From 610eef2089c186c6e698bb1781501ee8c696f7d5 Mon Sep 17 00:00:00 2001 From: Michal Nasiadka Date: Fri, 24 Apr 2026 19:25:00 +0200 Subject: Drop apache installation outside of httpd container Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/986483 Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/986352 Change-Id: Ia66dde09bbbad2a5a9e67a8c642f3223ca38be43 Signed-off-by: Michal Nasiadka --- docker/base/Dockerfile.j2 | 3 +- docker/base/httpd_setup.sh | 51 ---------------------- docker/horizon/Dockerfile.j2 | 4 -- docker/httpd/Dockerfile.j2 | 5 +-- docker/httpd/httpd_setup.sh | 51 ++++++++++++++++++++++ .../ironic-prometheus-exporter/Dockerfile.j2 | 21 --------- docker/keystone/keystone-base/Dockerfile.j2 | 4 -- docker/keystone/keystone/Dockerfile.j2 | 2 - .../letsencrypt-webserver/Dockerfile.j2 | 34 --------------- .../letsencrypt-webserver/extend_start.sh | 3 -- docker/openstack-base/Dockerfile.j2 | 8 ---- 11 files changed, 54 insertions(+), 132 deletions(-) delete mode 100644 docker/base/httpd_setup.sh create mode 100644 docker/httpd/httpd_setup.sh delete mode 100644 docker/letsencrypt/letsencrypt-webserver/Dockerfile.j2 delete mode 100644 docker/letsencrypt/letsencrypt-webserver/extend_start.sh (limited to 'docker') diff --git a/docker/base/Dockerfile.j2 b/docker/base/Dockerfile.j2 index c137011f6..46d8222c6 100644 --- a/docker/base/Dockerfile.j2 +++ b/docker/base/Dockerfile.j2 @@ -304,7 +304,6 @@ COPY set_configs.py /usr/local/bin/kolla_set_configs COPY start.sh /usr/local/bin/kolla_start COPY copy_cacerts.sh /usr/local/bin/kolla_copy_cacerts COPY install_projects.sh /usr/local/bin/kolla_install_projects -COPY httpd_setup.sh /usr/local/bin/kolla_httpd_setup COPY kolla_patch.sh /usr/local/bin/kolla_patch COPY sudoers /etc/sudoers @@ -327,7 +326,7 @@ RUN touch /usr/local/bin/kolla_extend_start \ /usr/local/bin/kolla_copy_cacerts \ /usr/local/bin/kolla_install_projects \ /usr/local/bin/kolla_patch \ - && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_httpd_setup \ + && chmod 644 /usr/local/bin/kolla_extend_start \ && chmod 440 /etc/sudoers \ && mkdir -p /var/log/kolla \ && chown :kolla /var/log/kolla \ diff --git a/docker/base/httpd_setup.sh b/docker/base/httpd_setup.sh deleted file mode 100644 index 35f7b5b1e..000000000 --- a/docker/base/httpd_setup.sh +++ /dev/null @@ -1,51 +0,0 @@ -#!/bin/bash - -# This script performs setup necessary to run the Apache httpd web server. -# It should be sourced rather than executed as environment variables are set. - -# Assume the service runs on top of Apache httpd when user is root. -if [[ "$(whoami)" == 'root' ]]; then - # NOTE(pbourke): httpd will not clean up after itself in some cases which - # results in the container not being able to restart. (bug #1489676, 1557036) - if [[ "${KOLLA_BASE_DISTRO}" =~ debian|ubuntu ]]; then - # NOTE(yoctozepto): APACHE_CONFDIR has to be set to pass the next step - # under the `set -o nounset` regime - APACHE_CONFDIR= - # Loading Apache2 ENV variables - . /etc/apache2/envvars - install -d /var/run/apache2/ - rm -rf /var/run/apache2/* - else - rm -rf /var/run/httpd/* /run/httpd/* /tmp/httpd* - # NOTE(mmalchuk): This added to make Rocky/Centos similar to Ubuntu/Debian - # to provide /server-status handler for local monitoring of the Apache. - # The module already loaded in the /etc/httpd/conf.modules.d/00-base.conf. - cat << EOF >/etc/httpd/conf.modules.d/99-server-status.conf - - SetHandler server-status - Require local - -EOF - fi - - # CentOS/Rocky have an issue with mod_ssl which produces an invalid Apache - # configuration in /etc/httpd/conf.d/ssl.conf. This causes the following error - # on startup: - # SSLCertificateFile: file '/etc/pki/tls/certs/localhost.crt' does not exist or is empty - # Work around this by generating certificates manually. - # NOTE(mnasiadka): in EL9 upgrade jobs gencerts is failing on wrong permissions to dhparams.pem - if [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]] && [[ ! -e /etc/pki/tls/certs/localhost.crt ]]; then - rm -f /tmp/dhparams.pem - /usr/libexec/httpd-ssl-gencerts - fi -fi - -# The default system locale with unicode support -LANG=C.UTF-8 - -# Override the default locale if configured -if [[ "${KOLLA_BASE_DISTRO}" =~ debian|ubuntu ]]; then - [ -f /etc/default/locale ] && . /etc/default/locale -else - [ -f /etc/locale.conf ] && . /etc/locale.conf -fi diff --git a/docker/horizon/Dockerfile.j2 b/docker/horizon/Dockerfile.j2 index c7d6f8aa2..bd661fcad 100644 --- a/docker/horizon/Dockerfile.j2 +++ b/docker/horizon/Dockerfile.j2 @@ -26,10 +26,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build {{ macros.install_packages(horizon_packages | customizable("packages")) }} -{% block horizon_ubuntu_source_setup %} -RUN ln -s ../mods-available/headers.load /etc/apache2/mods-enabled/headers.load -{% endblock %} - {% endif %} ADD horizon-archive /horizon-source diff --git a/docker/httpd/Dockerfile.j2 b/docker/httpd/Dockerfile.j2 index a41465661..03b4e688b 100644 --- a/docker/httpd/Dockerfile.j2 +++ b/docker/httpd/Dockerfile.j2 @@ -36,9 +36,8 @@ RUN echo > /etc/apache2/ports.conf {% endif %} COPY extend_start.sh /usr/local/bin/kolla_extend_start -RUN chmod 644 /usr/local/bin/kolla_extend_start - +COPY httpd_setup.sh /usr/local/bin/kolla_httpd_setup +RUN chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_httpd_setup USER root {% block apache_footer %}{% endblock %} - diff --git a/docker/httpd/httpd_setup.sh b/docker/httpd/httpd_setup.sh new file mode 100644 index 000000000..35f7b5b1e --- /dev/null +++ b/docker/httpd/httpd_setup.sh @@ -0,0 +1,51 @@ +#!/bin/bash + +# This script performs setup necessary to run the Apache httpd web server. +# It should be sourced rather than executed as environment variables are set. + +# Assume the service runs on top of Apache httpd when user is root. +if [[ "$(whoami)" == 'root' ]]; then + # NOTE(pbourke): httpd will not clean up after itself in some cases which + # results in the container not being able to restart. (bug #1489676, 1557036) + if [[ "${KOLLA_BASE_DISTRO}" =~ debian|ubuntu ]]; then + # NOTE(yoctozepto): APACHE_CONFDIR has to be set to pass the next step + # under the `set -o nounset` regime + APACHE_CONFDIR= + # Loading Apache2 ENV variables + . /etc/apache2/envvars + install -d /var/run/apache2/ + rm -rf /var/run/apache2/* + else + rm -rf /var/run/httpd/* /run/httpd/* /tmp/httpd* + # NOTE(mmalchuk): This added to make Rocky/Centos similar to Ubuntu/Debian + # to provide /server-status handler for local monitoring of the Apache. + # The module already loaded in the /etc/httpd/conf.modules.d/00-base.conf. + cat << EOF >/etc/httpd/conf.modules.d/99-server-status.conf + + SetHandler server-status + Require local + +EOF + fi + + # CentOS/Rocky have an issue with mod_ssl which produces an invalid Apache + # configuration in /etc/httpd/conf.d/ssl.conf. This causes the following error + # on startup: + # SSLCertificateFile: file '/etc/pki/tls/certs/localhost.crt' does not exist or is empty + # Work around this by generating certificates manually. + # NOTE(mnasiadka): in EL9 upgrade jobs gencerts is failing on wrong permissions to dhparams.pem + if [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]] && [[ ! -e /etc/pki/tls/certs/localhost.crt ]]; then + rm -f /tmp/dhparams.pem + /usr/libexec/httpd-ssl-gencerts + fi +fi + +# The default system locale with unicode support +LANG=C.UTF-8 + +# Override the default locale if configured +if [[ "${KOLLA_BASE_DISTRO}" =~ debian|ubuntu ]]; then + [ -f /etc/default/locale ] && . /etc/default/locale +else + [ -f /etc/locale.conf ] && . /etc/locale.conf +fi diff --git a/docker/ironic/ironic-prometheus-exporter/Dockerfile.j2 b/docker/ironic/ironic-prometheus-exporter/Dockerfile.j2 index 3fdf78167..52a865598 100644 --- a/docker/ironic/ironic-prometheus-exporter/Dockerfile.j2 +++ b/docker/ironic/ironic-prometheus-exporter/Dockerfile.j2 @@ -9,27 +9,6 @@ USER root {% import "macros.j2" as macros with context %} -{% if base_package_type == 'rpm' %} - - {% set ironic_prometheus_exporter_packages = [ - 'httpd', - 'mod_ssl', - ] %} - -{{ macros.install_packages(ironic_prometheus_exporter_packages | customizable("packages")) }} -RUN sed -i -r 's,^(Listen 80),#\1,' /etc/httpd/conf/httpd.conf \ - && sed -i -r 's,^(Listen 443),#\1,' /etc/httpd/conf.d/ssl.conf - -{% elif base_package_type == 'deb' %} - {% set ironic_prometheus_exporter_packages = [ - 'apache2', - ] %} - -{{ macros.install_packages(ironic_prometheus_exporter_packages | customizable("packages")) }} -RUN echo > /etc/apache2/ports.conf - -{% endif %} - ENV IRONIC_CONFIG /etc/ironic/ironic.conf {{ macros.kolla_patch_sources() }} diff --git a/docker/keystone/keystone-base/Dockerfile.j2 b/docker/keystone/keystone-base/Dockerfile.j2 index e1e8588bf..36d793a2e 100644 --- a/docker/keystone/keystone-base/Dockerfile.j2 +++ b/docker/keystone/keystone-base/Dockerfile.j2 @@ -16,15 +16,11 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build {% set keystone_base_packages = [ 'cyrus-sasl-devel', - 'mod_auth_mellon', - 'mod_auth_openidc', 'openldap-devel', ] %} {% elif base_package_type == 'deb' %} {% set keystone_base_packages = [ - 'libapache2-mod-auth-mellon', - 'libapache2-mod-auth-openidc', 'libldap-common', 'libldap2-dev', 'libsasl2-dev', diff --git a/docker/keystone/keystone/Dockerfile.j2 b/docker/keystone/keystone/Dockerfile.j2 index 26af6932e..46d60330e 100644 --- a/docker/keystone/keystone/Dockerfile.j2 +++ b/docker/keystone/keystone/Dockerfile.j2 @@ -10,11 +10,9 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build {% if base_package_type == 'rpm' %} {% set keystone_packages = [ 'krb5-devel', - 'mod_auth_gssapi', ] %} {% elif base_package_type == 'deb' %} {% set keystone_packages = [ - 'libapache2-mod-auth-gssapi', 'libkrb5-dev', ] %} {% endif %} diff --git a/docker/letsencrypt/letsencrypt-webserver/Dockerfile.j2 b/docker/letsencrypt/letsencrypt-webserver/Dockerfile.j2 deleted file mode 100644 index d4be0153f..000000000 --- a/docker/letsencrypt/letsencrypt-webserver/Dockerfile.j2 +++ /dev/null @@ -1,34 +0,0 @@ -FROM {{ namespace }}/{{ image_prefix }}letsencrypt-base:{{ tag }} -{% block labels %} -LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build_date }}" -{% endblock %} - -{% block letsencrypt_webserver_header %}{% endblock %} - -{% import "macros.j2" as macros with context %} - -{% if base_package_type == 'rpm' %} - {% set letsencrypt_webserver_packages = [ - 'httpd', - 'mod_ssl' - ] %} -{% elif base_package_type == 'deb' %} - {% set letsencrypt_webserver_packages = [ - 'apache2' - ] %} -{% endif %} -{{ macros.install_packages(letsencrypt_webserver_packages | customizable("packages")) }} - -{% if base_package_type == 'rpm' %} -RUN sed -i -r 's,^(Listen 80),#\1,' /etc/httpd/conf/httpd.conf \ - && sed -i -r 's,^(Listen 443),#\1,' /etc/httpd/conf.d/ssl.conf -{% elif base_package_type == 'deb' %} -RUN echo > /etc/apache2/ports.conf -{% endif %} - -COPY extend_start.sh /usr/local/bin/kolla_letsencrypt_extend_start - -{{ macros.kolla_patch_sources() }} - -{% block letsencrypt_webserver_footer %}{% endblock %} -{% block footer %}{% endblock %} diff --git a/docker/letsencrypt/letsencrypt-webserver/extend_start.sh b/docker/letsencrypt/letsencrypt-webserver/extend_start.sh deleted file mode 100644 index c55f0b199..000000000 --- a/docker/letsencrypt/letsencrypt-webserver/extend_start.sh +++ /dev/null @@ -1,3 +0,0 @@ -#!/bin/bash - -. /usr/local/bin/kolla_httpd_setup diff --git a/docker/openstack-base/Dockerfile.j2 b/docker/openstack-base/Dockerfile.j2 index eaa010396..6c53fe587 100644 --- a/docker/openstack-base/Dockerfile.j2 +++ b/docker/openstack-base/Dockerfile.j2 @@ -37,7 +37,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build {% elif base_package_type == 'deb' %} {% set openstack_base_packages = [ - 'apache2', 'build-essential', 'ca-certificates', 'git', @@ -209,13 +208,6 @@ ENV PATH /var/lib/kolla/venv/bin:$PATH RUN {{ macros.install_pip(['pip', 'wheel', 'setuptools']) }} \ && {{ macros.install_pip(openstack_base_pip_packages | customizable("pip_packages")) }} -{% if base_package_type == 'rpm' %} -RUN sed -i -r 's,^(Listen 80),#\1,' /etc/httpd/conf/httpd.conf \ - && sed -i -r 's,^(Listen 443),#\1,' /etc/httpd/conf.d/ssl.conf -{% elif base_package_type == 'deb' %} -RUN echo > /etc/apache2/ports.conf -{% endif %} - {{ macros.kolla_patch_sources() }} {% block openstack_base_footer %}{% endblock %} -- cgit v1.2.3