- OpenStack-announce - lists.openstack.org

[release][mistral] mistral-dashboard 2.0.0 release (mitaka)
by no-reply＠openstack.org 07 Apr '16

07 Apr '16

We are gleeful to announce the release of: mistral-dashboard 2.0.0: Mistral dashboard This release is part of the mitaka release series. For more details, please see below. Changes in mistral-dashboard 2.0.0.0rc1..2.0.0 ---------------------------------------------- f49b147 Update .gitreview for stable/mitaka Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + 1 file changed, 1 insertion(+)

1 0

[release][designate] designate-dashboard 2.0.0 release (mitaka)
by no-reply＠openstack.org 07 Apr '16

07 Apr '16

We are tickled pink to announce the release of: designate-dashboard 2.0.0: Designate Horizon UI bits This release is part of the mitaka release series. For more details, please see below. Changes in designate-dashboard 2.0.0.0rc1..2.0.0 ------------------------------------------------ 7fbe18a Imported Translations from Zanata 2fdca52 Fix unit tests under Django 1.9 72d45d6 Add ADD_INSTALLED_APPS to 'enabled' file 76df49e Extract strings from django templates 03813a8 Imported Translations from Zanata 202300b Imported Translations from Zanata a829a1b Update .gitreview for stable/mitaka Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + babel-django.cfg | 4 + .../templates/dns_domains/domain_detail.html | 2 +- .../dns_domains/templates/dns_domains/records.html | 2 +- .../enabled/_1720_project_dns_panel.py | 2 + designatedashboard/locale/django.pot | 238 +++++++++++++--- designatedashboard/locale/ja/LC_MESSAGES/django.po | 134 ++++++++- .../locale/ko_KR/LC_MESSAGES/django.po | 227 +++++++++++++++ .../locale/pt_BR/LC_MESSAGES/django.po | 305 +++++++++++++++++++++ 16 files changed, 939 insertions(+), 120 deletions(-)

1 0

[release][sahara] sahara 4.0.0 release (mitaka)
by no-reply＠openstack.org 07 Apr '16

07 Apr '16

We are jazzed to announce the release of: sahara 4.0.0: Sahara project This release is part of the mitaka release series. With source available at: http://git.openstack.org/cgit/openstack/sahara For more details, please see below. 4.0.0 ^^^^^ New Features ************ * Add ability of scheduling EDP jobs for sahara * Added support of running sahara-api as wsgi application. Use 'sahara-wsgi-api' command for use this feature. * CDH 5.5.0 is supported in CDH plugin. * OpenStack Key Manager service can now be used by sahara to enable storage of sensitive information in an external service such as barbican. Upgrade Notes ************* * HDP plugin removed from default configuration list. End users who are using HDP should ensure that their configuration files continue to list "hdp". * Move notifications options into oslo_messaging_notifications Deprecation Notes ***************** * The HDP 2.0.6 plugin is deprecated in Mitaka release and will be removed in Newton release. Please, use the Ambari 2.3 instead. * Removed support of Vanilla 2.6.0 plugin. * Removed support for the Spark 1.0.0 plugin. Bug Fixes ********* * Fixed api_insecure handling in sessions. Closed bug 1539498. * Add regular expression matching on search values for certain string fields of sahara objects. This applies to list operations through the REST API and therefore applies to the dashboard and sahara client as well. Closes bug 1503345. Changes in sahara 4.0.0.0rc1..4.0.0 ----------------------------------- 65330b8 Set libext path for Oozie 4.0.1, 4.1.0 6daf4c0 Update .gitreview for stable/mitaka Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + sahara/plugins/mapr/services/oozie/oozie.py | 12 +++++++----- 2 files changed, 8 insertions(+), 5 deletions(-)

1 0

[release][freezer] freezer-api 2.0.0 release (mitaka)
by no-reply＠openstack.org 07 Apr '16

07 Apr '16

We are eager to announce the release of: freezer-api 2.0.0: OpenStack Backup and Restore API Service This release is part of the mitaka release series. For more details, please see below. Changes in freezer-api 2.0.0.0rc1..2.0.0 ---------------------------------------- ea70bbc This is incorrect url in example doc and conf 13f0b7b Add Freezer API Version Test e38f650 Fix url from stackforge to openstack Diffstat (except docs and test files) ------------------------------------- .pylintrc | 2 +- devstack/README.rst | 2 +- devstack/gate_hook.sh | 1 + devstack/local.conf.example | 2 +- devstack/settings | 2 +- .../services/freezer_api_client.py | 34 ++++++++++++++++++++++ 14 files changed, 155 insertions(+), 12 deletions(-)

1 0

[release][neutron] neutron-fwaas 8.0.0 release (mitaka)
by no-reply＠openstack.org 07 Apr '16

07 Apr '16

We are gleeful to announce the release of: neutron-fwaas 8.0.0: OpenStack Networking FWaaS This release is part of the mitaka release series. For more details, please see below. 8.0.0 ^^^^^ Generation of sample Neutron FWaaS configuration files. Enable quotas for FWaaS. New Features ************ * Neutron FWaaS no longer includes static example configuration files. Instead, use tools/generate_config_file_samples.sh to generate them. The files are generated with a .sample extension. * The FWaaS extension will register quotas. The default values for quota_firewall and quota_firewall_policy are set to 10. The default value for quota_firewall_rule is set to 100. Quotas can be adjusted in the conf files, including -1 values to allow unlimited. Known Issues ************ * Tenants may receive a 409 Conflict error with a message body containing a quota exceeded message during resource creation if their quota is exceeded. Other Notes *********** * Operators that increase the default limit for quota_routers from 10 may want to bump FWaaS quotas as well, since with router insertion a tenant can potentially have a unique policy and firewall for each router. Changes in neutron-fwaas 8.0.0.0rc2..8.0.0 ------------------------------------------ ab56228 Constraint requirements using mitaka upper-constraints.txt file Diffstat (except docs and test files) ------------------------------------- tools/tox_install.sh | 2 +- tox.ini | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)

1 0

[release][freezer] freezer 2.0.0 release (mitaka)
by no-reply＠openstack.org 07 Apr '16

07 Apr '16

We are jazzed to announce the release of: freezer 2.0.0: The OpenStack Backup Restore and Disaster Recovery as a Service Platform This release is part of the mitaka release series. For more details, please see below. Changes in freezer 2.0.0.0rc1..2.0.0 ------------------------------------ 367a225 Fix creation of jobs with stopped state fd5d6ba Updated from global requirements 9efa12f Added --overwrite parameter for removing all files from restore directory. Default value --overwrite=False 0973cf7 Use correct type for freezer arguments a6b771f Provides more details in the help of --restore-from-date option. Explains the behavior with an example. 7c0f5bc Rename mode default to fs 219fb2b Start to introduce tempest tests. 34d2168 enable output of metadata to a file Diffstat (except docs and test files) ------------------------------------- devstack/settings | 3 ++ freezer/common/config.py | 49 ++++++++++++++-------- freezer/engine/engine.py | 6 ++- freezer/job.py | 2 +- freezer/main.py | 11 ++++- freezer/mode/default.py | 35 ---------------- freezer/mode/fs.py | 35 ++++++++++++++++ freezer/scheduler/scheduler_job.py | 6 ++- .../freezer_tempest_plugin/services/__init__.py | 0 freezer/utils/utils.py | 4 ++ requirements.txt | 35 +++++++++------- setup.cfg | 3 ++ setup.py | 36 +++++++++------- test-requirements.txt | 26 +++++++----- 23 files changed, 263 insertions(+), 99 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index adeefc3..741e429 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,3 +1,6 @@ -astroid<1.4.0 # breaks pylint 1.4.4 -setuptools>=16.0 -pbr>=1.6 +# The order of packages is significant, because pip processes them in the order +# of appearance. Changing the order has an impact on the overall integration +# process, which may cause wedges in the gate later. +astroid<1.4.0 # LGPL # breaks pylint 1.4.4 +setuptools>=16.0 # PSF/ZPL +pbr>=1.6 # Apache-2.0 @@ -5,9 +8,9 @@ python-swiftclient>=2.2.0 # Apache-2.0 -python-keystoneclient>=1.6.0,!=1.8.0 -python-cinderclient>=1.3.1 -python-glanceclient>=1.2.0 # Apache-2.0 -python-novaclient>=2.29.0,!=2.33.0 # Apache-2.0 -python-openstackclient>=2.0.0 # Apache-2.0 -oslo.utils>=3.2.0 -oslo.i18n>=1.5.0 # Apache-2.0 -oslo.log>=1.14.0 -oslo.config>=3.2.0 # Apache-2.0 +python-keystoneclient!=1.8.0,!=2.1.0,>=1.6.0 # Apache-2.0 +python-cinderclient>=1.3.1 # Apache-2.0 +python-glanceclient>=2.0.0 # Apache-2.0 +python-novaclient!=2.33.0,>=2.29.0 # Apache-2.0 +python-openstackclient>=2.1.0 # Apache-2.0 +oslo.utils>=3.5.0 # Apache-2.0 +oslo.i18n>=2.1.0 # Apache-2.0 +oslo.log>=1.14.0 # Apache-2.0 +oslo.config>=3.7.0 # Apache-2.0 @@ -15,3 +18,3 @@ oslo.config>=3.2.0 # Apache-2.0 -PyMySQL>=0.6.2 # MIT License -pymongo>=3.0.2 -paramiko>=1.13.0 +PyMySQL>=0.6.2 # MIT License +pymongo!=3.1,>=3.0.2 # Apache-2.0 +paramiko>=1.16.0 # LGPL @@ -21 +24 @@ six>=1.9.0 # MIT -apscheduler +apscheduler # MIT License diff --git a/test-requirements.txt b/test-requirements.txt index b830d53..c7c96a9 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -1,5 +1,8 @@ -flake8>=2.2.4,<=2.4.1 -hacking>=0.10.2,<0.11 -coverage>=3.6 -discover -mock>=1.2 +# The order of packages is significant, because pip processes them in the order +# of appearance. Changing the order has an impact on the overall integration +# process, which may cause wedges in the gate later. +flake8<2.6.0,>2.4.1 # MIT +hacking<0.11,>=0.10.2 +coverage>=3.6 # Apache-2.0 +discover # BSD +mock>=1.2 # BSD @@ -7,5 +10,8 @@ pylint==1.4.5 # GNU GPL v2 -python-subunit>=0.0.18 -sphinx>=1.1.2,!=1.2.0,!=1.3b1,<1.3 # BSD -oslosphinx>=2.5.0,!=3.4.0 # Apache-2.0 -testrepository>=0.0.18 -testtools>=1.4.0 +python-subunit>=0.0.18 # Apache-2.0/BSD +sphinx!=1.2.0,!=1.3b1,<1.3,>=1.1.2 # BSD +oslosphinx!=3.4.0,>=2.5.0 # Apache-2.0 +testrepository>=0.0.18 # Apache-2.0/BSD +testtools>=1.4.0 # MIT + +# Tempest Plugin +tempest-lib>=0.14.0 # Apache-2.0

1 0

[release][keystone] keystone 9.0.0 release (mitaka)
by no-reply＠openstack.org 07 Apr '16

07 Apr '16

We are satisfied to announce the release of: keystone 9.0.0: OpenStack Identity This release is part of the mitaka release series. For more details, please see below. 9.0.0 ^^^^^ New Features ************ * [blueprint domain-specific-roles (https://blueprints.launchpad.net/keystone/+spec/domain-specific- roles)] Roles can now be optionally defined as domain specific. Domain specific roles are not referenced in policy files, rather they can be used to allow a domain to build their own private inference rules with implied roles. A domain specific role can be assigned to a domain or project within its domain, and any subset of global roles it implies will appear in a token scoped to the respective domain or project. The domain specific role itself, however, will not appear in the token. * [blueprint bootstrap (https://blueprints.launchpad.net/keystone/+spec/bootstrap) keystone-manage now supports the bootstrap command on the CLI so that a keystone install can be initialized without the need of the admin_token filter in the paste-ini. * [blueprint domain-config-default (https://blueprints.launchpad.net/keystone/+spec/domain-config- default)] The Identity API now supports retrieving the default values for the configuration options that can be overriden via the domain specific configuration API. * [blueprint url-safe-naming (https://blueprints.launchpad.net/keystone/+spec/url-safe-naming) The names of projects and domains can optionally be ensured to be url safe, to support the future ability to specify projects using hierarchical naming. * [bug 1490804 (https://bugs.launchpad.net/keystone/+bug/1490804) Audit IDs are included in the token revocation list. * [bug 1519210 (https://bugs.launchpad.net/keystone/+bug/1519210) A user may now opt-out of notifications by specifying a list of event types using the *notification_opt_out* option in *keystone.conf*. These events are never sent to a messaging service. * [bug 1542417 (https://bugs.launchpad.net/keystone/+bug/1542417) Added support for a *user_description_attribute* mapping to the LDAP driver configuration. * [bug 1526462 (https://bugs.launchpad.net/keystone/+bug/1526462) Support for posixGroups with OpenDirectory and UNIX when using the LDAP identity driver. * [bug 1489061 (https://bugs.launchpad.net/keystone/+bug/1489061) Caching has been added to catalog retrieval on a per user ID and project ID basis. This affects both the v2 and v3 APIs. As a result this should provide a performance benefit to fernet-based deployments. * Keystone supports "$(project_id)s" in the catalog. It works the same as "$(tenant_id)s". Use of "$(tenant_id)s" is deprecated and catalog endpoints should be updated to use "$(project_id)s". * [bug 1525317 (https://bugs.launchpad.net/keystone/+bug/1525317) Enable filtering of identity providers based on *id*, and *enabled* attributes. * [bug 1555830 (https://bugs.launchpad.net/keystone/+bug/1555830) Enable filtering of service providers based on *id*, and *enabled* attributes. * [blueprint federation-group-ids-mapped-without-domain-reference (https://blueprints.launchpad.net/keystone/+spec/federation-group- ids-mapped-without-domain-reference)] Enhanced the federation mapping engine to allow for group IDs to be referenced without a domain ID. * [blueprint implied-roles (https://blueprints.launchpad.net/keystone/+spec/implied-roles) Keystone now supports creating implied roles. Role inference rules can now be added to indicate when the assignment of one role implies the assignment of another. The rules are of the form *prior_role* implies *implied_role*. At token generation time, user/group assignments of roles that have implied roles will be expanded to also include such roles in the token. The expansion of implied roles is controlled by the *prohibited_implied_role* option in the *[assignment]* section of *keystone.conf*. * [bug 96869 (https://bugs.launchpad.net/keystone/+bug/968696) A pair of configuration options have been added to the "[resource]" section to specify a special "admin" project: "admin_project_domain_name" and "admin_project_name". If these are defined, any scoped token issued for that project will have an additional identifier "is_admin_project" added to the token. This identifier can then be checked by the policy rules in the policy files of the services when evaluating access control policy for an API. Keystone does not yet support the ability for a project acting as a domain to be the admin project. That will be added once the rest of the code for projects acting as domains is merged. * [bug 1515302 (https://bugs.launchpad.net/keystone/+bug/1515302) Two new configuration options have been added to the *[ldap]* section. *user_enabled_emulation_use_group_config* and *project_enabled_emulation_use_group_config*, which allow deployers to choose if they want to override the default group LDAP schema option. * [bug 1501698 (https://bugs.launchpad.net/keystone/+bug/1501698) Support parameter *list_limit* when LDAP is used as identity backend. * [bug 1479569 (https://bugs.launchpad.net/keystone/+bug/1479569) Names have been added to list role assignments (GET /role_assignments?include_names=True), rather than returning just the internal IDs of the objects the names are also returned. * Domains are now represented as top level projects with the attribute *is_domain* set to true. Such projects will appear as parents for any previous top level projects. Projects acting as domains can be created, read, updated, and deleted via either the project API or the domain API (V3 only). * [bug 1500222 (https://bugs.launchpad.net/keystone/+bug/1500222) Added information such as: user ID, project ID, and domain ID to log entries. As a side effect of this change, both the user's domain ID and project's domain ID are now included in the auth context. * [bug 1473042 (https://bugs.launchpad.net/keystone/+bug/1473042) Keystone's S3 compatibility support can now authenticate using AWS Signature Version 4. * [blueprint totp-auth (https://blueprints.launchpad.net/keystone/+spec/totp-auth) Keystone now supports authenticating via Time-based One-time Password (TOTP). To enable this feature, add the "totp" auth plugin to the *methods* option in the *[auth]* section of *keystone.conf*. More information about using TOTP can be found in keystone's developer documentation (http://docs.openstack.org/developer/keystone/auth-totp.html) * [blueprint x509-ssl-client-cert-authn (https://blueprints.launchpad.net/keystone/+spec/x509-ssl-client- cert-authn)] Keystone now supports tokenless client SSL x.509 certificate authentication and authorization. Upgrade Notes ************* * [bug 1473553 (https://bugs.launchpad.net/keystone/+bug/1473553) The *keystone-paste.ini* must be updated to put the "admin_token_auth" middleware before "build_auth_context". See the sample *keystone- paste.ini* for the correct *pipeline* value. Having "admin_token_auth" after "build_auth_context" is deprecated and will not be supported in a future release. * The LDAP driver now also maps the user description attribute after user retrieval from LDAP. If this is undesired behavior for your setup, please add *description* to the *user_attribute_ignore* LDAP driver config setting. The default mapping of the description attribute is set to *description*. Please adjust the LDAP driver config setting *user_description_attribute* if your LDAP uses a different attribute name (for instance to *displayName* in case of an AD backed LDAP). If your *user_additional_attribute_mapping* setting contains *description:description* you can remove this mapping, since this is now the default behavior. * The default setting for the *os_inherit* configuration option is changed to True. If it is required to continue with this portion of the API disabled, then override the default setting by explicitly specifying the os_inherit option as False. * The *keystone-paste.ini* file must be updated to remove extension filters, and their use in "[pipeline:api_v3]". Remove the following filters: "[filter:oauth1_extension]", "[filter:federation_extension]", "[filter:endpoint_filter_extension]", and "[filter:revoke_extension]". See the sample keystone-paste.ini (https://git.openstack.org/cgit/openstack/keystone/tree/etc /keystone-paste.ini) file for guidance. * The *keystone-paste.ini* file must be updated to remove extension filters, and their use in "[pipeline:public_api]" and "[pipeline:admin_api]" pipelines. Remove the following filters: "[filter:user_crud_extension]", "[filter:crud_extension]". See the sample keystone-paste.ini (https://git.openstack.org/cgit/openstack/keystone/tree/etc /keystone-paste.ini) file for guidance. * A new config option, *insecure_debug*, is added to control whether debug information is returned to clients. This used to be controlled by the *debug* option. If you'd like to return extra information to clients set the value to "true". This extra information may help an attacker. * The configuration options for LDAP connection pooling, *[ldap] use_pool* and *[ldap] use_auth_pool*, are now both enabled by default. Only deployments using LDAP drivers are affected. Additional configuration options are available in the *[ldap]* section to tune connection pool size, etc. * [bug 1541092 (https://bugs.launchpad.net/keystone/+bug/1541092) Only database upgrades from Kilo and newer are supported. * Keystone now uses oslo.cache. Update the *[cache]* section of *keystone.conf* to point to oslo.cache backends: "oslo_cache.memcache_pool" or "oslo_cache.mongo". Refer to the sample configuration file for examples. See oslo.cache (http://docs.openstack.org/developer/oslo.cache) for additional documentation. Deprecation Notes ***************** * [blueprint deprecated-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of- mitaka)] The V8 Assignment driver interface is deprecated. Support for the V8 Assignment driver interface is planned to be removed in the 'O' release of OpenStack. * [blueprint deprecated-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of- mitaka)] The V8 Role driver interface is deprecated. Support for the V8 Role driver interface is planned to be removed in the 'O' release of OpenStack. * The V8 Resource driver interface is deprecated. Support for the V8 Resource driver interface is planned to be removed in the 'O' release of OpenStack. * [blueprint deprecated-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of- mitaka)] The "admin_token_auth" filter must now be placed before the "build_auth_context" filter in *keystone-paste.ini*. * Use of "$(tenant_id)s" in the catalog endpoints is deprecated in favor of "$(project_id)s". * [blueprint deprecated-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of- mitaka)] Deprecate the "enabled" option from "[endpoint_policy]", it will be removed in the 'O' release, and the extension will always be enabled. * [blueprint deprecated-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of- mitaka)] The token memcache and memcache_pool persistence backends have been deprecated in favor of using Fernet tokens (which require no persistence). * [blueprint deprecated-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of- mitaka)] Deprecated all v2.0 APIs. The keystone team recommends using v3 APIs instead. Most v2.0 APIs will be removed in the 'Q' release. However, the authentication APIs and EC2 APIs are indefinitely deprecated and will not be removed in the 'Q' release. * [blueprint deprecated-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of- mitaka)] As of the Mitaka release, the PKI and PKIz token formats have been deprecated. They will be removed in the 'O' release. Due to this change, the *hash_algorithm* option in the *[token]* section of the configuration file has also been deprecated. Also due to this change, the "keystone-manage pki_setup" command has been deprecated as well. * [blueprint deprecated-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of- mitaka)] As of the Mitaka release, write support for the LDAP driver of the Identity backend has been deprecated. This includes the following operations: create user, create group, delete user, delete group, update user, update group, add user to group, and remove user from group. These operations will be removed in the 'O' release. * [blueprint deprecated-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of- mitaka)] As of the Mitaka release, the auth plugin *keystone.auth.plugins.saml2.Saml2* has been deprecated. It is recommended to use *keystone.auth.plugins.mapped.Mapped* instead. The "saml2" plugin will be removed in the 'O' release. * [blueprint deprecated-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of- mitaka)] As of the Mitaka release, the simple_cert_extension is deprecated since it is only used in support of the PKI and PKIz token formats. It will be removed in the 'O' release. * The *os_inherit* configuration option is disabled. In the future, this option will be removed and this portion of the API will be always enabled. * [blueprint deprecated-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of- mitaka)] The file "httpd/keystone.py" has been deprecated in favor of "keystone-wsgi-admin" and "keystone-wsgi-public" and may be removed in the 'O' release. * [blueprint deprecated-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of- mitaka)] "keystone.common.cache.backends.memcache_pool", "keystone.common.cache.backends.mongo", and "keystone.common.cache.backends.noop" are deprecated in favor of oslo.cache backends. The keystone backends will be removed in the 'O' release. * The V8 Federation driver interface is deprecated in favor of the V9 Federation driver interface. Support for the V8 Federation driver interface is planned to be removed in the 'O' release of OpenStack. Security Issues *************** * The use of admin_token filter is insecure compared to the use of a proper username/password. Historically the admin_token filter has been left enabled in Keystone after initialization due to the way CMS systems work. Moving to an out-of-band initialization using "keystone-manage bootstrap" will eliminate the security concerns around a static shared string that conveys admin access to keystone and therefore to the entire installation. * The admin_token method of authentication was never intended to be used for any purpose other than bootstrapping an install. However many deployments had to leave the admin_token method enabled due to restrictions on editing the paste file used to configure the web pipelines. To minimize the risk from this mechanism, the *admin_token* configuration value now defaults to a python *None* value. In addition, if the value is set to *None*, either explicitly or implicitly, the *admin_token* will not be enabled, and an attempt to use it will lead to a failed authentication. * [bug 1490804 (https://bugs.launchpad.net/keystone/+bug/1490804) [CVE-2015-7546 (http://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2015-7546)] A bug is fixed where an attacker could avoid token revocation when the PKI or PKIZ token provider is used. The complete remediation for this vulnerability requires the corresponding fix in the keystonemiddleware project. Bug Fixes ********* * [bug 1535878 (https://bugs.launchpad.net/keystone/+bug/1535878) Originally, to perform GET /projects/{project_id}, the provided policy files required a user to have at least project admin level of permission. They have been updated to allow it to be performed by any user who has a role on the project. * [bug 1516469 (https://bugs.launchpad.net/keystone/+bug/1516469) Endpoints filtered by endpoint_group project association will be included in the service catalog when a project scoped token is issued and "endpoint_filter.sql" is used for the catalog driver. * Support has now been added to send notification events on user/group membership. When a user is added or removed from a group a notification will be sent including the identifiers of both the user and the group. * [bug 1527759 (https://bugs.launchpad.net/keystone/+bug/1527759) Reverted the change that eliminates the ability to get a V2 token with a user or project that is not in the default domain. This change broke real-world deployments that utilized the ability to authenticate via V2 API with a user not in the default domain or with a project not in the default domain. The deployer is being convinced to update code to properly handle V3 auth but the fix broke expected and tested behavior. * [bug 1480270 (https://bugs.launchpad.net/keystone/+bug/1480270) Endpoints created when using v3 of the keystone REST API will now be included when listing endpoints via the v2.0 API. Other Notes *********** * The list_project_ids_for_user(), list_domain_ids_for_user(), list_user_ids_for_project(), list_project_ids_for_groups(), list_domain_ids_for_groups(), list_role_ids_for_groups_on_project() and list_role_ids_for_groups_on_domain() methods have been removed from the V9 version of the Assignment driver. * [blueprint move-extensions (https://blueprints.launchpad.net/keystone/+spec/move-extensions) If any extension migrations are run, for example: "keystone-manage db_sync --extension endpoint_policy" an error will be returned. This is working as designed. To run these migrations simply run: "keystone-manage db_sync". The complete list of affected extensions are: "oauth1", "federation", "endpoint_filter", "endpoint_policy", and "revoke". * [bug 1367113 (https://bugs.launchpad.net/keystone/+bug/1367113) The "get entity" and "list entities" functionality for the KVS catalog backend has been reimplemented to use the data from the catalog template. Previously this would only act on temporary data that was created at runtime. The create, update and delete entity functionality now raises an exception. * "keystone-manage db_sync" will no longer create the Default domain. This domain is used as the domain for any users created using the legacy v2.0 API. A default domain is created by "keystone- manage bootstrap" and when a user or project is created using the legacy v2.0 API. * The ability to validate a trust-scoped token against the v2.0 API has been removed, in favor of using the version 3 of the API. * [blueprint removed-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/removed-as-of- mitaka)] Removed "extras" from token responses. These fields should not be necessary and a well-defined API makes this field redundant. This was deprecated in the Kilo release. * [blueprint removed-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/removed-as-of- mitaka)] Removed "RequestBodySizeLimiter" from keystone middleware. The keystone team suggests using "oslo_middleware.sizelimit.RequestBodySizeLimiter" instead. This was deprecated in the Kilo release. * [blueprint removed-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/removed-as-of- mitaka)] Notifications with event_type "identity.created.role_assignment" and "identity.deleted.role_assignment" have been removed. The keystone team suggests listening for "identity.role_assignment.created" and "identity.role_assignment.deleted" instead. This was deprecated in the Kilo release. * [blueprint removed-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/removed-as-of- mitaka)] Removed "check_role_for_trust" from the trust controller, ensure policy files do not refer to this target. This was deprecated in the Kilo release. * [blueprint removed-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/removed-as-of- mitaka)] Removed Catalog KVS backend ("keystone.catalog.backends.sql.Catalog"). This was deprecated in the Icehouse release. * [blueprint removed-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/removed-as-of- mitaka)] The LDAP backend for Assignment has been removed. This was deprecated in the Kilo release. * [blueprint removed-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/removed-as-of- mitaka)] The LDAP backend for Resource has been removed. This was deprecated in the Kilo release. * [blueprint removed-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/removed-as-of- mitaka)] The LDAP backend for Role has been removed. This was deprecated in the Kilo release. * [blueprint removed-as-of-mitaka (https://blueprints.launchpad.net/keystone/+spec/removed-as-of- mitaka)] Removed Revoke KVS backend ("keystone.revoke.backends.kvs.Revoke"). This was deprecated in the Juno release. Changes in keystone 9.0.0.0rc2..9.0.0 ------------------------------------- 3e5fca0 Update federated user display name with shadow_users_api Diffstat (except docs and test files) ------------------------------------- keystone/identity/core.py | 4 ++-- 2 files changed, 30 insertions(+), 2 deletions(-)

1 0

[release][heat] heat 6.0.0 release (mitaka)
by no-reply＠openstack.org 07 Apr '16

07 Apr '16

We are glad to announce the release of: heat 6.0.0: OpenStack Orchestration This release is part of the mitaka release series. For more details, please see below. 6.0.0 ^^^^^ New Features ************ * Added new functionality for showing and listing stack outputs without resolving all outputs during stack initialisation. * Added new API calls for showing and listing stack outputs "/stack/outputs" and "/stack/outputs/output_key". * Added using of new API in python-heatclient for "output_show" and "output_list". Now, if version of Heat API is 1.19 or above, Heat client will use API calls "output_show" and "output_list" instead of parsing of stack get response. If version of Heat API is lower than 1.19, outputs resolve in Heat client as well as before. * Add new "OS::Barbican::GenericContainer" resource for storing arbitrary barbican secrets. * Add new "OS::Barbican::RSAContainer" resource for storing RSA public keys, private keys, and private key pass phrases. * A new "OS::Barbican::CertificateContainer" resource for storing the secrets that are relevant to certificates. * OS::Nova::HostAggregate resource plugin is added to support host aggregate, which is provided by nova "aggregates" API extension. * nova.host constraint is added to support to validate host attribute which is provided by nova "host" API extension. * OS::Neutron::QoSPolicy resource plugin is added to support QoS policy, which is provided by neutron "qos" API extension. * OS::Neutron::QoSBandwidthLimitRule resource plugin is added to support neutron QoS bandwidth limit rule, which is provided by neutron "qos" API extension. * Resources "OS::Neutron::Port" and "OS::Neutron::Net" now support "qos_policy" optional property, that will associate with QoS policy to offer different service levels based on the policy rules. * OS::Neutron::RBACPolicy resource plugin is added to support RBAC policy, which is used to manage RBAC policy in Neutron. This resource creates and manages Neutron RBAC policy, which allows to share Neutron networks to subsets of tenants. * Added a new "event-sinks" element to the environment which allows specifying a target where events from the stack are sent. It supports the "zaqar-queue" element for now. * Adds a new "immutable" boolean field to the parameters section in a HOT template. This gives template authors the ability to mark template parameters as immutable to restrict updating parameters which have destructive effects on the application. A value of True results in the engine rejecting stack-updates that include changes to that parameter. When not specified in the template, "immutable" defaults to False to ensure backwards compatibility with old templates. * A new "OS::Keystone::Region" resource that helps in managing the lifecycle of keystone region. * A new "OS::Neutron:AddressScope" resource that helps in managing the lifecycle of neutron address scope. Availability of this resource depends on availability of neutron "address-scope" API extension. This resource can be associated with multiple subnet pools in a one- to-many relationship. The subnet pools under an address scope must not overlap. * New resources for Neutron Load Balancer version 2. These are unique for version 2 and do not support or mix with existing version 1 resources. * New resource "OS::Neutron::LBaaS::LoadBalancer" is added to create and manage Load Balancers which allow traffic to be directed between servers. * New resource "OS::Neutron::LBaaS::Listener" is added to create and manage Listeners which represent a listening endpoint for the Load Balancer. * New resource "OS::Neutron::LBaaS::Pool" is added to create and manage Pools which represent a group of nodes. Pools define the subnet where nodes reside, the balancing algorithm, and the nodes themselves. * New resource "OS::Neutron::LBaaS::PoolMember" is added to create and manage Pool members which represent a single backend node. * New resource "OS::Neutron::LBaaS::HealthMonitor" is added to create and manage Health Monitors which watch status of the Load Balanced servers. * A stack can be searched for resources based on their name, status, type, action, id and physcial_resource_id. And this feature is enabled both in REST API and CLI. For more details, please refer orchestration API document and heat CLI user guide. * Adds a new feature to restrict update or replace of a resource when a stack is being updated. Template authors can set "restricted_actions" in the "resources" section of "resource_registry" in an environment file to restrict update or replace. * New resource "OS::Senlin::Cluster" is added to create a cluster in senlin. A cluster is a group of homogeneous nodes. * New resource "OS::Senlin::Node" is added to create a node in senlin. Node represents a physical object exposed by other OpenStack services. * New resource "OS::Senlin::Receiver" is added to create a receiver in senlin. Receiver can be used to hook the engine to some external event/alarm sources. * New resource "OS::Senlin::Profile" is added to create a profile in senlin. Profile is a module used for creating nodes, it's the definition of a node. * New resource "OS::Senlin::Policy" is added to create a policy in senlin. Policy is a set of rules that can be checked and/or enforced when an Action is performed on a Cluster. * The OS::Nova::Server now supports a new property user_data_update_policy, which may be set to either 'REPLACE' (default) or 'IGNORE' if you wish to allow user_data updates to be ignored on stack update. This is useful when managing a group of servers where changed user_data should apply to new servers without replacing existing servers. * Multiple environment files may be passed to the server in the files dictionary along with an ordered list of the environment file names. The server will generate the stack's environment from the provided files rather than requiring the client to merge the environments together. This is optional; the existing interface to pass in the already resolved environment is still present. * A new "OS::Neutron:SubnetPool" resource that helps in managing the lifecycle of neutron subnet pool. Availability of this resource depends on availability of neutron "subnet_allocation" API extension. * Resource "OS::neutron::Subnet" now supports "subnetpool" optional property, that will automate the allocation of CIDR for the subnet from the specified subnet pool. * Template validation is improved to ignore the given set of error codes. For example, heat will report template as invalid one, if it does not find any required OpenStack services in the cloud deployment and while authoring the template, user might wants to avoid such scenarios, so that (s)he could create valid template without bothering about run-time environments. Please refer the API documentation of validate template for more details. Upgrade Notes ************* * If upgrading with pre-icehouse stacks which contain resources that create users (such as OS::Nova::Server, OS::Heat::SoftwareDeployment, and OS::Heat::WaitConditionHandle), it is possible that the users will not be removed upon stack deletion due to the removal of a legacy fallback code path. In such a situation, these users will require manual removal. Changes in heat 6.0.0.0rc2..6.0.0 --------------------------------- bea576f Sync integration tests requirements 950505d Revert "Check RBAC policy for nested stacks" 184b09a Imported Translations from Zanata 0c407b8 Add translation rule to delete ssh auth key from Magnum baymodel Diffstat (except docs and test files) ------------------------------------- heat/common/policy.py | 8 +- heat/engine/resources/openstack/magnum/baymodel.py | 11 + heat/engine/stack.py | 2 - heat/locale/de/LC_MESSAGES/heat.po | 21 +- heat/locale/fr/LC_MESSAGES/heat.po | 9 +- heat/locale/it/LC_MESSAGES/heat.po | 9 +- heat/locale/ja/LC_MESSAGES/heat.po | 173 +++++++------- heat/locale/ko_KR/LC_MESSAGES/heat-log-error.po | 251 +++++++++++++++++++++ heat/locale/ko_KR/LC_MESSAGES/heat-log-warning.po | 10 +- .../functional/test_conditional_exposure.py | 21 -- 11 files changed, 396 insertions(+), 147 deletions(-)

1 0

[release][glance] glance 12.0.0 release (mitaka)
by no-reply＠openstack.org 07 Apr '16

07 Apr '16

We are happy to announce the release of: glance 12.0.0: OpenStack Image Service This release is part of the mitaka release series. For more details, please see below. 12.0.0 ^^^^^^ New Features ************ * Implement the ability to filter images by the properties *id*, *name*, *status*,`container_format`, *disk_format* using the 'in' operator between the values. Following the pattern of existing filters, new filters are specified as query parameters using the field to filter as the key and the filter criteria as the value in the parameter. Filtering based on the principle of full compliance with the template, for example 'name = in:deb' does not match 'debian'. Changes apply exclusively to the API v2 Image entity listings An example of an acceptance criteria using the 'in' operator for name ?name=in:name1,name2,name3. These filters were added using syntax that conforms to the latest guidelines from the OpenStack API Working Group. * Implemented re-authentication with trusts when updating image status in registry after image upload. When long-running image upload takes some a lot of time (more than token expiration time) glance uses trusts to receive new token and update image status in registry. It allows users to upload big size images without increasing token expiration time. Upgrade Notes ************* * Metadata definitions previously associated with OS::Nova::Instance have been changed to be associated with OS::Nova::Server in order to align with Heat and Searchlight. You may either upgrade them using glance-manage db load_metadefs [path] [merge] [prefer_new] or glance-manage db upgrade 44. * The task API is being deprecated and it has been made admin only. If deployers of Glance would like to have this API as a public one, it is necessary to change the *policy.json* file and remove *role:admin* from every *task* related field. Deprecation Notes ***************** * The use_user_token, admin_user, admin_password, admin_tenant_name, auth_url, auth_strategy and auth_region options in the [DEFAULT] configuration section in glance-api.conf are deprecated, and will be removed in the O release. See https://wiki.openstack.org/wiki/OSSN/OSSN-0060 * The task API was added to allow users for uploading images asynchronously and for deployers to have more control in the upload process. Unfortunately, this API has not worked the way it was expected to. Therefore, the task API has entered a deprecation period and it is meant to be replaced by the new import API. This change makes the task API admin only by default so that it is not accidentally deployed as a public API. * OSprofiler support requires passing of trace information between various OpenStack services. This information is signed by one of HMAC keys, which we historically defined in glance-api-paste.ini and glance-registry-paste.ini files (together with enabled option, that in fact was duplicated in the corresponding configuration files). OSprofiler 0.3.1 and higher supports passing this information via configuration files, therefore it's recommended to modify the "[filter:osprofiler]" section in *-paste.ini to look like "paste.filter_factor = osprofiler.web:WsgiMiddleware.factory" and set the "hmac_keys" option in the glance-*.conf files. Security Issues *************** * Fixing bug 1525915; image might be transitioning from active to queued by regular user by removing last location of image (or replacing locations with empty list). This allows user to re-upload data to the image breaking Glance's promise of image data immutability. From now on, last location cannot be removed and locations cannot be replaced with empty list. Bug Fixes ********* * Metadata definitions previously associated with OS::Nova::Instance have been changed to be associated with OS::Nova::Server in order to align with Heat and Searchlight. Changes in glance 12.0.0.0rc1..12.0.0 ------------------------------------- 02ef2ab Imported Translations from Zanata 768f168 Imported Translations from Zanata 1cb2bda Imported Translations from Zanata ab05625 Imported Translations from Zanata d4aaa1b Imported Translations from Zanata 869e551 Imported Translations from Zanata 040d5fa Update .gitreview for stable/mitaka Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + glance/locale/de/LC_MESSAGES/glance.po | 461 ++++++++-------- glance/locale/es/LC_MESSAGES/glance.po | 345 +++++++++++- glance/locale/fr/LC_MESSAGES/glance.po | 29 +- glance/locale/it/LC_MESSAGES/glance.po | 353 +++++++++++- glance/locale/ja/LC_MESSAGES/glance.po | 595 +++++++++++++++++++-- .../locale/ko_KR/LC_MESSAGES/glance-log-error.po | 376 +++++++++++++ glance/locale/ko_KR/LC_MESSAGES/glance-log-info.po | 315 +++++++++++ .../locale/ko_KR/LC_MESSAGES/glance-log-warning.po | 274 ++++++++++ glance/locale/ko_KR/LC_MESSAGES/glance.po | 368 ++++++++++++- glance/locale/pt_BR/LC_MESSAGES/glance.po | 351 +++++++++++- 11 files changed, 3165 insertions(+), 303 deletions(-)

1 0

[release][horizon] horizon 9.0.0 release (mitaka)
by no-reply＠openstack.org 07 Apr '16

07 Apr '16

We are amped to announce the release of: horizon 9.0.0: OpenStack Dashboard This release is part of the mitaka release series. For more details, please see below. 9.0.0 ^^^^^ Cinder defines storage size in gibibytes (GiB), which is inconsistent with Horizon panels that show/request storage size in gigabytes (GB). New Features ************ * Added the Metadata tab to the new Launch Instance workflow to allow adding key-value metadata to an instance at launch. This includes any properties from the OS::Nova::Server namespace of the glance metadata definitions. * Allows to attach ports during instance launch <https://blueprints.launchpad.net/horizon/+spec/allow-launching- ports> * [blueprint angular-performance-strict-di (https://blueprints.launchpad.net/horizon/+spec/angular-performance- strict-di)] This blueprint enforces strict dependency injection in AngularJS code, for improvements to minification and thus performance. * Move OpenStack Dashboard Swift panel rendering logic to client- side using AngularJS for significant usability improvements. * Added the Developer dashboard plugin to contrib. This runs when "DEBUG=True", and adds tooling to the UI to aid in development. * Added the Bootstrap Theme Preview panel to the Developer dashboard. This panel contains a list of Bootstrap components with source code, so that developers can see examples of how to structure this code and the effects their theme will have upon it. * Added the Django template cached loader, so templates are stored in memory. See https://docs.djangoproject.com/en/1.8/ref/templates/api /#django.template.loaders.cached.Loader * [blueprint cinder-consistency-groups (https://blueprints.launchpad.net/horizon/+spec/cinder-consistency- groups)] This feature adds a new Consistency Groups tab to the Project Volumes panel. Consistency Groups (GG) contain existing volumes, and allow the user to perform actions on the volumes in one step. Actions include: create a CG, manage volumes associated with the CG, update a CG, and delete a CGs. Note that a CG can not be deleted if it contains any volumes. * Instance metadata can be updated (https://blueprints.launchpad.net/horizon/+spec/edit-server- metadata) * Made the Angular Launch Instance workflow the default in Horizon. * [blueprint integrate-magic-search (https://blueprints.launchpad.net/horizon/+spec/integrate-magic- search)] Magic Search was an external dependency that was being heavily modified or overwritten in sections, so the used parts of code base have been moved into Horizon. * [blueprint integration-tests-hardening (https://blueprints.launchpad.net/horizon/+spec/integration-tests- hardening)] This blueprint reduced failures in the integration tests caused by structure or styling changes, by making them less dependent on aspects of page structure, such as ordering or CSS classes. * Added the Update Encryption action for encrypted volume types. * [blueprint keystone-federation-protocol-mapping (https://blueprints.launchpad.net/horizon/+spec/keystone-federation- protocol-mapping)] This blueprint provides CRUD interaction for identity provider protocols. * Allow to override settings from local_settings.py with file snippets dropped into local_settings.d/ directory. * [blueprint pagination-for-flavor (https://blueprints.launchpad.net/horizon/+spec/pagination-for- flavor)] Added forward and backward pagination to the Flavors panel * Added support for managing domains and projects when using Keystone v3. Horizon now maintains a domain scoped token for users who have a role on a domain, a project scoped token for users who have a role on a project, or both a domain scoped token and project scoped token for users who have roles on both. * Domain management supports the following use cases: * Cloud Admin - View and manage identity resources across domains * Domain Admin - View and manage identity resources in the domain logged in * User - View identity project in the domain logged in * Horizon can be configured to run with multiple themes available at run time. A new selection widget is available through the user menu. It uses a browser cookie to allow users to toggle between the configured themes. By default, Horizon is configured with the two themes available, 'default' and 'material'. * Allow external plugins to contribute translations to the Javascript message catalog. * Selenium tests may now be exercised using the headless PhantomJS driver. * Added the angular extensible service which allows angular horizon elements such as workflows, tables, actions, and forms to be extended dynamically by adding, removing, or replacing items. The extensible service is applied to every workflow created using the horizon workflow service. This includes the angular Launch Instance workflow. * All Volume related panels in Horizon that previously used the term "GB" and "gigabyte" have been replaced with 'GiB' and 'gibibyte'. * [blueprint keystone-federation-idp (https://blueprints.launchpad.net/horizon/+spec/keystone-federation- idp)] Add support for managing keystone identity provider. To enable the panel, set "OPENSTACK_KEYSTONE_FEDERATION_MANAGEMENT" in the local_settting.py to True. * [blueprint keystone-federation-mapping (https://blueprints.launchpad.net/horizon/+spec/keystone-federation- mapping)] Add basic support for managing keystone federation mapping. * Added the LAUNCH_INSTANCE_DEFAULTS setting which allows specifying default values for the Launch Instance workflow. Initially only the Configuration Drive property is supported. * [blueprint message-of-the-day (https://blueprints.launchpad.net/horizon/+spec/message-of-the-day) Message of the day can now be configured in horizon, this will be displayed to the user whenever they login. To enable the feature set "MESSAGES_PATH" in the local_settting.py to the directory where message files are located. The message file must have a .json file extension. * Added policy support to the angular workflow service so each step in a workflow can specify a policy check that must pass in order for the step to be displayed. Known Issues ************ * There are also some Nova related panels (e.g. "Instances") that reference storage size in "GB". These panels will be addressed in subsequent patches. Upgrade Notes ************* * All AngularJS code must use explicit dependency injection. See https://docs.angularjs.org/guide/di#using-strict-dependency- injection * Custom template tags must have a thread-safe Node implementation to work with the the cached loader. See https://docs.djangoproject.com/en/1.8/howto/custom-template-tags /#template-tag-thread-safety * Horizon no longer requires Magic Search as an external dependency. * The Sahara based content has been removed from the Horizon source tree and is now a separate plugin. To continue managing Sahara in Horizon, installing the sahara-dashboard plugin on the Horizon server is required. * The Trove based content has been removed from the Horizon source tree and is now a separate plugin. To continue managing Trove in Horizon, installing the trove-dashboard plugin on the Horizon server is required. * The main engine managing integration with oslo.policy has been moved to django_openstack_auth. The configuration is still managed in Horizon, but the setting for "POLICY_CHECK_FUNCTION" now uses "openstack_auth.policy.check" rather than "openstack_dashboard.policy.check". Current behavior will remain consistent. Deprecation Notes ***************** * The Python Swift panel has been deprecated and no longer displays by default. To use the old interface edit "enabled/_1920_project_containers_panel.py" to change "swift_panel" to "'legacy'". * The Python Launch Instance workflow has been deprecated and no longer displays by default. * The 'default_ipv4_subnet_pool_label' and 'default_ipv6_subnet_pool_label' options has been deprecated and will be removed in the Newton release. Starting with Mitaka you can create one default subnet pool per address family through the Neutron API. These subnet pools will automatically show up in the subnet pool list using the name of the pool as label. * The setting CUSTOM_THEME_PATH is now deprecated. * The setting DEFAULT_THEME_PATH is now deprecated. * The 'webroot' theme has been removed. Security Issues *************** * Policies associated with Consistency Groups exist in the Cinder policy file, and by default, all actions are disabled. Bug Fixes ********* * Provided the ability for plugins to contribute translations to the JavaScript message catalog. Previously the horizon and openstack_dahboard applications were hardcoded. * blueprint gb-to-gib-conversion <https://blueprints.launchpad.net/horizon/+spec/gb-to-gib- conversion/> * Several fixes have been made to the hzTable controller. The list below outline these changes. See inline documentation for usage details. * Properties are now bound to the controller instead of the scope. * Emit the *hzTable:clearSelected* event to clear table row selections. * The property *selections* tracks the checkbox selection state of each row. * The property *selected* is now a list of selected rows. * The property *numSelected* has been removed, use *selected.length* instead. * The *select* method has been renamed to to *toggleSelect*. * The 'webroot' theme was providing an example of how to set the webroot value through SCSS for accessing needed static URL prefixes for assets like font paths. This value is now retrieved directly from the Django settings and is available directly in the SCSS namespace via $static_url. Other Notes *********** * Current limitations on managing identity resources with Keystone v3: * Does not support role assignments across domains, such as giving a user in domain1 access to domain2. * Does not support project admins managing Keystone projects. * Does not support hierarchical project management. Changes in horizon 9.0.0.0rc1..9.0.0 ------------------------------------ 3f4eeaa Imported Translations from Zanata 10e6bf5 Fixing updating user with no default project dd4d1fb Imported Translations from Zanata 19b6a65 Fix opening multiple Launch Instance during jQuery table polling 8ad7d1f Imported Translations from Zanata 2694d45 Imported Translations from Zanata 2143bb6 Imported Translations from Zanata 7f1a831 Imported Translations from Zanata 184b67d Imported Translations from Zanata f1036b4 Imported Translations from Zanata 7c71e21 Imported Translations from Zanata 5d0391f Update .gitreview for stable/mitaka Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + horizon/locale/en_AU/LC_MESSAGES/django.po | 108 +- horizon/locale/en_AU/LC_MESSAGES/djangojs.po | 84 +- horizon/locale/fr/LC_MESSAGES/django.po | 28 +- horizon/locale/it/LC_MESSAGES/django.po | 110 +- horizon/locale/it/LC_MESSAGES/djangojs.po | 85 +- horizon/locale/ja/LC_MESSAGES/djangojs.po | 8 +- horizon/locale/ko_KR/LC_MESSAGES/django.po | 29 +- horizon/locale/ko_KR/LC_MESSAGES/djangojs.po | 17 +- horizon/locale/pt_BR/LC_MESSAGES/django.po | 10 +- horizon/locale/ru/LC_MESSAGES/django.po | 37 +- horizon/locale/tr_TR/LC_MESSAGES/django.po | 20 +- horizon/locale/tr_TR/LC_MESSAGES/djangojs.po | 15 +- horizon/locale/zh_CN/LC_MESSAGES/django.po | 55 +- horizon/locale/zh_CN/LC_MESSAGES/djangojs.po | 19 +- horizon/locale/zh_TW/LC_MESSAGES/django.po | 66 +- horizon/locale/zh_TW/LC_MESSAGES/djangojs.po | 46 +- horizon/static/framework/framework.module.js | 12 +- horizon/static/horizon/js/horizon.tables.js | 4 +- horizon/static/horizon/js/horizon.tabs.js | 2 +- .../dashboards/identity/users/forms.py | 8 +- .../locale/de/LC_MESSAGES/django.po | 219 ++- .../locale/de/LC_MESSAGES/djangojs.po | 134 +- openstack_dashboard/locale/django.pot | 397 +++- openstack_dashboard/locale/djangojs.pot | 224 ++- .../locale/en_AU/LC_MESSAGES/django.po | 1198 +++++++++++- .../locale/en_AU/LC_MESSAGES/djangojs.po | 1491 ++++++++++++++- .../locale/fr/LC_MESSAGES/django.po | 28 +- .../locale/fr/LC_MESSAGES/djangojs.po | 81 +- .../locale/it/LC_MESSAGES/django.po | 1245 ++++++++++++- .../locale/it/LC_MESSAGES/djangojs.po | 1519 ++++++++++++++- .../locale/ja/LC_MESSAGES/django.po | 268 ++- .../locale/ja/LC_MESSAGES/djangojs.po | 168 +- .../locale/ko_KR/LC_MESSAGES/django.po | 504 +++-- .../locale/ko_KR/LC_MESSAGES/djangojs.po | 296 ++- .../locale/pt_BR/LC_MESSAGES/django.po | 278 ++- .../locale/pt_BR/LC_MESSAGES/djangojs.po | 289 ++- .../locale/ru/LC_MESSAGES/django.po | 838 ++++++++- .../locale/ru/LC_MESSAGES/djangojs.po | 1053 ++++++++++- .../locale/zh_CN/LC_MESSAGES/django.po | 1959 +++++++++++--------- .../locale/zh_CN/LC_MESSAGES/djangojs.po | 248 ++- .../locale/zh_TW/LC_MESSAGES/django.po | 1038 ++++++++++- .../locale/zh_TW/LC_MESSAGES/djangojs.po | 1422 +++++++++++++- 44 files changed, 14134 insertions(+), 1577 deletions(-)

1 0