Add infra container images for memcached, redis, rabbitmq and mariadb

build.sh

@@ -303,6 +303,17 @@ build_image() {
     return
   fi
 
+  # Infrastructure containers: no sources.txt means RPM-only (no Python source builds)
+  local project_sources="${CONTAINERS_DIR}/${project}/sources.txt"
+  if [[ ! -f "${project_sources}" ]]; then
+    buildah bud \
+      $(image_tag_args "${dir_name}") \
+      --build-arg "BASE_IMAGE=${BASE_IMAGE}" \
+      -f "${CONTAINERS_DIR}/${dir_name}/Containerfile" \
+      "${CONTAINERS_DIR}/${dir_name}/"
+    return
+  fi
+
   # Ensure stream is set for service images
   if [[ -z "${STREAM}" ]]; then
     echo "ERROR: STREAM is required for building service images." >&2
@@ -887,6 +898,11 @@ ensure_sources_for_targets() {
       continue
     fi
 
+    # Skip rpm-only projects (no sources.txt)
+    if [[ ! -f "${CONTAINERS_DIR}/${project}/sources.txt" ]]; then
+      continue
+    fi
+
     ensure_sources_for_stream "${img}" "${stream}"
 
     if [[ -z "${_ensure_projects_seen[$project]:-}" ]]; then

containers/base/rpms.repo

@@ -63,3 +63,9 @@ baseurl=http://mirror.stream.centos.org/10-stream/AppStream/$basearch/os/
 enabled=1
 gpgcheck=0
 excludepkgs=openssl*
+
+[centos10-messaging-sig-rabbitmq4]
+name=CentOS Stream 10 - Messaging SIG - RabbitMQ 4
+baseurl=http://mirror.stream.centos.org/SIGs/10-stream/messaging/$basearch/rabbitmq-4/
+enabled=1
+gpgcheck=0

containers/mariadb/mariadb/Containerfile

@@ -0,0 +1,24 @@
+ARG BASE_IMAGE=localhost/openstack/openstack-base:latest
+FROM ${BASE_IMAGE}
+
+LABEL summary="OpenStack MariaDB" \
+      io.k8s.description="MariaDB database service with Galera clustering for OpenStack"
+
+RUN uid_gid_manage mysql
+
+# UBI AppStream disabled to avoid mariadb version conflicts with CentOS packages
+COPY bindeps.txt /tmp/bindeps.txt
+RUN pkgs=$(cat /tmp/bindeps.txt | grep -v '^#' | grep -v '^$' | tr '\n' ' ') && \
+    if [ -n "${pkgs}" ]; then microdnf -y --disablerepo=ubi-10-appstream-rpms install ${pkgs} && microdnf clean all && rm -rf /var/cache/dnf; fi && \
+    rm /tmp/bindeps.txt
+
+COPY scripts/extend_start.sh /usr/local/bin/kolla_extend_start
+COPY scripts/security_reset.expect /usr/local/bin/kolla_security_reset
+RUN chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_security_reset
+
+RUN rm -rf /var/lib/mysql/* /etc/my.cnf.d/mariadb-server.cnf /etc/my.cnf.d/auth_gssapi.cnf
+
+USER mysql
+
+ENTRYPOINT ["dumb-init", "--"]
+CMD ["kolla_start"]

containers/mariadb/mariadb/bindeps.txt

@@ -0,0 +1,12 @@
+expect
+galera
+hostname
+jq
+mariadb
+mariadb-backup
+mariadb-server-galera
+mariadb-server-utils
+rsync
+socat
+stunnel
+tar

containers/mariadb/mariadb/scripts/extend_start.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+
+function bootstrap_db {
+    mysqld_safe --wsrep-new-cluster --skip-networking --wsrep-on=OFF --pid-file=/var/lib/mysql/mariadb.pid &
+    # Wait for the mariadb server to be "Ready" before starting the security reset with a max timeout
+    # NOTE(huikang): the location of mysql's socket file varies depending on the OS distributions.
+    # Querying the cluster status has to be executed after the existence of mysql.sock and mariadb.pid.
+    TIMEOUT=${DB_MAX_TIMEOUT:-60}
+    while [[ ! -S /var/lib/mysql/mysql.sock ]] && \
+          [[ ! -S /var/run/mysqld/mysqld.sock ]] || \
+          [[ ! -f /var/lib/mysql/mariadb.pid ]]; do
+        if [[ ${TIMEOUT} -gt 0 ]]; then
+            let TIMEOUT-=1
+            sleep 1
+        else
+            exit 1
+        fi
+    done
+
+    sudo -E kolla_security_reset
+    mysql -u root --password="${DB_ROOT_PASSWORD}" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY '${DB_ROOT_PASSWORD}' WITH GRANT OPTION;"
+    mysql -u root --password="${DB_ROOT_PASSWORD}" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '${DB_ROOT_PASSWORD}' WITH GRANT OPTION;"
+    mysqladmin -uroot -p"${DB_ROOT_PASSWORD}" shutdown
+}
+
+# This catches all cases of the BOOTSTRAP variable being set, including empty
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    mysql_install_db
+    bootstrap_db
+    exit 0
+fi
+
+if [[ "${!BOOTSTRAP_ARGS[@]}" ]]; then
+    ARGS="${BOOTSTRAP_ARGS}"
+fi

containers/mariadb/mariadb/scripts/security_reset.expect

@@ -0,0 +1,67 @@
+#!/usr/bin/expect -f
+
+if [catch {set timeout $env(DB_MAX_TIMEOUT)}] {set timeout 10}
+spawn mysql_secure_installation
+expect {
+  timeout { send_user "\nFailed to get 'Enter current password for root (enter for none):' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Enter current password for root (enter for none):' prompt\n"; exit 1 }
+  "Enter current password for root (enter for none):"
+}
+send "\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Switch to unix_socket authentication [Y/n] ' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Switch to unix_socket authentication' prompt\n"; exit 1 }
+  "Switch to unix_socket authentication \\\[Y/n\\\] "
+}
+send "n\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Change the root password? [Y/n]' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Change the root password?' prompt\n"; exit 1 }
+  "Change the root password? \\\[Y/n\\\] "
+}
+send "y\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'New password:' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'New password:' prompt\n"; exit 1 }
+  "New password:"
+}
+send "$env(DB_ROOT_PASSWORD)\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Re-enter new password:' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Re-enter new password:' prompt\n"; exit 1 }
+  "Re-enter new password:"
+}
+send "$env(DB_ROOT_PASSWORD)\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Remove anonymous users?' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Remove anonymous users?' prompt\n"; exit 1 }
+  "Remove anonymous users?"
+}
+send "y\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Disallow root login remotely?' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Disallow root login remotely?' prompt\n"; exit 1 }
+  "Disallow root login remotely?"
+}
+send "n\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Remove test database and access to it?' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Remove test database and access to it?' prompt\n"; exit 1 }
+  "Remove test database and access to it?"
+}
+send "y\r"
+
+expect {
+  timeout { send_user "\nFailed to get 'Reload privilege tables now?' prompt\n"; exit 1 }
+  eof { send_user "\nFailed to get 'Reload privilege tables now?' prompt\n"; exit 1 }
+  "Reload privilege tables now?"
+}
+send "y\r"
+expect eof

containers/memcached/memcached/Containerfile

@@ -0,0 +1,14 @@
+ARG BASE_IMAGE=localhost/openstack/openstack-base:latest
+FROM ${BASE_IMAGE}
+
+LABEL summary="OpenStack Memcached" \
+      io.k8s.description="Memcached caching service for OpenStack"
+
+RUN uid_gid_manage memcached
+
+COPY bindeps.txt /tmp/bindeps.txt
+RUN pkgs=$(cat /tmp/bindeps.txt | grep -v '^#' | grep -v '^$' | tr '\n' ' ') && \
+    if [ -n "${pkgs}" ]; then microdnf -y install ${pkgs} && microdnf clean all && rm -rf /var/cache/dnf; fi && \
+    rm /tmp/bindeps.txt
+
+USER memcached

containers/memcached/memcached/bindeps.txt

@@ -0,0 +1 @@
+memcached

containers/rabbitmq/rabbitmq/Containerfile

@@ -0,0 +1,18 @@
+ARG BASE_IMAGE=localhost/openstack/openstack-base:latest
+FROM ${BASE_IMAGE}
+
+LABEL summary="OpenStack RabbitMQ" \
+      io.k8s.description="RabbitMQ messaging service for OpenStack"
+
+RUN uid_gid_manage rabbitmq
+
+COPY bindeps.txt /tmp/bindeps.txt
+RUN pkgs=$(cat /tmp/bindeps.txt | grep -v '^#' | grep -v '^$' | tr '\n' ' ') && \
+    if [ -n "${pkgs}" ]; then microdnf -y install ${pkgs} && microdnf clean all && rm -rf /var/cache/dnf; fi && \
+    rm /tmp/bindeps.txt && \
+    rm -f /etc/rabbitmq/rabbitmq.conf
+
+COPY scripts/extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 755 /usr/local/bin/kolla_extend_start
+
+USER rabbitmq

containers/rabbitmq/rabbitmq/bindeps.txt

@@ -0,0 +1,2 @@
+hostname
+rabbitmq-server

containers/rabbitmq/rabbitmq/scripts/extend_start.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+
+# NOTE(sbezverk): In kubernetes environment, if this file exists from previous
+# bootstrap, the system does not allow to overwrite it (it bootstrap files with
+# permission denied error) but it allows to delete it and then recreate it.
+    if [[ -e "/var/lib/rabbitmq/.erlang.cookie" ]]; then
+        rm -f /var/lib/rabbitmq/.erlang.cookie
+    fi
+    echo "${RABBITMQ_CLUSTER_COOKIE}" > /var/lib/rabbitmq/.erlang.cookie
+    chmod 400 /var/lib/rabbitmq/.erlang.cookie
+    exit 0
+fi

containers/redis/redis/Containerfile

@@ -0,0 +1,14 @@
+ARG BASE_IMAGE=localhost/openstack/openstack-base:latest
+FROM ${BASE_IMAGE}
+
+LABEL summary="OpenStack Redis (Valkey)" \
+      io.k8s.description="Valkey (Redis-compatible) caching and messaging service for OpenStack"
+
+RUN uid_gid_manage valkey
+
+COPY bindeps.txt /tmp/bindeps.txt
+RUN pkgs=$(cat /tmp/bindeps.txt | grep -v '^#' | grep -v '^$' | tr '\n' ' ') && \
+    if [ -n "${pkgs}" ]; then microdnf -y install ${pkgs} && microdnf clean all && rm -rf /var/cache/dnf; fi && \
+    rm /tmp/bindeps.txt
+
+USER valkey

containers/redis/redis/bindeps.txt

@@ -0,0 +1,2 @@
+procps-ng
+valkey