Merge pull request #55 from stackhpc/upstream/master-2025-06-23

Synchronise master with upstream

Author: priteau

devstack/upgrade/from-2025.1/upgrade-octavia

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+# Openstack moved from using wsgi scripts to directly calling the wsgi module
+# due to changes in setuptools that stops the pbr wsgi_scripts from working.
+# This script will reconfigure uwsgi on upgrade to point to the module instead
+# of the wsgi script that is no longer present in octavia.
+
+function configure_octavia_upgrade {
+    source $GRENADE_DIR/functions
+
+    iniset $OCTAVIA_UWSGI_CONF uwsgi module $OCTAVIA_UWSGI_APP
+}

diskimage-create/README.rst

@@ -102,7 +102,7 @@ Command syntax:
             [-a **amd64** | armhf | aarch64 | ppc64le ]
             [-b **haproxy** ]
             [-c **~/.cache/image-create** | <cache directory> ]
-            [-d **jammy**/**9-stream**/**9** | <other release id> ]
+            [-d **noble**/**9-stream**/**9** | <other release id> ]
             [-e]
             [-f]
             [-g **repository branch** | stable/train | stable/stein | ... ]
@@ -125,7 +125,7 @@ Command syntax:
         '-a' is the architecture type for the image (default: amd64)
         '-b' is the backend type (default: haproxy)
         '-c' is the path to the cache directory (default: ~/.cache/image-create)
-        '-d' distribution release id (default on ubuntu: jammy)
+        '-d' distribution release id (default on ubuntu: noble)
         '-e' enable complete mandatory access control systems when available (default: permissive)
         '-f' disable tmpfs for build
         '-g' build the image for a specific OpenStack Git branch (default: current repository branch)

diskimage-create/diskimage-create.sh

@@ -23,7 +23,7 @@ usage() {
     echo "            [-a **amd64** | armhf | aarch64 | ppc64le]"
     echo "            [-b **haproxy** ]"
     echo "            [-c **~/.cache/image-create** | <cache directory> ]"
-    echo "            [-d **jammy**/**9-stream**/**9** | <other release id> ]"
+    echo "            [-d **noble**/**9-stream**/**9** | <other release id> ]"
     echo "            [-e]"
     echo "            [-f]"
     echo "            [-g **repository branch** | stable/train | stable/stein | ... ]"
@@ -45,7 +45,7 @@ usage() {
     echo "        '-a' is the architecture type for the image (default: amd64)"
     echo "        '-b' is the backend type (default: haproxy)"
     echo "        '-c' is the path to the cache directory (default: ~/.cache/image-create)"
-    echo "        '-d' distribution release id (default on ubuntu: jammy)"
+    echo "        '-d' distribution release id (default on ubuntu: noble)"
     echo "        '-e' enable complete mandatory access control systems when available (default: permissive)"
     echo "        '-f' disable tmpfs for build"
     echo "        '-g' build the image for a specific OpenStack Git branch (default: current repository branch)"
@@ -242,7 +242,7 @@ AMP_CACHEDIR="$( cd "$AMP_CACHEDIR" && pwd )"
 AMP_BASEOS=${AMP_BASEOS:-"ubuntu-minimal"}
 
 if [ "$AMP_BASEOS" = "ubuntu-minimal" ]; then
-    export DIB_RELEASE=${AMP_DIB_RELEASE:-"jammy"}
+    export DIB_RELEASE=${AMP_DIB_RELEASE:-"noble"}
 elif [ "${AMP_BASEOS}" = "rhel" ]; then
     export DIB_RELEASE=${AMP_DIB_RELEASE:-"9"}
 elif [ "${AMP_BASEOS}" = "centos-minimal" ]; then
@@ -469,6 +469,11 @@ if [ "${AMP_BASEOS}" = "centos-minimal" ] || [ "${AMP_BASEOS}" = "fedora" ] || [
     fi
 fi
 
+# AppArmor systems
+if [ "${AMP_BASEOS}" = "ubuntu-minimal" ] || [ "${AMP_BASEOS}" = "ubuntu" ]; then
+    AMP_element_sequence="$AMP_element_sequence amphora-apparmor"
+fi
+
 # Disable the dnf makecache timer
 if [ "${AMP_BASEOS}" = "centos-minimal" ] || [ "${AMP_BASEOS}" = "fedora" ] || [ "${AMP_BASEOS}" = "rhel" ] || [ "${AMP_BASEOS}" = "rocky-container" ]; then
     AMP_element_sequence="$AMP_element_sequence disable-makecache"

elements/amphora-apparmor/README.rst

@@ -0,0 +1,4 @@
+Element to configure apparmor for Octavia
+
+This element will configure apparmor to allow rsyslog to create a log socket
+for Octavia Amphora logging

elements/amphora-apparmor/element-deps

@@ -0,0 +1 @@
+install-static

elements/amphora-apparmor/post-install.d/10-fix-rsyslog

@@ -0,0 +1,11 @@
+#!/bin/bash
+# This is a workaround to a known kernel bug with apparmor:
+# https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1373070
+#
+# Apparmor cannot handle namespaces correctly and will drop the '/' prefix
+# from a file path, thus causing the process to not have access.
+#
+# The reported workaround is to add flags=(attach_disconnected) to the rsyslog
+# profile.
+
+sed -i 's#profile rsyslogd /usr/sbin/rsyslogd {#profile rsyslogd /usr/sbin/rsyslogd flags=(attach_disconnected) {#g' /etc/apparmor.d/usr.sbin.rsyslogd

elements/amphora-apparmor/static/etc/apparmor.d/rsyslog.d/octavia

@@ -0,0 +1,4 @@
+# Allow rsyslog to create the octavia logging socket
+/run/rsyslog/              w,
+/run/rsyslog/octavia/      w,
+/run/rsyslog/octavia/log   rwk,

octavia/common/jinja/haproxy/combined_listeners/templates/haproxy.cfg.j2

@@ -34,7 +34,6 @@ frontend prometheus-exporter-internal-endpoint
     bind 127.0.0.1:9101
     mode http
     no log
-    option http-use-htx
     http-request use-service prometheus-exporter if { path /metrics }
     http-request reject
     timeout http-request 5s

octavia/tests/unit/common/jinja/haproxy/combined_listeners/test_jinja_cfg.py

@@ -570,7 +570,6 @@ def test_render_template_prometheus(self):
                     "    bind 127.0.0.1:9101\n"
                     "    mode http\n"
                     "    no log\n"
-                    "    option http-use-htx\n"
                     "    http-request use-service prometheus-exporter if { "
                     "path /metrics }\n"
                     "    http-request reject\n"

releasenotes/notes/update-ubuntu-amphora-image-default-to-noble-d2733d4bcc31fec9.yaml

@@ -0,0 +1,5 @@
+---
+upgrade:
+  - |
+    ``diskimage-create.sh`` has been updated to build Ubuntu Noble (24.04)
+    amphora images per default.