Move to CentOS Stream 9

OpenStack 'zed' requires Python 3.8+ so RHEL 8 family has to go.

This changeset moves to CentOS Stream 9 while move to RockyLinux 9 is
planned as final solution.

CI moved to CentOS Stream 9 nodes.

Depends-on: https://review.opendev.org/c/openstack/kolla-ansible/+/839715

Change-Id: I113b9984294cf8663d3fc0c8840320e1d40ea731

.zuul.d/base.yaml

@@ -55,10 +55,10 @@
           0M27tl+OWHO3KkfFR4tWc3dws3r1kYjQeds0adBHyYD0eL8SJfwZkbtojAQ1JM=
 
 - nodeset:
-    name: kolla-centos8-stream
+    name: kolla-centos-9-stream
     nodes:
       - name: primary
-        label: centos-8-stream
+        label: centos-9-stream
 
 - nodeset:
     name: kolla-ubuntu-jammy
@@ -73,10 +73,10 @@
         label: debian-bullseye
 
 - nodeset:
-    name: kolla-centos8-stream-aarch64
+    name: kolla-centos-9-stream-aarch64
     nodes:
       - name: primary
-        label: centos-8-stream-arm64
+        label: centos-9-stream-arm64
 
 - nodeset:
     name: kolla-debian-bullseye-aarch64

.zuul.d/centos.yaml

@@ -1,43 +1,41 @@
 ---
-- job:
-    name: kolla-build-centos8s
-    parent: kolla-base
-    nodeset: kolla-centos8-stream
-    vars:
-      base_distro: centos
-      base_distro_version: stream8
+- project:
+    check:
+      jobs:
+        - kolla-build-centos9s
+        - kolla-ansible-centos9s-source:
+            vars:
+              kolla_python_version: "3.9"
+    check-arm64:
+      jobs:
+        - kolla-build-centos9s-aarch64
+    gate:
+      jobs:
+        - kolla-build-centos9s
+        - kolla-ansible-centos9s-source:
+            vars:
+              kolla_python_version: "3.9"
+    experimental:
+      jobs:
+        - kolla-build-no-infra-wheels-centos9s
 
 - job:
-    name: kolla-build-centos8s-aarch64
-    parent: kolla-build-centos8s
-    nodeset: kolla-centos8-stream-aarch64
+    name: kolla-build-centos9s
+    parent: kolla-base
+    nodeset: kolla-centos-9-stream
+    vars:
+      base_distro: centos
     voting: false
 
 - job:
-    name: kolla-publish-centos8s-dockerhub
-    parent: kolla-build-centos8s
-    post-run: tests/playbooks/publish.yml
-    vars:
-      publisher: true
-      kolla_registry: dockerhub
-      kolla_namespace: kolla
-    secrets:
-      - kolla_dockerhub_creds
+    name: kolla-build-centos9s-aarch64
+    parent: kolla-build-centos9s
+    nodeset: kolla-centos-9-stream-aarch64
+    voting: false
 
 - job:
-    name: kolla-publish-centos8s-quay
-    parent: kolla-build-centos8s
-    post-run: tests/playbooks/publish.yml
-    vars:
-      publisher: true
-      kolla_registry: quay.io
-      kolla_namespace: openstack.kolla
-    secrets:
-      - kolla_quay_io_creds
-
-- job:
-    name: kolla-build-no-infra-wheels-centos8s
+    name: kolla-build-no-infra-wheels-centos9s
     parent: kolla-build-no-infra-wheels-base
-    nodeset: kolla-centos8-stream
+    nodeset: kolla-centos-9-stream
     vars:
       base_distro: centos

docker/base/Dockerfile.j2

@@ -62,10 +62,14 @@ COPY dnf.conf /etc/dnf/dnf.conf
 {% endblock %}
 
 #### BEGIN REPO ENABLEMENT
+{#
+Repo files not available for CentOS Stream 9:
+    'elasticsearch.repo',  # signed with SHA1 key https://github.com/elastic/elasticsearch/issues/85876
+    'grafana.repo',        # signed with SHA1 key https://github.com/grafana/grafana/issues/41036
+    'proxysql.repo',       # no repository yet for RHEL9 family
+ #}
 {% set base_yum_repo_files = [
-    'elasticsearch.repo',
-    'grafana.repo',
-    'proxysql.repo',
+    'mariadb.repo',
     'rabbitmq_rabbitmq-server.repo',
     'td.repo',
 ] %}
@@ -73,35 +77,41 @@ COPY dnf.conf /etc/dnf/dnf.conf
 {% set base_yum_url_packages = [
 ] %}
 
-{% set base_yum_repo_keys = [
+{#
+SHA1 keys are not supported in RHEL9: https://github.com/rpm-software-management/rpm/issues/1977
     'https://artifacts.elastic.co/GPG-KEY-elasticsearch',
     'https://packages.grafana.com/gpg.key',
+ #}
+{% set base_yum_repo_keys = [
     'https://downloads.mariadb.com/MariaDB/RPM-GPG-KEY-MariaDB',
-    'https://repo.proxysql.com/ProxySQL/proxysql-2.4.x/repo_pub_key',
-    'https://github.com/rabbitmq/signing-keys/releases/download/2.0/rabbitmq-release-signing-key.asc',
     'https://packages.treasuredata.com/GPG-KEY-td-agent',
 ] %}
 
 {% if base_arch == 'x86_64' %}
     {% set base_yum_repo_files = base_yum_repo_files + [
         'influxdb.repo',
-        'mariadb.repo',
         'rabbitmq_rabbitmq-erlang.repo',
     ] %}
     # FIXME(mgoddard): Not available for CentOS 8 yet.
     #   'crmsh.repo',
 
     {% set base_yum_repo_keys = base_yum_repo_keys + [
+        'https://github.com/rabbitmq/signing-keys/releases/download/2.0/rabbitmq-release-signing-key.asc',
         'https://repos.influxdata.com/influxdb.key',
     ] %}
 {% elif base_arch == 'aarch64' %}
-    {% set base_yum_repo_files = base_yum_repo_files + [
+{#
+Repo files not available for CentOS Stream 9:
         'erlang-solutions.repo',
-        'mariadb-aarch64.repo',
+ #}
+    {% set base_yum_repo_files = base_yum_repo_files + [
     ] %}
 
-    {% set base_yum_repo_keys = base_yum_repo_keys + [
+{#
+SHA1 keys are not supported in RHEL9: https://github.com/rpm-software-management/rpm/issues/1977
         'https://packages.erlang-solutions.com/rpm/erlang_solutions.asc',
+ #}
+    {% set base_yum_repo_keys = base_yum_repo_keys + [
     ] %}
 {% endif %}
 
@@ -150,8 +160,7 @@ RUN rm -f /etc/rpm/macros.image-language-conf \
 ] %}
 
 {% set base_centos_yum_repo_packages = [
-    'centos-release-ceph-pacific',
-    'centos-release-nfv-extras',
+    'centos-release-ceph-quincy',
     'centos-release-nfv-openvswitch',
     'centos-release-opstools',
     'epel-release',
@@ -168,20 +177,26 @@ RUN rm -f /etc/rpm/macros.image-language-conf \
 # from delorean or rdo-release-* package
 # https://review.rdoproject.org/r/c/rdo-infra/ansible-role-dlrn/+/33241
 {% set base_centos_yum_repos_to_disable = [
-    'advanced-virtualization',
-    'centos-nfv-extras',
-    'centos-nfv-ovs',
-    'centos-ceph-pacific',
+    'centos-ceph-quincy',
     'centos-nfv-openvswitch',
     'centos-opstools',
+    'centos9-nfv-ovs',
+    'centos9-opstools',
+    'centos9-rabbitmq',
+    'centos9-storage',
     'epel',
-    'epel-modular',
 ] %}
 
 {% if base_arch == 'x86_64' %}
     {% set base_centos_yum_repos_to_disable = base_centos_yum_repos_to_disable + [
         'influxdb',
     ] %}
+{% elif base_arch == 'aarch64' %}
+
+{# NOTE(hrw): delorean-deps.repo may force x86-64 repos #}
+
+RUN sed -i -e "s/x86_64/aarch64/g" /etc/yum.repos.d/delorean-deps.repo
+
 {% endif %}
 
 RUN {{ macros.install_packages(base_centos_yum_repo_packages | customizable("centos_yum_repo_packages"), chain=True, clean=False) }}
@@ -204,9 +219,9 @@ RUN {{ macros.install_packages(base_centos_yum_repo_packages | customizable("cen
 
 {% block base_redhat_binary_versionlock %}{% endblock %}
 
+{# NOTE(hrw): CentOS Stream 9 has curl-minimal, Rocky Linux 9 has curl so we do not install any #}
 {% set base_centos_packages = [
         'ca-certificates',
-        'curl',
         'dumb-init',
         'findutils',
         'hostname',

docker/base/mariadb-aarch64.repo

@@ -1,6 +0,0 @@
-[mariadb]
-name = MariaDB Server
-baseurl = https://dlm.mariadb.com/repo/mariadb-server/10.6/yum/rhel/8/aarch64
-gpgcheck = 1
-enabled = 0
-module_hotfixes = 1

docker/base/mariadb.repo

@@ -1,6 +1,6 @@
 [mariadb]
 name = MariaDB Server
-baseurl = https://dlm.mariadb.com/repo/mariadb-server/10.6/yum/rhel/8/x86_64
+baseurl = https://dlm.mariadb.com/repo/mariadb-server/10.6/yum/rhel/$releasever/$basearch
 gpgcheck = 1
 enabled = 0
 module_hotfixes = 1

docker/base/rabbitmq_rabbitmq-erlang.repo

@@ -1,5 +1,6 @@
 [rabbitmq_rabbitmq-erlang]
 name=rabbitmq_rabbitmq-erlang
+# https://www.rabbitmq.com/install-rpm.html lists "el/8" for CentOS Stream 9
 baseurl=https://packagecloud.io/rabbitmq/erlang/el/8/$basearch
 gpgcheck=1
 enabled=0

docker/bifrost/bifrost-base/Dockerfile.j2

@@ -12,6 +12,12 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {# NOTE(mgoddard): EPEL required for nginx #}
 {{ macros.enable_extra_repos(['epel']) }}
 
+{% set bifrost_base_packages = [
+    'cpio',
+] %}
+
+{{ macros.install_packages(bifrost_base_packages | customizable("packages")) }}
+
 ENV VENV /var/lib/kolla/venv
 
 {% set bifrost_base_pip_packages = [

docker/collectd/Dockerfile.j2

@@ -30,12 +30,10 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
       'collectd-dbi',
       'collectd-disk',
       'collectd-dns',
-      'collectd-generic-jmx',
       'collectd-ipmi',
       'collectd-log_logstash',
       'collectd-logparser',
       'collectd-mcelog',
-      'collectd-memcachec',
       'collectd-mysql',
       'collectd-netlink',
       'collectd-openldap',
@@ -59,7 +57,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
   {% if base_arch =='x86_64' %}
       {% set collectd_packages = collectd_packages + [
         'collectd-hugepages',
-        'collectd-iptables',
         'collectd-pcie-errors',
         'collectd-pmu',
         'collectd-rdt',

docker/cron/Dockerfile.j2

@@ -12,6 +12,11 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
         'cronie',
         'logrotate'
     ] %}
+
+# NOTE(hrw): In RHEL 9 family it is done by systemd timer, we want cron to
+# handle it.
+COPY logrotate /etc/cron.daily/logrotate
+
 {% elif base_package_type == 'deb' %}
     {% set cron_packages = [
         'cron',

docker/cron/extend_start.sh

@@ -3,15 +3,19 @@
 CRON_LOGROTATE_CURRENT_PATH="$(find /etc/cron* -name logrotate)"
 CRON_LOGROTATE_CURRENT_SCHEDULE=$(echo "${CRON_LOGROTATE_CURRENT_PATH}" | sed -r 's/(.*)(hourly|daily|weekly|monthly)(.*)/\2/g')
 
-# Pass only for hourly|daily|weekly|monthly
-if [[ "${KOLLA_LOGROTATE_SCHEDULE:-undefined}" =~ hourly|daily|weekly|monthly ]]; then
+if [ -z $CRON_LOGROTATE_CURRENT_PATH ]; then
+    echo "logrotate is not handled by cron"
+else
+    # Pass only for hourly|daily|weekly|monthly
+    if [[ "${KOLLA_LOGROTATE_SCHEDULE:-undefined}" =~ hourly|daily|weekly|monthly ]]; then
 
-    CRON_LOGROTATE_DESIRED_PATH="/etc/cron.${KOLLA_LOGROTATE_SCHEDULE}/logrotate"
+        CRON_LOGROTATE_DESIRED_PATH="/etc/cron.${KOLLA_LOGROTATE_SCHEDULE}/logrotate"
 
-    if [[ "${CRON_LOGROTATE_CURRENT_PATH}" != "${CRON_LOGROTATE_DESIRED_PATH}" ]]; then
-        mv ${CRON_LOGROTATE_CURRENT_PATH} ${CRON_LOGROTATE_DESIRED_PATH}
-        CRON_LOGROTATE_CURRENT_SCHEDULE="${KOLLA_LOGROTATE_SCHEDULE}"
+        if [[ "${CRON_LOGROTATE_CURRENT_PATH}" != "${CRON_LOGROTATE_DESIRED_PATH}" ]]; then
+            mv ${CRON_LOGROTATE_CURRENT_PATH} ${CRON_LOGROTATE_DESIRED_PATH}
+            CRON_LOGROTATE_CURRENT_SCHEDULE="${KOLLA_LOGROTATE_SCHEDULE}"
+        fi
     fi
-fi
 
-echo "[i] Cron schedule for logrotate is currently set to: ${CRON_LOGROTATE_CURRENT_SCHEDULE}."
+    echo "[i] Cron schedule for logrotate is currently set to: ${CRON_LOGROTATE_CURRENT_SCHEDULE}."
+fi

docker/cron/logrotate

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+# skip in favour of systemd timer
+if [ -d /run/systemd/system ]; then
+    exit 0
+fi
+
+# this cronjob persists removals (but not purges)
+if [ ! -x /usr/sbin/logrotate ]; then
+    exit 0
+fi
+
+/usr/sbin/logrotate /etc/logrotate.conf
+EXITVALUE=$?
+if [ $EXITVALUE != 0 ]; then
+    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
+fi
+exit $EXITVALUE

docker/horizon/Dockerfile.j2

@@ -7,7 +7,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 {% import "macros.j2" as macros with context %}
 
-{{ macros.enable_extra_repos(['powertools']) }}
 {{ macros.configure_user(name='horizon') }}
 
 {% if base_package_type == 'rpm' %}

docker/iscsid/Dockerfile.j2

@@ -26,8 +26,9 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {{ macros.install_packages(iscsid_packages | customizable("packages"))  }}
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
+# NOTE(hrw): CentOS Stream 9 lacks initiatorname.iscsi file
 RUN chmod 644 /usr/local/bin/kolla_extend_start \
-    && rm /etc/iscsi/initiatorname.iscsi
+    && rm -f /etc/iscsi/initiatorname.iscsi
 
 {% block iscsid_footer %}{% endblock %}
 {% block footer %}{% endblock %}

docker/keystone/keystone-base/Dockerfile.j2

@@ -17,8 +17,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
         'openldap-devel',
     ] %}
 
-RUN dnf module enable mod_auth_openidc -y
-
 {% elif base_package_type == 'deb' %}
     {% set keystone_base_packages = [
         'libapache2-mod-auth-mellon',

docker/kolla-toolbox/Dockerfile.j2

@@ -17,7 +17,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {{ macros.enable_extra_repos(['epel']) }}
 {% endif %}
 
-{{ macros.enable_extra_repos(['erlang', 'openvswitch', 'powertools', 'rabbitmq']) }}
+{{ macros.enable_extra_repos(['crb', 'erlang', 'openvswitch', 'rabbitmq']) }}
 
 {% if base_package_type == 'rpm' %}
 

docker/mariadb/mariadb-server/Dockerfile.j2

@@ -10,7 +10,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {{ macros.configure_user(name='mysql') }}
 
 {# NOTE(mgoddard): EPEL required for pv package #}
-{{ macros.enable_extra_repos(['epel']) }}
+{{ macros.enable_extra_repos(['epel', 'mariadb']) }}
 
 {% if base_package_type == 'rpm' %}
     {% set mariadb_packages = [

docker/neutron/neutron-base/extend_start.sh

@@ -6,26 +6,28 @@ fi
 if [[ $(stat -c %a /var/log/kolla/neutron) != "755" ]]; then
     chmod 755 /var/log/kolla/neutron
 fi
-if [[ ${KOLLA_BASE_DISTRO} == "centos" ]]; then
-    export UPDATE_ALTERNATIVES="/usr/sbin/update-alternatives"
-else
-    export UPDATE_ALTERNATIVES="/usr/bin/update-alternatives"
-fi
 
-# set legacy iptables to allow kernels not supporting iptables-nft
-# CentOS has update-alternatives 1.13, so use --display (not --query)
-if $UPDATE_ALTERNATIVES --display iptables; then
-    # NOTE(yoctozepto): Kolla-Ansible does not always set KOLLA_LEGACY_IPTABLES;
-    # the workaround below ensures it gets set to `false` in such cases to fix
-    # this code under `set -o nounset`.
-    KOLLA_LEGACY_IPTABLES=${KOLLA_LEGACY_IPTABLES-false}
+# NOTE(hrw): from RHEL 9 release notes:
+# "Iptables-nft and ipset are now deprecated, which included the utilities,
+#  iptables, ip6tables, ebtables, and arptables. These are all replaced by the
+#  nftables framework."
+# so no need to even use u-a on RHEL 9 family as there is one provider
+# (and there is no u-a for ip6tables so script fails)
 
-    if [[ $KOLLA_LEGACY_IPTABLES == "true" ]]; then
-        sudo $UPDATE_ALTERNATIVES --set iptables /usr/sbin/iptables-legacy
-        sudo $UPDATE_ALTERNATIVES --set ip6tables /usr/sbin/ip6tables-legacy
-    else
-        sudo $UPDATE_ALTERNATIVES --auto iptables
-        sudo $UPDATE_ALTERNATIVES --auto ip6tables
+if [[ ${KOLLA_BASE_DISTRO} != "centos" ]]; then
+    if /usr/bin/update-alternatives --display iptables; then
+        # NOTE(yoctozepto): Kolla-Ansible does not always set KOLLA_LEGACY_IPTABLES;
+        # the workaround below ensures it gets set to `false` in such cases to fix
+        # this code under `set -o nounset`.
+        KOLLA_LEGACY_IPTABLES=${KOLLA_LEGACY_IPTABLES-false}
+
+        if [[ $KOLLA_LEGACY_IPTABLES == "true" ]]; then
+            sudo /usr/bin/update-alternatives --set iptables /usr/sbin/iptables-legacy
+            sudo /usr/bin/update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
+        else
+            sudo /usr/bin/update-alternatives --auto iptables
+            sudo /usr/bin/update-alternatives --auto ip6tables
+        fi
     fi
 fi
 

docker/nova/nova-compute/Dockerfile.j2

@@ -42,9 +42,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
         ] %}
     {% endif %}
 
-{{ macros.install_packages(nova_compute_packages | customizable("packages")) }} \
-    && dnf remove -y linux-firmware \
-    && dnf clean all
+{{ macros.install_packages(nova_compute_packages | customizable("packages")) }}
 
 {% elif base_package_type == 'deb' %}
 

docker/nova/nova-libvirt/Dockerfile.j2

@@ -25,7 +25,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
         'openvswitch',
         'qemu-img',
         'qemu-kvm',
-        'trousers'
     ] %}
     {% if base_arch == 'x86_64' %}
         {% set nova_libvirt_packages = nova_libvirt_packages + [

docker/openstack-base/Dockerfile.j2

@@ -7,7 +7,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 {% import "macros.j2" as macros with context %}
 
-{{ macros.enable_extra_repos(['opstools', 'powertools']) }}
+{{ macros.enable_extra_repos(['crb']) }}
 
 {% if base_package_type == 'rpm' %}
     {% set openstack_base_packages = [
@@ -55,7 +55,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 {% endif %}
 
-{{ macros.enable_extra_repos(['powertools']) }}
 {{ macros.install_packages(openstack_base_packages | customizable("packages")) }}
 
 {% set openstack_base_pip_packages = [

docker/prometheus/prometheus-libvirt-exporter/Dockerfile.j2

@@ -5,6 +5,8 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 {% import "macros.j2" as macros with context %}
 
+{{ macros.enable_extra_repos(['crb']) }}
+
 {% block prometheus_libvirt_exporter_header %}{% endblock %}
 
 {% if base_package_type == 'rpm' %}

docker/rabbitmq/Dockerfile.j2

@@ -14,7 +14,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {{ macros.enable_extra_repos(['epel']) }}
 {% endif %}
 
-{{ macros.enable_extra_repos(['erlang', 'powertools', 'rabbitmq']) }}
+{{ macros.enable_extra_repos(['crb', 'erlang', 'rabbitmq']) }}
 
 {% block rabbitmq_install %}
 {% if base_package_type == 'rpm' %}

docker/vitrage/vitrage-base/Dockerfile.j2

@@ -7,7 +7,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 {% import "macros.j2" as macros with context %}
 
-{{ macros.enable_extra_repos(['powertools']) }}
 {{ macros.configure_user(name='vitrage') }}
 
 {% if base_package_type == 'rpm' %}

docker/watcher/watcher-base/Dockerfile.j2

@@ -7,7 +7,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 {% import "macros.j2" as macros with context %}
 
-{{ macros.enable_extra_repos(['powertools']) }}
 {{ macros.configure_user(name='watcher') }}
 
 ADD watcher-base-archive /watcher-base-source

kolla/common/config.py

@@ -24,22 +24,20 @@ from kolla.version import version_info as version
 BASE_OS_DISTRO = ['centos', 'debian', 'ubuntu']
 BASE_ARCH = ['x86_64', 'aarch64']
 DEFAULT_BASE_TAGS = {
-    'centos': {'name': 'quay.io/centos/centos', 'tag': 'stream8'},
+    'centos': {'name': 'quay.io/centos/centos', 'tag': 'stream9'},
     'debian': {'name': 'debian', 'tag': 'bullseye'},
     'ubuntu': {'name': 'ubuntu', 'tag': '22.04'},
 }
 # NOTE(hrw): has to match PRETTY_NAME in /etc/os-release
 DISTRO_PRETTY_NAME = {
-    'centos': 'CentOS Stream 8',
+    'centos': 'CentOS Stream 9',
     'debian': 'Debian GNU/Linux 11 (bullseye)',
     'ubuntu': 'Ubuntu 22.04',
 }
 OPENSTACK_RELEASE = 'master'
 
 # This is noarch repository so we will use it on all architectures
-DELOREAN = "https://trunk.rdoproject.org/centos8-yoga/" \
-    "consistent/delorean.repo"
-DELOREAN_DEPS = "https://trunk.rdoproject.org/centos8-yoga/" \
+DELOREAN_DEPS = "https://trunk.rdoproject.org/centos9-master/" \
     "delorean-deps.repo"
 
 INSTALL_TYPE_CHOICES = ['source']
@@ -270,7 +268,7 @@ _BASE_OPTS = [
                help=('Set the package type of the distro. If not set then '
                      'the packaging type is set to "rpm" if a RHEL based '
                      'distro and "deb" if a Debian based distro.')),
-    cfg.ListOpt('rpm_setup_config', default=[DELOREAN, DELOREAN_DEPS],
+    cfg.ListOpt('rpm_setup_config', default=[DELOREAN_DEPS],
                 help=('Comma separated list of .rpm or .repo file(s) '
                       'or URL(s) to install before building containers')),
     cfg.StrOpt('apt_sources_list', help=('Path to custom sources.list')),

kolla/image/build.py

@@ -87,11 +87,19 @@ UNBUILDABLE_IMAGES = {
         "skydive-base",      # no aarch64 binary
     },
 
+    # Issues for SHA1 keys:
+    # https://github.com/elastic/elasticsearch/issues/85876
+    # https://github.com/grafana/grafana/issues/41036
     'centos': {
+        "elasticsearch",         # SHA1 gpg key
+        "grafana",               # SHA1 gpg key
         "hacluster-pcs",         # Missing crmsh package
+        "kibana",                # SHA1 gpg key
+        "logstash",              # SHA1 gpg key
         "nova-spicehtml5proxy",  # Missing spicehtml5 package
         "ovsdpdk",               # Not supported on CentOS
-        "tgtd",                  # Not supported on CentOS 8
+        "proxysql",              # no binary package
+        "tgtd",                  # Not supported on CentOS
     },
 
     'debian': {
@@ -623,7 +631,7 @@ class KollaWorker(object):
         self.rpm_setup = self.build_rpm_setup(rpm_setup_config)
 
         if self.base in ['centos']:
-            self.conf.distro_python_version = "3.6"
+            self.conf.distro_python_version = "3.9"
             self.distro_package_manager = 'dnf'
             self.base_package_type = 'rpm'
         elif self.base in ['debian']:

kolla/template/repos.yaml

@@ -1,13 +1,13 @@
 ---
 centos:
-  ceph: "centos-ceph-pacific"
+  ceph: "centos-ceph-quincy"
+  crb: "crb"
   elasticsearch: "elasticsearch-kibana-logstash-7.x"
   epel: "epel"
-  epel-modular: "epel-modular"
   erlang: "rabbitmq_rabbitmq-erlang"
   extras: "extras"
   grafana: "grafana"
-  hacluster: "ha"
+  hacluster: "highavailability"
   haproxy: "centos-nfv-extras"
   influxdb: "influxdb"
   kibana: "elasticsearch-kibana-logstash-7.x"
@@ -15,27 +15,25 @@ centos:
   mariadb: "mariadb"
   openvswitch: "centos-nfv-openvswitch"
   opstools: "centos-opstools"
-  powertools: "powertools"
   proxysql: "proxysql"
   rabbitmq: "rabbitmq_rabbitmq-server"
   td-agent: "treasuredata"
 
 centos-aarch64:
-  ceph: "centos-ceph-pacific"
+  ceph: "centos-ceph-quincy"
+  crb: "crb"
   elasticsearch: "elasticsearch-kibana-logstash-7.x"
   epel: "epel"
-  epel-modular: "epel-modular"
   erlang: "erlang-solutions"
   extras: "extras"
   grafana: "grafana"
-  hacluster: "ha"
+  hacluster: "highavailability"
   haproxy: "centos-nfv-extras"
   kibana: "elasticsearch-kibana-logstash-7.x"
   logstash: "elasticsearch-kibana-logstash-7.x"
   mariadb: "mariadb"
   openvswitch: "centos-nfv-openvswitch"
   opstools: "centos-opstools"
-  powertools: "powertools"
   proxysql: "proxysql"
   rabbitmq: "rabbitmq_rabbitmq-server"
   td-agent: "treasuredata"

kolla/tests/test_build.py

@@ -529,11 +529,10 @@ class KollaWorkerTest(base.TestCase):
         self.assertEqual('3.10', kolla.distro_python_version)
 
     def test_build_distro_python_version_centos(self):
-        """check distro_python_version for CentOS 8.0.1905"""
+        """check distro_python_version for CentOS Stream 9"""
         self.conf.set_override('base', 'centos')
-        self.conf.set_override('base_tag', '8.0.1905')
         kolla = build.KollaWorker(self.conf)
-        self.assertEqual('3.6', kolla.distro_python_version)
+        self.assertEqual('3.9', kolla.distro_python_version)
 
     def test_build_distro_package_manager(self):
         """check distro_package_manager conf value is taken"""

kolla/tests/test_methods.py

@@ -55,7 +55,7 @@ class MethodsTest(base.TestCase):
         result = methods.handle_repos(template_vars, ['grafana', 'ceph'],
                                       'enable')
         expectCmd = 'RUN dnf config-manager  --enable grafana '
-        expectCmd += '--enable centos-ceph-pacific || true'
+        expectCmd += '--enable centos-ceph-quincy || true'
         self.assertEqual(expectCmd, result)
 
     def test_enable_repos_debian(self):
@@ -145,7 +145,7 @@ class MethodsTest(base.TestCase):
         result = methods.handle_repos(template_vars, ['grafana', 'ceph'],
                                       'disable')
         expectCmd = 'RUN dnf config-manager  --disable grafana '
-        expectCmd += '--disable centos-ceph-pacific || true'
+        expectCmd += '--disable centos-ceph-quincy || true'
         self.assertEqual(expectCmd, result)
 
     # NOTE(hrw): there is no disabling of repos for Debian/Ubuntu

releasenotes/notes/centos-stream-9-ec4591d83c22b509.yaml

@@ -0,0 +1,4 @@
+---
+features:
+  - |
+    CentOS Stream 9 is now used instead of CentOS Stream 8.

tests/playbooks/pre.yml

@@ -18,26 +18,24 @@
         path: "{{ kolla_build_logs_dir }}"
         state: directory
 
-    - name: Install Python3 setuptools and family
+    - name: Install Python3 pip and setuptools
       package:
         name:
           - python3-pip
           - python3-setuptools
-          - python3-virtualenv
-          - python3-wheel
       become: true
 
-    # NOTE(hrw): On RedHat systems it is part of python3-virtualenv
-    - name: Install virtualenv on Debian systems
+    # NOTE(hrw): On RedHat systems venv is part of python3-libs
+    - name: Install Python3 venv on Debian systems
       package:
         name:
-          - virtualenv
+          - python3-venv
       become: true
       when:
         ansible_os_family == "Debian"
 
     - name: Create virtualenv
-      command: python3 -m virtualenv {{ virtualenv_path }} --python python3
+      command: python3 -m venv {{ virtualenv_path }}
 
     - name: Install kolla
       command: "{{ virtualenv_path }}/bin/python -m pip install {{ zuul.project.src_dir }}"
@@ -58,11 +56,11 @@
 
     - name: Configure Docker repo for CentOS
       block:
-        - name: Add Docker YUM repository
+        - name: Add Docker repository
           yum_repository:
             name: docker
             description: Docker
-            baseurl: "{{ nodepool_docker_proxy }}/centos/7/$basearch/stable"
+            baseurl: "{{ nodepool_docker_proxy }}/centos/9/$basearch/stable"
             enabled: yes
             gpgcheck: yes
             gpgkey: "{{ nodepool_docker_proxy }}/centos/gpg"

tests/templates/template_overrides.j2

@@ -23,7 +23,7 @@ RUN echo registry={{ nodepool_npmjs_proxy }} > /etc/npmrc \
 RUN sed -i \
         -e "s|^\(mirrorlist.*\)|#\1|" \
         -e "s|^#baseurl=http://mirror.centos.org|baseurl=http://{{ nodepool_mirror_host }}|" \
-        /etc/yum.repos.d/CentOS-*.repo
+        /etc/yum.repos.d/centos*.repo
 
 {% raw %}
 {% endblock %}
@@ -46,7 +46,7 @@ RUN sed -i \
         -e "s|^#baseurl=https://mirror.centos.org|baseurl=http://{{ nodepool_mirror_host }}|" \
         -e "s|^baseurl=http://mirror.centos.org|baseurl=http://{{ nodepool_mirror_host }}|" \
         -e "s|^baseurl=https://mirror.centos.org|baseurl=http://{{ nodepool_mirror_host }}|" \
-        /etc/yum.repos.d/CentOS-*.repo \
+        /etc/yum.repos.d/centos*.repo \
     && sed -i \
         -e "s|^\(metalink.*\)|#\1|" \
         -e "s|^#baseurl=http://download.example/pub|baseurl=http://{{ nodepool_mirror_host }}|" \