aboutsummaryrefslogtreecommitdiff
path: root/docker
AgeCommit message (Collapse)AuthorFilesLines
2026-07-06Migrate to pyproject.tomlMichal Nasiadka370-10879/+0
[tool.setuptools.data-files] does not support recursive directory installation. The old setup.cfg [files] worked because PBR's FilesConfig.expand_globs() used os.walk() to expand docker/*, but this hook is not triggered by the pbr.build PEP-517 backend. Move docker/ into kolla/ and use [tool.setuptools.package-data] instead. Update kolla_worker._get_images_dir() to check the kolla package directory first so both editable and regular installs work. Change-Id: I4fc452c03740ef22ebbb4e8d0d86c4f4783e2d09 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-07-06Merge "Install and start virtlogd in nova-libvirt-spice."Zuul2-1/+16
2026-07-06Merge "Add opt-in SPICE support for Rocky via COPR."Zuul2-0/+128
2026-07-02set_configs: Add support for creating files and setting permsMichal Arbet1-6/+43
Change-Id: I74a6d05007488b69fa040c40d01a07afae369794 Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/989850 Signed-off-by: Michal Arbet <michal.arbet@ultimum.io>
2026-07-02Merge "Fix parsing of permissions with special bits"Zuul1-5/+14
2026-07-01Fix parsing of permissions with special bitsMichal Arbet1-5/+14
kolla_set_configs currently fails to parse permissions such as 2775 because only legacy values like 0755 are converted to Python octal notation. Accept standard UNIX permission notation for permissions with special mode bits such as SGID, SUID, and sticky bit. Change-Id: I5937a17b0d70f9c1db4b2617854d0180c37fe2c0 Closes-Bug: #2154269 Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/989850 Signed-off-by: Michal Arbet <michal.arbet@ultimum.io>
2026-06-29Merge "kolla-build: fix build-date LABEL invalidating Docker layer cache"Zuul186-186/+186
2026-06-29Install and start virtlogd in nova-libvirt-spice.Michael Still2-1/+16
The nova-libvirt-spice image is a kerbside fork of the upstream nova-libvirt image, and is what kolla-ansible deploys for the nova_libvirt container when kerbside is enabled. Mirror the virtlogd changes made to the upstream image: install libvirt-daemon-log where it is a separate package, and add the start script which runs virtlogd as a sidecar of libvirtd so that nova instance console logs are rotated. Change-Id: Ifdcd3ae34e62fc484d1a25ef6f6c68c467745fda Depends-On: https://review.opendev.org/c/openstack/kolla/+/993065 Signed-off-by: Michael Still <mikal@stillhq.com>
2026-06-29Add opt-in SPICE support for Rocky via COPR.Michael Still2-0/+128
RHEL9 dropped SPICE support from qemu-kvm, and Rocky Linux followed suit. Up until now the documented guidance has been to use the Debian or Ubuntu container images if you want to serve the ``spice-direct`` console type, because the stock Rocky nova-libvirt image will simply fail to start any SPICE-enabled instance. This change adds a second version of the nova-libvirt container image called nova-libvirt-spice. It is always built, but is identical for all supported container base distributions except for Rocky Linux. In the Rocky Linux case, this container adds the community maintained ligenix/enterprise-qemu-spice COPR repository that provides a rebuild of ``qemu-kvm`` with SPICE support re-enabled for both EPEL 9 and EPEL 10. Which nova-libvirt container should be used in a given deployment is delegated to logic in kolla-ansible, based on the deployer's settings in globals.yml. The COPR is a third-party rebuild with no vendor support contract. The release note and support matrix are updated to describe the opt-in path and call this caveat out explicitly. The earlier "you must use Debian or Ubuntu" wording in the support matrix is softened here, rather than by retroactively editing the kerbside container-build patch that introduced it, so that this feature can land (or not land) independently of the earlier change. Partial-Bug: #2131793 (spice-direct consoles) Prompt: I am interested in seeing how we would go about using https://copr.fedorainfracloud.org/coprs/ligenix/enterprise-qemu-spice/ to add SPICE support back to the Kolla build Rocky Linux containers as a new patch in the kolla/ORDER list. Could you please investigate options here? Assisted-By: Claude Code Co-Authored-By: Claude Opus 4.7 (1M context, medium effort) <noreply@anthropic.com> Change-Id: I410b87b7f8cdd541c48d9a749b3fea634a5f4e6c Signed-off-by: Michael Still <mikal@stillhq.com>
2026-06-24kolla-build: fix build-date LABEL invalidating Docker layer cacheMichal Nasiadka186-186/+186
The build-date label was rendered into a LABEL instruction on line 3 of every Dockerfile template, immediately after FROM. Because Docker invalidates the cache for a changed instruction and all subsequent layers, a date change caused a full rebuild of every image on each new calendar day, even when nothing else had changed. Fix this by removing build-date from the Dockerfile templates and applying it as a --label argument at build time via image.labels. Labels passed on the build command line are not part of the Dockerfile cache key, so the date is still recorded in the image metadata without affecting layer caching. Change-Id: I8ef0d85bab1a999a4d09f7cbf0c088ca00fdcf77 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-19Merge "Add YAML support to kolla_set_configs engine"Zuul2-8/+31
2026-06-19Merge "Revert "horizon: pin setuptools <82""Zuul1-5/+1
2026-06-19Revert "horizon: pin setuptools <82"Michal Nasiadka1-5/+1
This reverts commit 4cdf881631eb0a671b9f70d5afefa6ead1949118. Reason for revert: It's fixed in Horizon Change-Id: If7e6ad7114c69de2435732a45f7a86a7b9bfeca1 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-18Remove cgi-bin creation in gnocchi and masakariMichal Nasiadka2-3/+1
This is no longer required Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/993932 Change-Id: I20a2ff0a97b9fad86b6103ec488a39e42cdba091 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-17Add YAML support to kolla_set_configs enginePiotr Milewski2-8/+31
Following the PTG agreement, this commit extends the container configuration engine (set_configs.py) to support YAML format while maintaining backward compatibility with JSON. - Integrated 'yaml' library as a universal parser for both JSON and YAML formats (YAML is a superset of JSON) - Updated 'load_config' to search for 'config.json', 'config.yaml' - Added 'python3-yaml' (Debian) and 'python3-pyyaml' (RHEL) as required base packages in Dockerfile.j2 This change improves configuration readability and allows for easier maintenance while ensuring no breakage for existing JSON-based deployments. Change-Id: Icfb52b8f94e1036d5952b160c5921348d1427fda Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-06-12Install and start virtlogd in nova-libvirt.Michael Still2-1/+16
Due to implementation choices in qemu and libvirt, standard log rotate does not work on these console files, and instead the usual approach is to have libvirt's virtlogd rotate the contents of the console log file when it gets a bit big. OpenStack Compute knows how to read data from more than one rotated console log file if required to service a REST API request. OpenStack Kolla and Kolla-Ansible deploy OpenStack components in docker or podman containers. An error in the startup configuration for the nova_libvirt container results in the libvirt virtlogd daemon not being run, which results in this console log rotation not occurring. This opens up the risk of a disk usage denial of service attack on a hypervisor. The console log is stored on the same filesystem as ephemeral disks, and OpenStack Nova will take a hypervisor out of service if disk space becomes constrained. There is some protection from the instance console not being able to write data particularly quickly, but it is definitely still possible to fill the hypervisor file system -- especially if multiple instances are used. This misconfiguration appears to exist in all versions of Kolla / Kolla-Ansible as best as I can tell. Partial-Bug: 2155214 Change-Id: Ib62191e3022e5bcff781c12f662c9800fb210eb9 Signed-off-by: Michael Still <mikal@stillhq.com>
2026-06-08keepalived: Install mariadb client packageMichal Nasiadka1-2/+6
Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/992020 Related-Bug: #2155865 Change-Id: I1c67f6b0f4780b7caf83ccf95a20861d9fefe20b Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-08Merge "Implement container image build for kerbside."Zuul5-0/+64
2026-06-07Merge "httpd: Install mod_auth_mellon from EPEL"Zuul2-4/+2
2026-06-03Implement container image build for kerbside.Michael Still5-0/+64
This change adds images for Kerbside. Kerbside is a SPICE protocol native proxy used to expose the new spice-direct console type provided by Openstack Compute. This allows high fidelity virtual desktop experiences without requiring transcoding of the console into HTML5 in Horizon, or allowing users direct access to the console ports on your hypervisors. Sadly, Red Hat chose to remove SPICE support from qemu in RHEL9, and Rocky Linux has followed along. You therefore _must_ run the Debian or Ubuntu container images if you wish to use the ``spice-direct`` console type. Architecturally Kerbside has two components -- an API service which turns console access URLs from Nova into URLs to ``.vv`` files, and a proxy service which actually proxies the SPICE traffic. These are handled as separate container images here because they're quite different. One is a WSGI REST API, and the other is a daemon. It is also likely that deployers would choose to host these on different machines. Finally, the proxy service needs to be special cased in load balancing because it strongly expects to terminate TLS itself. The haproxy is therefore configured as a layer 4 proxy in this case. Depends-On: https://review.opendev.org/c/openstack/kolla/+/991249 Change-Id: If60a70745462e1360cfadaab1a5a8d75b7fdeb21 Partial-Bug: #2131793 (spice-direct consoles) Signed-off-by: Michael Still <mikal@stillhq.com>
2026-06-02Merge "masakari: Add crmadmin and cibadmin to monitors sudoers"Zuul1-0/+2
2026-06-01httpd: Install mod_auth_mellon from EPELMichal Nasiadka2-4/+2
And remove the redundant comment and repo enablement in keystone container. Change-Id: I3a64b13fcaef62c73cccc9c478e7392efc8ee554 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-05-19Remove support for networking-infobloxTakashi Kajinami1-20/+0
The project[1] has received no commit for 4 years. Its latest commit still uses upper constraints from the old, abandoned Wallaby branch. [1] https://opendev.org/x/networking-infoblox Depends-on: https://review.opendev.org/c/openstack/kolla-ansible/+/988844 Change-Id: I9e2ba00671eb7d05de3c40ed9524f20922e081b1 Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
2026-05-13Merge "horizon: rebuild static assets after theme changes"Zuul1-1/+2
2026-05-08Merge "ironic-pxe: Remove httpd setup call"Zuul1-2/+0
2026-05-08horizon: rebuild static assets after theme changesGrzegorz Koper1-1/+2
Include the theme directory in settings_bundle so theme-only changes invalidate the cache and rebuild the static assets. Closes-Bug: #2148389 Change-Id: If4fbc24c5c339f7dee7bf67a09fc6448ede0c9fd Signed-off-by: Grzegorz Koper <grzegorzk@stackhpc.com>
2026-05-08Remove influxdb from repos.yamlMichal Nasiadka1-1/+0
It was ommitted in the original influxdb removal patch [1]. [1]: https://review.opendev.org/c/openstack/kolla/+/973051 Change-Id: Ie28d1cc615cc09f013438285b4dcbc2dbab0f4b5 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-05-08ironic-pxe: Remove httpd setup callMichal Nasiadka1-2/+0
We're not using ironic-pxe as ironic-http anymore and kolla_httpd_setup has been removed from base. Change-Id: Id25e39cee9fd64d147301a39528aa8525bd682c2 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-05-06Drop apache installation outside of httpd container22.0.0.0rc1Michal Nasiadka10-81/+3
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/986483 Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/986352 Change-Id: Ia66dde09bbbad2a5a9e67a8c642f3223ca38be43 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-05-05set_configs: Add support for creating directories and setting permsMichal Nasiadka1-0/+22
Change-Id: Id63c035fafaa68a9004c65161c5a3a3ad5544f02 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-05-04Merge "Remove Babel from openstack-base"Zuul1-1/+0
2026-05-04Merge "Bump OVN to 26.03 in Rocky Linux 10 images"Zuul1-1/+1
2026-05-04Remove Babel from openstack-basePierre Riteau1-1/+0
The Babel dependency was removed from most OpenStack projects years ago. Change-Id: I21fc99f42b0fbfa45ff2d9366ea603866e6682d4 Signed-off-by: Pierre Riteau <pierre@stackhpc.com>
2026-04-28Bump OVN to 26.03 in Rocky Linux 10 imagesBartosz Bezak1-1/+1
Change-Id: I3f0dab4b7d612d3e3f3057c1db8c36e3905cec75 Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
2026-04-28keystone: Remove wsgi fileMichal Nasiadka2-3/+0
Kolla-Ansible has been migrated long ago to use uwsgi app instead of file. Change-Id: I347c6f89136427347e9443c85230632474adb7eb Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-28Remove httpd_setup calls from api containersMichal Nasiadka21-47/+0
We have dropped mod_wsgi support from services in [1]. [1]: https://review.opendev.org/c/openstack/kolla-ansible/+/982414 Change-Id: Ie5da8427706dfb74bad4e174c990355a6870114c Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-28Drop mod_wsgiMichal Nasiadka2-4/+0
It's not needed since [1]. [1]: https://review.opendev.org/c/openstack/kolla-ansible/+/982414 Change-Id: I39ab300240b0178f3697ff2dcdf1fab2c3b828bf Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-27Merge "Drop zun and kuryr"Zuul16-295/+0
2026-04-27Merge "Switch to binary release of OpenStack Network exporter"Zuul1-29/+8
2026-04-24Drop zun and kuryrMichal Nasiadka16-295/+0
Zun is broken in 2026.1, it has been released broken and there are no reviews on the patch to fix it [1]. [1]: https://review.opendev.org/c/openstack/zun/+/982362 Change-Id: I770b9e62c66f8cc63475d51f80eecacc8415b91f Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-24Switch to binary release of OpenStack Network exporterDoug Szumski1-29/+8
We no longer need to build this from source: aharivel has kindly responded to our request to create a release: https://github.com/openstack-k8s-operators/openstack-network-exporter/releases Needed-By: I35b3bb10aec18a9377515e8c04d2542e712c0f12 Change-Id: Id30cab4e4bbac470f33354870fd941c3ea17815c Signed-off-by: Doug Szumski <doug@stackhpc.com>
2026-04-24Remove reference to deprecated app.wsgi in Aodh imagePiotr Milewski1-4/+1
The app.wsgi entry point has been removed upstream in Aodh 2026.1 (see: https://review.opendev.org/c/openstack/aodh/+/983216) Change-Id: I2738b7844bf852f2a0a1ca903463f92ffc25f4d2 Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-04-15Merge "Return missing systemd-udev into cinder and glance containers"Zuul2-2/+4
2026-04-15Return missing systemd-udev into cinder and glance containersVictor Chembaev2-2/+4
systemd-udev package provides /usr/lib/udev/scsi_id tool, required for operating with scsi-attached storage Closes-Bug: #2148205 Change-Id: I7b0c25d361fc61992089ee88625fb3ab63c12fb4 Signed-off-by: Victor Chembaev <chembervint@gmail.com>
2026-04-13Add Prometheus network exporterDoug Szumski1-0/+45
This exporter comes from https://github.com/openstack-k8s-operators and will replace the existing OVN exporter which was archived at the end of 2024. It can gather metrics from both OVN and OVS based OpenStack clouds. Change-Id: Idb070d5e5469abd472481f7e19614ee2a78c85d0 Signed-off-by: Doug Szumski <doug@stackhpc.com>
2026-04-03Merge "add venv path check when set dev mode"Zuul1-1/+3
2026-04-02Merge "Add Dockerfile for neutron-ovn-vpn-agent"Zuul1-0/+31
2026-04-01Merge "Remove dsa from haproxy-ssh host key types"Zuul1-1/+1
2026-03-30Merge "Bump OVN to 25.09 in Rocky Linux 10 images"Zuul1-1/+1
2026-03-30Merge "Prometheus: add valkey exporter image"Zuul1-0/+25
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 19:23:12 +0000