aboutsummaryrefslogtreecommitdiff
path: root/kolla/image
AgeCommit message (Collapse)AuthorFilesLines
2026-09-22Merge "Allow lowercase from"Zuul1-2/+3
2026-09-16Ensure git cloned dirs are writable for the executing userMichal Nasiadka1-0/+6
Closes-Bug: #2167377 Change-Id: Ic5e32b79d058223634d990fb2e33041692f682ce Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-09-10Drop support for CentOS Stream 10Michal Nasiadka2-16/+3
Change-Id: I5973943fe83bbb00cfc8623c0cd4d4b98b369315 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-08-05Add cleanup_repos to revert build_only overridesMichal Nasiadka1-0/+1
Repos marked build_only: true are backed up before handle_repos() overwrites them and restored at the end of each image build, so CI mirror URLs are not baked into the final image. The cleanup RUN was injected into every Dockerfile, not just images that called handle_repos() for those repos. Child images with no backup fell through to "rm -f", deleting the inherited repo file (e.g. debian.sources in bifrost-base, breaking cpio install). Fix by adding a {repo}.enabled sentinel that handle_repos creates when it processes a build_only repo, making the cleanup conditional on that sentinel. Change-Id: Ie5b9970a4575b6258dc238059d3f33ddfe155789 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-07-30Allow lowercase fromMichal Nasiadka1-2/+3
Change-Id: I42cf2aac795e9f61692deec956de0bedab55086f Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-07-30Move PIP_* env variables to ARG and configMichal Nasiadka2-0/+24
Leaving empty CI template_overrides file in case we need to use it in future. Change-Id: Ic46f1a594bcc330536bc78d93ece10e60622f6d4 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-07-23Rework tar normalization to a shared functionMichael Sherman1-24/+20
Add missing tests Change-Id: I91b42fe530f87af7d78bb1a543b29a4b0d50872e Signed-off-by: Michael Sherman <shermanm@uchicago.edu>
2026-07-06Migrate to pyproject.tomlMichal Nasiadka1-0/+3
[tool.setuptools.data-files] does not support recursive directory installation. The old setup.cfg [files] worked because PBR's FilesConfig.expand_globs() used os.walk() to expand docker/*, but this hook is not triggered by the pbr.build PEP-517 backend. Move docker/ into kolla/ and use [tool.setuptools.package-data] instead. Update kolla_worker._get_images_dir() to check the kolla package directory first so both editable and regular installs work. Change-Id: I4fc452c03740ef22ebbb4e8d0d86c4f4783e2d09 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-24kolla-build: normalize mtime in archive creationMichal Nasiadka1-0/+3
The reset_userinfo tar filter used when creating plugins and additions archives normalized uid/gid but left mtime untouched. Since archives are created after set_time() has already run, and the default working directory is a fresh temp dir per invocation, the embedded directory mtime was always the current time. Docker computes a content checksum for ADD instructions, so a different mtime in the tar produced a different checksum on every run. Fix by setting tarinfo.mtime = 0 in both reset_userinfo filters and calling os.utime(arc_path, (0, 0)) on the archive file after creation, making the archives binary-identical across runs for the same content. Change-Id: I205dab2c4a74fb9e3cb15c421d5c025849f5632a Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-24kolla-build: fix build-date LABEL invalidating Docker layer cacheMichal Nasiadka2-4/+1
The build-date label was rendered into a LABEL instruction on line 3 of every Dockerfile template, immediately after FROM. Because Docker invalidates the cache for a changed instruction and all subsequent layers, a date change caused a full rebuild of every image on each new calendar day, even when nothing else had changed. Fix this by removing build-date from the Dockerfile templates and applying it as a --label argument at build time via image.labels. Labels passed on the build command line are not part of the Dockerfile cache key, so the date is still recorded in the image metadata without affecting layer caching. Change-Id: I8ef0d85bab1a999a4d09f7cbf0c088ca00fdcf77 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-18kolla-build: Add Docker BuildKit support via docker buildx buildMichal Nasiadka2-1/+103
Add --buildkit flag to use docker buildx build instead of the docker-py SDK. An optional --buildkit-builder selects a named buildx builder instance, enabling docker-container or remote drivers for multi-arch builds. --buildkit and --squash are mutually exclusive and rejected at startup. PushTask is skipped when buildkit is active; push is handled inline. Set buildkit as the new default. Change-Id: Idbf1d1bdc091bb84721f8006c2b916731b999859 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-10kolla-build: Use SandboxedEnvironment to prevent SSTIMichal Nasiadka1-2/+3
Switch from jinja2.Environment to jinja2.sandbox.SandboxedEnvironment to block Server-Side Template Injection attacks. Closes-Bug: #2146056 Change-Id: Iecd1d8dcf99007e3339120961c7c1d0ca12f83d8 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-03-31Merge "Add OCI standard labels to container images"Zuul2-3/+74
2026-03-30Add OCI standard labels to container imagesPiotr Milewski2-3/+74
Currently, Kolla images lack standard metadata, making it difficult to identify their build source, creation time, or exact version solely by inspecting the image artifact. This patch introduces the addition of Open Container Initiative (OCI) standard labels to all generated images. The build process now detects metadata (utilizing `direct_url.json` for pip-installed packages to avoid subprocess calls) and injects the following labels into the container runtime config: * org.opencontainers.image.authors * org.opencontainers.image.created * org.opencontainers.image.description * org.opencontainers.image.licenses * org.opencontainers.image.revision * org.opencontainers.image.source * org.opencontainers.image.title * org.opencontainers.image.url * org.opencontainers.image.version Example output: "Labels": { "org.opencontainers.image.authors": "Kolla Project (https://launchpad.net/kolla)", "org.opencontainers.image.created": "2025-12-22T14:02:47.015819", "org.opencontainers.image.description": "OpenStack Kolla keystone-ssh image", "org.opencontainers.image.licenses": "Apache-2.0", "org.opencontainers.image.revision": "96b54022857ccef8dc6bb11789abe32119827109", "org.opencontainers.image.source": "https://opendev.org/openstack/kolla", "org.opencontainers.image.title": "keystone-ssh", "org.opencontainers.image.url": "https://opendev.org/openstack/kolla", "org.opencontainers.image.version": "master-ubuntu-noble" } This enhancement improves the interoperability of Kolla images with standard container tools and registries that display OCI metadata. Change-Id: I3451940c90180ba91759c839987434e94251e32e Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-01-22Drop TelegrafMichal Nasiadka1-2/+0
It has been deprecated in June 2025. Change-Id: I45bfed8ac7fd86dedab81533751e573272c01012 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-12-16Switch to Debian TrixieMichal Nasiadka1-2/+0
Change-Id: Ib7f551d4a7c6ffe95786853d6899e704de4747b8 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-12-03redis: Drop redis and redis-sentinel imagesMichal Nasiadka1-2/+0
We switched to Valkey Change-Id: Ic40fecb87dd3eaf67eb1d3088978d462ff5b4320 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-06Merge "debian: Use {{ openstack_release_codename }} for extrepo"Zuul1-0/+3
2025-10-01Move to Rocky Linux 10Michal Nasiadka1-1/+3
Depends-On: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/961237 Change-Id: Idd809f5efd2d308c1565d7635e67af0a431d18f7 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-09-23debian: Use {{ openstack_release_codename }} for extrepoMichal Nasiadka1-0/+3
Change-Id: I5e89a9a241f746a2cbab723ea5fc57ea65ad5ee5 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-08-20Merge "Enable Prometheus mtail build for ARM64"Zuul1-1/+0
2025-08-20Merge "Influxdb: use stable RHEL repo"Zuul1-1/+0
2025-08-18Influxdb: use stable RHEL repoBartosz Bezak1-1/+0
Switch the RHEL repo to the stable channel as per [1]. Use new GPG. Telegraf arm64 builds are enabled again, as binaries exists. [1] https://repos.influxdata.com/stable/x86_64/ Change-Id: Ie4f6f15404f6965df51f3214506ae9f8bb9b61e7 Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
2025-08-18Enable Barbican build on Ubuntu ARM64Bartosz Bezak1-1/+0
Re-enable the Ubuntu arm64 build. The previous exclusion was due to uWSGI issue [1], which is no longer reproducible on Ubuntu Noble. Change-Id: I400e9a9a3bf03053589835f933023eedee504f08 Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
2025-08-18Enable Prometheus mtail build for ARM64Bartosz Bezak1-1/+0
arm64 binaries are available currently. Change-Id: Iabf606848a6160eaf9e2494a2564f37c6db09882 Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
2025-08-06send empty X-Registry-Auth for anonymous pushesBartosz Bezak1-0/+10
Since Docker 28.3.3 the daemon rejects a push that carries no `X-Registry-Auth` header [1]. The SDK already sets this header when it finds credentials, so the breakage happens only on anonymous pushes. During `PushTask.push_image()` we now check whether the SDK can resolve credentials for the target registry; if it cannot, we inject `auth_config={}`, causing the SDK to send the minimal "{}" header that satisfies the daemon while leaving authenticated pushes unchanged. Drop this addition when [2] is fixed. [1] https://github.com/moby/moby/pull/50371 [2] https://github.com/docker/docker-py/issues/3348 Closes-Bug: #2119619 Change-Id: I7a2f3fce223afd74741b40bf62836b325fca5b19 Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
2025-07-16Move to CentOS Stream 10Michal Nasiadka1-0/+3
Known missing packages: - mod_auth_mellon - missing SAML support in Keystone/Horizon - built in Kolla COPR - glusterfs-fuse in manila-share - built in Kolla COPR - collectd/telegraf - no opstools repository - redis - needs a switch to valkey - python3-ethtool - not required for neutron-mlnx-agent since 6 years [1] Building packages in Kolla COPR is a temporary solution until these show up in EPEL10. [1]: Id2cae3ac9ff049e9fc8225551f99e1e99a87fc65 Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/951751 Change-Id: I7074fabcf95184fcfd2561648ae1e05acfb0bc11 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-02-19Remove Git remote origin after cloning sourcesMichal Arbet1-0/+1
When kolla is cloning a Git repository during the build process, the `.git/config` file retains the remote origin URL, which may expose sensitive credentials if authentication tokens are embedded in the URL. This fix ensures that the remote is removed after cloning to prevent unintended exposure of credentials. Closes-Bug: #2098904 Change-Id: Iec21fc2363e03133ec77326da7392bc25b40132a
2025-02-18Allow to use configure_user macro for external templatesAndriy Kurilin1-1/+12
Commit 79a234239516b94b1b79c7ddafcc4fbe4e3ba155 introduced an ability to build 'in-house'/'not-built-in' projects with Kolla. This commits extends this feature with an ability to use configure_user macro for 'not-built-in' users. The implementation is done the same way as for 'sources', i.e. engine after registers new section structure as soon as it finds unknown '<project>-user' section. In addition, the documentation and CI are extended to cover ``--docker-dir`` option. Change-Id: I690d9f3829083f2493bf286a1c45764b9699219b
2024-11-15Add mechanism for patching files in containersMichal Arbet2-1/+33
This patch adds a way to patch files in a Docker image built by Kolla. This is very useful for several reasons, specifically: - Custom modifications - The stable branch of some library has a fix but no pip package has been released - Eliminates the need to package your own pip packages - Eliminates the need to invent your own versioning to prevent upstream versioning - Eliminates the need to manage a pip server - In other words, it eliminates the need to get a wheel into the image and install it manually using any method not previously mentioned It is also highly desirable because, although Kolla can replace the source for a service with a custom URL for a tarball or its own Git repo, it cannot do this for dependencies pulled from pip. I would also like to point out that this is a feature with its own code path and works only if the user "inserts" a patch into the folder patches/docker-image/something.patch and creates an analogous series file for patch source code. Simply said, this code will never interfere with the upstream build process since this feature is not intended for use in upstream. It is rather meant for downstream users who know what they are doing. Now they just have an option to patch their images. Everything works on all layers of the Docker image and stores a report of applied patches which can then be seen in /etc. This mechanism is similar as debian patch quilt. Change-Id: I61d0790c5d4d070b7ea9e8c99c0a76ff5d22bf9d
2024-10-24CI: bump hackingMichal Nasiadka1-2/+2
Change-Id: I5f2177b7c2edc0e35ed2e8e9bdfc4be2f262309f
2024-09-19Switch to Dynamic Python Version DetectionMichal Arbet1-8/+0
This commit removes the hardcoded KOLLA_DISTRO_PYTHON_VERSION and replaces it with dynamic Python version detection during container images build. Dockerfiles and scripts now use general python3 references, simplifying maintenance and ensuring compatibility with future Python versions. Test cases relying on distro_python_version were also cleaned up. Change-Id: I891749598247a5e951ed4a873b16acfd0566f59c
2024-09-02Merge "Drop prometheus-msteams container images"Zuul1-1/+0
2024-08-27Check if archive is tarfileMichal Nasiadka1-3/+8
Change-Id: I802267d848c1dee722015b0d379bd9210f6c103e
2024-08-23Drop prometheus-msteams container imagesBartosz Bezak1-1/+0
The prometheus-msteams project is no longer maintained [1]. As a result we are removing its associated container images from our repository. Users are encouraged to switch to the native Prometheus Alertmanager integration with Microsoft Teams [2], which offers ongoing support and features. [1] https://github.com/prometheus-msteams/prometheus-msteams/issues/343 [2] https://prometheus.io/docs/alerting/latest/configuration/#msteams_config Change-Id: I66421b14668722607b58865a2ad100204fd387f7
2024-05-28Drop packaging requirement and unpin docker-pyMichal Nasiadka1-11/+9
Change-Id: I11d306be5e5bb3d5b05b50dd8ee64ac9424854a1
2024-05-10collectd: Mark unbuildable on rockyMichal Nasiadka1-0/+1
Since Rocky 9.4 release - delivered libpqos is 5, not 4 - and CentOS Stream 9 OpsTools packages have not been rebuilt. Related-Bug: #2065362 Change-Id: Ic0929becd44f25a9fb8d6d789b8169f41c95a226
2024-03-28Merge "add: cross-compile support"Zuul1-0/+1
2024-02-21Move curl sources to sources.pyMichal Nasiadka2-0/+13
Move most curl sources to sources.py, so it can be automatically updated in future. This also makes overriding the versions/locations/sha256 easier. Change-Id: Ib3497fe96162ae190e5c113cacaaa3ef8334f590
2024-02-08add: cross-compile supportTadas Sutkaitis1-0/+1
The main goal is to be able to build ARM images on standard x86 hardware. Add simple functions supported by python-py and podman-py to enable creation of container images on emulated architectures. Change-Id: I1526b460f6e271c2ec63ab3a3b1dc348d742e96d
2023-12-21Merge "Summary JSON file"Zuul2-4/+21
2023-12-04Revert "Disable build of Gnocchi containers"Michal Nasiadka1-9/+0
This reverts commit 5505cd000ce7f12c272c5b62074c9cc6bf1bb7a7. Closes-Bug: 2039051 Reason for revert: Builds properly now Change-Id: I8fbe01340e539949d867a87a3d20326fc1a2b1b0
2023-12-04bifrost: Don't use env-setupMichal Nasiadka1-2/+0
env-setup script removes epel-release and this breaks our CI template overrides. It is also more geared towards using in opendev CI - let's just install proper Ansible version instead. Change-Id: I68f645bef05dd15eba41479e3ef6713100fb87d0
2023-11-28Handle the case where docker is not availableBartosz Bezak1-1/+6
Change-Id: I473ea1c68d2fd7f15fa0545d77892276b1accfeb
2023-11-28import packaging only for docker container engineBartosz Bezak1-1/+1
Change-Id: If4e0c0e5d6ed5c79ca7d8a3c8f16bfa665f6968f
2023-10-11mark gnocchi-base as unbuildableSven Kieske1-0/+9
Related-Bug: 2039051 Change-Id: If374f086e54be5b9799db7661c88b0204c4f507c Signed-off-by: Sven Kieske <kieske@osism.tech>
2023-09-29Fix build errors missing podman/docker moduleMichal Nasiadka1-9/+12
Example: Traceback (most recent call last): File "/home/ubuntu/kolla/kolla/image/build.py", line 79, in run task.run() File "/home/ubuntu/kolla/kolla/image/tasks.py", line 144, in run self.builder(self.image) File "/home/ubuntu/kolla/kolla/image/tasks.py", line 424, in builder if isinstance(e, podman.errors.exceptions.BuildError): NameError: name 'podman' is not defined Change-Id: I947c77750b3ccfb975e010c2042a3716e3e46bde
2023-09-21Add podman for image buildingMichal Arbet2-3/+40
Add podman as an option to choose for container engine for kolla-build (--engine podman) Signed-off-by: Konstantin Yarovoy <konstantin.yarovoy@tietoevry.com> Co-Authored-By: Michal Arbet <michal.arbet@ultimum.io> Change-Id: I068c906df97745e397408d8c3ef6af47ee037638
2023-09-14Fix stderr logging when image build failMichal Arbet1-1/+8
Change-Id: Ie8730ae44cc26b87bd7eac93c8aac8dce8c7c5fc
2023-09-08build: distutils.StrictVersion() is deprecatedMarcin Juszkiewicz1-2/+2
kolla/tests/test_build.py::MainTest::test_run_build [65/1834] /home/marcin/devel/linaro/kolla/kolla/kolla/image/build.py:117: DeprecationWarning: distutils Version classes are deprecated. Use packaging.version instead. StrictVersion(docker.__version__) Change-Id: I2ebc8b0e35c67bf893deb89ea7fa0146dedd4640
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 19:28:47 +0000