Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding RockyLinux to openstack #1706

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Adding RockyLinux to openstack #1706

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion images/capi/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -380,7 +380,7 @@ OCI_BUILD_NAMES ?= oci-ubuntu-2004 oci-ubuntu-2204 oci-oracle-linux-8 oci-ora

DO_BUILD_NAMES ?= do-centos-7 do-ubuntu-2004 do-ubuntu-2204 do-ubuntu-2404

OPENSTACK_BUILD_NAMES ?= openstack-ubuntu-2004 openstack-ubuntu-2204 openstack-ubuntu-2404 openstack-flatcar
OPENSTACK_BUILD_NAMES ?= openstack-ubuntu-2004 openstack-ubuntu-2204 openstack-ubuntu-2404 openstack-flatcar openstack-rockylinux-8 openstack-rockylinux-9

OSC_BUILD_NAMES ?= osc-ubuntu-2004 osc-ubuntu-2204

Expand Down Expand Up @@ -825,6 +825,8 @@ build-node-ova-local-base-ubuntu-2004: ## Builds Ubuntu 20.04 Base Node OVA w lo
build-openstack-ubuntu-2004: ## Builds Ubuntu 20.04 OpenStack image
build-openstack-ubuntu-2204: ## Builds Ubuntu 22.04 OpenStack image
build-openstack-ubuntu-2404: ## Builds Ubuntu 24.04 OpenStack image
build-openstack-rockylinux-8: ## Builds RockyLinux 8 OpenStack image
build-openstack-rockylinux-9: ## Builds RockyLinux 9 OpenStack image
build-openstack-flatcar: ## Builds Flatcar OpenStack image
build-openstack-all: $(OPENSTACK_BUILD_TARGETS)

Expand Down
80 changes: 52 additions & 28 deletions images/capi/ansible/roles/security/tasks/falco.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,44 +14,68 @@

---

- name: Add Falco package signing key
ansible.builtin.apt_key:
url: https://falco.org/repo/falcosecurity-packages.asc
state: present
- name: Install Falco on Debian based systems
when: ansible_os_family == "Debian"
block:
- name: Add Falco package signing key
ansible.builtin.apt_key:
url: https://falco.org/repo/falcosecurity-packages.asc
state: present

- name: Add Falco apt repo
ansible.builtin.apt_repository:
repo: deb https://download.falco.org/packages/deb stable main
state: present
filename: falcosecurity
when: ansible_os_family == "Debian"
- name: Add Falco apt repo
ansible.builtin.apt_repository:
repo: deb https://download.falco.org/packages/deb stable main
state: present
filename: falcosecurity

- name: Install Falco requirements
ansible.builtin.apt:
pkg:
- dkms
- make
- "linux-headers-{{ ansible_kernel }}"
- clang
- llvm
update_cache: true
state: present
ignore_errors: true
register: pkg_result
until: pkg_result is success
when: ansible_os_family == "Debian"
- name: Install Falco requirements
ansible.builtin.apt:
pkg:
- dkms
- make
- "linux-headers-{{ ansible_kernel }}"
- clang
- llvm
update_cache: true
state: present
ignore_errors: true
register: pkg_result
until: pkg_result is success

- name: Install Falco on RedHat based systems
when: ansible_os_family == "RedHat"
block:
- name: Add Falco YUM repo
ansible.builtin.yum_repository:
name: Falco repository
description: Falco YUM repo
file: falcosecurity
baseurl: https://falco.org/repo/falcosecurity-rpm.repo
gpgcheck: true
enabled: true
gpgkey: https://falco.org/repo/falcosecurity-packages.asc

- name: Install Falco requirements
ansible.builtin.dnf:
pkg:
- dkms
- make
- "kernel-devel-{{ ansible_kernel }}"
- clang
- llvm
- dialog
state: present
ignore_errors: true
register: pkg_result
until: pkg_result is success

- name: Install Falco
ansible.builtin.apt:
ansible.builtin.package:
name: falco
update_cache: true
state: present
when: ansible_os_family == "Debian"

- name: Enable Falco Modern eBPF
ansible.builtin.service:
name: falco-modern-bpf
state: started
enabled: true
when: ansible_os_family == "Debian"
39 changes: 26 additions & 13 deletions images/capi/ansible/roles/security/tasks/trivy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,25 +14,38 @@

---

- name: Add Trivy package signing key
ansible.builtin.apt_key:
url: https://aquasecurity.github.io/trivy-repo/deb/public.key
state: present
when: ansible_os_family == "Debian"

- name: Add Trivy apt repo
ansible.builtin.apt_repository:
repo: "deb https://aquasecurity.github.io/trivy-repo/deb {{ansible_distribution_release}} main"
state: present
filename: trivy
- name: Install Trivy on Debian based systems
when: ansible_os_family == "Debian"
block:
- name: Add Trivy package signing key
ansible.builtin.apt_key:
url: https://aquasecurity.github.io/trivy-repo/deb/public.key
state: present

- name: Add Trivy apt repo
ansible.builtin.apt_repository:
repo: "deb https://aquasecurity.github.io/trivy-repo/deb {{ansible_distribution_release}} main"
state: present
filename: trivy

- name: Install Trivy on RedHat based systems
when: ansible_os_family == "RedHat"
block:
- name: Add Trivy rpm repo
ansible.builtin.yum_repository:
name: Trivy repository
description: Trivy YUM repo
file: trivy
baseurl: https://aquasecurity.github.io/trivy-repo/rpm/releases/{{ ansible_distribution_release }}/{{ ansible_architecture }}/
gpgcheck: true
enabled: true
gpgkey: https://aquasecurity.github.io/trivy-repo/rpm/public.keyy

- name: Install Trivy
ansible.builtin.apt:
ansible.builtin.package:
name: trivy
update_cache: true
state: present
when: ansible_os_family == "Debian"

- name: Update Trivy DB to ensure latest records are available as of now
ansible.builtin.command: trivy rootfs --download-db-only
Expand Down
41 changes: 23 additions & 18 deletions images/capi/packer/goss/goss-vars.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -331,6 +331,17 @@ rockylinux:
- distro_version: "8"
package:
<<: *rh8_rpms
openstack:
package:
cloud-init:
cloud-utils-growpart:
os_version:
- distro_version: "8"
package:
<<: *rh8_rpms
- distro_version: "9"
package:
<<: *rh9_rpms
rhel:
common-package: *common_rpms
amazon:
Expand Down Expand Up @@ -405,24 +416,6 @@ rhel:
- distro_version: "9"
package:
<<: *rh9_rpms
nutanix:
package:
cloud-init:
iscsi-initiator-utils:
nfs-utils:
lvm2:
xfsprogs:
os_version:
- distro_version: "8"
package:
<<: *rh8_rpms
- distro_version: "9"
package:
<<: *rh9_rpms
service:
iscsid:
enabled: true
running: false
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wondering why the nutanix block is being remove here.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

erm, good question, I had no reason to remove this that I can recall!
Been a while since I raised this though but is probably in error, let me re-add it and check and then I'll nudge again.

ubuntu:
common-kernel-param:
net.ipv4.conf.all.rp_filter:
Expand Down Expand Up @@ -546,6 +539,18 @@ ubuntu:
linux-tools-generic:
huaweicloud:
package: {}
openstack:
service:
networkd-dispatcher:
enabled: true
running: true
package:
linux-cloud-tools-virtual:
linux-tools-virtual:
open-vm-tools:
cloud-guest-utils:
cloud-initramfs-copymods:
cloud-initramfs-dyn-netconf:

oracle linux:
common-kernel-param:
Expand Down
2 changes: 1 addition & 1 deletion images/capi/packer/openstack/packer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@
"ARCH": "amd64",
"OS": "{{user `distro_name` | lower}}",
"OS_VERSION": "{{user `os_version`}}",
"PROVIDER": "qemu",
"PROVIDER": "openstack",
"containerd_version": "{{user `containerd_version`}}",
"kubernetes_cni_deb_version": "{{ user `kubernetes_cni_deb_version` }}",
"kubernetes_cni_rpm_version": "{{ split (user `kubernetes_cni_rpm_version`) \"-\" 0 }}",
Expand Down
8 changes: 8 additions & 0 deletions images/capi/packer/openstack/rockylinux-8.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
{
"build_name": "rockylinux-8",
"distro_name": "rockylinux",
"epel_rpm_gpg_key": "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-8",
"os_version": "8",
"redhat_epel_rpm": "https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm",
"ssh_username": "cloud-user"
}
8 changes: 8 additions & 0 deletions images/capi/packer/openstack/rockylinux-9.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
{
"build_name": "rockylinux-9",
"distro_name": "rockylinux",
"epel_rpm_gpg_key": "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9",
"os_version": "9",
"redhat_epel_rpm": "https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm",
"ssh_username": "cloud-user"
}