Skip to content

Commit 695c05e

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #1706 from drew-viles/openstack-rockylinux
Adding RockyLinux to openstack
2 parents ee97cf1 + f71add4 commit 695c05e

File tree

6 files changed

+114
-43
lines changed

6 files changed

+114
-43
lines changed

‎images/capi/Makefile‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -380,7 +380,7 @@ OCI_BUILD_NAMES ?= oci-ubuntu-2004 oci-ubuntu-2204 oci-oracle-linux-8 oci-ora
380380

381381
DO_BUILD_NAMES ?= do-centos-7 do-ubuntu-2004 do-ubuntu-2204 do-ubuntu-2404
382382

383-
OPENSTACK_BUILD_NAMES ?= openstack-ubuntu-2004 openstack-ubuntu-2204 openstack-ubuntu-2404 openstack-flatcar
383+
OPENSTACK_BUILD_NAMES ?= openstack-ubuntu-2004 openstack-ubuntu-2204 openstack-ubuntu-2404 openstack-flatcar openstack-rockylinux-9
384384

385385
OSC_BUILD_NAMES ?= osc-ubuntu-2004 osc-ubuntu-2204
386386

@@ -825,6 +825,7 @@ build-node-ova-local-base-ubuntu-2004: ## Builds Ubuntu 20.04 Base Node OVA w lo
825825
build-openstack-ubuntu-2004: ## Builds Ubuntu 20.04 OpenStack image
826826
build-openstack-ubuntu-2204: ## Builds Ubuntu 22.04 OpenStack image
827827
build-openstack-ubuntu-2404: ## Builds Ubuntu 24.04 OpenStack image
828+
build-openstack-rockylinux-9: ## Builds RockyLinux 9 OpenStack image
828829
build-openstack-flatcar: ## Builds Flatcar OpenStack image
829830
build-openstack-all: $(OPENSTACK_BUILD_TARGETS)
830831

@@ -962,6 +963,7 @@ validate-do-all: $(DO_VALIDATE_TARGETS) ## Validates all DigitalOcean Snapshot P
962963
validate-openstack-ubuntu-2004: ## Validates Ubuntu 20.04 Openstack Image Packer config
963964
validate-openstack-ubuntu-2204: ## Validates Ubuntu 22.04 Openstack Image Packer config
964965
validate-openstack-ubuntu-2404: ## Validates Ubuntu 22.04 Openstack Image Packer config
966+
validate-openstack-rocky-9: ## Validates Rocky 9 Openstack Image Packer config
965967
validate-openstack-flatcar: ## Validates Flatcar Openstack Image Packer config
966968
validate-openstack-all: $(OPENSTACK_VALIDATE_TARGETS) ## Validates all Openstack Glance Image Packer config
967969

‎images/capi/ansible/roles/security/tasks/falco.yml‎

Lines changed: 54 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -14,44 +14,70 @@
1414

1515
---
1616

17-
- name: Add Falco package signing key
18-
ansible.builtin.apt_key:
19-
url: https://falco.org/repo/falcosecurity-packages.asc
20-
state: present
17+
- name: Install Falco on Debian based systems
2118
when: ansible_os_family == "Debian"
19+
block:
20+
- name: Add Falco package signing key
21+
ansible.builtin.apt_key:
22+
url: https://falco.org/repo/falcosecurity-packages.asc
23+
state: present
2224

23-
- name: Add Falco apt repo
24-
ansible.builtin.apt_repository:
25-
repo: deb https://download.falco.org/packages/deb stable main
26-
state: present
27-
filename: falcosecurity
28-
when: ansible_os_family == "Debian"
25+
- name: Add Falco apt repo
26+
ansible.builtin.apt_repository:
27+
repo: deb https://download.falco.org/packages/deb stable main
28+
state: present
29+
filename: falcosecurity
2930

30-
- name: Install Falco requirements
31-
ansible.builtin.apt:
32-
pkg:
33-
- dkms
34-
- make
35-
- "linux-headers-{{ ansible_kernel }}"
36-
- clang
37-
- llvm
38-
update_cache: true
39-
state: present
40-
ignore_errors: true
41-
register: pkg_result
42-
until: pkg_result is success
43-
when: ansible_os_family == "Debian"
31+
- name: Install Falco requirements
32+
ansible.builtin.apt:
33+
pkg:
34+
- dkms
35+
- make
36+
- "linux-headers-{{ ansible_kernel }}"
37+
- clang
38+
- llvm
39+
update_cache: true
40+
state: present
41+
ignore_errors: true
42+
register: pkg_result
43+
until: pkg_result is success
44+
45+
- name: Install Falco on RedHat based systems
46+
when: ansible_os_family == "RedHat"
47+
block:
48+
- name: Add Falco YUM repo
49+
ansible.builtin.yum_repository:
50+
name: Falco repository
51+
description: Falco YUM repo
52+
file: falcosecurity
53+
baseurl: https://falco.org/repo/falcosecurity-rpm.repo
54+
gpgcheck: true
55+
enabled: true
56+
gpgkey: https://falco.org/repo/falcosecurity-packages.asc
57+
58+
- name: Install Falco requirements
59+
ansible.builtin.dnf:
60+
pkg:
61+
- dkms
62+
- make
63+
- "kernel-devel-{{ ansible_kernel }}"
64+
- clang
65+
- llvm
66+
- dialog
67+
state: present
68+
ignore_errors: true
69+
register: pkg_result
70+
until: pkg_result is success
4471

4572
- name: Install Falco
46-
ansible.builtin.apt:
73+
ansible.builtin.package:
4774
name: falco
48-
update_cache: true
4975
state: present
50-
when: ansible_os_family == "Debian"
76+
when: ansible_os_family == "Debian" or ansible_os_family == "RedHat"
5177

5278
- name: Enable Falco Modern eBPF
5379
ansible.builtin.service:
5480
name: falco-modern-bpf
5581
state: started
5682
enabled: true
57-
when: ansible_os_family == "Debian"
83+
when: ansible_os_family == "Debian" or ansible_os_family == "RedHat"

‎images/capi/ansible/roles/security/tasks/trivy.yml‎

Lines changed: 28 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -14,27 +14,42 @@
1414

1515
---
1616

17-
- name: Add Trivy package signing key
18-
ansible.builtin.apt_key:
19-
url: https://aquasecurity.github.io/trivy-repo/deb/public.key
20-
state: present
21-
when: ansible_os_family == "Debian"
22-
23-
- name: Add Trivy apt repo
24-
ansible.builtin.apt_repository:
25-
repo: "deb https://aquasecurity.github.io/trivy-repo/deb {{ansible_distribution_release}} main"
26-
state: present
27-
filename: trivy
17+
- name: Install Trivy on Debian based systems
2818
when: ansible_os_family == "Debian"
19+
block:
20+
- name: Add Trivy package signing key
21+
ansible.builtin.apt_key:
22+
url: https://aquasecurity.github.io/trivy-repo/deb/public.key
23+
state: present
24+
25+
- name: Add Trivy apt repo
26+
ansible.builtin.apt_repository:
27+
repo: "deb https://aquasecurity.github.io/trivy-repo/deb {{ansible_distribution_release}} main"
28+
state: present
29+
filename: trivy
30+
31+
- name: Install Trivy on RedHat based systems
32+
when: ansible_os_family == "RedHat"
33+
block:
34+
- name: Add Trivy rpm repo
35+
ansible.builtin.yum_repository:
36+
name: Trivy repository
37+
description: Trivy YUM repo
38+
file: trivy
39+
baseurl: https://aquasecurity.github.io/trivy-repo/rpm/releases/{{ ansible_distribution_release }}/{{ ansible_architecture }}/
40+
gpgcheck: true
41+
enabled: true
42+
gpgkey: https://aquasecurity.github.io/trivy-repo/rpm/public.keyy
2943

3044
- name: Install Trivy
31-
ansible.builtin.apt:
45+
ansible.builtin.package:
3246
name: trivy
3347
update_cache: true
3448
state: present
35-
when: ansible_os_family == "Debian"
49+
when: ansible_os_family == "Debian" or ansible_os_family == "RedHat"
3650

3751
- name: Update Trivy DB to ensure latest records are available as of now
3852
ansible.builtin.command: trivy rootfs --download-db-only
3953
args:
4054
creates: ~/.cache/trivy/db/trivy.db
55+
when: ansible_os_family == "Debian" or ansible_os_family == "RedHat"

‎images/capi/packer/goss/goss-vars.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -331,6 +331,14 @@ rockylinux:
331331
- distro_version: "8"
332332
package:
333333
<<: *rh8_rpms
334+
openstack:
335+
package:
336+
cloud-init:
337+
cloud-utils-growpart:
338+
os_version:
339+
- distro_version: "9"
340+
package:
341+
<<: *rh9_rpms
334342
rhel:
335343
common-package: *common_rpms
336344
amazon:
@@ -546,6 +554,18 @@ ubuntu:
546554
linux-tools-generic:
547555
huaweicloud:
548556
package: {}
557+
openstack:
558+
service:
559+
networkd-dispatcher:
560+
enabled: true
561+
running: true
562+
package:
563+
linux-cloud-tools-virtual:
564+
linux-tools-virtual:
565+
open-vm-tools:
566+
cloud-guest-utils:
567+
cloud-initramfs-copymods:
568+
cloud-initramfs-dyn-netconf:
549569

550570
oracle linux:
551571
common-kernel-param:

‎images/capi/packer/openstack/packer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@
9292
"ARCH": "amd64",
9393
"OS": "{{user `distro_name` | lower}}",
9494
"OS_VERSION": "{{user `os_version`}}",
95-
"PROVIDER": "qemu",
95+
"PROVIDER": "openstack",
9696
"containerd_version": "{{user `containerd_version`}}",
9797
"kubernetes_cni_deb_version": "{{ user `kubernetes_cni_deb_version` }}",
9898
"kubernetes_cni_rpm_version": "{{ split (user `kubernetes_cni_rpm_version`) \"-\" 0 }}",

‎images/capi/packer/openstack/rockylinux-9.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"build_name": "rockylinux-9",
3+
"distro_name": "rockylinux",
4+
"epel_rpm_gpg_key": "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9",
5+
"os_version": "9",
6+
"redhat_epel_rpm": "https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm",
7+
"ssh_username": "rocky"
8+
}

0 commit comments

Comments
 (0)