aboutsummaryrefslogtreecommitdiff
path: root/kolla
AgeCommit message (Collapse)AuthorFilesLines
2026-07-23Rework tar normalization to a shared functionMichael Sherman2-24/+82
Add missing tests Change-Id: I91b42fe530f87af7d78bb1a543b29a4b0d50872e Signed-off-by: Michael Sherman <shermanm@uchicago.edu>
2026-07-23Merge "Add monitoring for external component versions"Zuul1-0/+9
2026-07-22Merge "rabbitmq: Update to 4.3"Zuul4-4/+4
2026-07-21Merge "neutron: Move tap-as-a-service to be a plugin"Zuul2-1/+4
2026-07-21Merge "Bump ansible-core to 2.21"Zuul1-1/+1
2026-07-21neutron: Move tap-as-a-service to be a pluginMichal Nasiadka2-1/+4
Neutron has changed policy definitions and it's fixed in unreleased version of tap-as-a-service - and we're installing that package from pypi instead of from tarballs. Change-Id: Icffea19cf9c1279dd7e133c5588efd5818249b75 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-07-20rabbitmq: Update to 4.3Piotr Milewski4-4/+4
Erlang 28 is only supported for new clusters. Upgrades of clusters running RabbitMQ with Khepri on Erlang 27 to Erlang 28 have a known issue affecting rolling upgrades. Change-Id: I60d85a92534e8aa9ec6a72d71457057b96d7e554 Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-07-20ironic-pxe: don't fail if symlinks already existOwen Jones1-4/+2
`ironic-pxe` start-up fails if symlinks to efi files have previously been created. Removing test for existence and adding `-f` flag to symlink creation ensures they always exist without failing on start. Closes-Bug: #2160317 Change-Id: Ib736e5beb201409c8987fbc62225c75f89cbfe62 Signed-off-by: Owen Jones <owen@stackhpc.com>
2026-07-20Add monitoring for external component versionsPiotr Milewski1-0/+9
This commit introduces a new tool designed to monitor versions of external components defined in kolla/common/sources.py. Change-Id: I85e35fcba454c519c12c7ed90210b7dbd46c1677 Signed-off-by: Piotr Milewski <vurmil@gmail.com> Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-07-17ironic: stop using driver-requirements.txtMichal Nasiadka2-2/+1
It was removed with [1]. [1]: https://opendev.org/openstack/ironic/commit/299203f7a327be883707da950630c35714b482a2# Change-Id: Ic71e22241ab58175ebda95efac152c5a5c5d5000 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-07-10Bump ansible-core to 2.21Michal Nasiadka1-1/+1
Change-Id: I51c63b487b2550f6357aba6068f671b3c22df5da Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-07-09Update docstring in handle_reposMichal Nasiadka1-5/+13
Change-Id: Ic088f5a85f3c033b0c5024d0b2e1bc889c52648d Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-07-09Add support to override base reposMichal Nasiadka6-51/+334
BaseOS and AppStream for CentOS/Rocky ubuntu, ubuntu-security for Ubuntu debian, debian-security for Debian ubuntu-cloud-archive is not really a base repo - so removing it from ubuntu.sources Change-Id: Iab98de963f2e8532389b7563bb572d8aa20c7aa6 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-07-06Migrate to pyproject.tomlMichal Nasiadka371-0/+10882
[tool.setuptools.data-files] does not support recursive directory installation. The old setup.cfg [files] worked because PBR's FilesConfig.expand_globs() used os.walk() to expand docker/*, but this hook is not triggered by the pbr.build PEP-517 backend. Move docker/ into kolla/ and use [tool.setuptools.package-data] instead. Update kolla_worker._get_images_dir() to check the kolla package directory first so both editable and regular installs work. Change-Id: I4fc452c03740ef22ebbb4e8d0d86c4f4783e2d09 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-07-06Merge "kolla-build: normalize mtime in archive creation"Zuul1-0/+3
2026-07-06Merge "Add opt-in SPICE support for Rocky via COPR."Zuul1-0/+5
2026-06-29Merge "kolla-build: fix build-date LABEL invalidating Docker layer cache"Zuul3-4/+3
2026-06-29Add opt-in SPICE support for Rocky via COPR.Michael Still1-0/+5
RHEL9 dropped SPICE support from qemu-kvm, and Rocky Linux followed suit. Up until now the documented guidance has been to use the Debian or Ubuntu container images if you want to serve the ``spice-direct`` console type, because the stock Rocky nova-libvirt image will simply fail to start any SPICE-enabled instance. This change adds a second version of the nova-libvirt container image called nova-libvirt-spice. It is always built, but is identical for all supported container base distributions except for Rocky Linux. In the Rocky Linux case, this container adds the community maintained ligenix/enterprise-qemu-spice COPR repository that provides a rebuild of ``qemu-kvm`` with SPICE support re-enabled for both EPEL 9 and EPEL 10. Which nova-libvirt container should be used in a given deployment is delegated to logic in kolla-ansible, based on the deployer's settings in globals.yml. The COPR is a third-party rebuild with no vendor support contract. The release note and support matrix are updated to describe the opt-in path and call this caveat out explicitly. The earlier "you must use Debian or Ubuntu" wording in the support matrix is softened here, rather than by retroactively editing the kerbside container-build patch that introduced it, so that this feature can land (or not land) independently of the earlier change. Partial-Bug: #2131793 (spice-direct consoles) Prompt: I am interested in seeing how we would go about using https://copr.fedorainfracloud.org/coprs/ligenix/enterprise-qemu-spice/ to add SPICE support back to the Kolla build Rocky Linux containers as a new patch in the kolla/ORDER list. Could you please investigate options here? Assisted-By: Claude Code Co-Authored-By: Claude Opus 4.7 (1M context, medium effort) <noreply@anthropic.com> Change-Id: I410b87b7f8cdd541c48d9a749b3fea634a5f4e6c Signed-off-by: Michael Still <mikal@stillhq.com>
2026-06-24prometheus-mtail: Switch to a new forkMichal Nasiadka1-4/+4
It seems that the original maintainer lost write access to google/mtail repository long time ago, and we still ship versions from 2024. [1]: https://github.com/google/mtail/issues/929 Change-Id: I41c5d0649eb38348ccda413b7d6537830cd82bec Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-24kolla-build: normalize mtime in archive creationMichal Nasiadka1-0/+3
The reset_userinfo tar filter used when creating plugins and additions archives normalized uid/gid but left mtime untouched. Since archives are created after set_time() has already run, and the default working directory is a fresh temp dir per invocation, the embedded directory mtime was always the current time. Docker computes a content checksum for ADD instructions, so a different mtime in the tar produced a different checksum on every run. Fix by setting tarinfo.mtime = 0 in both reset_userinfo filters and calling os.utime(arc_path, (0, 0)) on the archive file after creation, making the archives binary-identical across runs for the same content. Change-Id: I205dab2c4a74fb9e3cb15c421d5c025849f5632a Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-24kolla-build: fix build-date LABEL invalidating Docker layer cacheMichal Nasiadka3-4/+3
The build-date label was rendered into a LABEL instruction on line 3 of every Dockerfile template, immediately after FROM. Because Docker invalidates the cache for a changed instruction and all subsequent layers, a date change caused a full rebuild of every image on each new calendar day, even when nothing else had changed. Fix this by removing build-date from the Dockerfile templates and applying it as a --label argument at build time via image.labels. Labels passed on the build command line are not part of the Dockerfile cache key, so the date is still recorded in the image metadata without affecting layer caching. Change-Id: I8ef0d85bab1a999a4d09f7cbf0c088ca00fdcf77 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-22Merge "repos: Merge user-provided with default repos.yaml"Zuul2-9/+12
2026-06-18Update Prometheus to version 3.5.4Pierre Riteau1-3/+3
This release fixes multiple security issues [1]. [1] https://github.com/prometheus/prometheus/releases/tag/v3.5.4 Change-Id: I1ec8f15e14360422aa316779bd19195fd1f4f7a1 Signed-off-by: Pierre Riteau <pierre@stackhpc.com>
2026-06-18kolla-build: Add Docker BuildKit support via docker buildx buildMichal Nasiadka5-1/+428
Add --buildkit flag to use docker buildx build instead of the docker-py SDK. An optional --buildkit-builder selects a named buildx builder instance, enabling docker-container or remote drivers for multi-arch builds. --buildkit and --squash are mutually exclusive and rejected at startup. PushTask is skipped when buildkit is active; push is handled inline. Set buildkit as the new default. Change-Id: Idbf1d1bdc091bb84721f8006c2b916731b999859 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-16repos: Merge user-provided with default repos.yamlMichal Nasiadka2-9/+12
Change-Id: I7513f1ab627aa5137e16777ca6bee600e14a00e9 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-10kolla-build: Use SandboxedEnvironment to prevent SSTIMichal Nasiadka3-2/+113
Switch from jinja2.Environment to jinja2.sandbox.SandboxedEnvironment to block Server-Side Template Injection attacks. Closes-Bug: #2146056 Change-Id: Iecd1d8dcf99007e3339120961c7c1d0ca12f83d8 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-08Merge "Implement container image build for kerbside."Zuul3-0/+9
2026-06-07Merge "Revert "Switch to Gazpacho/2026.1 sources"."Zuul1-1/+1
2026-06-07Merge "httpd: Install mod_auth_mellon from EPEL"Zuul1-4/+0
2026-06-05Revert "Switch to Gazpacho/2026.1 sources".Michael Still1-1/+1
This reverts the OPENSTACK_RELEASE bump from kolla commit 352b7fce. The stable/2026.1 branch is now active, so the late-cycle pin to '2026.1' is stale and needs to be reverted back to 'master' -- mirroring the same housekeeping pattern as the 2025.1->master revert (87678d014, 2025-05) and the 2025.2->master revert (c30e4e524, 2025-12). I specifically found this because Nova master commit 770580bb bumped oslo.privsep in requirements.txt from >=2.6.2 to >=3.11.0. With OPENSTACK_RELEASE = '2026.1', openstack_branch resolves to stable-2026.1 and openstack-base pulls requirements-stable-2026.1.tar.gz, which still pins oslo.privsep===3.10.1. The resulting ResolutionImpossible causes image builds to fail. Change-Id: I7d156af2fa9677cd4921f518ac1c6ecf7acde9ce Signed-off-by: Michael Still <mikal@stillhq.com>
2026-06-03Implement container image build for kerbside.Michael Still3-0/+9
This change adds images for Kerbside. Kerbside is a SPICE protocol native proxy used to expose the new spice-direct console type provided by Openstack Compute. This allows high fidelity virtual desktop experiences without requiring transcoding of the console into HTML5 in Horizon, or allowing users direct access to the console ports on your hypervisors. Sadly, Red Hat chose to remove SPICE support from qemu in RHEL9, and Rocky Linux has followed along. You therefore _must_ run the Debian or Ubuntu container images if you wish to use the ``spice-direct`` console type. Architecturally Kerbside has two components -- an API service which turns console access URLs from Nova into URLs to ``.vv`` files, and a proxy service which actually proxies the SPICE traffic. These are handled as separate container images here because they're quite different. One is a WSGI REST API, and the other is a daemon. It is also likely that deployers would choose to host these on different machines. Finally, the proxy service needs to be special cased in load balancing because it strongly expects to terminate TLS itself. The haproxy is therefore configured as a layer 4 proxy in this case. Depends-On: https://review.opendev.org/c/openstack/kolla/+/991249 Change-Id: If60a70745462e1360cfadaab1a5a8d75b7fdeb21 Partial-Bug: #2131793 (spice-direct consoles) Signed-off-by: Michael Still <mikal@stillhq.com>
2026-06-01httpd: Install mod_auth_mellon from EPELMichal Nasiadka1-4/+0
And remove the redundant comment and repo enablement in keystone container. Change-Id: I3a64b13fcaef62c73cccc9c478e7392efc8ee554 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-05-27Merge "Align default tag with Kolla-Ansible"Zuul1-1/+3
2026-05-27Align default tag with Kolla-AnsibleMichal Nasiadka1-1/+3
Change-Id: Ic305125f32963dcc5a841e63dec2d368d0549eab Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-05-08Remove influxdb from repos.yamlMichal Nasiadka1-9/+0
It was ommitted in the original influxdb removal patch [1]. [1]: https://review.opendev.org/c/openstack/kolla/+/973051 Change-Id: Ie28d1cc615cc09f013438285b4dcbc2dbab0f4b5 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-29Update Prometheus to version 3.5.3Piotr Milewski1-3/+3
This release fixes multiple security issues [1]. [1] https://github.com/prometheus/prometheus/releases/tag/v3.5.3 Change-Id: I9f4243a40d0907639324308d84d8a860c1e54941 Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-04-27Merge "Update Prometheus to version 3.5.2"Zuul1-3/+3
2026-04-27Merge "Drop zun and kuryr"Zuul3-21/+3
2026-04-24Update Prometheus to version 3.5.2Pierre Riteau1-3/+3
Change-Id: I9d82fbcc26a8a3af2718ea8e1f2e0d87a3523579 Signed-off-by: Pierre Riteau <pierre@stackhpc.com>
2026-04-24Drop zun and kuryrMichal Nasiadka3-21/+3
Zun is broken in 2026.1, it has been released broken and there are no reviews on the patch to fix it [1]. [1]: https://review.opendev.org/c/openstack/zun/+/982362 Change-Id: I770b9e62c66f8cc63475d51f80eecacc8415b91f Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-04-24Switch to binary release of OpenStack Network exporterDoug Szumski1-2/+7
We no longer need to build this from source: aharivel has kindly responded to our request to create a release: https://github.com/openstack-k8s-operators/openstack-network-exporter/releases Needed-By: I35b3bb10aec18a9377515e8c04d2542e712c0f12 Change-Id: Id30cab4e4bbac470f33354870fd941c3ea17815c Signed-off-by: Doug Szumski <doug@stackhpc.com>
2026-04-13Add Prometheus network exporterDoug Szumski1-0/+6
This exporter comes from https://github.com/openstack-k8s-operators and will replace the existing OVN exporter which was archived at the end of 2024. It can gather metrics from both OVN and OVS based OpenStack clouds. Change-Id: Idb070d5e5469abd472481f7e19614ee2a78c85d0 Signed-off-by: Doug Szumski <doug@stackhpc.com>
2026-03-31Merge "Add OCI standard labels to container images"Zuul2-3/+74
2026-03-30Add OCI standard labels to container imagesPiotr Milewski2-3/+74
Currently, Kolla images lack standard metadata, making it difficult to identify their build source, creation time, or exact version solely by inspecting the image artifact. This patch introduces the addition of Open Container Initiative (OCI) standard labels to all generated images. The build process now detects metadata (utilizing `direct_url.json` for pip-installed packages to avoid subprocess calls) and injects the following labels into the container runtime config: * org.opencontainers.image.authors * org.opencontainers.image.created * org.opencontainers.image.description * org.opencontainers.image.licenses * org.opencontainers.image.revision * org.opencontainers.image.source * org.opencontainers.image.title * org.opencontainers.image.url * org.opencontainers.image.version Example output: "Labels": { "org.opencontainers.image.authors": "Kolla Project (https://launchpad.net/kolla)", "org.opencontainers.image.created": "2025-12-22T14:02:47.015819", "org.opencontainers.image.description": "OpenStack Kolla keystone-ssh image", "org.opencontainers.image.licenses": "Apache-2.0", "org.opencontainers.image.revision": "96b54022857ccef8dc6bb11789abe32119827109", "org.opencontainers.image.source": "https://opendev.org/openstack/kolla", "org.opencontainers.image.title": "keystone-ssh", "org.opencontainers.image.url": "https://opendev.org/openstack/kolla", "org.opencontainers.image.version": "master-ubuntu-noble" } This enhancement improves the interoperability of Kolla images with standard container tools and registries that display OCI metadata. Change-Id: I3451940c90180ba91759c839987434e94251e32e Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-03-30Merge "Update Ceph Squid RPM repo to centos-10-stream"Zuul2-2/+2
2026-03-30Merge "Prometheus: add valkey exporter image"Zuul1-0/+11
2026-03-26Switch to Gazpacho/2026.1 sourcesMichal Nasiadka2-3/+6
Change-Id: I9b6eba0c55fa9914e8db3576127f7d53c13e97d5 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-03-25Prometheus: add valkey exporter imagePiotr Milewski1-0/+11
Adds a new prometheus-valkey-exporter image to support monitoring of Valkey instances. Change-Id: Id0ad47301e48fc4e2cb1f93865a5c5d58f521467 Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-03-25Update Ceph Squid RPM repo to centos-10-streamSeunghun Lee2-2/+2
Change-Id: I530a0f710507c8f959ccf10e4d3560372e800a05 Signed-off-by: Seunghun Lee <seunghun@stackhpc.com>
2026-03-25Merge "Drop Telegraf"Zuul3-4/+1
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-06 00:29:26 +0000