June 2016 - OpenStack-announce - lists.openstack.org

[new][openstackansible] openstack-ansible-security 13.1.2 release
by no-reply＠openstack.org 03 Jun '16

03 Jun '16

We are jazzed to announce the release of: openstack-ansible-security 13.1.2: Security hardening role for openstack-ansible For more details, please see below. 13.1.2 ^^^^^^ Bug Fixes * The dictionary-based variables in "defaults/main.yml" are now individual variables. The dictionary-based variables could not be changed as the documentation instructed. Instead it was required to override the entire dictionary. Deployers must use the new variable names to enable or disable the security configuration changes applied by the security role. For more information, see Launchpad Bug 1577944 (https://bugs.launchpad.net/openstack- ansible/+bug/1577944). * The security role now handles "ssh_config" files that contain "Match" stanzas. A marker is added to the configuration file and any new configuration items will be added below that marker. In addition, the configuration file is validated for each change to the ssh configuration file. Changes in openstack-ansible-security 13.1.1..13.1.2 ---------------------------------------------------- b1db632 Handle Match properly in sshd_config df31e9a Removing equal signs in docs e2b3990 Switch from dict to individual variables f0f5367 Doc updates Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 103 ++++++++++----------- ...tionary-variables-removed-957c7b7b2108ba1f.yaml | 9 ++ ...iled-access-audit-logging-789dc01c8bcbef17.yaml | 2 +- ...ndling-sshd-match-stanzas-fa40b97689004e46.yaml | 7 ++ tasks/auth.yml | 4 +- tasks/kernel.yml | 14 +-- tasks/services.yml | 26 +++--- tasks/sshd.yml | 74 ++++++++++++++- templates/osas-auditd.j2 | 50 +++++----- 42 files changed, 271 insertions(+), 163 deletions(-)

1 0

[new][openstackansible] openstack-ansible-memcached_server 13.1.2 release
by no-reply＠openstack.org 03 Jun '16

03 Jun '16

We are delighted to announce the release of: openstack-ansible-memcached_server 13.1.2: memcached_server for OpenStack Ansible For more details, please see below. 13.1.2 ^^^^^^ New Features * The openstack-ansible-memcached_server role includes a new override,`memcached_connections` which is automatically calculated from the number of memcached connection limit plus additional 1k to configure the OS nofile limit. Without proper nofile limit configuration, memcached will crash in order to support higher parallel connection TCP/Memcache counts. Changes in openstack-ansible-memcached_server 13.1.1..13.1.2 ------------------------------------------------------------ 045b2d8 Configure nofile OS limit for memcached server role Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 1 + ...ached_server-add-nofile-setting-504e0c50e10a4ea6.yaml | 9 +++++++++ tasks/memcached_config.yml | 16 ++++++++++++++++ 3 files changed, 26 insertions(+)

1 0

[new][openstackansible] openstack-ansible-galera_server 13.1.2 release
by no-reply＠openstack.org 03 Jun '16

03 Jun '16

We are glad to announce the release of: openstack-ansible-galera_server 13.1.2: Galera Server role for OpenStack-Ansible For more details, please see below. Changes in openstack-ansible-galera_server 13.1.0..13.1.2 --------------------------------------------------------- 26ec8e8 Role tests should test against the same branch 290e729 Add dependencies for paramiko 2.0 Diffstat (except docs and test files) ------------------------------------- other-requirements.txt | 4 ++++ 4 files changed, 11 insertions(+), 19 deletions(-) Requirements updates -------------------- diff --git a/other-requirements.txt b/other-requirements.txt index da55ba7..3307388 100644 --- a/other-requirements.txt +++ b/other-requirements.txt @@ -17,0 +18,4 @@ curl + +# Requirements for Paramiko 2.0 +libssl-dev +libffi-dev

1 0

[new][horizon] horizon 9.0.1 release (mitaka)
by no-reply＠openstack.org 03 Jun '16

03 Jun '16

We are pumped to announce the release of: horizon 9.0.1: OpenStack Dashboard This release is part of the mitaka stable release series. For more details, please see below. Changes in horizon 9.0.0..9.0.1 ------------------------------- 99dc305 Imported Translations from Zanata 838b824 UX: Misaligned OpenStack Logo 3c8c403 Django compressor cannot find custom theme templates 3639d3b Imported Translations from Zanata 52c0894 Fix untranslated strings in ng-instance 7896a2a Add scrolling to the projector selector 0ea1326 Imported Translations from Zanata cdde60c Change Metadata Display widget to case insensitive a597414 Fix workflow bug in "Create Network" dialog dfeacc2 Fix babel msgids to include tag attributes and entities c5779c7 "Clear Selection" is unlocalzed b398571 Fix existing metadata display in metadata widget 31b9439 Image create "Copy Data" checkbox wrong label 26e359b Imported Translations from Zanata f812b3c Updated from global requirements c570ee9 Fix key import in angular Launch Instance 6554a3f Imported Translations from Zanata 7edc346 Fix translation test 408114a Fix pre_test_hook fail and sidebar menu fail c6bc96c Imported Translations from Zanata e9b8368 Fix tests broken by novaclient 4.0.0 release ec4fdd8 Fix longtime tests 722a7b3 Pass environment data to update stack action ecb8f46 Use Chrome for JS unit tests 41e8525 Imported Translations from Zanata e212650 Imported Translations from Zanata 6ee3340 Fix Nova test data and selenium tests 08bfbb8 Imported Translations from Zanata e49c347 Fix new Swift UI to work with Ceph backend c0e04d4 Prevent transfer tables expanding out of modal 61bf0f9 Minor ng containers cleanup Diffstat (except docs and test files) ------------------------------------- horizon/karma.conf.js | 10 +- horizon/locale/ca/LC_MESSAGES/django.po | 6 +- horizon/locale/cs/LC_MESSAGES/django.po | 25 +- horizon/locale/cs/LC_MESSAGES/djangojs.po | 23 +- horizon/locale/de/LC_MESSAGES/django.po | 12 +- horizon/locale/de/LC_MESSAGES/djangojs.po | 6 +- horizon/locale/django.pot | 530 - horizon/locale/djangojs.pot | 614 - horizon/locale/en_AU/LC_MESSAGES/django.po | 6 +- horizon/locale/en_AU/LC_MESSAGES/djangojs.po | 6 +- horizon/locale/en_GB/LC_MESSAGES/django.po | 15 +- horizon/locale/en_GB/LC_MESSAGES/djangojs.po | 37 +- horizon/locale/es/LC_MESSAGES/django.po | 123 +- horizon/locale/es/LC_MESSAGES/djangojs.po | 123 +- horizon/locale/es_MX/LC_MESSAGES/django.po | 6 +- horizon/locale/fi_FI/LC_MESSAGES/django.po | 6 +- horizon/locale/fil/LC_MESSAGES/django.po | 6 +- horizon/locale/fr/LC_MESSAGES/django.po | 6 +- horizon/locale/fr/LC_MESSAGES/djangojs.po | 106 +- horizon/locale/hi/LC_MESSAGES/django.po | 6 +- horizon/locale/hi/LC_MESSAGES/djangojs.po | 6 +- horizon/locale/hu/LC_MESSAGES/django.po | 6 +- horizon/locale/id/LC_MESSAGES/django.po | 6 +- horizon/locale/it/LC_MESSAGES/django.po | 6 +- horizon/locale/it/LC_MESSAGES/djangojs.po | 15 +- horizon/locale/ja/LC_MESSAGES/django.po | 11 +- horizon/locale/ja/LC_MESSAGES/djangojs.po | 6 +- horizon/locale/ko_KR/LC_MESSAGES/django.po | 6 +- horizon/locale/ko_KR/LC_MESSAGES/djangojs.po | 6 +- horizon/locale/nl_NL/LC_MESSAGES/django.po | 6 +- horizon/locale/nl_NL/LC_MESSAGES/djangojs.po | 6 +- horizon/locale/pa_IN/LC_MESSAGES/django.po | 6 +- horizon/locale/pa_IN/LC_MESSAGES/djangojs.po | 6 +- horizon/locale/pl_PL/LC_MESSAGES/django.po | 6 +- horizon/locale/pl_PL/LC_MESSAGES/djangojs.po | 6 +- horizon/locale/pt/LC_MESSAGES/django.po | 6 +- horizon/locale/pt_BR/LC_MESSAGES/django.po | 62 +- horizon/locale/pt_BR/LC_MESSAGES/djangojs.po | 86 +- horizon/locale/ru/LC_MESSAGES/django.po | 6 +- horizon/locale/ru/LC_MESSAGES/djangojs.po | 6 +- horizon/locale/sl_SI/LC_MESSAGES/django.po | 6 +- horizon/locale/sr/LC_MESSAGES/django.po | 6 +- horizon/locale/sr/LC_MESSAGES/djangojs.po | 6 +- horizon/locale/te_IN/LC_MESSAGES/djangojs.po | 442 + horizon/locale/tr_TR/LC_MESSAGES/django.po | 6 +- horizon/locale/tr_TR/LC_MESSAGES/djangojs.po | 6 +- horizon/locale/zh_CN/LC_MESSAGES/django.po | 104 +- horizon/locale/zh_CN/LC_MESSAGES/djangojs.po | 104 +- horizon/locale/zh_TW/LC_MESSAGES/django.po | 29 +- horizon/locale/zh_TW/LC_MESSAGES/djangojs.po | 31 +- .../static/framework/util/filters/filters.spec.js | 2 +- .../framework/widgets/charts/pie-chart.spec.js | 2 +- .../widgets/metadata/tree/metadata-tree.html | 2 +- .../widgets/metadata/tree/tree.service.js | 19 +- .../framework/widgets/metadata/tree/tree.spec.js | 3 +- .../framework/widgets/modal/simple-modal.html | 2 +- horizon/static/horizon/js/horizon.forms.js | 28 +- horizon/test/webdriver.py | 82 +- horizon/themes.py | 18 +- horizon/utils/babel_extract_angular.py | 31 +- openstack_dashboard/api/rest/swift.py | 7 +- openstack_dashboard/api/swift.py | 7 +- .../dashboards/project/networks/workflows.py | 4 +- .../dashboards/project/stacks/forms.py | 3 + .../containers/containers-model.service.spec.js | 14 +- .../project/containers/create-container-modal.html | 4 +- .../project/containers/create-folder-modal.html | 17 +- .../project/containers/object-details-modal.html | 6 +- .../dashboard/project/containers/objects.html | 4 +- .../project/containers/upload-object-modal.html | 15 +- .../workflow/launch-instance/details/details.html | 8 +- .../keypair/import-keypair.controller.js | 4 +- .../keypair/import-keypair.controller.spec.js | 4 +- openstack_dashboard/karma.conf.js | 10 +- .../locale/as/LC_MESSAGES/django.po | 6 +- .../locale/bn_IN/LC_MESSAGES/django.po | 6 +- .../locale/brx/LC_MESSAGES/django.po | 6 +- .../locale/cs/LC_MESSAGES/django.po | 6 +- .../locale/cs/LC_MESSAGES/djangojs.po | 17 +- .../locale/de/LC_MESSAGES/django.po | 286 +- .../locale/de/LC_MESSAGES/djangojs.po | 72 +- openstack_dashboard/locale/django.pot | 15538 ------------------- openstack_dashboard/locale/djangojs.pot | 3095 ---- .../locale/en_AU/LC_MESSAGES/django.po | 6 +- .../locale/en_AU/LC_MESSAGES/djangojs.po | 27 +- .../locale/en_GB/LC_MESSAGES/django.po | 427 +- .../locale/en_GB/LC_MESSAGES/djangojs.po | 6 +- .../locale/es/LC_MESSAGES/django.po | 4425 +++--- .../locale/es/LC_MESSAGES/djangojs.po | 1386 +- .../locale/fr/LC_MESSAGES/django.po | 4032 ++--- .../locale/fr/LC_MESSAGES/djangojs.po | 738 +- .../locale/gu/LC_MESSAGES/django.po | 6 +- .../locale/hi/LC_MESSAGES/django.po | 6 +- .../locale/it/LC_MESSAGES/django.po | 9 +- .../locale/it/LC_MESSAGES/djangojs.po | 38 +- .../locale/ja/LC_MESSAGES/django.po | 6 +- .../locale/ja/LC_MESSAGES/djangojs.po | 27 +- .../locale/kn/LC_MESSAGES/django.po | 6 +- .../locale/ko_KR/LC_MESSAGES/django.po | 477 +- .../locale/ko_KR/LC_MESSAGES/djangojs.po | 62 +- .../locale/kok/LC_MESSAGES/django.po | 6 +- .../locale/ks/LC_MESSAGES/django.po | 6 +- .../locale/mai/LC_MESSAGES/django.po | 6 +- .../locale/mni/LC_MESSAGES/django.po | 6 +- .../locale/mr/LC_MESSAGES/django.po | 6 +- .../locale/ne/LC_MESSAGES/django.po | 6 +- .../locale/nl_NL/LC_MESSAGES/django.po | 6 +- .../locale/pa_IN/LC_MESSAGES/django.po | 6 +- .../locale/pl_PL/LC_MESSAGES/django.po | 6 +- .../locale/pl_PL/LC_MESSAGES/djangojs.po | 6 +- .../locale/pt_BR/LC_MESSAGES/django.po | 2655 ++-- .../locale/pt_BR/LC_MESSAGES/djangojs.po | 524 +- .../locale/ru/LC_MESSAGES/django.po | 6 +- .../locale/ru/LC_MESSAGES/djangojs.po | 29 +- .../locale/sr/LC_MESSAGES/django.po | 6 +- .../locale/ta/LC_MESSAGES/django.po | 6 +- .../locale/tr_TR/LC_MESSAGES/django.po | 6 +- .../locale/tr_TR/LC_MESSAGES/djangojs.po | 6 +- .../locale/ur/LC_MESSAGES/django.po | 6 +- .../locale/zh_CN/LC_MESSAGES/django.po | 31 +- .../locale/zh_CN/LC_MESSAGES/djangojs.po | 725 +- .../locale/zh_TW/LC_MESSAGES/django.po | 3353 ++-- .../locale/zh_TW/LC_MESSAGES/djangojs.po | 312 +- .../static/dashboard/scss/_variables.scss | 4 + .../static/dashboard/scss/components/_navbar.scss | 11 + .../scss/components/_transfer_tables.scss | 6 + openstack_dashboard/test/test_data/nova_data.py | 35 +- package.json | 6 +- requirements.txt | 4 +- tools/gate/integration/pre_test_hook.sh | 1 - 141 files changed, 12495 insertions(+), 29158 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index a0fa350..09da781 100644 --- a/requirements.txt +++ b/requirements.txt @@ -12 +12 @@ pbr>=1.6 # Apache-2.0 -Babel>=1.3 # BSD +Babel!=2.3.0,!=2.3.1,!=2.3.2,!=2.3.3,>=1.3 # BSD @@ -33 +33 @@ python-heatclient>=0.6.0 # Apache-2.0 -python-keystoneclient!=1.8.0,!=2.1.0,>=1.6.0 # Apache-2.0 +python-keystoneclient!=1.8.0,!=2.1.0,<3.0.0,>=1.6.0 # Apache-2.0

1 0

[OSSA-2016-008] Incorrect Audit IDs in Keystone Fernet Tokens can result in revocation bypass (CVE-2016-4911)
by morgan fainberg 03 Jun '16

03 Jun '16

============================================================================================ OSSA-2016-008: Incorrect Audit IDs in Keystone Fernet Tokens can result in revocation bypass ============================================================================================ :Date: May 23, 2016 :CVE: CVE-2016-4911 Affects ~~~~~~~ - Keystone: ==9.0.0 Description ~~~~~~~~~~~ Lance Bragstad (Rackspace) reported a vulnerability in the Keystone Fernet Token Provider. By rescoping a token a user will receive a new token without correct audit_ids, these incorrect audit_ids will prevent the entire chain of tokens from being revoked properly. This vulnerability does not impact revoking a token by its individual audit_id. Only deployments with Keystone configured to use Fernet tokens are impacted. Patches ~~~~~~~ - https://review.openstack.org/#/c/312582/ (Mitaka) - https://review.openstack.org/#/c/311886/ (Newton) Credits ~~~~~~~ - Lance Bragstad from Rackspace (CVE-2016-4911) References ~~~~~~~~~~ - https://bugs.launchpad.net/bugs/1577558 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4911 Notes ~~~~~ - This fix was included in the openstack/keystone 9.0.1 (mitaka) release. -- Morgan Fainberg OpenStack Vulnerability Management Team

1 0

[new][sahara] python-saharaclient 0.15.0 release (newton)
by no-reply＠openstack.org 02 Jun '16

02 Jun '16

We are thrilled to announce the release of: python-saharaclient 0.15.0: Client library for Sahara API This release is part of the newton release series. With source available at: https://git.openstack.org/cgit/openstack/python-saharaclient With package available at: https://pypi.python.org/pypi/python-saharaclient Please report issues through launchpad: https://bugs.launchpad.net/python-saharaclient For more details, please see below. 0.15.0 ^^^^^^ Upgrade Notes ************* * Option 'version' is replaced by 'plugin-version' option. Bug Fixes ********* * Option 'version' is a global option, which is used for getting the client version. So there were problems with the OpenStack client, when we specified 'version' of the plugin, but OSC treated that as a request for getting the current client version. Hence, to fix this problem, 'version' is replaced by 'plugin-version'. Related bug 1565775. Changes in python-saharaclient 0.13.0..0.15.0 --------------------------------------------- f02ea89 Change plugin version 'version' parameter to 'plugin-version' 1fd405c Updated from global requirements 7f40491 Updated from global requirements 4944304 Updated from global requirements 19175d5 Updated from global requirements 19b02b7 Updated from global requirements d4389a1 Updated from global requirements 9621abe Updated from global requirements 079e839 Updated from global requirements c279df9 Remove integration tests from saharaclient afd81b7 Update reno for stable/mitaka 6a5f3e1 Updated from global requirements 409c48b Remove unused pngmath Sphinx extension Diffstat (except docs and test files) ------------------------------------- ...version_to_plugin-version-20cfe17530446391.yaml | 10 + releasenotes/source/index.rst | 1 + releasenotes/source/mitaka.rst | 6 + requirements.txt | 10 +- saharaclient/osc/v1/cluster_templates.py | 30 +- saharaclient/osc/v1/clusters.py | 20 +- saharaclient/osc/v1/job_types.py | 12 +- saharaclient/osc/v1/node_group_templates.py | 34 +-- saharaclient/osc/v1/plugins.py | 13 +- .../integration/configs/itest.conf.sample-full | 273 ----------------- test-requirements.txt | 10 +- tox.ini | 6 - 38 files changed, 161 insertions(+), 2023 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 1b0f282..519264a 100644 --- a/requirements.txt +++ b/requirements.txt @@ -7,2 +7,2 @@ pbr>=1.6 # Apache-2.0 -Babel>=1.3 # BSD -cliff!=1.16.0,>=1.15.0 # Apache-2.0 +Babel>=2.3.4 # BSD +cliff!=1.16.0,!=1.17.0,>=1.15.0 # Apache-2.0 @@ -13,2 +13,2 @@ oslo.i18n>=2.1.0 # Apache-2.0 -oslo.utils>=3.5.0 # Apache-2.0 -python-keystoneclient!=1.8.0,!=2.1.0,>=1.6.0 # Apache-2.0 +oslo.utils>=3.11.0 # Apache-2.0 +python-keystoneclient!=1.8.0,!=2.1.0,>=1.7.0 # Apache-2.0 @@ -16 +16 @@ python-openstackclient>=2.1.0 # Apache-2.0 -requests!=2.9.0,>=2.8.1 # Apache-2.0 +requests>=2.10.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index a9c5ba3..d91624b 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -9,2 +9 @@ discover # BSD -mock>=1.2 # BSD -oslo.config>=3.7.0 # Apache-2.0 +mock>=2.0 # BSD @@ -13,5 +12,2 @@ oslotest>=1.10.0 # Apache-2.0 -os-testr>=0.4.1 # Apache-2.0 -python-neutronclient>=2.6.0 # Apache-2.0 -python-novaclient!=2.33.0,>=2.29.0 # Apache-2.0 -python-swiftclient>=2.2.0 # Apache-2.0 -reno>=0.1.1 # Apache2 +os-testr>=0.7.0 # Apache-2.0 +reno>=1.6.2 # Apache2

1 0

[new][neutron] neutron-vpnaas 7.1.0 release (liberty)
by no-reply＠openstack.org 01 Jun '16

01 Jun '16

We are happy to announce the release of: neutron-vpnaas 7.1.0: OpenStack Networking VPN as a Service This release is part of the liberty stable release series. For more details, please see below. Changes in neutron-vpnaas 7.0.4..7.1.0 -------------------------------------- 4f1971b Update devstack plugin for dependent packages Diffstat (except docs and test files) ------------------------------------- devstack/plugin.sh | 1 + 1 file changed, 1 insertion(+)

1 0

[new][neutron] neutron-lbaas 7.1.0 release (liberty)
by no-reply＠openstack.org 01 Jun '16

01 Jun '16

We are pleased to announce the release of: neutron-lbaas 7.1.0: OpenStack Networking Load Balancing as a Service This release is part of the liberty stable release series. For more details, please see below. Changes in neutron-lbaas 7.0.4..7.1.0 ------------------------------------- 0674621 Make all tox targets constrained bfc8b51 Update local.conf to use Cirros 0.3.4 c65ca64 Pass config info in neutron-lbaas api v2 tempest tests 0b7b089 Fix scenario tests for octavia driver Diffstat (except docs and test files) ------------------------------------- devstack/samples/local.conf | 2 +- .../v2/scenario/test_healthmonitor_basic.py | 7 --- .../tempest/v2/scenario/test_listener_basic.py | 8 +-- tools/tox_install.sh | 14 ++++- tox.ini | 10 +++- 7 files changed, 95 insertions(+), 49 deletions(-)

1 0

[new][neutron] neutron-fwaas 7.1.0 release (liberty)
by no-reply＠openstack.org 01 Jun '16

01 Jun '16

We are pumped to announce the release of: neutron-fwaas 7.1.0: OpenStack Networking FWaaS This release is part of the liberty stable release series. For more details, please see below. 7.1.0 ^^^^^ Enable quotas for FWaaS. New Features ************ * The FWaaS extension can register quotas. The default values for quota_firewall, quota_firewall_policy, and quota_firewall_rule are set to -1 (unlimited). Known Issues ************ * Tenants may receive a 409 Conflict error with a message body containing a quota exceeded message during resource creation if their quota is exceeded. Other Notes *********** * Operators that increase the default limit for quota_routers from 10 may want to bump FWaaS quotas as well, since with router insertion a tenant can potentially have a unique policy and firewall for each router. Changes in neutron-fwaas 7.0.2..7.1.0 ------------------------------------- 1909e55 Make all tox targets constrained 2ce8b58 FWaaS quota registration d578ac7 Consume FWaaS plugin queue in RPC workers Diffstat (except docs and test files) ------------------------------------- neutron_fwaas/extensions/firewall.py | 9 +++-- neutron_fwaas/services/firewall/fwaas_plugin.py | 15 ++++--- .../unit/services/firewall/test_fwaas_plugin.py | 19 +++++++-- .../notes/enable-quotas-a3d0a21743bb1985.yaml | 17 ++++++++ tools/tox_install.sh | 46 ++++++++++++++++++++++ tox.ini | 12 ++++-- 6 files changed, 102 insertions(+), 16 deletions(-)

1 0

[new][neutron] neutron 7.1.0 release (liberty)
by no-reply＠openstack.org 01 Jun '16

01 Jun '16

We are jubilant to announce the release of: neutron 7.1.0: OpenStack Networking This release is part of the liberty stable release series. For more details, please see below. 7.1.0 ^^^^^ Allowed address pairs can now be cleared by passing None in addition to an empty list. This is to make it possible to use the --action=clear option with the neutron client. neutron port-update <uuid> --allowed-address-pairs action=clear Support for MTU selection and advertisement. New Features ************ * Use the value of the network 'mtu' attribute for the MTU of virtual network interfaces such as veth pairs, patch ports, and tap devices involving a particular network. * Enable end-to-end support for arbitrary MTUs including jumbo frames between instances and provider networks by moving MTU disparities between flat or VLAN networks and overlay networks from layer-2 devices to layer-3 devices that support path MTU discovery (PMTUD). * When advertise_mtu is set in the config, Neutron supports advertising the LinkMTU using Router Advertisements. Upgrade Notes ************* * Does not change MTU for existing virtual network interfaces. * Actions that create virtual network interfaces on an existing network with the 'mtu' attribute containing a value greater than zero could cause issues for network traffic traversing existing and new virtual network interfaces. Bug Fixes ********* * Fixes bug 1537734 * Explicitly configure MTU of virtual network interfaces rather than using default values or incorrect values that do not account for overlay protocol overhead. * The Linuxbridge agent now supports the ability to toggle the local ARP responder when L2Population is enabled. This ensures compatibility with the allowed-address-pairs extension. Closes bug 1445089. Other Notes *********** * For details please read Blueprint mtu-selection-and-advertisement (https://specs.openstack.org/openstack/neutron-specs/specs/kilo/mtu- selection-and-advertisement.html). Changes in neutron 7.0.4..7.1.0 ------------------------------- 0991b19 Support MTU advertisement using IPv6 RAs 7560c84 Register RA and PD config options in l3-agent 92f40c5 Updated from global requirements df80a6e Enforce UUID of port/subnet ID for router interfaces 531b682 Restart dsnmasq on any network subnet change 13f7d19 Outerjoin to networks for port ownership filter c6f8188 RBAC: Fix port query and deletion for network owner fd240c1 Use correct session in update_allocation_pools 0ffab09 Add exponential back-off RPC client d29e2f7 DVR: Clear SNAT namespace when agent restarts after router move 69a384a Use admin context when removing DVR router on vm port deletion 7593e7f Clear DVR MAC on last agent deletion from host d32b852 Updated from global requirements 8d29f38 Cleanup stale OVS flows for physical bridges 1d1159b IPtables firewall prevent ICMPv6 spoofing 52430ce Mitigate restriction for fixed ips per dhcp port b33c16b OVS: Add mac spoofing filtering to flows 05de318 Delete fipnamespace when external net removed on DVR fa2c378 unbreak unit test caused by c5fa665de3173f3ad82cc3e7624b5968bc52c08d c55aba1 Make agent interface plugging utilize network MTU de5bdc9 Consume service plugins queues in RPC workers. 6b33c51 Only prevent l3 port deletion if router exists a46e008 Don't disconnect br-int from phys br if connected a38cb93 ML2: update port's status to DOWN if its binding info has changed 9d6a82f Updated from global requirements 996af44 Fix corrupted release note in Liberty fd5fd25 Iptables firewall prevent IP spoofed DHCP requests 275a171 Switched from fixtures to mock to mock out starting RPC consumers 8810a25 DVR: Increase the link-local address pair range a43b11e L3 agent: match format used by iptables 3a922a2 Don't drop 'protocol' from client supplied security_group_rule dict 90fb36f Split the FIP Namespace delete in L3 agent for DVR b392ad1 Don't delete br-int to br-tun patch on startup 0feecfe Delete metadata_proxy for network if it is not needed 36864b6 Adds base in-tree functional testing of the dhcp agent (OVS) 0186815 fix _validate_shared_update for dvr router ports c823e8c add arp_responder flag to linuxbridge agent 695335b Switches metering agent to stateless iptables 0e543db Fix setting peer to bridge interfaces 7175fde Refactor and fix dummy process fixture 6dea586 Remove obsolete keepalived PID files before start 761a1be Support Routes==2.3 d1618c9 port security: gracefully handle resources with no bindings 05e9044 Move test_extend_port_dict_no_port_security to where it belongs to c0d53a3 SG protocol validation to allow numbers or names d48c66b DVR: rebind port if ofport changes b57d9fa Linux Bridge: Add mac spoofing filtering to ebtables 5ad201c Change log level from error to warning e09c435 DHCP: Downgrade 'network has been deleted' logs 4848c71 Catch DBDuplicateEntry errors in RBAC code 8de5b03 Change the exception type from ValueError to IpamValueInvalid 92d58fc L3 agent: log traceback on floating ip setup failure a21da84 Update default gateway in the fip namespace after subnet-update eec85f3 Make run_ofctl check for socket error 82a6d2b Skip fullstack L3 HA test 4cb9062 lb: avoid doing nova VIF work plumbing tap to qbr e17f391 Remove test_external_network_visibility a86274e Check tap bridge timestamps to detect local changes 362896a Catch DB reference errors in binding DVR ports 48a6196 Move db query to fetch down bindings under try/except b90ca9f ML2: Downgrade 'no bound segment' warning a42b176 Close XenAPI sessions in neutron-rootwrap-xen-dom0 b30eb16 Add IPAllocation object to session info to stop GC 967d003 Allow address pairs to be cleared with None 1252c3f Downgrade "device not found" log message 52c34cb Downgrade network not found log in DHCP RPC 5dd0a91 Fix branch order when upgrading to alembic milestone 3b54294 Watch for 'new' events in ovsdb monitor for ofport d774e70 Removes host file contents from DHCP agent logs 8a1a21f Add VLAN tag info to port before applying SG initial setup. feaf9d3 Optimize and refactor router delete execution ec052cf radvd prefix configuration for DHCPV6_Stateful RA 0965953 Prevent PD subnets with incorrect IPv6 modes e1de91d Correct insufficient name for external process in manager log 1b10be8 Add network_update RPC into SR-IOV agent 54f8819 Separate the command for replace_port to delete and add 1e3ef49 Corrected wrong ethertype exception message 2db525d Add more log when dhcp agent sync_state. ccdfd17 Prevent binding IPv6 addresses to Neutron interfaces 3a22335 Do not remove router from dvr_snat agents on dvr port deletion 0bce029 Fix port relationship for DVRPortBinding d32d066 Decomposition phase2 for MidoNet plugin e1d177f Support rootwrap sysctl and conntrack commands for non-l3 nodes Diffstat (except docs and test files) ------------------------------------- bin/neutron-rootwrap-xen-dom0 | 13 +- etc/l3_agent.ini | 6 + etc/neutron/plugins/midonet/midonet.ini | 13 - etc/neutron/plugins/ml2/linuxbridge_agent.ini | 5 + etc/neutron/rootwrap.d/iptables-firewall.filters | 7 + neutron/agent/common/ovs_lib.py | 32 ++- neutron/agent/dhcp/agent.py | 33 ++- neutron/agent/l3/agent.py | 4 +- neutron/agent/l3/dvr.py | 6 + neutron/agent/l3/dvr_edge_router.py | 27 +- neutron/agent/l3/dvr_fip_ns.py | 74 +++-- neutron/agent/l3/dvr_local_router.py | 31 +- neutron/agent/l3/dvr_snat_ns.py | 19 +- neutron/agent/l3/ha_router.py | 7 +- neutron/agent/l3/item_allocator.py | 4 +- neutron/agent/l3/router_info.py | 70 ++++- neutron/agent/l3_agent.py | 4 + neutron/agent/linux/bridge_lib.py | 45 +-- neutron/agent/linux/dhcp.py | 8 +- neutron/agent/linux/external_process.py | 9 +- neutron/agent/linux/interface.py | 53 ++-- neutron/agent/linux/ip_lib.py | 45 +++ neutron/agent/linux/iptables_firewall.py | 42 ++- neutron/agent/linux/keepalived.py | 23 +- neutron/agent/linux/ovsdb_monitor.py | 8 + neutron/agent/linux/pd.py | 2 - neutron/agent/linux/ra.py | 38 ++- neutron/agent/metadata/driver.py | 10 +- neutron/api/extensions.py | 5 +- neutron/api/rpc/agentnotifiers/l3_rpc_agent_api.py | 34 ++- neutron/api/rpc/handlers/dhcp_rpc.py | 17 +- neutron/api/v2/base.py | 10 +- neutron/callbacks/resources.py | 1 + neutron/common/constants.py | 19 +- neutron/common/rpc.py | 86 +++++- neutron/db/agents_db.py | 7 +- neutron/db/agentschedulers_db.py | 13 +- neutron/db/db_base_plugin_common.py | 24 ++ neutron/db/db_base_plugin_v2.py | 21 +- neutron/db/dvr_mac_db.py | 31 ++ neutron/db/ipam_backend_mixin.py | 12 +- neutron/db/ipam_non_pluggable_backend.py | 2 +- neutron/db/ipam_pluggable_backend.py | 2 +- neutron/db/l3_agentschedulers_db.py | 23 +- neutron/db/l3_db.py | 83 +++++- neutron/db/l3_dvr_db.py | 36 ++- neutron/db/l3_dvrscheduler_db.py | 18 +- neutron/db/l3_hamode_db.py | 2 +- neutron/db/migration/cli.py | 7 +- neutron/db/models_v2.py | 3 +- neutron/db/portsecurity_db.py | 4 +- neutron/db/portsecurity_db_common.py | 41 ++- neutron/db/rbac_db_mixin.py | 16 +- neutron/db/securitygroups_db.py | 36 ++- neutron/extensions/allowedaddresspairs.py | 1 + neutron/extensions/portsecurity.py | 8 +- neutron/extensions/rbac.py | 4 + neutron/extensions/securitygroup.py | 7 + neutron/ipam/drivers/neutrondb_ipam/driver.py | 3 +- neutron/ipam/exceptions.py | 6 + neutron/ipam/requests.py | 10 +- neutron/plugins/midonet/__init__.py | 0 neutron/plugins/midonet/plugin.py | 52 ---- neutron/plugins/midonet/requirements.txt | 1 - neutron/plugins/ml2/drivers/l2pop/mech_driver.py | 34 +-- .../ml2/drivers/linuxbridge/agent/arp_protect.py | 59 ++++ .../ml2/drivers/linuxbridge/agent/common/config.py | 6 + .../linuxbridge/agent/linuxbridge_neutron_agent.py | 171 +++++++---- .../drivers/mech_sriov/agent/sriov_nic_agent.py | 53 +++- .../drivers/openvswitch/agent/common/constants.py | 3 + .../openvswitch/agent/openflow/native/br_int.py | 41 ++- .../openvswitch/agent/openflow/native/br_phys.py | 1 - .../openvswitch/agent/openflow/ovs_ofctl/br_int.py | 35 ++- .../agent/openflow/ovs_ofctl/br_phys.py | 1 - .../openvswitch/agent/ovs_dvr_neutron_agent.py | 6 + .../drivers/openvswitch/agent/ovs_neutron_agent.py | 56 +++- neutron/plugins/ml2/extensions/port_security.py | 12 +- neutron/plugins/ml2/models.py | 2 +- neutron/plugins/ml2/plugin.py | 43 +-- neutron/plugins/ml2/rpc.py | 6 +- neutron/plugins/opencontrail/contrail_plugin.py | 16 +- neutron/policy.py | 13 +- neutron/service.py | 20 +- neutron/services/l3_router/l3_router_plugin.py | 6 +- .../metering/drivers/iptables/iptables_driver.py | 1 + neutron/services/metering/metering_plugin.py | 9 +- .../api/admin/test_shared_network_extension.py | 14 +- .../functional/agent/linux/test_bridge_lib.py | 42 +++ .../functional/agent/linux/test_keepalived.py | 31 ++ .../agent/linux/test_linuxbridge_arp_protect.py | 36 ++- .../functional/agent/linux/test_ovsdb_monitor.py | 16 ++ .../l3_router/test_l3_dvr_router_plugin.py | 134 ++++++++- .../unit/agent/linux/test_iptables_firewall.py | 87 ++++-- .../plugins/ml2/drivers/l2pop/test_mech_driver.py | 22 +- .../agent/test_linuxbridge_neutron_agent.py | 223 ++++++++++----- .../mech_sriov/agent/test_sriov_nic_agent.py | 107 +++++++ .../agent/openflow/native/test_br_int.py | 8 +- .../agent/openflow/native/test_br_phys.py | 1 - .../agent/openflow/ovs_ofctl/test_br_int.py | 4 +- .../agent/openflow/ovs_ofctl/test_br_phys.py | 1 - .../openvswitch/agent/test_ovs_neutron_agent.py | 133 +++++++-- .../drivers/openvswitch/agent/test_ovs_tunnel.py | 69 ++++- .../plugins/ml2/extensions/test_port_security.py | 39 +++ .../unit/plugins/ml2/test_ext_portsecurity.py | 4 +- .../plugins/oneconvergence/test_nvsd_plugin.py | 2 +- .../plugins/opencontrail/test_contrail_plugin.py | 5 + .../unit/scheduler/test_dhcp_agent_scheduler.py | 8 + .../unit/scheduler/test_l3_agent_scheduler.py | 61 +--- .../services/metering/drivers/test_iptables.py | 9 + ...d-address-pairs-with-none-4757bcca78076c9e.yaml | 9 + .../notes/end-to-end-mtu-00345fc4282cb8fb.yaml | 20 ++ ...ridge_vxlan_arp_responder-e9ea91552e1b62a7.yaml | 7 + ...lection-and-advertisement-ab29f9ec43140224.yaml | 9 + requirements.txt | 6 +- setup.cfg | 2 - test-requirements.txt | 2 +- tools/configure_for_func_testing.sh | 5 + 158 files changed, 4057 insertions(+), 1128 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index c309417..bfba811 100644 --- a/requirements.txt +++ b/requirements.txt @@ -8,2 +8,2 @@ PasteDeploy>=1.5.0 -Routes!=2.0,!=2.1,>=1.12.3;python_version=='2.7' -Routes!=2.0,>=1.12.3;python_version!='2.7' +Routes!=2.0,!=2.1,!=2.3.0,>=1.12.3;python_version=='2.7' # MIT +Routes!=2.0,!=2.3.0,>=1.12.3;python_version!='2.7' # MIT @@ -24 +24 @@ WebOb>=1.2.3 -python-keystoneclient!=1.8.0,>=1.6.0 +python-keystoneclient!=1.8.0,<3.0.0,>=1.6.0 diff --git a/test-requirements.txt b/test-requirements.txt index f181106..50bfa12 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -6 +6 @@ hacking<0.11,>=0.10.0 -cliff>=1.14.0 # Apache-2.0 +cliff!=1.16.0,!=1.17.0,>=1.14.0 # Apache-2.0

1 0