapt. Change-Id: I3e599f780e8f84ea131988f4a9a45f17055c8ab2
2021-12-23nova: remove EPEL repository from nova-spicehtml5proxy imageMark Goddard1-3/+0
The EPEL8 repository doesn't provide the necessary spice-html5 package, and the image is marked unbuildable for CentOS. Let's not make EPEL look more useful than it is. TrivialFix Change-Id: Ia37792ca6e5b40156ebd57b6c290d1ee9d4ff87a
2021-12-07Ensure nvme-cli is present in nova-compute imagesPierre Riteau2-4/+5
The nvme-cli package is required to get the nvme command executed by os-brick, which is used by nova-compute. We don't need to explicitely install it for centos binary images, as it is required by os-brick which is required by openstack-nova-common, but all other types of images were missing it. Change-Id: I754939da7636c57d2a8d5b83debb5d8a58e38432 Closes-Bug: #1953509
2021-12-04Merge "nova: drop pypowervm dependency"Zuul1-0/+3
2021-12-01nova: drop pypowervm dependencyMarcin Juszkiewicz1-0/+3
Nova depends on pypowervm for POWER architecture support. But it is unmaintained upstream and breaks CentOS builds (wants to install Py2 only 'futures' package). Change-Id: Ife9385c93239e910db2e4405ec4661f667357bc0
2021-11-26nova-compute: trim image a bit on CentOSMarcin Juszkiewicz1-3/+9
libguestfs package fetched kernel-core one which fetched linux-firmware. We remove the last one and save ~500MB of space: before/centos-binary-nova-compute: 3.3GB after1/centos-binary-nova-compute: 2.71GB Closes-Bug: #1946801 Change-Id: I98cc19c95fcec07dd4e494c14c09938d754f1de0
2021-06-18Revert "libvirt: pin edk2-ovmf"Pierre Riteau1-2/+1
The "internal error: unknown feature amd-sev-es" error in libvirt seen with the edk2-ovmf package is fixed by a commit in libvirt 7.4.0 [0] to avoid erroring out on unknown QEMU firmware features. CentOS Stream 8 was wrongly using the CentOS 8 advanced-virtualization repository [1] instead of the CentOS Stream 8 one [2]. This is fixed by centos-release-advanced-virtualization-1.0-3 [3], which should bring libvirt-7.4.0-1 into our nova-libvirt image. This reverts commit 1a2c33512b6c4bdcdbf7d7bb08e791fb53e4f063. [0] https://github.com/libvirt/libvirt/commit/61d95a1073833ec4323c1ef28e71e913c55aa7b9 [1] http://mirror.centos.org/centos/8/virt/x86_64/advanced-virtualization/ [2] http://mirror.centos.org/centos/8-stream/virt/x86_64/advancedvirt-common/ [3] https://koji.mbox.centos.org/koji/buildinfo?buildID=18004 Change-Id: I1f58262109dd27a4c4ee9b60d87010170b5ea7bb
2021-05-25libvirt: pin edk2-ovmfMichał Nasiadka1-1/+2
edk2-ovmf introduced a bug [1] and results libvirt/qemu errors It's going to be fixed in next rebase to libvirt 7.4.0 - but let's pin for now. [1]: https://bugzilla.redhat.com/show_bug.cgi?id=1961558#c10 Change-Id: I0cb0512ef40c48353d582b1c37a446f251b79ac7
2021-05-11Drop ppc64le supportMarcin Juszkiewicz1-8/+0
We do not test support for ppc64le on CI or other systems. In previous cycles it was used by TripleO and now they have own way. Change-Id: Ibd955869a6f9485dfa4d08a8ad2f4b28b7d59c15
2021-04-13centos: enable repos where neededMarcin Juszkiewicz2-2/+2
With RDO use we did not disabled some repositories. This patch disable them and enable where needed. Change-Id: Ia9d537fe9c1ad54789d2bfb4027254fbb3defe7e
2021-03-23enable 'libvirt' repo for images with python*-libvirtMarcin Juszkiewicz2-1/+2
There are several images installing 'python3-libvirt' package. Which for Debian reside in 'libvirt' repo. So let's enable it where needed. Change-Id: I1c91d27f2578f5ca7c83c4747725b1d9371880b0
2021-02-04get rid of traces of CentOS 7 supportMarcin Juszkiewicz2-61/+18
Change-Id: I4d20f23a9b26364943bf967908255d82c8f6621b
2021-01-15Remove nova-mksproxy imageChristian Berendt1-16/+0
Signed-off-by: Christian Berendt <berendt@betacloud-solutions.de> Change-Id: I3d101f171bd1cc6f3c192ddc98cea0d63bccb739
2020-12-18nova-compute: daxio on CentOS 8 is x86-64 onlyMarcin Juszkiewicz1-2/+14
I somehow missed that when it was sent for review. Change-Id: Iabacaeccdb360544125ad910d5c3f5f9d895dac5
2020-12-15Add daxio for nvdimm scenarioMartin Schuppert1-2/+6
nova-compute uses daxio to cleanup vpmem backend device on instance delete. If the daxio binary is missing in the nova-compute container instance delete fails. daxio is provided in centos via daxio, in ubuntu via the pmdk-tools package. Change-Id: Ifb5948653565e2ae902783762e20e33527020efe Closes-Bug: 1907124
2020-08-24Debian: use QEMU 5.0 from buster-backportsMarcin Juszkiewicz1-1/+6
This will allow us to make sure of all updates. 'qemu-kvm' got dropped in Debian Change-Id: If09a8188030baa284dd353b1c3f830d78c5091b7
2020-08-10Merge "Refactor httpd install to base image"Zuul1-33/+3
2020-08-10Refactor httpd install to base imageJames Kirsch1-33/+3
Refactor installing and initial setup of httpd and mod wsgi from individual services to base image. Change-Id: I651a55a9ebe258ef403d33de010a4dfb368a4021
2020-07-31Remove TODO in libvirt scriptRadosław Piliszek1-8/+0
This is no longer required when Kolla-Ansible is patched. Note this is *not* safe to backport as it requires the user to have Kolla-Ansible patched, i.e. would normally break most. Change-Id: Ic5b9a58d212711a4d6c13822548c92013a6bae50 Related-Bug: #1681461 Depends-On: https://review.opendev.org/735441
2020-07-09introduce 'infra_image_prefix' for infra imagesMarcin Juszkiewicz1-1/+1
Defaults to 'image_prefix' for now but shows which images gets their names changed soon. Change-Id: I0608e8f62f28d6667b4c8753c47553e4cbf75503
2020-06-22Add sysfsutils to nova-compute ubuntu sourceRadosław Piliszek1-0/+1
This fixes the FC Cinder backend usage in Nova. Change-Id: I036cfe3af3dd96625f986a820c78a10e6558b086 Closes-bug: #1884484
2020-05-06Enable mod_wsgi in Nova API containerJames Kirsch1-2/+0
This patch modifies the Dockerfile for the Nova API so that the 'root' user executes the container setup scripts. This enables the container httpd configuration script to execute. Change-Id: I374af00a374346840c12777a530d39768b28c908 Partially-Implements: blueprint add-ssl-internal-network Depends-On: https://review.opendev.org/725962
2020-04-16nova-libvirt: fix after centos 7 removal damageMarcin Juszkiewicz1-8/+1
Removal of CentOS 7 butchered Dockerfile.j2 so UEFI was not installed in Debian/Ubuntu images. Change-Id: I13be95df12ed30a366bd7d0e934704bd338781cf
2020-04-15Merge "nova-compute: add ndctl to expose NVDIMMs to guests"Zuul1-0/+18
2020-04-15Remove support for CentOS 7Marcin Juszkiewicz5-93/+20
With the move to RHEL/CentOS 8 we no longer have Python 2 in our images so there is no need for checking which Python version (2.x or 3.x) is used inside of containers. We also no longer have to support yum as a value for distro_package_manager. Partially-Implements: blueprint centos-rhel-8 Change-Id: Ie45cf3465fedddbde7856961527421883ba3d5c9
2020-04-14nova-compute: add ndctl to expose NVDIMMs to guestsPiotr Kopec1-0/+18
`ndctl` is a utility for managing the nvdimm subsystem required by Nova for attaching PMEM(persistent memory) namespaces to guests [0]. [0]: https://docs.openstack.org/nova/latest/admin/virtual-persistent-memory.html Change-Id: I8ed1b6c1d0985b2a73206bd9249a5664cd80c912 Closes-Bug: #1870455
2020-03-13kibana, nova-libvirt: handle it properly for non-x86Marcin Juszkiewicz1-1/+1
Upstream kibana package contains NodeJS x86-64 binaries so can not be used directly on non-x86 architectures. I took upstream packages, removed NodeJS binary from it and added 'nodejs' dependency. Package is present in my Linaro OBS repository where I keep other packages needed for aarch64 kolla run. Via APT pinning I mark them as not wanted so they are not used on any architecture with two exceptions: 1. libvirt - we need fixed version to be able to use ThunderX servers 2. kibana - to be able to run it at all For x86-64 upstream kibana package is used. Closes-bug: #1867365 Change-Id: I456402849022100bde1fffdfbf6292b35690f0f2
2020-03-05nova-libvirt: use dmidecode and xen-utils on archs which have themMarcin Juszkiewicz1-1/+1
Instead of listing architectures which do not have those packages we should list those which have. Makes adding s390x easier. Change-Id: I68aa6f4b7fb1c8d63c84f3436a34399cc9644060
2020-03-03Use StorageSIG repos for Ceph in CentOS8Alfredo Moralejo2-12/+2
Storage SIG has built Ceph Nautilus and Ganesha for CentOS8 in CentOS Build System. Let's switch to use them in kolla. Change-Id: Id37dca84c4eb918aaf2d3c036ef5387fe75988dd
2020-03-01Add block labels to all DockerfilesChristian Berendt12-0/+24
Change-Id: I9692dda817ef134d647247431565e1b58cf9da41
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 19:19:40 +0000