| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
[tool.setuptools.data-files] does not support recursive directory
installation. The old setup.cfg [files] worked because PBR's
FilesConfig.expand_globs() used os.walk() to expand docker/*, but
this hook is not triggered by the pbr.build PEP-517 backend.
Move docker/ into kolla/ and use [tool.setuptools.package-data]
instead. Update kolla_worker._get_images_dir() to check the kolla
package directory first so both editable and regular installs work.
Change-Id: I4fc452c03740ef22ebbb4e8d0d86c4f4783e2d09
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
|
|
|
|
|
|
The nova-libvirt-spice image is a kerbside fork of the upstream
nova-libvirt image, and is what kolla-ansible deploys for the
nova_libvirt container when kerbside is enabled. Mirror the virtlogd
changes made to the upstream image: install libvirt-daemon-log where
it is a separate package, and add the start script which runs
virtlogd as a sidecar of libvirtd so that nova instance console logs
are rotated.
Change-Id: Ifdcd3ae34e62fc484d1a25ef6f6c68c467745fda
Depends-On: https://review.opendev.org/c/openstack/kolla/+/993065
Signed-off-by: Michael Still <mikal@stillhq.com>
|
|
RHEL9 dropped SPICE support from qemu-kvm, and Rocky Linux followed
suit. Up until now the documented guidance has been to use the Debian
or Ubuntu container images if you want to serve the ``spice-direct``
console type, because the stock Rocky nova-libvirt image will simply
fail to start any SPICE-enabled instance.
This change adds a second version of the nova-libvirt container image
called nova-libvirt-spice. It is always built, but is identical for
all supported container base distributions except for Rocky Linux.
In the Rocky Linux case, this container adds the community
maintained ligenix/enterprise-qemu-spice COPR repository that provides
a rebuild of ``qemu-kvm`` with SPICE support re-enabled for both
EPEL 9 and EPEL 10.
Which nova-libvirt container should be used in a given deployment is
delegated to logic in kolla-ansible, based on the deployer's settings
in globals.yml.
The COPR is a third-party rebuild with no vendor support contract.
The release note and support matrix are updated to describe the
opt-in path and call this caveat out explicitly. The earlier
"you must use Debian or Ubuntu" wording in the support matrix is
softened here, rather than by retroactively editing the kerbside
container-build patch that introduced it, so that this feature can
land (or not land) independently of the earlier change.
Partial-Bug: #2131793 (spice-direct consoles)
Prompt: I am interested in seeing how we would go about using
https://copr.fedorainfracloud.org/coprs/ligenix/enterprise-qemu-spice/
to add SPICE support back to the Kolla build Rocky Linux containers
as a new patch in the kolla/ORDER list. Could you please investigate
options here?
Assisted-By: Claude Code
Co-Authored-By: Claude Opus 4.7 (1M context, medium effort) <noreply@anthropic.com>
Change-Id: I410b87b7f8cdd541c48d9a749b3fea634a5f4e6c
Signed-off-by: Michael Still <mikal@stillhq.com>
|
|
The build-date label was rendered into a LABEL instruction on line
3 of every Dockerfile template, immediately after FROM.
Because Docker invalidates the cache for a changed instruction and
all subsequent layers, a date change caused a full rebuild of every
image on each new calendar day, even when nothing else had changed.
Fix this by removing build-date from the Dockerfile templates and
applying it as a --label argument at build time via image.labels.
Labels passed on the build command line are not part of the
Dockerfile cache key, so the date is still recorded in the image
metadata without affecting layer caching.
Change-Id: I8ef0d85bab1a999a4d09f7cbf0c088ca00fdcf77
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
|
|
Due to implementation choices in qemu and libvirt, standard log
rotate does not work on these console files, and instead the usual
approach is to have libvirt's virtlogd rotate the contents of the
console log file when it gets a bit big. OpenStack Compute knows
how to read data from more than one rotated console log file if
required to service a REST API request.
OpenStack Kolla and Kolla-Ansible deploy OpenStack components in
docker or podman containers. An error in the startup configuration
for the nova_libvirt container results in the libvirt virtlogd
daemon not being run, which results in this console log rotation
not occurring.
This opens up the risk of a disk usage denial of service attack
on a hypervisor. The console log is stored on the same filesystem
as ephemeral disks, and OpenStack Nova will take a hypervisor out
of service if disk space becomes constrained. There is some
protection from the instance console not being able to write data
particularly quickly, but it is definitely still possible to fill
the hypervisor file system -- especially if multiple instances are used.
This misconfiguration appears to exist in all versions of
Kolla / Kolla-Ansible as best as I can tell.
Partial-Bug: 2155214
Change-Id: Ib62191e3022e5bcff781c12f662c9800fb210eb9
Signed-off-by: Michael Still <mikal@stillhq.com>
|
|
We have dropped mod_wsgi support from services in [1].
[1]: https://review.opendev.org/c/openstack/kolla-ansible/+/982414
Change-Id: Ie5da8427706dfb74bad4e174c990355a6870114c
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
|
|
The move to Debian Trixie for Kolla master accidentally broke SPICE
consoles for Nova (both Horizon and spice-direct). This is because Debian
and Ubuntu now package the SPICE support in a separate package. Without
this package, an attempt to start an instance in Nova requiring SPICE will
result in messages like this in the nova-libvirt logs:
libvirt.libvirtError: unsupported configuration: spice graphics are
not supported with this QEMU
And the instance will enter an error state.
The fix is to install the `qemu-system-modules-spice` package as well in
the nova-libvirt image. This re-arrangement of packages does not affect
Debian Bookworm unless backports are explicitly enabled later.
Closes-Bug: #2138186
Change-Id: Ib4ced4a04353b9c11c6f0abb7cfa91001b239e53
Signed-off-by: Michael Still <mikal@stillhq.com>
|
|
Closes-Bug: #2132960
Change-Id: I672f625e445bd1a2db1c4994baa7c44c20723a62
Signed-off-by: rafal Lewandowski <rafal@stackhpc.com>
|
|
Currently we are enabling repos irrespective of rpm/deb
statement blocks and not failing in the method used
if a repository is missing.
Downside is - we might be producing one more layer,
but it probably is a more logical approach.
This is required for adding rpm support in repos.yaml
that will also include failing on missing repositories.
Change-Id: I5479c5c935760f00fe4cd307366f261deee3199f
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
|
|
RDO has staffing problems and has decided to only
support SLURP releases - let's drop reliance on that
repository.
Change-Id: I56f86a1c5262e3ee2bcbb52cae53c3b2655ed87f
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
|
|
|
|
Known missing packages:
- mod_auth_mellon - missing SAML support in Keystone/Horizon - built in Kolla COPR
- glusterfs-fuse in manila-share - built in Kolla COPR
- collectd/telegraf - no opstools repository
- redis - needs a switch to valkey
- python3-ethtool - not required for neutron-mlnx-agent since 6 years [1]
Building packages in Kolla COPR is a temporary solution until these show up
in EPEL10.
[1]: Id2cae3ac9ff049e9fc8225551f99e1e99a87fc65
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/951751
Change-Id: I7074fabcf95184fcfd2561648ae1e05acfb0bc11
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
|
|
This change fixes the issue with absent rsync package when
'remote_filesystem_transport = rsync' is enabled in nova_compute.
Closes-Bug: #2113926
Change-Id: Ie6719928e4ec2901d661f44c9f259add35afa269
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
|
|
|
|
It probably has been omitted in Ubuntu 24.04 introduction since
aarch64 build jobs have not been stable.
Removing from nova-compute since it's already in nova-base,
nova-libvirt's parent is base - so updating to qemu-efi-aarch64
Change-Id: Idae2e87bfc8a556a090085e46f96d11279080f0f
|
|
fix: added mdevctl to nova-libvirt debian based containers, mdevctl is an
optional dependency of libvirt needed in 2024.2 for nova vGPU feature.
Closes-Bug: #2088055
Change-Id: Ifa92999672ed267ce877c492c9140fbee271b8b3
|
|
Previously, the `pycadf` package did not include
configuration files, so they were manually installed
from source. However, this was fixed in pycadf's upstream
in [1], allowing us to rely on the package itself.
Additionally, the `ceilometer_api_audit_map.conf` file
has been removed, as it was dropped in pycadf's upstream
commit here [2]
[1] https://review.opendev.org/c/openstack/pycadf/+/936741
[2] https://review.opendev.org/c/openstack/pycadf/+/930971
Change-Id: I022aa4c403f08385beb83b5d0c81f8abb42eb4a7
|
|
This patch adds a way to patch files in a Docker
image built by Kolla. This is very useful for several
reasons, specifically:
- Custom modifications
- The stable branch of some library has a fix but no pip
package has been released
- Eliminates the need to package your own pip packages
- Eliminates the need to invent your own versioning to prevent
upstream versioning
- Eliminates the need to manage a pip server
- In other words, it eliminates the need to get a wheel into
the image and install it manually using any method not
previously mentioned
It is also highly desirable because, although Kolla can replace
the source for a service with a custom URL for a tarball or its
own Git repo, it cannot do this for dependencies pulled from pip.
I would also like to point out that this is a feature with its own
code path and works only if the user "inserts" a patch into the folder
patches/docker-image/something.patch and creates an analogous series
file for patch source code.
Simply said, this code will never interfere with the upstream build process
since this feature is not intended for use in upstream.
It is rather meant for downstream users who know what they are doing.
Now they just have an option to patch their images.
Everything works on all layers of the Docker image and stores a report
of applied patches which can then be seen in /etc.
This mechanism is similar as debian patch quilt.
Change-Id: I61d0790c5d4d070b7ea9e8c99c0a76ff5d22bf9d
|
|
Closes-Bug: #2067050
Change-Id: Ife426c073048ff27bdfd9f3af30aaaab8c2e4497
|
|
Add setuptools because Python3.12 dropped distutils
Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/925581
Change-Id: Ie12c43dc1de122c203edc28181366457ccd67834
|
|
It's basically noop since dmidecode is in libvirt deps
in all distributions for a long time.
Change-Id: I48251e0a96f22a3ca6e1cc2523b81e3e1aa1ae71
|
|
Xen support in Nova has been dropped cycles ago.
Change-Id: Ieb52291529eb0d94206b3f30195c4d2527c9dc52
|
|
openvswitch package is already installed in nova-base from
CentOS NFV SIG repos - and in nova-compute we don't enable this
repo - so we get openvswitch installed from RDO packages.
Closes-Bug: #2064098
Change-Id: If39e045357563111219a008fa7a81a82ef906627
|
|
Closes-Bug: 2062572
Change-Id: I456a5b8f66aa88a82fb54938e8df7195d127d9cd
|
|
It does not exist in repos.yaml since [1].
[1]: Id585c7744ba130ad1dfc28138fb0f9e6eeae771d
Change-Id: Ic74eba44fc6e5508976de24cf20a5039f3292731
|
|
|
|
This patch fixes missing pycadf's audit maps
for services and change the way how pycadf
is installed.
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/905858
Closes-Bug: #2047941
Change-Id: I9b43d1a9990ad8aa7381ea81b0f2d692967be949
|
|
This code was valid for centos:8 and centos:stream8, but is not required
for centos:stream9 or rockylinux:9 which do not include this file.
Change-Id: I50f78d73afe0944dd91998ab9799fa2f36cc46a3
|
|
Added the --local_cell argument to nova db sync commands during
bootstrap and upgrade.
This was previously thought to have no effect [1], but has since been
discovered to fail when rotating the nova database password.
[1] https://opendev.org/openstack/kolla-ansible/src/branch/master/ansible/roles/nova/tasks/bootstrap_service.yml#L2-L3
Closes-Bug: #2045558
Change-Id: Ic64eb51325b3503a14ebab9b9ff2f4d9caec734a
|
|
Since change I1bc19f8198da3f9ab2ae2a8864c3349b21b0249e we install the
centos-release-ceph-reef package as a dependency, but some code was
still expecting the quincy package.
Change-Id: I8ebcf815d80f3bead25e0078d69b34e17ad013bd
|
|
when configure `remote_filesystem_transport` to rsync, rsync binary is
required.
Change-Id: I07be614846be9305f0775df22a6d931ceab1720a
|
|
Closes-Bug: #2012821
Change-Id: I989cedce7a9af3882b5510d3479b29150139e861
|
|
Related-Bug: #1957080
Change-Id: I6cbbdfcd40a8f486a3a636b41d704ee6ffafb812
|
|
Fixes a hypothetical security issue related to privilege escalation via
rootwrap/privsep. A potential vulnerable service could previously allow
writes to its rootwrap/privsep config and thus allow for more commands
to be run with root privileges via rootwrap/privsep. For a succesful
attack, this would also require the service to allow to run arbitrary
commands via rootwrap/privsep. Thus far, no such vulnerabilities have
been reported and thus this fix is simply strengthening the container
images against such an issue in the future.
Change-Id: I92c81c77e6a16570a108cde8031f7977930fb02a
Closes-Bug: #1874298
|
|
This is necessary if using nova-compute with RBD backend (directly,
not via Cinder) and wishing to make an instance image to Glance
while (1) following the recommended Ceph permissions which do not
give Nova write permissions to the images' pool or (2) not using
RBD with Glance or (3) not revealing what Glance actually uses
as the backend (hiding locations).
Change-Id: I88e1e0ca01b2b2effad9515b905cc761fbb5d2d4
|
|
The goal of the swtpm project is to provide a TPM emulator (TPM 1.2 &
TPM 2) that can be integrated into virtualized environments, such as
virtual machines and containers.
Nova supports it for quite a while:
https://review.opendev.org/c/openstack/nova/+/631363
Change-Id: Ifb7e0f1632805807851720873a70179218bdf372
|
|
OpenStack 'zed' requires Python 3.8+ so RHEL 8 family has to go.
This changeset moves to CentOS Stream 9 while move to RockyLinux 9 is
planned as final solution.
CI moved to CentOS Stream 9 nodes.
Depends-on: https://review.opendev.org/c/openstack/kolla-ansible/+/839715
Change-Id: I113b9984294cf8663d3fc0c8840320e1d40ea731
|
|
Tim Shearer started it in 1d96a2bbe1b536b7d7f4cdbf55c6dabae6d058ae.
Since all extend_start files are sourced rather than executed, the executable
bits are now cleared throughout the project.
Change-Id: Ia1797c32fc6a35f9f077c673abf4d8e16e51a760
|
|
As we have one type of images now some RUN calls could be merged so we
will have less layers in resulting images.
Change-Id: I5178c58fbd8c65efe825dc249c0f1368ef0fe8e0
|
|
Explicitly set the permissions on the kolla-toolbox kolla_extend_start
file. Also, since all extend_start files are sourced rather than
executed, the executable bits are now cleared throughout the project.
Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0
|
|
|
|
We have one install_type only now so that infra stuff is not needed
anymore.
Change-Id: I60d50ba7699d46d001eaef365fb84b0ce8e9b262
|
|
Big patch drops all mentions of binary images support. Suggestions are
welcome how to split it into parts or handle better.
Change-Id: I5d5a46c6ce7734ceb8b844e17b43e359d7cac6e3
|
|
|
|
Adds Cyrus SASL packages necessary for the DIGEST-MD5 and SCRAM-SHA-256
mechanisms. These can be used for libvirt SASL authentication.
Change-Id: I13e19ca29eeab40cd08fa3afe2cdf7531867f81b
Partial-Bug: #1964013
|
|
We should use the same Python OVS bindings package
version as running OpenvSwitch. See related bug.
Closes-Bug: #1961874
Change-Id: Id6968e3ec1093f26f25f3045e2a6d8cc4f41adaa
|
|
This is noop on CentOS (it was installed as a dep already - better
be explicit) but installs qemu-img (and other qemu utils) on
Debian and Ubuntu.
qemu-img may be used by libvirtd to create non-raw images as it
happens, e.g., when Kolla's libvirtd is used by tenks.
Change-Id: Ib79b8486f4d5064e4f249201d28cf5d6541c69ef
|
|
|
