diff --git a/doc/source/configuration/ipa.rst b/doc/source/configuration/ipa.rst index 2a3fe78822..e88e251fc5 100644 --- a/doc/source/configuration/ipa.rst +++ b/doc/source/configuration/ipa.rst @@ -32,9 +32,7 @@ deployment: stackhpc_ipa_arch: aarch64 -The supported values are ``amd64`` and ``aarch64``. Rocky Linux 9 uses -``stackhpc_rocky_9_ipa_image_version`` for ``amd64`` and -``stackhpc_rocky_9_ipa_image_version_aarch64`` for ``aarch64``, similarly +The supported values are ``amd64`` and ``aarch64``. Rocky Linux 10 uses ``stackhpc_rocky_10_ipa_image_version`` for ``amd64`` and ``stackhpc_rocky_10_ipa_image_version_aarch64`` for ``aarch64``. diff --git a/etc/kayobe/kolla-image-tags.yml b/etc/kayobe/kolla-image-tags.yml index 36f06145d4..9aba5d2f8d 100644 --- a/etc/kayobe/kolla-image-tags.yml +++ b/etc/kayobe/kolla-image-tags.yml @@ -4,25 +4,5 @@ # where the key is the OS distro and the value is the tag to deploy. kolla_image_tags: openstack: - rocky-10: 2026.1-rocky-10-20260701T090934 - ubuntu-noble: 2026.1-ubuntu-noble-20260701T090934 - bifrost: - rocky-10: 2026.1-rocky-10-20260625T132007 - ubuntu-noble: 2026.1-ubuntu-noble-20260625T132007 - ironic_http: - rocky-10: 2026.1-rocky-10-20260724T130738 - ubuntu-noble: 2026.1-ubuntu-noble-20260724T130738 - keystone_httpd: - rocky-10: 2026.1-rocky-10-20260724T130738 - ubuntu-noble: 2026.1-ubuntu-noble-20260724T130738 - letsencrypt_webserver: - rocky-10: 2026.1-rocky-10-20260724T130738 - ubuntu-noble: 2026.1-ubuntu-noble-20260724T130738 - nova: - rocky-10: 2026.1-rocky-10-20260702T080453 - ubuntu-noble: 2026.1-ubuntu-noble-20260702T080453 - prometheus: - rocky-10: 2026.1-rocky-10-20260702T080453 - ubuntu-noble: 2026.1-ubuntu-noble-20260702T080453 - valkey: - ubuntu-noble: 2026.1-ubuntu-noble-20260724T130738 + rocky-10: 2026.1-rocky-10-20260805T101613 + ubuntu-noble: 2026.1-ubuntu-noble-20260805T101613 diff --git a/etc/kayobe/kolla/repos.yaml b/etc/kayobe/kolla/repos.yaml index 9273b7bc27..74b9011328 100644 --- a/etc/kayobe/kolla/repos.yaml +++ b/etc/kayobe/kolla/repos.yaml @@ -5,100 +5,122 @@ ubuntu: suite: "noble noble-updates noble-backports" component: "main universe" gpg_key: "/usr/share/keyrings/ubuntu-archive-keyring.gpg" - trusted: True + trusted: true + build_only: true ubuntu-security: url: "{{ stackhpc_repo_ubuntu_noble_security_url }}" suite: "noble-security" component: "main universe" gpg_key: "/usr/share/keyrings/ubuntu-archive-keyring.gpg" - trusted: True + trusted: true + build_only: true ubuntu-cloud-archive: url: "{{ stackhpc_repo_ubuntu_cloud_archive_url }}" component: "main" gpg_key: "/usr/share/keyrings/ubuntu-cloud-keyring.gpg" suite: "noble-updates/{{ openstack_release_codename }}" - trusted: True + trusted: true + build_only: true rpm: appstream: baseurl: "{{ stackhpc_repo_rocky_10_appstream_url }}" gpgkey: "https://dl.rockylinux.org/pub/rocky/RPM-GPG-KEY-Rocky-10" name: "appstream" + build_only: true baseos: baseurl: "{{ stackhpc_repo_rocky_10_baseos_url }}" gpgkey: "https://dl.rockylinux.org/pub/rocky/RPM-GPG-KEY-Rocky-10" name: "baseos" + build_only: true ceph: baseurl: "{{ stackhpc_repo_centos_stream_10_storage_ceph_squid_url }}" gpgkey: "https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage" name: "centos-ceph-squid" + build_only: true crb: baseurl: "{{ stackhpc_repo_rocky_10_crb_url }}" gpgkey: "https://dl.rockylinux.org/pub/rocky/RPM-GPG-KEY-Rocky-10" name: "crb" + build_only: true docker-ce: baseurl: "{{ stackhpc_repo_centos_stream_10_docker_url }}" gpgkey: "https://download.docker.com/linux/centos/gpg" name: "docker-ce" + build_only: true epel: baseurl: "{{ stackhpc_repo_epel_10_url }}" gpgkey: "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-$releasever" name: "epel" + build_only: true erlang: baseurl: "{{ stackhpc_repo_rhel9_rabbitmq_erlang_url }}" gpgkey: "https://github.com/rabbitmq/signing-keys/releases/download/3.0/cloudsmith.rabbitmq-erlang.E495BB49CC4BBE5B.key" name: "rabbitmq_rabbitmq-erlang" + build_only: true extras: baseurl: "{{ stackhpc_repo_rocky_10_extras_url }}" gpgkey: "https://dl.rockylinux.org/pub/rocky/RPM-GPG-KEY-Rocky-10" name: "extras" + build_only: true fluentd: baseurl: "{{ stackhpc_repo_rhel_10_fluent_6_url }}" gpgkey: "https://fluentd.cdn.cncf.io/GPG-KEY-fluent-package" name: "fluent-package-lts" + build_only: true grafana: baseurl: "{{ stackhpc_repo_grafana_url }}" gpgkey: "https://rpm.grafana.com/gpg.key" name: "grafana" + build_only: true hacluster: baseurl: "{{ stackhpc_repo_rocky_10_highavailability_url }}" gpgkey: "https://dl.rockylinux.org/pub/rocky/RPM-GPG-KEY-Rocky-10" name: "highavailability" + build_only: true mariadb: baseurl: "{{ stackhpc_repo_rhel_10_mariadb_11_4_url }}" gpgkey: "https://downloads.mariadb.com/MariaDB/RPM-GPG-KEY-MariaDB" name: "mariadb" + build_only: true opensearch: baseurl: "{{ stackhpc_repo_opensearch_3_x_yum_url }}" gpgkey: "https://artifacts.opensearch.org/publickeys/opensearch-release.pgp" repo_gpgcheck: 1 name: "opensearch-3.x" + build_only: true opensearch-dashboards: baseurl: "{{ stackhpc_repo_opensearch_dashboards_3_x_yum_url }}" gpgkey: "https://artifacts.opensearch.org/publickeys/opensearch-release.pgp" repo_gpgcheck: 1 name: "opensearch-dashboards-3.x" + build_only: true openvswitch: baseurl: "{{ stackhpc_repo_centos_stream_10_nfv_openvswitch_url }}" gpgkey: "https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-NFV" name: "centos-nfv-openvswitch" + build_only: true proxysql: baseurl: "{{ stackhpc_repo_almalinux_10_proxysql_3_0_url }}" gpgkey: "https://repo.proxysql.com/ProxySQL/proxysql-3.0.x/repo_pub_key" name: "proxysql" + build_only: true rabbitmq: baseurl: "{{ stackhpc_repo_rhel9_rabbitmq_server_url }}" gpgkey: | https://github.com/rabbitmq/signing-keys/releases/download/3.0/cloudsmith.rabbitmq-server.9F4587F226208342.key https://github.com/rabbitmq/signing-keys/releases/download/3.0/rabbitmq-release-signing-key.asc name: "rabbitmq_rabbitmq-server" + build_only: true security: baseurl: "{{ stackhpc_repo_rocky_10_security_url }}" gpgkey: "https://dl.rockylinux.org/pub/rocky/RPM-GPG-KEY-Rocky-10" name: "security" + build_only: true rocky-aarch64: erlang: baseurl: "{{ stackhpc_repo_rhel9_rabbitmq_erlang_27_url }}" gpgkey: "https://download.copr.fedorainfracloud.org/results/@openstack-kolla/rabbitmq-erlang-27/pubkey.gpg" name: "copr-rabbitmq-erlang" + build_only: true diff --git a/etc/kayobe/pulp-ipa-image-versions.yml b/etc/kayobe/pulp-ipa-image-versions.yml index 71ae143984..7d2831a58f 100644 --- a/etc/kayobe/pulp-ipa-image-versions.yml +++ b/etc/kayobe/pulp-ipa-image-versions.yml @@ -1,8 +1,6 @@ --- # IPA image versioning tags #TODO: Switch once RL10 images are available -stackhpc_rocky_9_ipa_image_version: "2025.1-20260420T095100" -stackhpc_rocky_9_ipa_image_version_aarch64: "2025.1-20260420T095100" -stackhpc_rocky_10_ipa_image_version: "2025.1-20260805T091024" -stackhpc_rocky_10_ipa_image_version_aarch64: "2025.1-20260805T091024" +stackhpc_rocky_10_ipa_image_version: "2026.1-20260813T115725" +stackhpc_rocky_10_ipa_image_version_aarch64: "2026.1-20260813T115725" stackhpc_ubuntu_noble_ipa_image_version: "2025.1-20260420T095100" diff --git a/etc/kayobe/pulp-repo-versions.yml b/etc/kayobe/pulp-repo-versions.yml index 84770cc558..aadcbdc72a 100644 --- a/etc/kayobe/pulp-repo-versions.yml +++ b/etc/kayobe/pulp-repo-versions.yml @@ -1,49 +1,49 @@ --- # This file is autogenerated by Ansible using the following workflow: # https://github.com/stackhpc/stackhpc-release-train/actions/workflows/package-update-kayobe.yml -stackhpc_pulp_repo_almalinux_10_proxysql_3_0_version: 20260605T211649 -stackhpc_pulp_repo_centos_stream_10_docker_aarch64_version: 20260620T010620 -stackhpc_pulp_repo_centos_stream_10_docker_version: 20260619T215327 -stackhpc_pulp_repo_centos_stream_10_nfv_openvswitch_aarch64_version: 20260603T233007 -stackhpc_pulp_repo_centos_stream_10_nfv_openvswitch_version: 20260602T230909 -stackhpc_pulp_repo_centos_stream_10_storage_ceph_squid_aarch64_version: 20260603T233007 -stackhpc_pulp_repo_centos_stream_10_storage_ceph_squid_version: 20260602T230909 -stackhpc_pulp_repo_doca_3_2_2_rhel10_aarch64_version: 20260326T091359 -stackhpc_pulp_repo_doca_3_2_2_rhel10_x86_64_version: 20260326T091359 -stackhpc_pulp_repo_docker_ce_ubuntu_noble_version: 20260622T222357 -stackhpc_pulp_repo_elrepo_10_aarch64_version: 20260220T152827 -stackhpc_pulp_repo_elrepo_10_version: 20260620T002710 -stackhpc_pulp_repo_epel_10_aarch64_version: 20260624T000231 -stackhpc_pulp_repo_epel_10_version: 20260623T220913 -stackhpc_pulp_repo_ubuntu_noble_fluent_6_version: 20260615T110539 -stackhpc_pulp_repo_rhel_10_fluent_6_version: 20260327T202539 -stackhpc_pulp_repo_grafana_version: 20260623T210745 +stackhpc_pulp_repo_almalinux_10_proxysql_3_0_version: 20260804T131930 +stackhpc_pulp_repo_centos_stream_10_docker_aarch64_version: 20260804T131930 +stackhpc_pulp_repo_centos_stream_10_docker_version: 20260804T131930 +stackhpc_pulp_repo_centos_stream_10_nfv_openvswitch_aarch64_version: 20260804T131930 +stackhpc_pulp_repo_centos_stream_10_nfv_openvswitch_version: 20260804T131930 +stackhpc_pulp_repo_centos_stream_10_storage_ceph_squid_aarch64_version: 20260804T131930 +stackhpc_pulp_repo_centos_stream_10_storage_ceph_squid_version: 20260804T131930 +stackhpc_pulp_repo_doca_3_2_2_rhel10_aarch64_version: 20260804T131930 +stackhpc_pulp_repo_doca_3_2_2_rhel10_x86_64_version: 20260804T131930 +stackhpc_pulp_repo_docker_ce_ubuntu_noble_version: 20260804T131930 +stackhpc_pulp_repo_elrepo_10_aarch64_version: 20260804T131930 +stackhpc_pulp_repo_elrepo_10_version: 20260804T131930 +stackhpc_pulp_repo_epel_10_aarch64_version: 20260804T131930 +stackhpc_pulp_repo_epel_10_version: 20260804T131930 stackhpc_pulp_repo_grafana_apt_version: 20260622T222446 +stackhpc_pulp_repo_grafana_version: 20260804T131930 stackhpc_pulp_repo_opensearch_3_x_yum_version: 20260610T213138 stackhpc_pulp_repo_opensearch_dashboards_3_x_yum_version: 20260610T213138 -stackhpc_pulp_repo_rhel9_rabbitmq_erlang_27_aarch64_version: 20260112T224827 -stackhpc_pulp_repo_rhel9_rabbitmq_erlang_version: 20260616T214234 -stackhpc_pulp_repo_rhel9_rabbitmq_server_version: 20260616T214234 -stackhpc_pulp_repo_rhel_10_mariadb_11_4_aarch64_version: 20260527T210633 -stackhpc_pulp_repo_rhel_10_mariadb_11_4_version: 20260527T210633 -stackhpc_pulp_repo_rocky_10_2_appstream_aarch64_version: 20260620T010620 -stackhpc_pulp_repo_rocky_10_2_appstream_source_version: 20260620T003535 -stackhpc_pulp_repo_rocky_10_2_appstream_version: 20260620T002710 -stackhpc_pulp_repo_rocky_10_2_baseos_aarch64_version: 20260620T010620 -stackhpc_pulp_repo_rocky_10_2_baseos_source_version: 20260620T003535 -stackhpc_pulp_repo_rocky_10_2_baseos_version: 20260620T003803 -stackhpc_pulp_repo_rocky_10_2_crb_aarch64_version: 20260620T010620 -stackhpc_pulp_repo_rocky_10_2_crb_source_version: 20260602T004048 -stackhpc_pulp_repo_rocky_10_2_crb_version: 20260620T002710 -stackhpc_pulp_repo_rocky_10_2_extras_aarch64_version: 20260602T012631 -stackhpc_pulp_repo_rocky_10_2_extras_source_version: 20260602T004048 -stackhpc_pulp_repo_rocky_10_2_extras_version: 20260602T001113 -stackhpc_pulp_repo_rocky_10_2_highavailability_aarch64_version: 20260602T012631 -stackhpc_pulp_repo_rocky_10_2_highavailability_source_version: 20260602T004048 -stackhpc_pulp_repo_rocky_10_2_highavailability_version: 20260602T001113 -stackhpc_pulp_repo_rocky_10_2_security_aarch64_version: 20260606T230245 -stackhpc_pulp_repo_rocky_10_2_security_source_version: 20260605T232846 -stackhpc_pulp_repo_rocky_10_2_security_version: 20260606T223509 -stackhpc_pulp_repo_ubuntu_cloud_archive_version: 20260621T235438 -stackhpc_pulp_repo_ubuntu_noble_security_version: 20260622T030723 -stackhpc_pulp_repo_ubuntu_noble_version: 20260622T030723 +stackhpc_pulp_repo_rhel9_rabbitmq_erlang_27_aarch64_version: 20260804T131930 +stackhpc_pulp_repo_rhel9_rabbitmq_erlang_version: 20260804T131930 +stackhpc_pulp_repo_rhel9_rabbitmq_server_version: 20260804T131930 +stackhpc_pulp_repo_rhel_10_fluent_6_version: 20260804T131930 +stackhpc_pulp_repo_rhel_10_mariadb_11_4_aarch64_version: 20260804T131930 +stackhpc_pulp_repo_rhel_10_mariadb_11_4_version: 20260804T131930 +stackhpc_pulp_repo_rocky_10_2_appstream_aarch64_version: 20260804T131930 +stackhpc_pulp_repo_rocky_10_2_appstream_source_version: 20260804T131930 +stackhpc_pulp_repo_rocky_10_2_appstream_version: 20260804T131930 +stackhpc_pulp_repo_rocky_10_2_baseos_aarch64_version: 20260804T131930 +stackhpc_pulp_repo_rocky_10_2_baseos_source_version: 20260804T131930 +stackhpc_pulp_repo_rocky_10_2_baseos_version: 20260804T131930 +stackhpc_pulp_repo_rocky_10_2_crb_aarch64_version: 20260804T131930 +stackhpc_pulp_repo_rocky_10_2_crb_source_version: 20260804T131930 +stackhpc_pulp_repo_rocky_10_2_crb_version: 20260804T131930 +stackhpc_pulp_repo_rocky_10_2_extras_aarch64_version: 20260804T131930 +stackhpc_pulp_repo_rocky_10_2_extras_source_version: 20260804T131930 +stackhpc_pulp_repo_rocky_10_2_extras_version: 20260804T131930 +stackhpc_pulp_repo_rocky_10_2_highavailability_aarch64_version: 20260804T131930 +stackhpc_pulp_repo_rocky_10_2_highavailability_source_version: 20260804T131930 +stackhpc_pulp_repo_rocky_10_2_highavailability_version: 20260804T131930 +stackhpc_pulp_repo_rocky_10_2_security_aarch64_version: 20260804T131930 +stackhpc_pulp_repo_rocky_10_2_security_source_version: 20260804T131930 +stackhpc_pulp_repo_rocky_10_2_security_version: 20260804T131930 +stackhpc_pulp_repo_ubuntu_cloud_archive_version: 20260804T131930 +stackhpc_pulp_repo_ubuntu_noble_fluent_6_version: 20260615T110539 +stackhpc_pulp_repo_ubuntu_noble_security_version: 20260804T131930 +stackhpc_pulp_repo_ubuntu_noble_version: 20260804T131930 diff --git a/etc/kayobe/seed.yml b/etc/kayobe/seed.yml index ae39034998..cc8233b179 100644 --- a/etc/kayobe/seed.yml +++ b/etc/kayobe/seed.yml @@ -114,17 +114,17 @@ seed_pulp_container_enabled: true seed_pulp_container: pulp: - image: quay.io/pulp/pulp + image: "quay.io/pulp/pulp" pre: "{{ kayobe_config_path }}/containers/pulp/pre.yml" post: "{{ kayobe_config_path }}/containers/pulp/post.yml" - tag: "3.81.0" + tag: "3.85.26" network_mode: host # Override deploy_containers_defaults.init == true to ensure # s6-overlay-suexec starts as pid 1 init: false env: - PULP_CONTENT_WORKERS: "{{ [ansible_facts.processor_vcpus * 2 + 1, 12] | min }}" - PULP_API_WORKERS: "{{ [ansible_facts.processor_vcpus * 2 + 1, 12] | min }}" + PULP_CONTENT_WORKERS: "{{ [ansible_facts.processor_vcpus * 2 + 1, 12] | min | string }}" + PULP_API_WORKERS: "{{ [ansible_facts.processor_vcpus * 2 + 1, 12] | min | string }}" PULP_HTTPS: "{{ 'true' if pulp_enable_tls | bool else 'false' }}" volumes: - /opt/kayobe/containers/pulp:/etc/pulp @@ -139,9 +139,9 @@ seed_squid_container_enabled: false seed_squid_container: squid: - image: ghcr.io/stackhpc/docker-squid + image: ubuntu/squid pre: "{{ kayobe_config_path }}/containers/squid_proxy/pre.yml" - tag: "6.10" + tag: "7.2-26.04_edge" network_mode: host volumes: - squid_spool:/var/spool/squid diff --git a/etc/kayobe/stackhpc-ipa-images.yml b/etc/kayobe/stackhpc-ipa-images.yml index 78217bff11..6f98406fd2 100644 --- a/etc/kayobe/stackhpc-ipa-images.yml +++ b/etc/kayobe/stackhpc-ipa-images.yml @@ -21,8 +21,6 @@ stackhpc_ipa_image_url: "{{ stackhpc_release_pulp_content_url }}/ipa-images/\ # IPA image version tag selection stackhpc_ipa_image_version: >- - {{ stackhpc_rocky_9_ipa_image_version_aarch64 if os_distribution == 'rocky' and os_release == '9' and stackhpc_ipa_arch == 'aarch64' else - stackhpc_rocky_10_ipa_image_version_aarch64 if os_distribution == 'rocky' and os_release == '10' and stackhpc_ipa_arch == 'aarch64' else - stackhpc_rocky_9_ipa_image_version if os_distribution == 'rocky' and os_release == '9' else + {{ stackhpc_rocky_10_ipa_image_version_aarch64 if os_distribution == 'rocky' and os_release == '10' and stackhpc_ipa_arch == 'aarch64' else stackhpc_rocky_10_ipa_image_version if os_distribution == 'rocky' and os_release == '10' else stackhpc_ubuntu_noble_ipa_image_version if os_distribution == 'ubuntu' and os_release == 'noble' }} diff --git a/etc/kayobe/trivy/allowed-vulnerabilities.yml b/etc/kayobe/trivy/allowed-vulnerabilities.yml index b2304bff0e..8e4240bf36 100644 --- a/etc/kayobe/trivy/allowed-vulnerabilities.yml +++ b/etc/kayobe/trivy/allowed-vulnerabilities.yml @@ -27,10 +27,17 @@ fluentd_allowed_vulnerabilities: - CVE-2026-42257 - CVE-2026-42258 +# Should be fixed once Grafana 13.1.2 RPM is released +grafana_allowed_vulnerabilities: + - GHSA-r277-6w6q-xmqw + letsencrypt_lego_allowed_vulnerabilities: - CVE-2025-68121 - CVE-2026-33186 +opensearch_dashboards_allowed_vulnerabilities: + - CVE-2026-59873 + prometheus_alertmanager_allowed_vulnerabilities: - CVE-2026-33186 diff --git a/releasenotes/notes/ubuntu-squid-container-75698bf1b9535163.yaml b/releasenotes/notes/ubuntu-squid-container-75698bf1b9535163.yaml new file mode 100644 index 0000000000..32cd0a560f --- /dev/null +++ b/releasenotes/notes/ubuntu-squid-container-75698bf1b9535163.yaml @@ -0,0 +1,7 @@ +--- +features: + - | + The Squid proxy container has been switched from a StackHPC-maintained + custom image, to a public image maintained by Canonical. The version of + Squid is bumped from 6.10 to 7.2. The old image was based on Rocky Linux 10, + and the new one is based on Ubuntu 26.04.