Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit d1987c5

Browse files
drew-vilesdrew-viles
committedMar 18, 2025··
patch: adding rockylinux support to openstack and updating rockylinux goss package args from cloud-utils to cloud-utils-growpart.
1 parent 5177612 commit d1987c5

File tree

7 files changed

+121
-61
lines changed

7 files changed

+121
-61
lines changed
 

‎images/capi/Makefile

+3-1
Original file line numberDiff line numberDiff line change
@@ -380,7 +380,7 @@ OCI_BUILD_NAMES ?= oci-ubuntu-2004 oci-ubuntu-2204 oci-oracle-linux-8 oci-ora
380380

381381
DO_BUILD_NAMES ?= do-centos-7 do-ubuntu-2004 do-ubuntu-2204 do-ubuntu-2404
382382

383-
OPENSTACK_BUILD_NAMES ?= openstack-ubuntu-2004 openstack-ubuntu-2204 openstack-ubuntu-2404 openstack-flatcar
383+
OPENSTACK_BUILD_NAMES ?= openstack-ubuntu-2004 openstack-ubuntu-2204 openstack-ubuntu-2404 openstack-flatcar openstack-rockylinux-8 openstack-rockylinux-9
384384

385385
OSC_BUILD_NAMES ?= osc-ubuntu-2004 osc-ubuntu-2204
386386

@@ -825,6 +825,8 @@ build-node-ova-local-base-ubuntu-2004: ## Builds Ubuntu 20.04 Base Node OVA w lo
825825
build-openstack-ubuntu-2004: ## Builds Ubuntu 20.04 OpenStack image
826826
build-openstack-ubuntu-2204: ## Builds Ubuntu 22.04 OpenStack image
827827
build-openstack-ubuntu-2404: ## Builds Ubuntu 24.04 OpenStack image
828+
build-openstack-rockylinux-8: ## Builds RockyLinux 8 OpenStack image
829+
build-openstack-rockylinux-9: ## Builds RockyLinux 9 OpenStack image
828830
build-openstack-flatcar: ## Builds Flatcar OpenStack image
829831
build-openstack-all: $(OPENSTACK_BUILD_TARGETS)
830832

‎images/capi/ansible/roles/security/tasks/falco.yml

+52-28
Original file line numberDiff line numberDiff line change
@@ -14,44 +14,68 @@
1414

1515
---
1616

17-
- name: Add Falco package signing key
18-
ansible.builtin.apt_key:
19-
url: https://falco.org/repo/falcosecurity-packages.asc
20-
state: present
17+
- name: Install Falco on Debian based systems
2118
when: ansible_os_family == "Debian"
19+
block:
20+
- name: Add Falco package signing key
21+
ansible.builtin.apt_key:
22+
url: https://falco.org/repo/falcosecurity-packages.asc
23+
state: present
2224

23-
- name: Add Falco apt repo
24-
ansible.builtin.apt_repository:
25-
repo: deb https://download.falco.org/packages/deb stable main
26-
state: present
27-
filename: falcosecurity
28-
when: ansible_os_family == "Debian"
25+
- name: Add Falco apt repo
26+
ansible.builtin.apt_repository:
27+
repo: deb https://download.falco.org/packages/deb stable main
28+
state: present
29+
filename: falcosecurity
2930

30-
- name: Install Falco requirements
31-
ansible.builtin.apt:
32-
pkg:
33-
- dkms
34-
- make
35-
- "linux-headers-{{ ansible_kernel }}"
36-
- clang
37-
- llvm
38-
update_cache: true
39-
state: present
40-
ignore_errors: true
41-
register: pkg_result
42-
until: pkg_result is success
43-
when: ansible_os_family == "Debian"
31+
- name: Install Falco requirements
32+
ansible.builtin.apt:
33+
pkg:
34+
- dkms
35+
- make
36+
- "linux-headers-{{ ansible_kernel }}"
37+
- clang
38+
- llvm
39+
update_cache: true
40+
state: present
41+
ignore_errors: true
42+
register: pkg_result
43+
until: pkg_result is success
44+
45+
- name: Install Falco on RedHat based systems
46+
when: ansible_os_family == "RedHat"
47+
block:
48+
- name: Add Falco YUM repo
49+
ansible.builtin.yum_repository:
50+
name: Falco repository
51+
description: Falco YUM repo
52+
file: falcosecurity
53+
baseurl: https://falco.org/repo/falcosecurity-rpm.repo
54+
gpgcheck: true
55+
enabled: true
56+
gpgkey: https://falco.org/repo/falcosecurity-packages.asc
57+
58+
- name: Install Falco requirements
59+
ansible.builtin.yum:
60+
pkg:
61+
- dkms
62+
- make
63+
- "kernel-devel-{{ ansible_kernel }}"
64+
- clang
65+
- llvm
66+
- dialog
67+
state: present
68+
ignore_errors: true
69+
register: pkg_result
70+
until: pkg_result is success
4471

4572
- name: Install Falco
46-
ansible.builtin.apt:
73+
ansible.builtin.package:
4774
name: falco
48-
update_cache: true
4975
state: present
50-
when: ansible_os_family == "Debian"
5176

5277
- name: Enable Falco Modern eBPF
5378
ansible.builtin.service:
5479
name: falco-modern-bpf
5580
state: started
5681
enabled: true
57-
when: ansible_os_family == "Debian"

‎images/capi/ansible/roles/security/tasks/trivy.yml

+26-13
Original file line numberDiff line numberDiff line change
@@ -14,25 +14,38 @@
1414

1515
---
1616

17-
- name: Add Trivy package signing key
18-
ansible.builtin.apt_key:
19-
url: https://aquasecurity.github.io/trivy-repo/deb/public.key
20-
state: present
21-
when: ansible_os_family == "Debian"
22-
23-
- name: Add Trivy apt repo
24-
ansible.builtin.apt_repository:
25-
repo: "deb https://aquasecurity.github.io/trivy-repo/deb {{ansible_distribution_release}} main"
26-
state: present
27-
filename: trivy
17+
- name: Install Trivy on Debian based systems
2818
when: ansible_os_family == "Debian"
19+
block:
20+
- name: Add Trivy package signing key
21+
ansible.builtin.apt_key:
22+
url: https://aquasecurity.github.io/trivy-repo/deb/public.key
23+
state: present
24+
25+
- name: Add Trivy apt repo
26+
ansible.builtin.apt_repository:
27+
repo: "deb https://aquasecurity.github.io/trivy-repo/deb {{ansible_distribution_release}} main"
28+
state: present
29+
filename: trivy
30+
31+
- name: Install Trivy on RedHat based systems
32+
when: ansible_os_family == "RedHat"
33+
block:
34+
- name: Add Trivy rpm repo
35+
ansible.builtin.yum_repository:
36+
name: Trivy repository
37+
description: Trivy YUM repo
38+
file: trivy
39+
baseurl: https://aquasecurity.github.io/trivy-repo/rpm/releases/{{ ansible_distribution_release }}/{{ ansible_architecture }}/
40+
gpgcheck: true
41+
enabled: true
42+
gpgkey: https://aquasecurity.github.io/trivy-repo/rpm/public.keyy
2943

3044
- name: Install Trivy
31-
ansible.builtin.apt:
45+
ansible.builtin.package:
3246
name: trivy
3347
update_cache: true
3448
state: present
35-
when: ansible_os_family == "Debian"
3649

3750
- name: Update Trivy DB to ensure latest records are available as of now
3851
ansible.builtin.command: trivy rootfs --download-db-only

‎images/capi/packer/goss/goss-vars.yaml

+23-18
Original file line numberDiff line numberDiff line change
@@ -331,6 +331,17 @@ rockylinux:
331331
- distro_version: "8"
332332
package:
333333
<<: *rh8_rpms
334+
openstack:
335+
package:
336+
cloud-init:
337+
cloud-utils-growpart:
338+
os_version:
339+
- distro_version: "8"
340+
package:
341+
<<: *rh8_rpms
342+
- distro_version: "9"
343+
package:
344+
<<: *rh9_rpms
334345
rhel:
335346
common-package: *common_rpms
336347
amazon:
@@ -405,24 +416,6 @@ rhel:
405416
- distro_version: "9"
406417
package:
407418
<<: *rh9_rpms
408-
nutanix:
409-
package:
410-
cloud-init:
411-
iscsi-initiator-utils:
412-
nfs-utils:
413-
lvm2:
414-
xfsprogs:
415-
os_version:
416-
- distro_version: "8"
417-
package:
418-
<<: *rh8_rpms
419-
- distro_version: "9"
420-
package:
421-
<<: *rh9_rpms
422-
service:
423-
iscsid:
424-
enabled: true
425-
running: false
426419
ubuntu:
427420
common-kernel-param:
428421
net.ipv4.conf.all.rp_filter:
@@ -546,6 +539,18 @@ ubuntu:
546539
linux-tools-generic:
547540
huaweicloud:
548541
package: {}
542+
openstack:
543+
service:
544+
networkd-dispatcher:
545+
enabled: true
546+
running: true
547+
package:
548+
linux-cloud-tools-virtual:
549+
linux-tools-virtual:
550+
open-vm-tools:
551+
cloud-guest-utils:
552+
cloud-initramfs-copymods:
553+
cloud-initramfs-dyn-netconf:
549554

550555
oracle linux:
551556
common-kernel-param:

‎images/capi/packer/openstack/packer.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@
9292
"ARCH": "amd64",
9393
"OS": "{{user `distro_name` | lower}}",
9494
"OS_VERSION": "{{user `os_version`}}",
95-
"PROVIDER": "qemu",
95+
"PROVIDER": "openstack",
9696
"containerd_version": "{{user `containerd_version`}}",
9797
"kubernetes_cni_deb_version": "{{ user `kubernetes_cni_deb_version` }}",
9898
"kubernetes_cni_rpm_version": "{{ split (user `kubernetes_cni_rpm_version`) \"-\" 0 }}",

‎images/capi/packer/openstack/rockylinux-8.json

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"build_name": "rockylinux-8",
3+
"distro_name": "rockylinux",
4+
"epel_rpm_gpg_key": "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-8",
5+
"os_version": "8",
6+
"redhat_epel_rpm": "https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm",
7+
"ssh_username": "cloud-user"
8+
}

‎images/capi/packer/openstack/rockylinux-9.json

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"build_name": "rockylinux-9",
3+
"distro_name": "rockylinux",
4+
"epel_rpm_gpg_key": "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9",
5+
"os_version": "9",
6+
"redhat_epel_rpm": "https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm",
7+
"ssh_username": "cloud-user"
8+
}

0 commit comments

Comments
 (0)
Please sign in to comment.